Add overlay planning commands

crates/geth/tests/bootstrap.rs

@@ -111,6 +111,55 @@ fn geth_init_in_temp_home() {
     );
 }
 
+#[test]
+fn cli_help_documents_owner_init_keys() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let output = run_geth(home.path(), &["init", "--help"]);
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("--admin-key <OPENSSH_PUBLIC_KEY>"));
+    assert!(stdout.contains("--signing-key <OPENSSH_PRIVATE_KEY>"));
+    assert!(stdout.contains("OpenSSH public key"));
+    assert!(stdout.contains("YubiKey"));
+    assert!(stdout.contains("both `--admin-key` and `--signing-key` are"));
+    assert!(stdout.contains("geth guide owner-setup"));
+}
+
+#[test]
+fn guide_command_explains_key_roles() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let output = run_geth(home.path(), &["guide", "keys"]);
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("--admin-key"));
+    assert!(stdout.contains("trust anchor"));
+    assert!(stdout.contains("--signing-key"));
+    assert!(stdout.contains("ssh-keygen -Y sign"));
+}
+
+#[test]
+fn guide_command_explains_overlay_boundaries() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let output = run_geth(home.path(), &["guide", "overlay"]);
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("geth overlay plan home"));
+    assert!(stdout.contains("TUN/Wintun"));
+    assert!(stdout.contains("all overlay packets must be carried over Iroh"));
+}
+
 #[test]
 fn owner_init_requires_admin_key_and_signing_key() {
     let home = tempfile::tempdir().expect("tempdir");
@@ -1378,6 +1427,31 @@ fn initialized_node_can_roundtrip_cas_blob() {
     );
 }
 
+#[test]
+fn overlay_plan_is_available_without_starting_packet_runtime() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::OverlayPlan {
+            name: "home-lan".to_owned(),
+            cidr: None,
+        },
+    )
+    .expect("overlay plan");
+    match response {
+        geth_control::ControlResponse::OverlayPlanned { plan } => {
+            assert_eq!(plan.resource.to_string(), "resource:overlay:home-lan");
+            assert_eq!(plan.alpn, "/geth/overlay/1");
+            assert!(plan.capabilities.contains(&"overlay.join".to_owned()));
+            assert!(plan.runtime.contains("no TUN/Wintun"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+}
+
 #[test]
 fn private_cas_blob_uses_resource_secret_epoch() {
     let home = tempfile::tempdir().expect("tempdir");