@consiliency/agent-board-cli 1.28.0 → 1.29.1

package/dist/identity_writer.js

@@ -1,174 +1,5 @@
-// CREDPATH SL-2 — the identity file WRITER. The contract (key set, value shapes, path, trusted
-// walk) is the client's `identity_file.ts`; nothing here restates it. This module only decides
-// which VALUES go in, and writes them the way the reader will accept.
-//
-// Order matters, because the Portal enrollment token is single-use
-// (Consiliency/message-board#521): `resolveIdentityDeployment` runs BEFORE enrollment commits,
-// so a missing or secret-shaped deployment value is refused while the token is still unspent.
-// Only then does enrollment run, and `identityValuesFromEnrollment` + `writeIdentityFile` turn
-// its outcome into the file.
-import { createHash } from "node:crypto";
-import { constants as FS } from "node:fs";
-import * as fs from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { CredentialResolutionError, DEPLOYMENT_ENV_ALIASES, describeMissingDeploymentFields, identityConfigRoot, resolveDeploymentField, identityFilePath, serializeIdentityFile, walkTrustedDirectory, } from "@consiliency/agent-board-client";
-async function syncDirectory(path) {
-    const handle = await fs.open(path, "r");
-    try {
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-}
-/** Create `path` exclusively (never following a planted link) at 0600, write, fsync. */
-export async function writeOwnerOnlyFile(path, content) {
-    const handle = await fs.open(path, FS.O_CREAT | FS.O_EXCL | FS.O_WRONLY | FS.O_NOFOLLOW, 0o600);
-    try {
-        await handle.writeFile(content, "utf8");
-        await handle.sync();
-    }
-    finally {
-        await handle.close();
-    }
-}
-/**
- * Write `content` to `path` so a reader sees the old file or the whole new one, never a
- * part: an exclusive 0600 temp beside it, fsync'd, renamed over it, then the directory
- * fsync'd. On any throw before the rename the temp is removed.
- */
-export async function writeOwnerOnlyFileAtomic(path, content, options = {}) {
-    const sync = options.syncDirectory ?? syncDirectory;
-    const temp = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
-    try {
-        await writeOwnerOnlyFile(temp, content);
-        await fs.rename(temp, path);
-    }
-    catch (error) {
-        await fs.unlink(temp).catch(() => { });
-        throw error;
-    }
-    await sync(dirname(path));
-}
-/**
- * Where each deployment value is read, in precedence order: the client's one alias table
- * (`DEPLOYMENT_ENV_ALIASES`), which puts the enrollment's own names first (so the file records
- * the deployment the enrollment used) and then the identity names. The enrollment resolvers read
- * the same table, so the two cannot disagree. The generic Supabase names are in no list: a
- * generic key never fills an identity field, here or in the loader.
- */
-export const DEPLOYMENT_ENV_NAMES = Object.freeze({
-    boardUrl: DEPLOYMENT_ENV_ALIASES.boardUrl,
-    sessionUrl: DEPLOYMENT_ENV_ALIASES.sessionUrl,
-    publishableKey: DEPLOYMENT_ENV_ALIASES.publishableKey,
-});
-const DEPLOYMENT_FILE_KEYS = {
-    boardUrl: "AGENT_BOARD_URL",
-    sessionUrl: "AGENT_BOARD_SESSION_URL",
-    publishableKey: "AGENT_BOARD_PUBLISHABLE_KEY",
-};
-// Well-shaped stand-ins for the values only the enrollment outcome supplies. The preflight
-// substitutes ONE deployment value into this map and lets `serializeIdentityFile` judge it, so
-// the shape rule applied here is the parser's own, never a second copy.
-const PREFLIGHT_STAND_INS = {
-    AGENT_BOARD_URL: "https://preflight.invalid",
-    AGENT_BOARD_SESSION_URL: "https://preflight.invalid/session",
-    AGENT_BOARD_PUBLISHABLE_KEY: "sb_publishable_preflight",
-    AGENT_BOARD_AGENT_SLUG: "preflight",
-    AGENT_BOARD_EXPECTED_AGENT_HANDLE: "preflight",
-    AGENT_BOARD_AGENT_KEY_REFERENCE: "os_keychain:preflight",
-    AGENT_BOARD_SIGNING_KEY_ID: "preflight",
-    AGENT_BOARD_SIGNING_KEY_VERSION: "1",
-    AGENT_BOARD_SIGNING_PUBLIC_KEY_FINGERPRINT: `sha256:${"A".repeat(43)}`,
-    MESSAGE_BOARD_AGENT_AUTH_MODE: "keystore_session",
-};
-/**
- * The deployment half of an identity, read and shape-checked before enrollment commits. Each
- * value is the shipped default, or env under the board group's all-or-nothing rule (the
- * client's `resolveDeploymentField`). Absent from an env-set group → `identity_incomplete`,
- * naming the variable that switched the group off; not the non-secret shape its key requires →
- * `identity_secret_value`. Both name the variable, never the value.
- */
-export function resolveIdentityDeployment(env) {
-    const deployment = {};
-    for (const field of Object.keys(DEPLOYMENT_ENV_NAMES)) {
-        const resolved = resolveDeploymentField(env, field);
-        if (resolved.value === undefined) {
-            throw new CredentialResolutionError("identity_incomplete", `cannot write an identity file: no ${DEPLOYMENT_FILE_KEYS[field]} for it ${describeMissingDeploymentFields([field], resolved.switchedBy)}`);
-        }
-        // A default is named by the file key it fills: it came from no variable.
-        const found = { name: resolved.name ?? `the default ${DEPLOYMENT_FILE_KEYS[field]}`, value: resolved.value };
-        try {
-            serializeIdentityFile({ ...PREFLIGHT_STAND_INS, [DEPLOYMENT_FILE_KEYS[field]]: found.value });
-        }
-        catch (error) {
-            if (error.code !== "identity_secret_value")
-                throw error;
-            throw new CredentialResolutionError("identity_secret_value", `${found.name} is not the non-secret shape ${DEPLOYMENT_FILE_KEYS[field]} requires; an identity file carries public values only`);
-        }
-        deployment[field] = found.value;
-    }
-    return deployment;
-}
-// ---------------------------------------------------------------------------------------------
-// Outcome → values → file
-// ---------------------------------------------------------------------------------------------
-/** `sha256:` + base64url, over the DECODED public key — exactly what fleet finalize recomputes. */
-function publicKeyFingerprint(agentPublicKey) {
-    const publicKey = Buffer.from(agentPublicKey, "base64url");
-    // The same refusal finalize makes: a value that is not canonical base64url of 32 bytes would
-    // still hash to a plausible fingerprint, of a key that is not the enrolled one. The
-    // re-encode comparison is also the charset and padding check.
-    if (publicKey.length !== 32 || publicKey.toString("base64url") !== agentPublicKey) {
-        throw new CredentialResolutionError("identity_public_key_invalid", "the enrollment outcome's public key is not a 32-byte base64url key");
-    }
-    return `sha256:${createHash("sha256").update(publicKey).digest("base64url")}`;
-}
-/**
- * The identity file's values for an enrolled agent. The URLs and publishable key come only
- * from `deployment`; everything else from the outcome. Validated by the client's serializer
- * before it is returned.
- */
-export function identityValuesFromEnrollment(outcome, deployment) {
-    const values = {
-        AGENT_BOARD_URL: deployment.boardUrl,
-        AGENT_BOARD_SESSION_URL: deployment.sessionUrl,
-        AGENT_BOARD_PUBLISHABLE_KEY: deployment.publishableKey,
-        AGENT_BOARD_AGENT_SLUG: outcome.agentHandle,
-        AGENT_BOARD_EXPECTED_AGENT_HANDLE: outcome.agentHandle,
-        // The form `fleet_onboarding.ts` checks: `${resolver}:${handle}`.
-        AGENT_BOARD_AGENT_KEY_REFERENCE: `${outcome.keyReference.resolver}:${outcome.keyReference.handle}`,
-        // `keyId`, the server's key identity /session mints against — NOT `signingKeyId`, the row.
-        AGENT_BOARD_SIGNING_KEY_ID: outcome.keyId,
-        AGENT_BOARD_SIGNING_KEY_VERSION: String(outcome.keyVersion),
-        AGENT_BOARD_SIGNING_PUBLIC_KEY_FINGERPRINT: publicKeyFingerprint(outcome.agentPublicKey),
-        MESSAGE_BOARD_AGENT_AUTH_MODE: "keystore_session",
-    };
-    serializeIdentityFile(values);
-    return values;
-}
-async function mkdirPrivate(path) {
-    await fs.mkdir(path, { mode: 0o700 }).catch((error) => {
-        if (error.code !== "EEXIST")
-            throw error;
-    });
-}
-/**
- * Write `harness`'s identity file for this host. Every refusal (bad harness, relative root,
- * invalid host, bad value) fires before the first filesystem change. The directory is then
- * put through the reader's own trusted walk, so the writer never produces a file the loader
- * would refuse to open. Returns the path written.
- */
-export async function writeIdentityFile(harness, values, env, options = {}) {
-    const path = identityFilePath(harness, env);
-    const content = serializeIdentityFile(values);
-    const configRoot = identityConfigRoot(env);
-    const strictFrom = join(configRoot, "agent-board");
-    await fs.mkdir(configRoot, { recursive: true, mode: 0o700 });
-    await mkdirPrivate(strictFrom);
-    await mkdirPrivate(join(strictFrom, "identities"));
-    await mkdirPrivate(dirname(path));
-    walkTrustedDirectory(dirname(path), strictFrom);
-    await writeOwnerOnlyFileAtomic(path, content, options);
-    return path;
-}
+// CREDPATH SL-2 — the identity file writer. ONBOARD SL-1 (IF-0-ONBOARD-9) moved its bodies to the
+// client (`@consiliency/agent-board-client`, `identity_writer.ts`) so the MCP server's in-chat
+// enrollment writes the same file through the same code; this module keeps every export, as a
+// re-export, so no cli caller changes.
+export { DEPLOYMENT_ENV_NAMES, identityValuesFromEnrollment, resolveIdentityDeployment, writeIdentityFile, writeOwnerOnlyFile, writeOwnerOnlyFileAtomic, } from "@consiliency/agent-board-client";

package/dist/keyslot_status.d.ts

@@ -115,3 +115,20 @@ export declare function cacheStateOf(report: Record<string, unknown> | null | un
 };
 /** IF-552-3: measure a keyslot in up to two phases. Never throws for a child's failure. */
 export declare function measureKeyslot(options: MeasureOptions): Promise<KeyslotMeasurement>;
+export interface MeasureSlotsOptions extends Omit<MeasureOptions, "harness" | "slot" | "notify" | "skipScan"> {
+    /** The slots to measure. Each name is ALSO its harness: `status.sh --slots` takes no `--harness`. */
+    slots: readonly string[];
+    /** Per-slot events; `progress` is the one shared walk's, so its slot is null. */
+    notify?: (slot: string | null, event: ScanEvent) => void;
+}
+/**
+ * ONBOARD SL-4 (IF-0-ONBOARD-1 "a key scan at most once per host"): several keyslots measured with
+ * ONE filesystem walk, in the same two phases as `measureKeyslot`. One slot IS `measureKeyslot`
+ * (the `--harness` form, byte-identical to a single-harness setup). Two or more use
+ * `status.sh --slots a,b,… --json`: phase 1 (`--scan-cache only`) for every slot, then ONE phase 2
+ * over just the slots phase 1 left without a valid cache. That form has no `--harness`, so each
+ * name is both the harness and the slot — true for setup, which never names a slot of its own.
+ * Each slot's phase `code` is its own line's `exit`; the process exit is only the worst of them.
+ * Lines are matched by their `slot` field, never by position. Never throws for a child's failure.
+ */
+export declare function measureKeyslots(options: MeasureSlotsOptions): Promise<Map<string, KeyslotMeasurement>>;

package/dist/keyslot_status.js

@@ -1,8 +1,9 @@
 // #552 IF-552-3 — the ONE place in the cli that spawns the packaged keyslot `status.sh`. Setup (the
 // key step, the loader refresh, the re-read before enrolling) and doctor (`key_storage`) all measure
 // a keyslot through `measureKeyslot`, so the scan cache, the two budgets and the process-group
-// cleanup are decided once. KSC-7 pins that no other cli source names `"status.sh"` as a call
-// argument (by the TypeScript AST).
+// cleanup are decided once. `setup --all` measures several slots through `measureKeyslots`
+// (`status.sh --slots`, one walk). KSC-7 pins that no other cli source names `"status.sh"` as a
+// call argument (by the TypeScript AST).
 //
 //   phase 1   `status.sh --scan-cache only` under the STATUS budget (180 s): every measurement, and
 //             the scan only if a valid cache holds it. Never scans.
@@ -240,3 +241,108 @@ export async function measureKeyslot(options) {
     notify({ kind: "result", phase: phase2 });
     return result();
 }
+/** status.sh `--slots` output: one JSON object per line, each naming its own slot. */
+const parseSlotReports = (stdout) => {
+    const reports = new Map();
+    for (const line of stdout.split("\n")) {
+        const report = parseReport(line);
+        if (report && typeof report.slot === "string" && !reports.has(report.slot))
+            reports.set(report.slot, report);
+    }
+    return reports;
+};
+/**
+ * ONBOARD SL-4 (IF-0-ONBOARD-1 "a key scan at most once per host"): several keyslots measured with
+ * ONE filesystem walk, in the same two phases as `measureKeyslot`. One slot IS `measureKeyslot`
+ * (the `--harness` form, byte-identical to a single-harness setup). Two or more use
+ * `status.sh --slots a,b,… --json`: phase 1 (`--scan-cache only`) for every slot, then ONE phase 2
+ * over just the slots phase 1 left without a valid cache. That form has no `--harness`, so each
+ * name is both the harness and the slot — true for setup, which never names a slot of its own.
+ * Each slot's phase `code` is its own line's `exit`; the process exit is only the worst of them.
+ * Lines are matched by their `slot` field, never by position. Never throws for a child's failure.
+ */
+export async function measureKeyslots(options) {
+    const slots = [...new Set(options.slots)];
+    const measured = new Map();
+    if (slots.length === 1) {
+        const [slot] = slots;
+        const { notify, slots: _slots, ...rest } = options;
+        void _slots;
+        measured.set(slot, await measureKeyslot({ ...rest, harness: slot, slot, ...(notify ? { notify: (event) => notify(slot, event) } : {}) }));
+        return measured;
+    }
+    if (slots.length === 0)
+        return measured;
+    const file = join(options.dir, "status.sh");
+    if (!existsSync(file)) {
+        for (const slot of slots)
+            measured.set(slot, { absent: true, code: null, report: null, phases: [], timedOut: false, folders: null });
+        return measured;
+    }
+    const run = options.run ?? defaultStorageRunner;
+    const budgets = { ...DEFAULT_BUDGETS, ...options.budgets };
+    const notify = options.notify ?? (() => { });
+    const phases = new Map(slots.map((slot) => [slot, []]));
+    const scanTimedOut = new Set();
+    let folders = null;
+    const call = async (mode, names) => {
+        const scanning = mode !== "only";
+        const args = ["--slots", names.join(","), "--json", "--scan-cache", mode, ...(scanning ? ["--scan-timeout", String(Math.max(1, Math.ceil(budgets.scanMs / 1000)))] : [])];
+        const outcome = await run(file, args, {
+            env: { ...options.env, KEYSEAL_SCAN_WATCH_PID: String(process.pid) },
+            timeoutMs: scanning ? budgets.scanMs + budgets.backstopMs : budgets.statusMs,
+            onStderrLine: scanning
+                ? (line) => {
+                    const match = PROGRESS_LINE.exec(line);
+                    if (!match)
+                        return;
+                    folders = Number(match[1]);
+                    notify(null, { kind: "progress", folders });
+                }
+                : undefined,
+        });
+        const reports = parseSlotReports(outcome.stdout);
+        const called = new Map();
+        for (const name of names) {
+            const report = reports.get(name) ?? null;
+            // A process that did not exit on its own judged nothing, whatever it printed first.
+            const code = outcome.code === null ? null : typeof report?.exit === "number" ? report.exit : outcome.code;
+            const phase = { mode, code, timedOut: outcome.timedOut === true, report: outcome.code === null ? null : report };
+            phases.get(name).push(phase);
+            called.set(name, phase);
+        }
+        return called;
+    };
+    let toScan = slots;
+    const phase1 = options.scan === "fresh" ? null : await call("only", slots);
+    if (phase1 !== null) {
+        if (options.scan === "only")
+            toScan = [];
+        else {
+            toScan = slots.filter((slot) => {
+                const phase = phase1.get(slot);
+                if (phase.code === null || phase.report === null)
+                    return false;
+                if (scanSourceOf(phase.report) !== "none")
+                    return false;
+                return !(phase.code === 1 && (options.onFailure ?? "stop") === "stop");
+            });
+        }
+    }
+    if (toScan.length > 0) {
+        for (const slot of toScan)
+            notify(slot, { kind: "before", phase1: phase1?.get(slot)?.report ?? null });
+        const phase2 = await call(options.scan === "fresh" ? "fresh" : "use", toScan);
+        for (const [slot, phase] of phase2) {
+            if (phase.timedOut)
+                scanTimedOut.add(slot);
+            notify(slot, { kind: "result", phase });
+        }
+    }
+    for (const slot of slots) {
+        const list = phases.get(slot);
+        const last = list.at(-1);
+        measured.set(slot, { absent: false, code: last ? last.code : null, report: last ? last.report : null, phases: list, timedOut: scanTimedOut.has(slot), folders });
+    }
+    return measured;
+}

package/dist/setup.d.ts

@@ -1,9 +1,11 @@
 import type { Command } from "commander";
-import { type DeviceAuthorizationPrompt, type EnrollmentIntent, type EnrollmentOutcome } from "@consiliency/agent-board-client";
+import { type DeviceAuthorizationPrompt, type EnrollmentIntent, type EnrollmentOutcome, type IdentityHarness, type ListHarnessProcessesOptions, type ParsedInviteInput } from "@consiliency/agent-board-client";
+import type { SetupAllOptions } from "./setup_all.js";
 import { type BakedAssets } from "./assets.js";
 import { type DoctorOptions, type DoctorReport } from "./doctor.js";
-import { type DepsOutcome, type KeyStorageContext, type KeyStorageSelection } from "./setup_storage.js";
-import { type ChildRunner, type WriterContext } from "./setup_writers.js";
+import { type IdentityDeployment } from "./identity_writer.js";
+import { type DepsOutcome, type KeyStorageContext, type KeyStorageSelection, type PreparedKeyStorage } from "./setup_storage.js";
+import { type ChildRunner, type SetupScope, type WriterContext } from "./setup_writers.js";
 export declare const SETUP_STEPS: readonly ["preflight", "deps", "key", "enroll", "identity", "board", "harness", "doctor"];
 export type SetupStepName = (typeof SETUP_STEPS)[number];
 export type SetupStatus = "done" | "already" | "skipped" | "failed" | "undetermined";
@@ -17,11 +19,24 @@ export interface SetupReport {
     exit: 0 | 1 | 2;
     /** Human text: per-step fixes and the next steps. Never part of `--json`'s stdout. */
     notes: string[];
+    /**
+     * IF-0-ONBOARD-3: this harness's processes that started before setup installed or upgraded its
+     * registration, found by executable. Empty when the harness step installed nothing.
+     */
+    staleSessions: StaleSession[];
+}
+export interface StaleSession {
+    pid: number;
+    /** ISO time the process started. */
+    startedAt: string;
+    cwd: string | null;
 }
 export interface SetupOptions {
     harness: string;
     slug?: string;
     invite?: boolean;
+    /** IF-0-ONBOARD-2: a file holding the invite (a bare code, or the whole invite message). */
+    inviteFile?: string;
     allowUnsealedKey?: boolean;
     agentSocket?: string;
     scope?: string;
@@ -61,7 +76,10 @@ export interface SetupDeps {
     sudoPath?: string;
     hostname?: () => string;
     bakedAssets?: () => BakedAssets;
+    /** A whole selector, scan included; its answer is final (the pre-ONBOARD seam). */
     selectKeyStorage?: (ctx: KeyStorageContext) => Promise<KeyStorageSelection>;
+    /** The key step's preparation (no scan); default `prepareKeyStorage`. */
+    prepareKeyStorage?: (ctx: KeyStorageContext) => Promise<PreparedKeyStorage>;
     /** Seams passed through to the storage selector (probeKeychain, run, keyslotDir, …). */
     storage?: Partial<KeyStorageContext>;
     enroll?: SetupEnroller;
@@ -71,6 +89,8 @@ export interface SetupDeps {
     doctorOptions?: Partial<DoctorOptions>;
     /** Seams passed through to the harness writer (fs, claudeManagedDir). */
     writer?: Partial<Pick<WriterContext, "fs" | "claudeManagedDir">>;
+    /** Seams passed through to the stale-session listing (`/proc` or `ps` readers, uid, platform). */
+    processes?: Omit<ListHarnessProcessesOptions, "startedBefore">;
 }
 export declare const DEFAULT_SUDO = "/usr/bin/sudo";
 export declare const SECRET_SERVICE_NAME = "org.freedesktop.secrets";
@@ -90,7 +110,22 @@ export declare const KEYCHAIN_INSTALL_ARGV: ReadonlyArray<{
 }>;
 /** `<short hostname>-<harness>`, lowercased to `[a-z0-9-]`. */
 export declare function defaultSlug(host: string, harness: string): string;
-export declare function pendingMarkerPath(harness: string, env: NodeJS.ProcessEnv): string;
+type IdentityState = {
+    kind: "present";
+    values: Record<string, string>;
+} | {
+    kind: "absent";
+} | {
+    kind: "unreadable";
+    reason: string;
+};
+declare class Run {
+    readonly steps: SetupStep[];
+    readonly notes: string[];
+    readonly staleSessions: StaleSession[];
+    record(step: SetupStep["step"], status: SetupStatus, reason: string, fix?: string): SetupStep;
+    report(): SetupReport;
+}
 interface DepsContext {
     env: NodeJS.ProcessEnv;
     platform: NodeJS.Platform;
@@ -105,6 +140,74 @@ interface DepsContext {
 export declare function depsStep(ctx: DepsContext): Promise<DepsOutcome & {
     fix?: string;
 }>;
+/**
+ * IF-0-ONBOARD-2: the invite, read ONCE and parsed by the shared parser. `--invite-file` and a
+ * piped stdin may hold the whole invite message; a terminal takes one hidden line that must be a
+ * bare code. The code never reaches argv, a log or any message: a refusal names only its reason.
+ */
+export declare function readSetupInvite(input: {
+    invite?: boolean;
+    inviteFile?: string;
+}, deps: Pick<SetupDeps, "interactive" | "prompt" | "readStdin">): Promise<{
+    invite: ParsedInviteInput | null;
+} | {
+    reason: string;
+    fix: string;
+}>;
+/** IF-0-ONBOARD-2 "Board": reported, never checked (setup has no target board). Never the code. */
+export declare function inviteBoardNote(invite: ParsedInviteInput): string;
+/**
+ * A pair past preflight, deps and its key PREPARATION (ONBOARD SL-4): what the rest of setup
+ * needs, plus the prepared storage, which is scanned before `finishSetupPair` may use it.
+ * `prepared` is null when the identity already exists (no key is chosen).
+ */
+export interface SetupPair {
+    readonly harness: IdentityHarness;
+    readonly slug: string;
+    readonly prepared: PreparedKeyStorage | null;
+    /** @internal */
+    readonly state: PairState;
+}
+interface PairState {
+    out: Run;
+    options: SetupOptions;
+    deps: SetupDeps;
+    env: NodeJS.ProcessEnv;
+    cwd: string;
+    scope: SetupScope;
+    assets: BakedAssets;
+    identity: IdentityState;
+    deployment: IdentityDeployment | null;
+    invite: ParsedInviteInput | null;
+    identityPath: string;
+    markerPath: string;
+}
+export type SetupPairStart = {
+    kind: "stopped";
+    report: SetupReport;
+} | {
+    kind: "started";
+    pair: SetupPair;
+};
+/** The storage context the key step's scan reads (env, runner, budgets, notices). */
+export declare function setupStorageContext(deps: SetupDeps): Pick<KeyStorageContext, "env" | "run" | "statusBudgets" | "notify">;
+/**
+ * Preflight, deps and the key PREPARATION for one harness. `preset.invite` is an invite the caller
+ * already read and parsed (`setup --all` reads it once for every pair); without it, the invite is
+ * read here.
+ */
+export declare function startSetupPair(options: SetupOptions, deps?: SetupDeps, preset?: {
+    invite: ParsedInviteInput | null;
+}): Promise<SetupPairStart>;
+/**
+ * The rest of one pair, from its FINAL key storage (`finalizeKeyStorage`'s answer for this pair;
+ * null for a pair whose identity exists): enroll, identity, board, harness, doctor.
+ */
+export declare function finishSetupPair(pair: SetupPair, selection: KeyStorageSelection | null): Promise<SetupReport>;
+/**
+ * One harness: start, the key step's one scan (prepare → measure → finalize, as `setup --all` does
+ * over every pair), then the rest.
+ */
 export declare function runSetup(options: SetupOptions, deps?: SetupDeps): Promise<SetupReport>;
 export type SetupRunner = (options: SetupOptions) => Promise<SetupReport>;
 interface SetupIo {
@@ -112,5 +215,9 @@ interface SetupIo {
     writeStderr(message: string): void;
 }
 export declare function formatSetupReport(report: SetupReport): string;
-export declare function addSetupCommand(program: Command, io: SetupIo, setup: SetupRunner): void;
+/** `setup --all`: runs, prints (the table, or `--json` on stdout with notes on stderr), returns the exit. */
+export type SetupAllCommand = (options: SetupAllOptions, output: {
+    json: boolean;
+}) => Promise<0 | 1 | 2>;
+export declare function addSetupCommand(program: Command, io: SetupIo, setup: SetupRunner, setupAll?: SetupAllCommand): void;
 export {};