feat(desktop): ship the real signed directory + pin the directory key

The desktop shipped placeholder gateways and an empty directory pubkey, so it
couldn't trust/discover the live fleet like mobile does. Now it ships the real
artifact.

- Bundle deploy/directory/directory.signed.json (identical to the mobile app's)
  as src/data/directory.json, and pin the real CVPN_DIRECTORY_PUBKEY
  (1e+42…KKw=). directory.ts now loads + can verify it via core directoryVerify,
  mirroring the mobile client's trust anchor.
- A test asserts the bundled snapshot actually verifies against the pinned key,
  so we can't ship a directory whose signature doesn't match.
- Filter 0.0.0.0 placeholder seeds in the offline cold-start (like mobile): live
  discovery resolves real IPs, so an unreachable fallback shows nothing rather
  than an unconnectable gateway.

Verified via a headless render: the desktop now discovers 🇩🇪 Germany from the
verified directory and the UI is fully live (Connect enabled, health dot).
All checks green (tsc, eslint, prettier, 12 tests).

Author: TheTrunk

clients/desktop/src/data/directory.json

@@ -0,0 +1,29 @@
+{
+  "version": 1,
+  "updated": "2026-07-17T14:12:07Z",
+  "payment_address": "t3disq3aZz8K3RLZL9zfkpP2UWNVV3hq4vZ",
+  "price_flux": 20,
+  "specs": [
+    "cumulusvpnau",
+    "cumulusvpnbr",
+    "cumulusvpnca",
+    "cumulusvpncz",
+    "cumulusvpnde",
+    "cumulusvpnfr",
+    "cumulusvpngb",
+    "cumulusvpnjp",
+    "cumulusvpnnl",
+    "cumulusvpnpl",
+    "cumulusvpnsg",
+    "cumulusvpnus"
+  ],
+  "seed_gateways": [
+    {
+      "ip": "0.0.0.0",
+      "country": "DE",
+      "sign_pubkey": "REPLACE_GATEWAY_ED25519_PUBKEY_B64"
+    }
+  ],
+  "sign_pubkey": "1e+42nEpmdjf/cAHs+yE2E2iwmAADpWiLy1VMepsKKw=",
+  "sig": "TsQTer0bKqMjb0mUZGKwwy5Lr0bDVaUKXynxZRoCJKk3Ps7D4Q/AREEgAZWuTT6Ob7SZQmRpf8ARwo4rK9LHAA=="
+}

clients/desktop/src/lib/directory.test.ts

@@ -1,5 +1,11 @@
 import { describe, expect, it } from 'vitest';
-import { BUNDLED_DIRECTORY, UPGRADE_URL, countryMeta } from './directory';
+import {
+  BUNDLED_DIRECTORY,
+  CVPN_DIRECTORY_PUBKEY,
+  UPGRADE_URL,
+  bundledDirectoryIsValid,
+  countryMeta,
+} from './directory';
 
 describe('countryMeta', () => {
   it('resolves display metadata for known countries', () => {
@@ -31,6 +37,13 @@ describe('BUNDLED_DIRECTORY', () => {
     expect(BUNDLED_DIRECTORY.specs).toContain('cumulusvpnde');
     expect(BUNDLED_DIRECTORY.specs.every((s) => s.startsWith('cumulus'))).toBe(true);
   });
+
+  it('is the real signed snapshot that verifies against the pinned key', () => {
+    // Guards against shipping a directory whose signature does not match the
+    // pinned CVPN_DIRECTORY_PUBKEY (the whole trust chain hangs off this).
+    expect(CVPN_DIRECTORY_PUBKEY).not.toBe('');
+    expect(bundledDirectoryIsValid()).toBe(true);
+  });
 });
 
 describe('UPGRADE_URL', () => {

clients/desktop/src/lib/directory.ts

@@ -2,48 +2,32 @@
  * Bundled signed `directory.json` snapshot + the directory Ed25519 pubkey the
  * client ships and pins. Cold-start / all-unreachable fallback per
  * `docs/10-api-contract.md` (order: disk cache → live discovery → this
- * snapshot). Every path is signature-checked via `core.directoryVerify`.
+ * snapshot). Every path is signature-checked via core `directoryVerify`.
  *
- * // POC: these are placeholder seed endpoints + an unset pinned key. A real
- * release regenerates this file from cumulusvpn.com and the Tauri updater ships
- * a fresh snapshot with every binary. `verifyDirectory()` is wired but the
- * bundled `sig` here is a placeholder, so we treat an unset pin as "trust on
- * first probe" during the POC.
+ * The snapshot here is the real artifact published from cumulusvpn.com (a copy
+ * of `deploy/directory/directory.signed.json`), identical to the one the mobile
+ * app ships, so the desktop discovers the same live fleet. Live discovery
+ * resolves the `specs` to gateway IPs through Flux; the `seed_gateways` are only
+ * the emergency direct-probe fallback.
  */
+import { directoryVerify } from '@cumulusvpn/core';
 import type { Directory } from '@cumulusvpn/core';
+import bundled from '../data/directory.json';
 
-/** Base64 Ed25519 directory public key clients pin. // POC: unset placeholder. */
-export const CVPN_DIRECTORY_PUBKEY = '';
+/**
+ * Pinned directory Ed25519 public key (`CVPN_DIRECTORY_PUBKEY`), base64.
+ * Baked into the binary; the whole trust chain hangs off this constant. Matches
+ * the mobile app's pin so both clients trust the same directory signer.
+ */
+export const CVPN_DIRECTORY_PUBKEY = '1e+42nEpmdjf/cAHs+yE2E2iwmAADpWiLy1VMepsKKw=';
 
-/** Last-known fleet snapshot baked into the release. */
-export const BUNDLED_DIRECTORY: Directory = {
-  version: 1,
-  updated: '2026-07-01T00:00:00Z',
-  payment_address: 't1PLACEHOLDERpaymentAddressREPLACEatRelease0',
-  price_flux: 20,
-  specs: [
-    'cumulusvpnau',
-    'cumulusvpnbr',
-    'cumulusvpnca',
-    'cumulusvpncz',
-    'cumulusvpnde',
-    'cumulusvpnfr',
-    'cumulusvpngb',
-    'cumulusvpnjp',
-    'cumulusvpnnl',
-    'cumulusvpnpl',
-    'cumulusvpnsg',
-    'cumulusvpnus',
-  ],
-  seed_gateways: [
-    { ip: '203.0.113.10', country: 'DE', sign_pubkey: '' },
-    { ip: '203.0.113.20', country: 'US', sign_pubkey: '' },
-    { ip: '203.0.113.30', country: 'NL', sign_pubkey: '' },
-  ],
-  // POC: placeholder signature; regenerated + verified against the pinned key
-  // in production. See discovery.directoryVerify.
-  sig: '',
-};
+/** Last-known fleet snapshot baked into the release, typed as core `Directory`. */
+export const BUNDLED_DIRECTORY: Directory = bundled as Directory;
+
+/** True iff the bundled snapshot verifies against the pinned directory key. */
+export function bundledDirectoryIsValid(): boolean {
+  return directoryVerify(BUNDLED_DIRECTORY, CVPN_DIRECTORY_PUBKEY);
+}
 
 /** Human display metadata for the countries the fleet serves. */
 export interface CountryMeta {
@@ -62,6 +46,10 @@ const COUNTRY_META: Record<string, CountryMeta> = {
   FR: { code: 'FR', name: 'France', flag: '🇫🇷' },
   CA: { code: 'CA', name: 'Canada', flag: '🇨🇦' },
   JP: { code: 'JP', name: 'Japan', flag: '🇯🇵' },
+  AU: { code: 'AU', name: 'Australia', flag: '🇦🇺' },
+  BR: { code: 'BR', name: 'Brazil', flag: '🇧🇷' },
+  CZ: { code: 'CZ', name: 'Czechia', flag: '🇨🇿' },
+  PL: { code: 'PL', name: 'Poland', flag: '🇵🇱' },
 };
 
 /** Resolve display metadata for an ISO country code, with a safe fallback. */

clients/desktop/src/lib/session.test.ts

@@ -67,16 +67,15 @@ describe('discoverCountries', () => {
     expect(de.signPubKey).toBe('sign-de');
   });
 
-  it('falls back to the bundled seed gateways when nothing is reachable', async () => {
+  it('drops 0.0.0.0 placeholder seeds when nothing is reachable', async () => {
     mockedDiscover.mockResolvedValue([]);
 
     const options = await discoverCountries();
 
-    expect(options.map((o) => o.code)).toEqual(['DE', 'NL', 'US']);
-    for (const o of options) {
-      expect(o.load).toBe(0);
-      expect(o.city).toBe('');
-    }
+    // The real signed directory ships only placeholder (0.0.0.0) seeds — live
+    // discovery resolves the real IPs — so the offline fallback is empty rather
+    // than a list of unconnectable gateways (matches the mobile client).
+    expect(options).toEqual([]);
   });
 });
 

clients/desktop/src/lib/session.ts

@@ -101,8 +101,11 @@ export async function discoverCountries(fetchImpl?: typeof fetch): Promise<Count
   if (gateways.length > 0) {
     return toCountryOptions(gateways);
   }
-  // Offline cold-start: synthesize options from the signed seed list.
+  // Offline cold-start: synthesize options from the signed seed list. Skip the
+  // 0.0.0.0 placeholder seeds (live discovery resolves real IPs), matching the
+  // mobile client — better to show nothing than an unconnectable gateway.
   return BUNDLED_DIRECTORY.seed_gateways
+    .filter((seed) => seed.ip !== '0.0.0.0')
     .map((seed): CountryOption => {
       const meta = countryMeta(seed.country);
       return {