direxio-deployer 0.1.0

package/tests/aws_credentials_test.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+
+cat > "$fakebin/aws" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'aws' >> "$CALLS"
+printf ' %q' "$@" >> "$CALLS"
+printf '\n' >> "$CALLS"
+
+case "${1:-} ${2:-}" in
+  "configure get")
+    exit 1
+    ;;
+  "sts get-caller-identity")
+    profile=${AWS_PROFILE:-}
+    key=${AWS_ACCESS_KEY_ID:-}
+    if [ "$profile" = "root-profile" ] || [ "$key" = "AKIAROOTTEST" ]; then
+      arn="arn:aws:iam::123456789012:root"
+      account="123456789012"
+    else
+      arn="arn:aws:iam::123456789012:user/DirexioDeployer-20260628"
+      account="123456789012"
+    fi
+    case "$*" in
+      *"--query Arn"*) printf '%s\n' "$arn" ;;
+      *"--query Account"*) printf '%s\n' "$account" ;;
+      *) printf '{"Account":"%s","Arn":"%s"}\n' "$account" "$arn" ;;
+    esac
+    ;;
+  *)
+    echo "unexpected aws call: $*" >&2
+    exit 2
+    ;;
+esac
+EOF
+chmod 700 "$fakebin/aws"
+
+CALLS="$tmp/aws.calls"
+export CALLS
+export PATH="$fakebin:$PATH"
+export AWS_SHARED_CREDENTIALS_FILE="$tmp/aws/credentials"
+export AWS_CONFIG_FILE="$tmp/aws/config"
+
+file_mode() {
+  if stat -c '%a' "$1" >/dev/null 2>&1; then
+    stat -c '%a' "$1"
+  else
+    stat -f '%Lp' "$1"
+  fi
+}
+
+cat > "$tmp/direxio.csv" <<'CSV'
+User name,Access key ID,Secret access key
+DirexioDeployer-20260628,AKIADIREXIOTEST,SECRET_DIREXIO_VALUE
+CSV
+
+out=$(bash "$ROOT/scripts/aws-credentials.sh" import-csv "$tmp/direxio.csv" direxio-deployer ap-southeast-1)
+
+[[ "$out" == *"profile=direxio-deployer"* ]]
+[[ "$out" == *"arn:aws:iam::<account>:user/DirexioDeployer-20260628"* ]]
+if [[ "$out" == *"AKIADIREXIOTEST"* || "$out" == *"SECRET_DIREXIO_VALUE"* ]]; then
+  echo "aws-credentials output leaked credential values" >&2
+  printf '%s\n' "$out" >&2
+  exit 1
+fi
+
+grep -q '^\[direxio-deployer\]$' "$AWS_SHARED_CREDENTIALS_FILE"
+grep -q '^aws_access_key_id = AKIADIREXIOTEST$' "$AWS_SHARED_CREDENTIALS_FILE"
+grep -q '^aws_secret_access_key = SECRET_DIREXIO_VALUE$' "$AWS_SHARED_CREDENTIALS_FILE"
+grep -q '^\[profile direxio-deployer\]$' "$AWS_CONFIG_FILE"
+grep -q '^region = ap-southeast-1$' "$AWS_CONFIG_FILE"
+
+credential_perm=$(file_mode "$AWS_SHARED_CREDENTIALS_FILE")
+config_perm=$(file_mode "$AWS_CONFIG_FILE")
+case "$(uname -s)" in
+  MINGW*|MSYS*|CYGWIN*)
+    [[ "$credential_perm" == "600" || "$credential_perm" == "644" ]]
+    [[ "$config_perm" == "600" || "$config_perm" == "644" ]]
+    ;;
+  *)
+    [ "$credential_perm" = "600" ]
+    [ "$config_perm" = "600" ]
+    ;;
+esac
+
+verify_out=$(AWS_PROFILE=direxio-deployer bash "$ROOT/scripts/aws-credentials.sh" verify direxio-deployer)
+[[ "$verify_out" == *"profile=direxio-deployer"* ]]
+[[ "$verify_out" == *"root=false"* ]]
+
+cat > "$tmp/root.csv" <<'CSV'
+Access key ID,Secret access key
+AKIAROOTTEST,SECRET_ROOT_VALUE
+CSV
+
+root_out=$(bash "$ROOT/scripts/aws-credentials.sh" import-csv "$tmp/root.csv" root-profile us-east-1)
+[[ "$root_out" == *"profile=root-profile"* ]]
+[[ "$root_out" == *"root=true"* ]]
+if [[ "$root_out" == *"AKIAROOTTEST"* || "$root_out" == *"SECRET_ROOT_VALUE"* ]]; then
+  echo "aws-credentials root output leaked credential values" >&2
+  printf '%s\n' "$root_out" >&2
+  exit 1
+fi
+grep -q '^\[root-profile\]$' "$AWS_SHARED_CREDENTIALS_FILE"
+grep -q '^aws_access_key_id = AKIAROOTTEST$' "$AWS_SHARED_CREDENTIALS_FILE"
+grep -q '^aws_secret_access_key = SECRET_ROOT_VALUE$' "$AWS_SHARED_CREDENTIALS_FILE"
+
+root_verify_out=$(AWS_PROFILE=root-profile bash "$ROOT/scripts/aws-credentials.sh" verify root-profile)
+[[ "$root_verify_out" == *"profile=root-profile"* ]]
+[[ "$root_verify_out" == *"root=true"* ]]
+
+set +e
+s0_output=$(
+  P2P_WORKDIR="$tmp/state-root" AWS_PROFILE=root-profile bash -c '
+    set -uo pipefail
+    cd "$1"
+    source scripts/lib/state.sh
+    state_init >/dev/null 2>&1
+    source scripts/lib/aws.sh
+    source scripts/phases/s0_prereq_aws.sh
+    run_phase
+  ' _ "$ROOT" 2>&1
+)
+s0_rc=$?
+set -e
+[ "$s0_rc" -eq 0 ]
+[[ "$s0_output" == *"AWS credentials are valid"* ]]
+
+echo "aws credentials ok"

package/tests/connect_daemon_runtime_check_test.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/direxio-connect" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "${1:-}" = "daemon" ] && [ "${2:-}" = "logs" ]; then
+  [ "${3:-}" = "--service-name" ]
+  [ "${4:-}" = "connect-check.example.test" ]
+  printf '%s\n' "${CONNECT_LOG_OUTPUT:-}"
+  exit 0
+fi
+
+[ "${1:-}" = "daemon" ]
+[ "${2:-}" = "status" ]
+[ "${3:-}" = "--service-name" ]
+[ "${4:-}" = "connect-check.example.test" ]
+
+cat <<STATUS
+cc-connect daemon status
+
+  Status:    ${CONNECT_STATUS:-Running}
+  Platform:  test
+  WorkDir:   ${CONNECT_WORK_DIR:-}
+STATUS
+EOF
+chmod 700 "$fakebin/direxio-connect"
+
+service_dir="$HOME/.direxio/nodes/connect-check.example.test"
+mkdir -p "$service_dir/cc-connect"
+config="$service_dir/cc-connect/config.toml"
+: > "$config"
+state="$service_dir/state.json"
+jq -n \
+  --arg service_dir "$service_dir" \
+  --arg config "$config" \
+  '{
+    run_id: "connect-daemon-test",
+    region: "ap-northeast-1",
+    domain_mode: "user",
+    domain: "connect-check.example.test",
+    agent_service_id: "connect-check.example.test",
+    agent_service_dir: $service_dir,
+    cc_connect_config: $config,
+    cc_connect_binary: "direxio-connect",
+    phase: "S7_VERIFY_E2E",
+    phases: {
+      S0_PREREQ_AWS: {status: "done"},
+      S1_PREFLIGHT: {status: "done"},
+      S2_DOMAIN: {status: "done"},
+      S3_PROVISION: {status: "done"},
+      S4_BOOTSTRAP_STACK: {status: "done"},
+      S5_INIT_TOKENS: {status: "done"},
+      S6_WIRE_LOCAL: {status: "done"},
+      S7_VERIFY_E2E: {status: "done"}
+    },
+    resources: {}
+  }' > "$state"
+
+verify_output=$(P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CONNECT_WORK_DIR="$service_dir/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify connect_daemon)
+printf '%s\n' "$verify_output" | grep -q 'verified runtime check: connect_daemon'
+
+expected_work_dir="$service_dir/cc-connect"
+if command -v cygpath >/dev/null 2>&1; then
+  expected_work_dir=$(cygpath -m "$expected_work_dir")
+fi
+
+jq -e '
+  .runtime_checks.connect_daemon.status == "passed"
+  and .runtime_checks.connect_daemon.service_name == "connect-check.example.test"
+  and .runtime_checks.connect_daemon.daemon_status == "Running"
+  and .runtime_checks.connect_daemon.work_dir == "'"$expected_work_dir"'"
+  and (.user_confirmations.agent_mcp_runtime | not)
+' "$state" >/dev/null
+
+set +e
+P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CONNECT_WORK_DIR="$service_dir/cc-connect" CONNECT_LOG_OUTPUT='ACP error (ACP_SESSION_INIT_FAILED): ACP metadata is missing for agent:main:acp:a18569b4-1f24-4f8a-aec6-f6a54530d50e. Recreate this ACP session with /acp spawn and rebind the thread.' bash "$ROOT/scripts/orchestrate.sh" verify connect_daemon > "$tmp/acp-error.out" 2>&1
+acp_rc=$?
+set -e
+[ "$acp_rc" -ne 0 ] || {
+  echo "connect daemon check must fail when daemon logs show ACP session init failure" >&2
+  exit 1
+}
+jq -e '
+  .runtime_checks.connect_daemon.status == "failed"
+  and (.runtime_checks.connect_daemon.evidence | contains("ACP session initialization failure"))
+  and (.runtime_checks.connect_daemon.agent_error | contains("ACP_SESSION_INIT_FAILED"))
+' "$state" >/dev/null
+
+report_output=$(P2P_WORKDIR="$service_dir" bash "$ROOT/scripts/orchestrate.sh" report new_deploy)
+report_path=$(printf '%s\n' "$report_output" | sed -nE 's/^operation report: //p' | tail -n 1)
+jq -e '
+  .runtime_checks.connect_daemon.status == "failed"
+  and .gates.user_confirmation.agent_mcp_runtime == "pending_runtime_confirmation"
+' "$report_path" >/dev/null
+
+set +e
+P2P_WORKDIR="$service_dir" PATH="$fakebin:$PATH" CONNECT_WORK_DIR="$HOME/.direxio/nodes/other.example.test/cc-connect" bash "$ROOT/scripts/orchestrate.sh" verify connect_daemon > "$tmp/wrong.out" 2>&1
+wrong_rc=$?
+set -e
+[ "$wrong_rc" -ne 0 ] || {
+  echo "connect daemon check must fail when daemon WorkDir belongs to another service" >&2
+  exit 1
+}
+jq -e '
+  .runtime_checks.connect_daemon.status == "failed"
+  and (.runtime_checks.connect_daemon.evidence | contains("different service"))
+' "$state" >/dev/null
+
+echo "connect daemon runtime check ok"

package/tests/default_paths_test.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+unset P2P_WORKDIR
+unset DIREXIO_WORKDIR
+export DOMAIN="IM.Example.test"
+
+# shellcheck disable=SC1090
+source "$ROOT/scripts/lib/state.sh"
+
+[ "$P2P_WORKDIR" = "$HOME/.direxio/nodes/im.example.test" ]
+[ "$STATE_JSON" = "$HOME/.direxio/nodes/im.example.test/state.json" ]
+
+(
+  unset P2P_WORKDIR
+  export DIREXIO_WORKDIR="$HOME/.direxio/custom-workdir"
+  # shellcheck disable=SC1090
+  source "$ROOT/scripts/lib/state.sh"
+  [ "$P2P_WORKDIR" = "$HOME/.direxio/custom-workdir" ]
+  [ "$STATE_JSON" = "$HOME/.direxio/custom-workdir/state.json" ]
+)
+
+rm -rf "$HOME/.direxio"
+(
+  unset DOMAIN P2P_WORKDIR DIREXIO_WORKDIR
+  HOME="$HOME" bash "$ROOT/scripts/orchestrate.sh" status >/dev/null 2>&1
+)
+[ ! -e "$HOME/.direxio/deploy" ]
+[ ! -e "$HOME/.direxio/nodes/state.json" ]
+
+mkdir -p "$HOME/.direxio/nodes/solo.example.test"
+jq -n '{domain:"solo.example.test", phase:"S3_PROVISION", resources:{instance_id:"i-solo"}}' > "$HOME/.direxio/nodes/solo.example.test/state.json"
+(
+  unset DOMAIN P2P_WORKDIR DIREXIO_WORKDIR
+  # shellcheck disable=SC1090
+  source "$ROOT/scripts/lib/state.sh"
+  [ "$P2P_WORKDIR" = "$HOME/.direxio/nodes" ]
+  [ "$STATE_JSON" = "$HOME/.direxio/nodes/state.json" ]
+)
+
+mkdir -p "$HOME/.direxio/nodes/second.example.test"
+jq -n '{domain:"second.example.test", phase:"S6_WIRE_LOCAL", resources:{instance_id:"i-second"}}' > "$HOME/.direxio/nodes/second.example.test/state.json"
+status_output=$(
+  unset DOMAIN P2P_WORKDIR DIREXIO_WORKDIR
+  HOME="$HOME" bash "$ROOT/scripts/orchestrate.sh" status
+)
+[[ "$status_output" == *"solo.example.test"* ]]
+[[ "$status_output" == *"second.example.test"* ]]
+[[ "$status_output" == *"i-solo"* ]]
+[[ "$status_output" == *"i-second"* ]]
+
+echo "default paths ok"

package/tests/destroy_local_bridge_test.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+
+cat > "$fakebin/aws" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'aws' >> "$CALLS"
+printf ' %q' "$@" >> "$CALLS"
+printf '\n' >> "$CALLS"
+
+case "${1:-} ${2:-}" in
+  "sts get-caller-identity")
+    case "$*" in
+      *"--query Arn"*) printf 'arn:aws:iam::123456789012:user/DirexioDeployer-Test\n' ;;
+      *"--query Account"*) printf '123456789012\n' ;;
+      *) printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:user/DirexioDeployer-Test"}\n' ;;
+    esac
+    ;;
+  "ec2 terminate-instances") exit 0 ;;
+  "ec2 wait") exit 0 ;;
+  "ec2 release-address") exit 0 ;;
+  "ec2 delete-security-group") exit 0 ;;
+  "ec2 delete-key-pair") exit 0 ;;
+  *) exit 0 ;;
+esac
+EOF
+chmod 700 "$fakebin/aws"
+
+cat > "$fakebin/direxio-connect" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'direxio-connect' >> "$CALLS"
+printf ' %q' "$@" >> "$CALLS"
+printf '\n' >> "$CALLS"
+if [ "${1:-}" = "daemon" ] && [ "${2:-}" = "status" ]; then
+  [ "${3:-}" = "--service-name" ]
+  [ -n "${4:-}" ]
+  cat <<STATUS
+cc-connect daemon status
+
+  Status:    Running
+  Platform:  test
+  WorkDir:   ${STATUS_WORK_DIR:-}
+STATUS
+fi
+EOF
+chmod 700 "$fakebin/direxio-connect"
+
+write_state() {
+  local state=$1 domain=$2 service_dir=$3
+  mkdir -p "$(dirname "$state")" "$service_dir/cc-connect"
+  : > "$service_dir/cc-connect/config.toml"
+  jq -n \
+    --arg region "us-east-1" \
+    --arg domain "$domain" \
+    --arg service_dir "$service_dir" \
+    '{
+      region: $region,
+      domain_mode: "user",
+      domain: $domain,
+      as_url: ("https://" + $domain),
+      agent_service_dir: $service_dir,
+      agent_service_id: $domain,
+      resources: {
+        instance_id: "i-test",
+        eip_id: "eipalloc-test",
+        sg_id: "sg-test",
+        key_name: "direxio-test"
+      }
+    }' > "$state"
+}
+
+run_destroy() {
+  local state=$1 calls=$2 status_work_dir=$3
+  : > "$calls"
+  CALLS="$calls" STATUS_WORK_DIR="$status_work_dir" PATH="$fakebin:$PATH" bash "$ROOT/scripts/destroy.sh" "$state" >/dev/null
+}
+
+current_service="$HOME/.direxio/nodes/a5.direxio.ai"
+current_state="$current_service/state.json"
+current_calls="$tmp/current.calls"
+write_state "$current_state" "a5.direxio.ai" "$current_service"
+run_destroy "$current_state" "$current_calls" "$current_service/cc-connect"
+
+grep -q '^direxio-connect daemon status --service-name a5.direxio.ai$' "$current_calls" || {
+  echo "destroy should query the current named daemon status" >&2
+  cat "$current_calls" >&2
+  exit 1
+}
+
+grep -q '^direxio-connect daemon stop --service-name a5.direxio.ai$' "$current_calls" || {
+  echo "destroy should stop the daemon when daemon status WorkDir matches the current service cc-connect dir" >&2
+  cat "$current_calls" >&2
+  exit 1
+}
+
+grep -q '^direxio-connect daemon uninstall --service-name a5.direxio.ai$' "$current_calls" || {
+  echo "destroy should uninstall the daemon after stopping the matching current service daemon" >&2
+  cat "$current_calls" >&2
+  exit 1
+}
+
+if [ -d "$current_service" ]; then
+  echo "destroy should remove the current service directory after stopping its daemon" >&2
+  exit 1
+fi
+
+other_service="$HOME/.direxio/nodes/b5.direxio.ai"
+other_state="$other_service/state.json"
+active_other_service="$HOME/.direxio/nodes/active-other"
+other_calls="$tmp/other.calls"
+mkdir -p "$active_other_service/cc-connect"
+write_state "$other_state" "b5.direxio.ai" "$other_service"
+run_destroy "$other_state" "$other_calls" "$active_other_service/cc-connect"
+
+grep -q '^direxio-connect daemon status --service-name b5.direxio.ai$' "$other_calls" || {
+  echo "destroy should query the named daemon for the service being destroyed" >&2
+  cat "$other_calls" >&2
+  exit 1
+}
+
+if grep -q '^direxio-connect daemon stop' "$other_calls"; then
+  echo "destroy must not stop a daemon whose status WorkDir belongs to a different service" >&2
+  cat "$other_calls" >&2
+  exit 1
+fi
+
+if grep -q '^direxio-connect daemon uninstall' "$other_calls"; then
+  echo "destroy must not uninstall a daemon whose status WorkDir belongs to a different service" >&2
+  cat "$other_calls" >&2
+  exit 1
+fi
+
+if [ -d "$other_service" ]; then
+  echo "destroy should remove the current service directory even when another service daemon is active" >&2
+  exit 1
+fi
+
+if [ ! -d "$active_other_service" ]; then
+  echo "destroy must not remove another service directory" >&2
+  exit 1
+fi
+
+echo "destroy local bridge ok"

package/tests/destroy_root_identity_test.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+
+cat > "$fakebin/aws" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'aws' >> "$CALLS"
+printf ' %q' "$@" >> "$CALLS"
+printf '\n' >> "$CALLS"
+
+case "${1:-} ${2:-}" in
+  "sts get-caller-identity")
+    case "$*" in
+      *"--query Arn"*) printf 'arn:aws:iam::123456789012:root\n' ;;
+      *"--query Account"*) printf '123456789012\n' ;;
+      *) printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:root"}\n' ;;
+    esac
+    ;;
+  "ec2 terminate-instances"|"ec2 release-address"|"ec2 delete-security-group"|"ec2 delete-key-pair"|"route53 change-resource-record-sets")
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+EOF
+chmod 700 "$fakebin/aws"
+
+service_dir="$HOME/.direxio/nodes/root-destroy.example.test"
+mkdir -p "$service_dir"
+state="$service_dir/state.json"
+jq -n \
+  --arg service_dir "$service_dir" \
+  '{
+    region: "us-east-1",
+    domain_mode: "user",
+    domain: "root-destroy.example.test",
+    agent_service_dir: $service_dir,
+    agent_service_id: "root-destroy.example.test",
+    resources: {
+      instance_id: "i-root-destroy",
+      eip_id: "eipalloc-root-destroy",
+      sg_id: "sg-root-destroy",
+      key_name: "direxio-root-destroy"
+    }
+  }' > "$state"
+
+calls="$tmp/aws.calls"
+: > "$calls"
+set +e
+CALLS="$calls" PATH="$fakebin:$PATH" bash "$ROOT/scripts/destroy.sh" "$state" > "$tmp/destroy.out" 2>&1
+destroy_rc=$?
+set -e
+
+[ "$destroy_rc" -eq 0 ] || {
+  echo "destroy must allow root identity when the operator chose root credentials" >&2
+  cat "$tmp/destroy.out" >&2
+  exit 1
+}
+grep -q 'source = ' "$tmp/destroy.out"
+
+for expected in 'ec2 terminate-instances' 'ec2 release-address' 'ec2 delete-security-group' 'ec2 delete-key-pair'; do
+  if ! grep -F "$expected" "$calls" >/dev/null; then
+    echo "destroy should process recorded AWS resource with root identity: $expected" >&2
+    cat "$calls" >&2
+    exit 1
+  fi
+done
+
+if grep -F 'route53 change-resource-record-sets' "$calls" >/dev/null; then
+  echo "destroy should not touch Route53 for DOMAIN_MODE=user" >&2
+  cat "$calls" >&2
+  exit 1
+fi
+
+if [ -d "$service_dir" ]; then
+  echo "destroy should remove local service state after processing resources" >&2
+  exit 1
+fi
+
+echo "destroy root identity allowed ok"

package/tests/destroy_route53_zone_test.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+export HOME="$tmp/home"
+mkdir -p "$HOME"
+
+fakebin="$tmp/bin"
+mkdir -p "$fakebin"
+cat > "$fakebin/aws" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+printf 'aws' >> "$CALLS"
+printf ' %q' "$@" >> "$CALLS"
+printf '\n' >> "$CALLS"
+
+case "${1:-} ${2:-}" in
+  "sts get-caller-identity")
+    case "$*" in
+      *"--query Arn"*) printf 'arn:aws:iam::123456789012:user/DirexioDeployer-Test\n' ;;
+      *"--query Account"*) printf '123456789012\n' ;;
+      *) printf '{"Account":"123456789012","Arn":"arn:aws:iam::123456789012:user/DirexioDeployer-Test"}\n' ;;
+    esac
+    ;;
+  "route53 list-hosted-zones")
+    printf '{"HostedZones":[{"Id":"/hostedzone/ZCREATE","Name":"route53-destroy.example.test."}]}\n'
+    ;;
+  "route53 change-resource-record-sets")
+    exit 0
+    ;;
+  "route53 delete-hosted-zone")
+    exit 0
+    ;;
+  "ec2 terminate-instances"|"ec2 wait"|"ec2 release-address"|"ec2 delete-security-group"|"ec2 delete-key-pair")
+    exit 0
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+EOF
+chmod 700 "$fakebin/aws"
+
+service_dir="$HOME/.direxio/nodes/route53-destroy.example.test"
+mkdir -p "$service_dir"
+state="$service_dir/state.json"
+jq -n \
+  --arg service_dir "$service_dir" \
+  '{
+    region: "us-east-1",
+    domain_mode: "route53",
+    domain: "route53-destroy.example.test",
+    agent_service_dir: $service_dir,
+    resources: {
+      public_ip: "203.0.113.99",
+      route53_zone_id: "ZCREATE",
+      route53_zone_name: "route53-destroy.example.test",
+      route53_zone_created_by_deployer: "true"
+    }
+  }' > "$state"
+
+calls="$tmp/aws.calls"
+CALLS="$calls" PATH="$fakebin:$PATH" bash "$ROOT/scripts/destroy.sh" "$state" >/dev/null
+
+grep -q '^aws route53 change-resource-record-sets --hosted-zone-id ZCREATE' "$calls" || {
+  echo "destroy should delete the Route53 A record from the recorded zone" >&2
+  cat "$calls" >&2
+  exit 1
+}
+
+grep -q '^aws route53 delete-hosted-zone --id ZCREATE$' "$calls" || {
+  echo "destroy should delete a deployer-created hosted zone to stop Route53 hosted-zone billing" >&2
+  cat "$calls" >&2
+  exit 1
+}
+
+echo "destroy route53 zone ok"