kadi-deploy 0.19.0

package/tests/down.test.ts

@@ -0,0 +1,1143 @@
+/**
+ * Deploy Down Command Tests
+ *
+ * These tests actually exercise the real functions with mocked externals:
+ *
+ * - executeDown(): verifies lock reading, routing, confirmation prompt,
+ *   and delegation to the correct teardown path
+ * - Local teardown: verifies execSync is called with the right compose command,
+ *   options, and that the lock file is cleaned up
+ * - Akash interactive: verifies connectWallet, closeDeployment, disconnectWallet
+ *   are called with the correct arguments from the lock file
+ * - Akash autonomous: verifies readSecretFromCli, createWalletFromMnemonic,
+ *   closeDeployment are called correctly
+ * - CLI registration: uses real Commander to verify the "down" subcommand is
+ *   wired up and actually invokes executeDown when parsed
+ * - Error paths: missing lock, missing mnemonic, failed wallet, failed close
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+
+import {
+  writeLockFile,
+  readLockFile,
+  buildLocalLock,
+  buildAkashLock,
+  type DeploymentLock,
+} from '../src/commands/lock.js';
+
+// ─────────────────────────────────────────────────────────
+// Mock external side-effects BEFORE importing down.ts
+// ─────────────────────────────────────────────────────────
+
+// Mock child_process.execSync — local teardown shells out
+const mockExecSync = vi.fn();
+vi.mock('node:child_process', () => ({
+  execSync: (...args: unknown[]) => mockExecSync(...args),
+}));
+
+// Mock spinners (ora) — avoid real terminal output
+vi.mock('../src/cli/spinners.js', () => ({
+  startSpinner: vi.fn(() => ({ text: '', succeed: vi.fn(), fail: vi.fn() })),
+  succeedSpinner: vi.fn(),
+  failSpinner: vi.fn(),
+}));
+
+// Mock prompts — no interactive input in tests
+const mockConfirmPrompt = vi.fn();
+const mockSelectPrompt = vi.fn();
+vi.mock('../src/cli/prompts.js', () => ({
+  confirmPrompt: (...args: unknown[]) => mockConfirmPrompt(...args),
+  selectPrompt: (...args: unknown[]) => mockSelectPrompt(...args),
+}));
+
+// Mock colors — pass-through so we can assert on message content
+vi.mock('../src/cli/colors.js', () => ({
+  error: (s: string) => s,
+  warning: (s: string) => s,
+  success: (s: string) => s,
+  dim: (s: string) => s,
+  bold: (s: string) => s,
+  highlight: (s: string) => s,
+  formatKeyValue: (k: string, v: string) => `${k}: ${v}`,
+}));
+
+// Mock Akash SDK — avoid real blockchain calls
+const mockCloseDeployment = vi.fn();
+const mockDisconnect = vi.fn();
+const mockConnectWallet = vi.fn();
+const mockDisconnectWallet = vi.fn();
+const mockCreateWalletFromMnemonic = vi.fn();
+
+vi.mock('@kadi.build/deploy-ability/akash', () => ({
+  AkashClient: vi.fn().mockImplementation(() => ({
+    closeDeployment: mockCloseDeployment,
+    disconnect: mockDisconnect,
+  })),
+  connectWallet: (...args: unknown[]) => mockConnectWallet(...args),
+  disconnectWallet: (...args: unknown[]) => mockDisconnectWallet(...args),
+  createWalletFromMnemonic: (...args: unknown[]) => mockCreateWalletFromMnemonic(...args),
+}));
+
+// Mock secrets vault — avoid shelling out to `kadi secret get`
+const mockReadSecretFromCli = vi.fn();
+vi.mock('../src/secrets/index.js', () => ({
+  readSecretFromCli: (...args: unknown[]) => mockReadSecretFromCli(...args),
+  validateSecretsOrFail: vi.fn(),
+}));
+
+// Mock node-localstorage and qrcode-terminal (side-effect imports in down.ts)
+vi.mock('node-localstorage', () => ({
+  LocalStorage: vi.fn().mockImplementation(() => ({})),
+}));
+vi.mock('qrcode-terminal', () => ({
+  default: { generate: vi.fn() },
+  generate: vi.fn(),
+}));
+
+// Import the mocked AkashClient constructor so we can re-set it after resetAllMocks
+import { AkashClient as MockedAkashClient } from '@kadi.build/deploy-ability/akash';
+
+// Now import the real function under test
+import { executeDown } from '../src/commands/down.js';
+
+// ─────────────────────────────────────────────────────────
+// Fixtures
+// ─────────────────────────────────────────────────────────
+
+function makeLocalLock(overrides?: Partial<DeploymentLock>): DeploymentLock {
+  return {
+    instanceId: 'a1b2',
+    target: 'local',
+    profile: 'dev',
+    deployedAt: '2026-02-25T12:00:00.000Z',
+    local: {
+      composePath: '/tmp/project/docker-compose.yml',
+      engine: 'docker',
+      network: 'kadi-net',
+      services: ['web', 'api'],
+      containers: { web: 'abc123', api: 'def456' },
+    },
+    ...overrides,
+  };
+}
+
+function makeAkashLock(overrides?: Partial<DeploymentLock>): DeploymentLock {
+  return {
+    instanceId: 'c3d4',
+    target: 'akash',
+    profile: 'production',
+    deployedAt: '2026-02-25T12:00:00.000Z',
+    akash: {
+      dseq: 12345678,
+      owner: 'akash1abc123',
+      provider: 'akash1prov456',
+      providerUri: 'https://provider.example.com',
+      network: 'mainnet',
+      gseq: 1,
+      oseq: 1,
+    },
+    ...overrides,
+  };
+}
+
+function createMockLogger() {
+  return {
+    log: vi.fn(),
+    error: vi.fn(),
+    warn: vi.fn(),
+    info: vi.fn(),
+    debug: vi.fn(),
+    verbose: vi.fn(),
+  };
+}
+
+function createMockCtx() {
+  return {
+    commander: {} as any,
+    logger: createMockLogger(),
+    core: {} as any,
+  };
+}
+
+// ─────────────────────────────────────────────────────────
+// Setup / teardown
+// ─────────────────────────────────────────────────────────
+
+let tmpDir: string;
+
+beforeEach(async () => {
+  tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'kadi-down-test-'));
+  // resetAllMocks clears call history AND resets mockImplementation
+  // (clearAllMocks only clears history, leaving stale throw-implementations)
+  vi.resetAllMocks();
+  // Re-configure default mocks after reset
+  mockConfirmPrompt.mockResolvedValue(true);
+  mockExecSync.mockReturnValue(undefined);
+  // Re-establish AkashClient constructor mock (resetAllMocks clears it)
+  (MockedAkashClient as unknown as ReturnType<typeof vi.fn>).mockImplementation(() => ({
+    closeDeployment: mockCloseDeployment,
+    disconnect: mockDisconnect,
+  }));
+});
+
+afterEach(async () => {
+  try {
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  } catch {
+    // ignore
+  }
+});
+
+// ==========================================================
+// 1. executeDown — no lock file
+// ==========================================================
+
+describe('executeDown — missing lock file', () => {
+  it('reports "No active deployment found" and does nothing', async () => {
+    const ctx = createMockCtx();
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('No active deployment found')
+    );
+    expect(mockExecSync).not.toHaveBeenCalled();
+    expect(mockCloseDeployment).not.toHaveBeenCalled();
+    expect(mockConnectWallet).not.toHaveBeenCalled();
+  });
+
+  it('tells the user which directory was searched', async () => {
+    const ctx = createMockCtx();
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    const allLogs = ctx.logger.log.mock.calls.flat().join('\n');
+    expect(allLogs).toContain(tmpDir);
+  });
+});
+
+// ==========================================================
+// 2. executeDown — confirmation prompt behavior
+// ==========================================================
+
+describe('executeDown — confirmation prompt', () => {
+  it('asks for confirmation when --yes is not set', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    mockConfirmPrompt.mockResolvedValue(false);
+
+    await executeDown(ctx, { project: tmpDir });
+
+    expect(mockConfirmPrompt).toHaveBeenCalledWith(
+      expect.stringContaining('Tear down'),
+      false
+    );
+    // Should NOT have proceeded
+    expect(mockExecSync).not.toHaveBeenCalled();
+  });
+
+  it('skips confirmation when --yes is set', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockConfirmPrompt).not.toHaveBeenCalled();
+    expect(mockExecSync).toHaveBeenCalled();
+  });
+
+  it('aborts without deleting lock when user declines', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    mockConfirmPrompt.mockResolvedValue(false);
+
+    await executeDown(ctx, { project: tmpDir });
+
+    expect(ctx.logger.log).toHaveBeenCalledWith('Cancelled.');
+    expect(mockExecSync).not.toHaveBeenCalled();
+    expect(await readLockFile(tmpDir)).not.toBeNull();
+  });
+
+  it('skips confirmation when --autonomous is set (no --yes needed)', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, autonomous: true });
+
+    expect(mockConfirmPrompt).not.toHaveBeenCalled();
+    expect(mockExecSync).toHaveBeenCalled();
+  });
+});
+
+// ==========================================================
+// 2b. executeDown — profile selection
+// ==========================================================
+
+describe('executeDown — profile selection', () => {
+  it('auto-selects the only active deployment', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    // Should not prompt for selection
+    expect(mockSelectPrompt).not.toHaveBeenCalled();
+    expect(mockExecSync).toHaveBeenCalled();
+  });
+
+  it('uses --profile flag to select a specific deployment', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true, profile: 'dev' });
+
+    // Should not prompt, should use local teardown
+    expect(mockSelectPrompt).not.toHaveBeenCalled();
+    expect(mockExecSync).toHaveBeenCalled();
+  });
+
+  it('errors when --profile specifies non-existent profile', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true, profile: 'nonexistent' });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('No active deployment found for profile "nonexistent"')
+    );
+    expect(mockExecSync).not.toHaveBeenCalled();
+  });
+
+  it('prompts user to select when multiple deployments and no --profile', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    // The selection prompt now shows instanceId-based choices
+    mockSelectPrompt.mockResolvedValue('a1b2 (dev, local)');
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockSelectPrompt).toHaveBeenCalledWith(
+      expect.stringContaining('Which deployment'),
+      expect.arrayContaining([
+        expect.stringContaining('a1b2'),
+        expect.stringContaining('c3d4'),
+      ])
+    );
+    expect(mockExecSync).toHaveBeenCalled();
+  });
+
+  it('only removes the selected profile, keeps others', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    // Tear down just local
+    await executeDown(ctx, { project: tmpDir, yes: true, profile: 'dev' });
+
+    // Akash entry should still exist
+    const lockFile = await readLockFile(tmpDir);
+    expect(lockFile).not.toBeNull();
+    const remaining = Object.values(lockFile!.deployments);
+    expect(remaining).toHaveLength(1);
+    expect(remaining[0].profile).toBe('production');
+  });
+
+  it('errors in autonomous mode with multiple deployments and no --profile', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    await executeDown(ctx, { project: tmpDir, autonomous: true });
+
+    expect(mockSelectPrompt).not.toHaveBeenCalled();
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('specify which one with --profile')
+    );
+    expect(mockExecSync).not.toHaveBeenCalled();
+    expect(mockCloseDeployment).not.toHaveBeenCalled();
+  });
+});
+
+// ==========================================================
+// 3. executeDown — local teardown (the real function path)
+// ==========================================================
+
+describe('executeDown — local teardown', () => {
+  it('calls execSync with correct compose command from lock data', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockExecSync).toHaveBeenCalledTimes(1);
+    const [cmd, opts] = mockExecSync.mock.calls[0];
+    expect(cmd).toBe(
+      'docker compose -f "/tmp/project/docker-compose.yml" down --remove-orphans'
+    );
+    expect(opts.cwd).toBe(tmpDir);
+    expect(opts.timeout).toBe(60_000);
+  });
+
+  it('uses engine from the lock (podman)', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock({
+      local: {
+        composePath: '/tmp/project/docker-compose.yml',
+        engine: 'podman',
+        network: 'kadi-net',
+        services: ['web'],
+        containers: { web: 'abc' },
+      },
+    }));
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    const cmd = mockExecSync.mock.calls[0][0] as string;
+    expect(cmd).toMatch(/^podman compose/);
+  });
+
+  it('--engine flag overrides the lock file engine', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock()); // lock says docker
+
+    await executeDown(ctx, { project: tmpDir, yes: true, engine: 'podman' });
+
+    const cmd = mockExecSync.mock.calls[0][0] as string;
+    expect(cmd).toMatch(/^podman compose/);
+    expect(cmd).not.toMatch(/^docker compose/);
+  });
+
+  it('uses the compose file path from the lock', async () => {
+    const ctx = createMockCtx();
+    const customPath = '/my/custom/compose.yaml';
+    await writeLockFile(tmpDir, makeLocalLock({
+      local: {
+        composePath: customPath,
+        engine: 'docker',
+        network: 'net',
+        services: ['app'],
+        containers: { app: 'xyz' },
+      },
+    }));
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    const cmd = mockExecSync.mock.calls[0][0] as string;
+    expect(cmd).toContain(`-f "${customPath}"`);
+  });
+
+  it('deletes the lock file after successful teardown', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    expect(await readLockFile(tmpDir)).not.toBeNull();
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(await readLockFile(tmpDir)).toBeNull();
+  });
+
+  it('logs success message', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    const allLogs = ctx.logger.log.mock.calls.flat().join('\n');
+    expect(allLogs).toContain('Local deployment torn down successfully');
+  });
+
+  it('passes stdio=inherit when --verbose', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true, verbose: true });
+
+    expect(mockExecSync.mock.calls[0][1].stdio).toBe('inherit');
+  });
+
+  it('passes stdio=pipe when not verbose', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockExecSync.mock.calls[0][1].stdio).toBe('pipe');
+  });
+
+  it('keeps lock file when execSync throws (containers already stopped)', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+    mockExecSync.mockImplementation(() => {
+      throw new Error('exit code 1');
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('exit code 1')
+    );
+    // Lock should NOT be deleted on failure
+    expect(await readLockFile(tmpDir)).not.toBeNull();
+  });
+});
+
+// ==========================================================
+// 4. executeDown — displays deployment info
+// ==========================================================
+
+describe('executeDown — deployment info display', () => {
+  it('displays local deployment details before teardown', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    const allLogs = ctx.logger.log.mock.calls.flat().join('\n');
+    expect(allLogs).toContain('local');
+    expect(allLogs).toContain('dev');
+    expect(allLogs).toContain('docker');
+    expect(allLogs).toContain('web, api');
+  });
+
+  it('displays Akash deployment details before teardown', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    // Set up interactive mocks
+    mockConnectWallet.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1test', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'ABC', height: 99, closedAt: new Date() },
+    });
+    const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {}) as any);
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    const allLogs = ctx.logger.log.mock.calls.flat().join('\n');
+    expect(allLogs).toContain('12345678');
+    expect(allLogs).toContain('akash1abc123');
+    expect(allLogs).toContain('mainnet');
+
+    mockExit.mockRestore();
+  });
+});
+
+// ==========================================================
+// 5. executeDown — target routing
+// ==========================================================
+
+describe('executeDown — target routing', () => {
+  it('routes local → execSync, not Akash SDK', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockExecSync).toHaveBeenCalled();
+    expect(mockConnectWallet).not.toHaveBeenCalled();
+    expect(mockCreateWalletFromMnemonic).not.toHaveBeenCalled();
+  });
+
+  it('routes akash → connectWallet, not execSync', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockConnectWallet.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1test', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+    const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {}) as any);
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockExecSync).not.toHaveBeenCalled();
+    expect(mockConnectWallet).toHaveBeenCalled();
+
+    mockExit.mockRestore();
+  });
+
+  it('routes akash + --autonomous → createWalletFromMnemonic, not connectWallet', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue('mnemonic words');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'AUTO', height: 5, closedAt: new Date() },
+    });
+    const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {}) as any);
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(mockConnectWallet).not.toHaveBeenCalled();
+    expect(mockCreateWalletFromMnemonic).toHaveBeenCalled();
+
+    mockExit.mockRestore();
+  });
+
+  it('logs error for unknown deployment target', async () => {
+    const ctx = createMockCtx();
+    // Manually write a lock with a bogus target
+    await writeLockFile(tmpDir, {
+      instanceId: '',
+      target: 'gcp' as any,
+      profile: 'test',
+      deployedAt: new Date().toISOString(),
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('Unknown deployment target')
+    );
+    expect(mockExecSync).not.toHaveBeenCalled();
+    expect(mockConnectWallet).not.toHaveBeenCalled();
+  });
+});
+
+// ==========================================================
+// 6. executeDown — Akash interactive teardown
+// ==========================================================
+
+describe('executeDown — Akash interactive teardown', () => {
+  let mockExit: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {}) as any);
+  });
+
+  afterEach(() => {
+    mockExit.mockRestore();
+  });
+
+  it('passes the lock network to connectWallet', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockConnectWallet.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1test', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockConnectWallet).toHaveBeenCalledWith(
+      expect.any(String),
+      'mainnet',
+      expect.any(Object),
+    );
+  });
+
+  it('--network flag overrides the lock network', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockConnectWallet.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1test', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, network: 'testnet' });
+
+    expect(mockConnectWallet).toHaveBeenCalledWith(
+      expect.any(String),
+      'testnet',
+      expect.any(Object),
+    );
+  });
+
+  it('calls closeDeployment with the dseq from the lock', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockConnectWallet.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1test', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockCloseDeployment).toHaveBeenCalledWith(12345678);
+  });
+
+  it('deletes lock after successful Akash close', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockConnectWallet.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1test', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(await readLockFile(tmpDir)).toBeNull();
+  });
+
+  it('does NOT delete lock and does NOT call closeDeployment when wallet fails', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockConnectWallet.mockResolvedValue({
+      success: false,
+      error: { message: 'User rejected' },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('User rejected')
+    );
+    expect(await readLockFile(tmpDir)).not.toBeNull();
+    expect(mockCloseDeployment).not.toHaveBeenCalled();
+  });
+
+  it('does NOT delete lock when closeDeployment fails', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockConnectWallet.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1test', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: false,
+      error: { message: 'Insufficient funds' },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('Insufficient funds')
+    );
+    expect(await readLockFile(tmpDir)).not.toBeNull();
+  });
+
+  it('calls disconnectWallet in the finally block', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    const walletData = { address: 'akash1test', signer: {} };
+    mockConnectWallet.mockResolvedValue({ success: true, data: walletData });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    expect(mockDisconnectWallet).toHaveBeenCalledWith(walletData);
+  });
+});
+
+// ==========================================================
+// 7. executeDown — Akash autonomous teardown
+// ==========================================================
+
+describe('executeDown — Akash autonomous teardown', () => {
+  let mockExit: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {}) as any);
+  });
+
+  afterEach(() => {
+    mockExit.mockRestore();
+  });
+
+  it('reads AKASH_WALLET from the specified vault', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue('mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, {
+      project: tmpDir,
+      yes: true,
+      autonomous: true,
+      secretsVault: 'my-vault',
+    });
+
+    expect(mockReadSecretFromCli).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'AKASH_WALLET',
+        vault: 'my-vault',
+        cwd: tmpDir,
+      })
+    );
+  });
+
+  it('defaults vault to "global"', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue('mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(mockReadSecretFromCli).toHaveBeenCalledWith(
+      expect.objectContaining({ vault: 'global' })
+    );
+  });
+
+  it('passes mnemonic and network to createWalletFromMnemonic', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    const mnemonic = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about';
+    mockReadSecretFromCli.mockReturnValue(mnemonic);
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(mockCreateWalletFromMnemonic).toHaveBeenCalledWith(mnemonic, 'mainnet');
+  });
+
+  it('--network overrides lock network in autonomous mode', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue('mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true, network: 'testnet' });
+
+    expect(mockCreateWalletFromMnemonic).toHaveBeenCalledWith(
+      expect.any(String),
+      'testnet'
+    );
+  });
+
+  it('calls closeDeployment with dseq from lock', async () => {
+    const ctx = createMockCtx();
+    const lock = makeAkashLock();
+    lock.akash!.dseq = 99999;
+    await writeLockFile(tmpDir, lock);
+
+    mockReadSecretFromCli.mockReturnValue('mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '99999', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(mockCloseDeployment).toHaveBeenCalledWith(99999);
+  });
+
+  it('deletes lock after successful autonomous close', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue('mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '12345678', transactionHash: 'TX', height: 1, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(await readLockFile(tmpDir)).toBeNull();
+  });
+
+  it('errors when mnemonic is not found in vault', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue(null);
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('AKASH_WALLET')
+    );
+    expect(mockCreateWalletFromMnemonic).not.toHaveBeenCalled();
+    expect(mockCloseDeployment).not.toHaveBeenCalled();
+    expect(await readLockFile(tmpDir)).not.toBeNull();
+  });
+
+  it('errors when createWalletFromMnemonic fails', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue('bad mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: false,
+      error: { message: 'Invalid mnemonic' },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('Invalid mnemonic')
+    );
+    expect(mockCloseDeployment).not.toHaveBeenCalled();
+  });
+
+  it('errors when closeDeployment fails in autonomous mode', async () => {
+    const ctx = createMockCtx();
+    await writeLockFile(tmpDir, makeAkashLock());
+
+    mockReadSecretFromCli.mockReturnValue('mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: false,
+      error: { message: 'Deployment already closed' },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(ctx.logger.error).toHaveBeenCalledWith(
+      expect.stringContaining('Deployment already closed')
+    );
+    expect(await readLockFile(tmpDir)).not.toBeNull();
+  });
+});
+
+// ==========================================================
+// 8. CLI registration — real Commander integration
+// ==========================================================
+
+describe('CLI registration — Commander wiring', () => {
+  it('registers a "deploy" parent command', async () => {
+    const { Command } = await import('commander');
+    const program = new Command();
+    const ctx = { commander: program, logger: createMockLogger(), core: {} as any };
+
+    const { default: registerDeploy } = await import('../src/index.js');
+    registerDeploy(ctx as any);
+
+    const deployCmd = program.commands.find((c: any) => c.name() === 'deploy');
+    expect(deployCmd).toBeDefined();
+    expect(deployCmd!.aliases()).toContain('d');
+  });
+
+  it('registers "up" as the default subcommand', async () => {
+    const { Command } = await import('commander');
+    const program = new Command();
+    const ctx = { commander: program, logger: createMockLogger(), core: {} as any };
+
+    const { default: registerDeploy } = await import('../src/index.js');
+    registerDeploy(ctx as any);
+
+    const deployCmd = program.commands.find((c: any) => c.name() === 'deploy');
+    const upCmd = deployCmd!.commands.find((c: any) => c.name() === 'up');
+    expect(upCmd).toBeDefined();
+    expect(upCmd!.description()).toContain('Deploy agents');
+  });
+
+  it('registers "down" as a subcommand with correct description', async () => {
+    const { Command } = await import('commander');
+    const program = new Command();
+    const ctx = { commander: program, logger: createMockLogger(), core: {} as any };
+
+    const { default: registerDeploy } = await import('../src/index.js');
+    registerDeploy(ctx as any);
+
+    const deployCmd = program.commands.find((c: any) => c.name() === 'deploy');
+    const downCmd = deployCmd!.commands.find((c: any) => c.name() === 'down');
+    expect(downCmd).toBeDefined();
+    expect(downCmd!.description()).toContain('Tear down');
+  });
+
+  it('"down" subcommand has all required option flags', async () => {
+    const { Command } = await import('commander');
+    const program = new Command();
+    const ctx = { commander: program, logger: createMockLogger(), core: {} as any };
+
+    const { default: registerDeploy } = await import('../src/index.js');
+    registerDeploy(ctx as any);
+
+    const deployCmd = program.commands.find((c: any) => c.name() === 'deploy');
+    const downCmd = deployCmd!.commands.find((c: any) => c.name() === 'down');
+    const optionFlags = downCmd!.options.map((o: any) => o.long || o.short);
+
+    expect(optionFlags).toContain('--project');
+    expect(optionFlags).toContain('--profile');
+    expect(optionFlags).toContain('--instance');
+    expect(optionFlags).toContain('--all');
+    expect(optionFlags).toContain('--engine');
+    expect(optionFlags).toContain('--yes');
+    expect(optionFlags).toContain('--autonomous');
+    expect(optionFlags).toContain('--secrets-vault');
+    expect(optionFlags).toContain('--network');
+  });
+
+  it('parsing "deploy down --project ... --yes" invokes executeDown and calls execSync', async () => {
+    const { Command } = await import('commander');
+    const program = new Command();
+    program.exitOverride();
+    const ctx = { commander: program, logger: createMockLogger(), core: {} as any };
+
+    const { default: registerDeploy } = await import('../src/index.js');
+    registerDeploy(ctx as any);
+
+    // Write a lock so executeDown finds something
+    await writeLockFile(tmpDir, makeLocalLock());
+
+    // Parse the CLI — this should trigger the action handler
+    // Note: from:'user' means no argv[0]/argv[1] prefix needed
+    await program.parseAsync(
+      ['deploy', 'down', '--project', tmpDir, '--yes'],
+      { from: 'user' }
+    );
+
+    // If wired correctly, execSync was called with a compose down command
+    expect(mockExecSync).toHaveBeenCalledTimes(1);
+    const cmd = mockExecSync.mock.calls[0][0] as string;
+    expect(cmd).toContain('compose');
+    expect(cmd).toContain('down');
+    expect(cmd).toContain('--remove-orphans');
+  });
+});
+
+// ==========================================================
+// 9. End-to-end: build lock → executeDown
+// ==========================================================
+
+describe('end-to-end: lock lifecycle through executeDown', () => {
+  it('buildLocalLock → writeLockFile → executeDown → lock deleted', async () => {
+    const ctx = createMockCtx();
+
+    const lock = buildLocalLock('my-profile', {
+      engine: 'docker',
+      network: 'kadi-net',
+      services: ['web', 'worker'],
+      containers: { web: 'c1', worker: 'c2' },
+      composePath: path.join(tmpDir, 'docker-compose.yml'),
+      deployedAt: new Date(),
+    });
+    const instanceId = await writeLockFile(tmpDir, lock);
+
+    // Confirm lock is valid
+    const lockFile = await readLockFile(tmpDir);
+    const entry = Object.values(lockFile!.deployments).find(d => d.profile === 'my-profile');
+    expect(entry).toBeDefined();
+    expect(entry!.target).toBe('local');
+    expect(entry!.profile).toBe('my-profile');
+    expect(entry!.instanceId).toBe(instanceId);
+    expect(entry!.local!.services).toEqual(['web', 'worker']);
+
+    // Tear down
+    await executeDown(ctx, { project: tmpDir, yes: true });
+
+    // Verify the real execSync call
+    expect(mockExecSync).toHaveBeenCalledTimes(1);
+    const cmd = mockExecSync.mock.calls[0][0] as string;
+    expect(cmd).toContain(path.join(tmpDir, 'docker-compose.yml'));
+    expect(cmd).toContain('down --remove-orphans');
+
+    // Lock gone
+    expect(await readLockFile(tmpDir)).toBeNull();
+  });
+
+  it('buildAkashLock → writeLockFile → executeDown --autonomous → lock deleted', async () => {
+    const ctx = createMockCtx();
+    const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {}) as any);
+
+    const lock = buildAkashLock('prod', {
+      dseq: 77777,
+      owner: 'akash1deployer',
+      provider: 'akash1provider',
+      providerUri: 'https://p.example.com',
+      network: 'testnet',
+      gseq: 1,
+      oseq: 1,
+      deployedAt: new Date(),
+    });
+    await writeLockFile(tmpDir, lock);
+
+    mockReadSecretFromCli.mockReturnValue('test mnemonic');
+    mockCreateWalletFromMnemonic.mockResolvedValue({
+      success: true,
+      data: { address: 'akash1auto', signer: {} },
+    });
+    mockCloseDeployment.mockResolvedValue({
+      success: true,
+      data: { dseq: '77777', transactionHash: 'HASH', height: 10, closedAt: new Date() },
+    });
+
+    await executeDown(ctx, { project: tmpDir, yes: true, autonomous: true });
+
+    expect(mockCloseDeployment).toHaveBeenCalledWith(77777);
+    expect(mockCreateWalletFromMnemonic).toHaveBeenCalledWith('test mnemonic', 'testnet');
+    expect(await readLockFile(tmpDir)).toBeNull();
+
+    mockExit.mockRestore();
+  });
+});