@huynle/hub 0.6.1 → 0.7.1

package/src/rpc.ts

@@ -15,11 +15,13 @@ const empty = obj({})
 const errorData = { type: "object" } as const
 
 /**
- * not_connected: no live connection · invalid: bad input · unreachable: server could not be reached ·
- * unavailable: spoke not running in this process · server_error: the hub refused the request.
+ * not_connected: no live connection (or the session has no hub token yet) · invalid: bad input ·
+ * unreachable: server could not be reached · unavailable: spoke not running in this process ·
+ * server_error: the hub refused the request · unsupported: the hub lacks the feature (messaging).
  */
 const errors = {
   not_connected: errorData,
+  unsupported: errorData,
   invalid: errorData,
   unreachable: errorData,
   unavailable: errorData,
@@ -90,6 +92,29 @@ const methods = {
   },
   /** Conversation mode for a session in this process (same path as the server's "conversation" op). */
   conversation: { input: obj({ sessionID: str, on: bool }, ["sessionID", "on"]), output: obj({ agent: str }, ["agent"]), errors },
+  /**
+   * /who: the hub's named and role-holding sessions (optionally one project or one role), asked as the TUI's
+   * current session (its own hub token). Labels are sanitised.
+   */
+  hubWho: {
+    input: obj({ sessionID: str, project: str, role: str }, ["sessionID"]),
+    output: obj(
+      {
+        sessions: {
+          type: "array",
+          items: obj({ sessionID: str, name: str, project: str, state: str, online: bool, roles: { type: "array", items: str } }, ["sessionID", "online", "roles"]),
+        },
+      },
+      ["sessions"],
+    ),
+    errors,
+  },
+  /** /msg: sends `text` word for word to `to` as the TUI's current session (its own hub token). */
+  hubMsg: {
+    input: obj({ sessionID: str, to: str, text: str }, ["sessionID", "to", "text"]),
+    output: obj({ id: str, to: str, delivery: str }, ["id", "to"]),
+    errors,
+  },
 } as const
 
 export const HubRpc = Rpc.define({ id: "hub", methods, events: {} })

package/src/spoke/client.ts

@@ -1,272 +1,3 @@
-// The spoke's single outbound WebSocket to the central server: hello/welcome handshake, request/
-// response correlation in both directions, and reconnect with jittered exponential backoff.
-import {
-  encode,
-  MAX_FRAME,
-  parseServerMessage,
-  PROTOCOL_VERSION,
-  type Hello,
-  type ResultFor,
-  type ServerRequest,
-  type SpokeMessage,
-  type SpokeRequest,
-  type Welcome,
-} from "../protocol"
-
-export type ConnectionState = "off" | "connecting" | "connected" | "revoked" | "error"
-
-export interface Backoff {
-  readonly minMs: number
-  readonly maxMs: number
-  readonly random?: () => number
-}
-
-/** Minimal WebSocket surface used here (Bun's WebSocket accepts `{ headers }` as a 2nd argument). */
-export interface SocketLike {
-  readonly readyState: number
-  onopen: ((ev: unknown) => void) | null
-  onmessage: ((ev: { data: unknown }) => void) | null
-  onclose: ((ev: { code?: number; reason?: string }) => void) | null
-  onerror: ((ev: unknown) => void) | null
-  send(data: string): void
-  close(code?: number, reason?: string): void
-}
-
-export interface ConnectionOptions {
-  readonly server: string
-  readonly token: string
-  /** Hello fields, computed per attempt so mode/directory are current. */
-  readonly hello: () => Omit<Hello, "t" | "v">
-  /** Executes a server request; a thrown error becomes `{ ok: false, error }`. */
-  readonly handle: (req: ServerRequest) => Promise<unknown>
-  readonly onWelcome?: (welcome: Welcome) => void
-  readonly onState?: (state: ConnectionState, error?: string) => void
-  readonly backoff?: Backoff
-  readonly requestTimeoutMs?: number
-  readonly socket?: (url: string, headers: Record<string, string>) => SocketLike
-}
-
-export function backoffDelay(attempt: number, backoff: Backoff): number {
-  const base = Math.min(backoff.maxMs, backoff.minMs * 2 ** Math.min(attempt, 30))
-  const random = (backoff.random ?? Math.random)()
-  return Math.round(base * (0.5 + 0.5 * random))
-}
-
-export function wsURL(server: string): string {
-  return `${server.replace(/\/+$/, "").replace(/^http/, "ws")}/spoke/ws`
-}
-
-const defaultSocket = (url: string, headers: Record<string, string>): SocketLike =>
-  new (WebSocket as unknown as new (url: string, options: { headers: Record<string, string> }) => SocketLike)(url, { headers })
-
-const message = (cause: unknown) => (cause instanceof Error ? cause.message : String(cause))
-
-interface Pending {
-  resolve: (value: unknown) => void
-  reject: (error: Error) => void
-  timer: ReturnType<typeof setTimeout>
-}
-
-export class SpokeConnection {
-  state: ConnectionState = "off"
-  lastError?: string
-  publicURL?: string
-  machineID?: string
-
-  private socket?: SocketLike
-  private welcomed = false
-  private stopped = true
-  private attempt = 0
-  private retry?: ReturnType<typeof setTimeout>
-  private nextID = 0
-  private readonly pending = new Map<string, Pending>()
-  private readonly backoff: Backoff
-
-  constructor(private readonly options: ConnectionOptions) {
-    this.backoff = options.backoff ?? { minMs: 1000, maxMs: 60_000 }
-  }
-
-  start(): void {
-    if (!this.stopped) return
-    this.stopped = false
-    this.open()
-  }
-
-  stop(): void {
-    this.stopped = true
-    clearTimeout(this.retry)
-    this.drop(1000, "stop")
-    this.failPending("disconnected")
-    this.setState("off")
-  }
-
-  /** Reconnects at once (e.g. after a local hub was started) instead of waiting out the backoff. */
-  retryNow(): void {
-    if (this.stopped || this.state === "connected" || this.state === "revoked" || this.socket) return
-    clearTimeout(this.retry)
-    this.attempt = 0
-    this.open()
-  }
-
-  /** Sends a frame once the server has welcomed us. Returns false when it could not be sent. */
-  send(frame: SpokeMessage): boolean {
-    if (!this.socket || !this.welcomed || this.socket.readyState !== 1) return false
-    try {
-      let text = encode(frame)
-      if (text.length > MAX_FRAME) {
-        // The hub drops the connection on an oversize frame; answer a request with an error instead.
-        if (frame.t !== "res") return false
-        text = encode({ t: "res", id: frame.id, ok: false, error: `Result too large to send (${text.length} characters, limit ${MAX_FRAME})` })
-      }
-      this.socket.send(text)
-      return true
-    } catch {
-      return false
-    }
-  }
-
-  request<R extends SpokeRequest>(req: R): Promise<ResultFor[R["op"]]> {
-    const id = `s${++this.nextID}`
-    return new Promise((resolve, reject) => {
-      if (this.state !== "connected") return reject(new Error("Not connected to the hub"))
-      const timer = setTimeout(() => {
-        this.pending.delete(id)
-        reject(new Error("The hub timed out"))
-      }, this.options.requestTimeoutMs ?? 15_000)
-      this.pending.set(id, { resolve: resolve as (v: unknown) => void, reject, timer })
-      if (!this.send({ t: "req", id, req })) {
-        clearTimeout(timer)
-        this.pending.delete(id)
-        reject(new Error("Not connected to the hub"))
-      }
-    })
-  }
-
-  private open(): void {
-    if (this.stopped) return
-    this.setState(this.state === "error" ? "error" : "connecting")
-    let socket: SocketLike
-    try {
-      socket = (this.options.socket ?? defaultSocket)(wsURL(this.options.server), {
-        Authorization: `Bearer ${this.options.token}`,
-      })
-    } catch (cause) {
-      this.fail(message(cause))
-      return
-    }
-    this.socket = socket
-    this.welcomed = false
-    socket.onopen = () => {
-      try {
-        socket.send(encode({ t: "hello", v: PROTOCOL_VERSION, ...this.options.hello() }))
-      } catch (cause) {
-        this.lastError = message(cause)
-      }
-    }
-    socket.onmessage = (ev) => this.receive(ev.data)
-    socket.onerror = () => {
-      this.lastError = this.welcomed ? "Connection error" : "Could not connect to the hub"
-    }
-    socket.onclose = (ev) => {
-      if (this.socket !== socket) return
-      this.socket = undefined
-      const wasWelcomed = this.welcomed
-      this.welcomed = false
-      this.failPending("disconnected")
-      if (this.stopped || this.state === "revoked") return
-      this.fail(wasWelcomed ? `Connection closed${ev.reason ? `: ${ev.reason}` : ""}` : (this.lastError ?? "Could not connect"))
-    }
-  }
-
-  private receive(data: unknown): void {
-    const text = typeof data === "string" ? data : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf8") : String(data)
-    const frame = parseServerMessage(text)
-    if (!frame) return
-    switch (frame.t) {
-      case "welcome":
-        this.welcomed = true
-        this.attempt = 0
-        this.publicURL = frame.publicURL
-        this.machineID = frame.machineID
-        this.lastError = undefined
-        this.setState("connected")
-        try {
-          this.options.onWelcome?.(frame)
-        } catch (cause) {
-          console.error("[hub] welcome handler failed", cause)
-        }
-        return
-      case "bye":
-        if (frame.reason === "revoked") {
-          this.stopped = true
-          clearTimeout(this.retry)
-          this.lastError = "This machine was revoked on the hub"
-          this.setState("revoked")
-          this.drop(1000, "revoked")
-          this.failPending("revoked")
-        }
-        return
-      case "res": {
-        const pending = this.pending.get(frame.id)
-        if (!pending) return
-        this.pending.delete(frame.id)
-        clearTimeout(pending.timer)
-        if (frame.ok) pending.resolve(frame.result)
-        else pending.reject(new Error(frame.error ?? "Request failed"))
-        return
-      }
-      case "req":
-        void this.answer(frame.id, frame.req)
-        return
-    }
-  }
-
-  private async answer(id: string, req: ServerRequest): Promise<void> {
-    let reply: SpokeMessage
-    try {
-      reply = { t: "res", id, ok: true, result: await this.options.handle(req) }
-    } catch (cause) {
-      reply = { t: "res", id, ok: false, error: message(cause) }
-    }
-    this.send(reply)
-  }
-
-  private fail(error: string): void {
-    this.lastError = error
-    this.setState("error")
-    if (this.stopped) return
-    clearTimeout(this.retry)
-    this.retry = setTimeout(() => this.open(), backoffDelay(this.attempt++, this.backoff))
-  }
-
-  private drop(code: number, reason: string): void {
-    const socket = this.socket
-    this.socket = undefined
-    this.welcomed = false
-    if (!socket) return
-    socket.onopen = socket.onmessage = socket.onerror = socket.onclose = null
-    try {
-      socket.close(code, reason)
-    } catch {
-      // already closed
-    }
-  }
-
-  private failPending(reason: string): void {
-    for (const [id, pending] of this.pending) {
-      clearTimeout(pending.timer)
-      pending.reject(new Error(`Hub ${reason}`))
-      this.pending.delete(id)
-    }
-  }
-
-  private setState(state: ConnectionState): void {
-    if (state === this.state) return
-    this.state = state
-    try {
-      this.options.onState?.(state, this.lastError)
-    } catch {
-      // observers must not break the connection
-    }
-  }
-}
+// The spoke's connection to the central server lives in the spoke SDK (packages/spoke-sdk); re-exported by relative
+// path so the published package and compiled binaries need no workspace link.
+export * from "../../packages/spoke-sdk/src/connection.ts"

package/src/spoke/conversation.ts

@@ -5,12 +5,8 @@
 
 export const VOICE_AGENT = "voice"
 
-/** metadata.source of the prompts the hub sends. opencode-hub (0.5) wrote "opencode-hub", opencode-voice (<= 0.4) "opencode-voice". */
-export const PROMPT_SOURCE = "hub"
-const PROMPT_SOURCES: readonly unknown[] = [PROMPT_SOURCE, "opencode-hub", "opencode-voice"]
-/** True for prompt metadata written by the hub, under either name. */
-export const isHubPrompt = (metadata: unknown): boolean =>
-  typeof metadata === "object" && metadata !== null && PROMPT_SOURCES.includes((metadata as { source?: unknown }).source)
+// PROMPT_SOURCE and isHubPrompt live in the spoke SDK (a harness-neutral marker for the hub's prompts).
+export { PROMPT_SOURCE, isHubPrompt } from "../../packages/spoke-sdk/src/prompt-source.ts"
 
 export const VOICE_AGENT_DESCRIPTION =
   "Voice front-end: short spoken replies; delegates real work to background subagents. Used by Hub conversation mode."
@@ -34,11 +30,19 @@ How to work:
 - Delegate multi-step work. A routine worker handles deterministic MCP work, short research and routine checks on your fast model. A complex worker handles coding, debugging, architecture, risky operations or work requiring substantial judgment on the full work model named below.
 - Call the subagent tool with the delegate agent named in the note below (use "general" if none is named), background: true, and a complete, self-contained prompt with the goal, relevant context, constraints, and what to report back. Require that the worker's final assistant message must contain only one or two plain-spoken sentences that can be read directly to the user. Put technical detail in tool output or progress before that final message.
 - Never run a subagent in the foreground (always pass background: true): a foreground subagent blocks the conversation and the user cannot talk to you until it ends.
-- New user messages can arrive while work is running; treat them as steering. For a correction, status request or related follow-up on the same active task, continue its subagent with the existing sessionID. Start a fresh worker after that task completes or for an unrelated task.
-- When the user asks how it's going, give a one-sentence progress update from what you know.
-- Successful worker results are spoken directly. Do not repeat a completed worker's result. Speak again only if the worker failed, the user must decide something, or a warning or next step genuinely needs explanation.
+- Give every worker a short description of two to four words, like "Deploy check" or "Changelog update": it is the task's name on your task board and in spoken announcements.
+- Parallel work: start one worker per independent task. When the user asks for several separate things, launch all their workers at once with several subagent tool calls in the same reply, each with background: true and its own self-contained prompt. Don't bundle unrelated tasks into one worker and don't wait for one to finish before starting the next. Example: "Check if the deploy went through and also update the changelog" → say "On it, two workers: one checks the deploy, one updates the changelog." and make two subagent calls in that reply.
+- New user messages can arrive while work is running; treat them as steering. For a correction, status request or related follow-up on the same active task, continue its subagent with the existing sessionID instead of starting another one. Example: while "Deploy check" runs, the user says "check staging too" → continue that worker: call the subagent tool with its sessionID and the new instruction. Start a fresh worker after that task completes or for an unrelated task.
+- When the user asks how it's going or what's running, answer in a sentence from the task board below (your workers, their state, last activity and results); it is live, so don't call a tool to check.
+- Successful worker results are spoken directly, and the hub also announces when a worker fails, needs a permission or asks a question (with the task's name when several run). Do not repeat a completed worker's result or those announcements. Speak again only if the user must decide something, or a warning or next step genuinely needs explanation.
+- To stop one task ("cancel the deploy one", "stop the changelog worker"), call hub_task_stop with that worker's sessionID from the task board; the other workers keep going. For "stop all the workers" or "pause everything", call it with all: true. It never stops you, and you can confirm in a few words. The stopped worker's cancellation notice arrives as a message afterwards: don't reply to it, you already confirmed.
 - If the user says stop, cancel or never mind, stop: start no new work and confirm briefly.`
 
+/** The tool the plugin adds for stopping one background worker (or all of them) by voice. */
+export const STOP_TOOL = "hub_task_stop"
+export const STOP_TOOL_DESCRIPTION =
+  "Stop a background worker (subagent session) you started, e.g. when the user says \"cancel the deploy one\" or \"stop that task\". Pass its sessionID from your task board, or all: true to stop all your running workers. It never stops you or sessions you did not start."
+
 export function delegateNote(subagent: string): string {
   return `Delegate agent on this machine: when you call the subagent tool, use agent "${subagent}" and always set background: true. Require its final assistant message to contain only one or two plain-spoken sentences for direct speech.`
 }
@@ -51,9 +55,9 @@ export function workModelNote(workModel: string): string {
   return `For a routine worker, omit model so it inherits your fast model. For a complex worker, set model: "${workModel}". Complex means coding, debugging, architecture, risky operations or work requiring substantial judgment.`
 }
 
-/** System parts the context hook adds: the delegate note for the voice agent, the whole prompt when conversation mode runs on another agent. */
-export function orchestratorParts(input: { agent: string; conversation: boolean; subagent: string; workModel?: string }): string[] {
-  const notes = [delegateNote(input.subagent), ...(input.workModel ? [workModelNote(input.workModel)] : [])]
+/** System parts the context hook adds: the delegate note (and the task board) for the voice agent, the whole prompt first when conversation mode runs on another agent. */
+export function orchestratorParts(input: { agent: string; conversation: boolean; subagent: string; workModel?: string; taskBoard?: string }): string[] {
+  const notes = [delegateNote(input.subagent), ...(input.workModel ? [workModelNote(input.workModel)] : []), ...(input.taskBoard ? [input.taskBoard] : [])]
   if (input.agent === VOICE_AGENT) return notes
   if (input.conversation) return [ORCHESTRATOR_PROMPT, ...notes]
   return []

package/src/spoke/deliver.ts

@@ -0,0 +1,75 @@
+// Hub message delivery (the deliver op): how a message is admitted into an OpenCode session, the id OpenCode
+// gets for it, the metadata it carries, who put each inbox item there, and applying each message once.
+//
+// Messages go in through OpenCode's native session.synthetic with a client id (decision 52aqsopo): OpenCode
+// keeps them in the session's inbox (busy sessions, open forms, interrupts) and deduplicates the id, even across
+// restarts. The model sees only the text (the hub-rendered envelope), never the metadata. An agent's prompt (kind
+// "prompt") gets its provenance envelope here, from the hub's meta, and is the hub's in the inbox (never a human turn).
+import { createHash } from "node:crypto"
+import type { DeliverMeta, Delivered, DeliveryMode } from "../protocol"
+import { PROMPT_SOURCE } from "./conversation"
+
+export interface DeliveryPlan {
+  /** How OpenCode admits it into a busy session: after the running turn (queue) or into it (steer). */
+  readonly delivery: DeliveryMode
+  /** Whether OpenCode starts a turn for it when the session is idle. */
+  readonly resume: boolean
+  /** What the spoke reports to the hub. */
+  readonly delivered: Delivered
+}
+
+export interface RecipientState {
+  /** A turn runs (or OpenCode reports the session busy). */
+  readonly busy: boolean
+  /** A form (question) is open in the session. */
+  readonly formOpen: boolean
+  /** The session is a subagent's (it has a parent). */
+  readonly subagent: boolean
+}
+
+/**
+ * How to admit a message. Busy recipients get plain messages after the running turn and asks into it, unless
+ * the hub chose (`meta.delivery`, e.g. urgent: steer). Idle recipients get a turn, always steered: a queued wake
+ * would come after the reply to items already waiting (a primer, wake:false messages) with a model call of its own
+ * (quirk hzmcqwpj), a steered one joins them in one call. With a form open OpenCode holds the message until the
+ * form is answered ("retained").
+ *
+ * `wake:false` and subagent sessions are admitted without starting a turn ("queued"). They default to steer: a
+ * queued item gets its own model call when a turn ends (that would wake the session), while a steered one
+ * without resume waits for the next turn and arrives before its prompt (or joins a turn already running).
+ */
+export function planDelivery(req: { readonly wake: boolean; readonly meta: DeliverMeta }, state: RecipientState): DeliveryPlan {
+  const resume = req.wake && !state.subagent
+  const chosen = req.meta.delivery ?? (!resume || req.meta.kind === "ask" ? "steer" : "queue")
+  // Idle: no running turn to queue behind; steered, the wake shares its model call with what already waits.
+  const delivery = resume && !state.busy && !state.formOpen ? "steer" : chosen
+  return { delivery, resume, delivered: deliveredAs(delivery, resume, state) }
+}
+
+function deliveredAs(delivery: DeliveryMode, resume: boolean, state: RecipientState): Delivered {
+  if (!resume) return "queued"
+  if (state.formOpen) return "retained"
+  if (state.busy) return delivery === "steer" ? "steer" : "queued"
+  return "turn"
+}
+
+/** OpenCode message ids: "msg_" and id characters. */
+const OPENCODE_ID = /^msg_[A-Za-z0-9]{1,200}$/
+
+/**
+ * The id OpenCode gets for a hub message: the hub's own `msg_…` id, else a stable `msg_hub…` id derived from it,
+ * so every retry of the same message reuses one id (OpenCode applies it once).
+ */
+export function harnessMessageID(messageID: string): string {
+  if (OPENCODE_ID.test(messageID)) return messageID
+  return `msg_hub${createHash("sha256").update(messageID).digest("hex").slice(0, 40)}`
+}
+
+/** metadata stored with a delivered message (for timelines; the model does not see it). */
+export function deliverMetadata(req: { readonly messageID: string; readonly meta: DeliverMeta }): Record<string, unknown> {
+  const { kind, from, to, replyTo, grant } = req.meta
+  return { source: PROMPT_SOURCE, messageID: req.messageID, kind, from, to, ...(replyTo !== undefined ? { replyTo } : {}), ...(grant !== undefined ? { grant } : {}) }
+}
+
+// The prompt envelope, InboxOrigins and DeliveryLedger live in the spoke SDK (harness-neutral).
+export { deliverText, DeliveryLedger, InboxOrigins, renderPromptEnvelope, type Admission } from "../../packages/spoke-sdk/src/delivery.ts"

package/src/spoke/enroll.ts

@@ -1,79 +1,2 @@
-// Device-code enrollment of this machine with the central server (before it has a token).
-// POST /spoke/enroll → EnrollStart; then POST /spoke/enroll/poll until the user approves it.
-import type { EnrollPoll, EnrollStart } from "../protocol"
-
-export type EnrollOutcome =
-  | { readonly status: "approved"; readonly machineID: string; readonly machineToken: string }
-  | { readonly status: "denied" | "expired" | "cancelled" }
-
-export interface EnrollOptions {
-  readonly signal?: AbortSignal
-  readonly fetch?: typeof fetch
-  readonly now?: () => number
-}
-
-const REQUEST_TIMEOUT_MS = 15_000
-
-async function post(server: string, path: string, body: unknown, options: EnrollOptions): Promise<unknown> {
-  const doFetch = options.fetch ?? fetch
-  const signals = [AbortSignal.timeout(REQUEST_TIMEOUT_MS), ...(options.signal ? [options.signal] : [])]
-  const response = await doFetch(`${server.replace(/\/+$/, "")}${path}`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(body),
-    signal: AbortSignal.any(signals),
-  })
-  if (!response.ok) throw new Error(`${path} failed: HTTP ${response.status}`)
-  return response.json()
-}
-
-function isStart(v: any): v is EnrollStart {
-  return (
-    typeof v === "object" &&
-    v !== null &&
-    typeof v.userCode === "string" &&
-    typeof v.deviceCode === "string" &&
-    typeof v.approveURL === "string" &&
-    typeof v.intervalMs === "number" &&
-    typeof v.expiresAt === "number"
-  )
-}
-
-export async function startEnrollment(server: string, machineName: string, options: EnrollOptions = {}): Promise<EnrollStart> {
-  const body = await post(server, "/spoke/enroll", { machineName }, options)
-  if (!isStart(body)) throw new Error("Invalid enrollment reply from the hub")
-  return body
-}
-
-const sleep = (ms: number, signal?: AbortSignal) =>
-  new Promise<void>((resolve) => {
-    const timer = setTimeout(done, ms)
-    function done() {
-      clearTimeout(timer)
-      signal?.removeEventListener("abort", done)
-      resolve()
-    }
-    signal?.addEventListener("abort", done, { once: true })
-  })
-
-/** Polls until approved, denied, expired, or aborted. Transient errors are retried until expiry. */
-export async function pollEnrollment(server: string, start: EnrollStart, options: EnrollOptions = {}): Promise<EnrollOutcome> {
-  const now = options.now ?? Date.now
-  const interval = Math.max(1, start.intervalMs)
-  for (;;) {
-    if (options.signal?.aborted) return { status: "cancelled" }
-    if (now() > start.expiresAt) return { status: "expired" }
-    await sleep(interval, options.signal)
-    if (options.signal?.aborted) return { status: "cancelled" }
-    let reply: Partial<EnrollPoll> & Record<string, unknown>
-    try {
-      reply = (await post(server, "/spoke/enroll/poll", { deviceCode: start.deviceCode }, options)) as typeof reply
-    } catch {
-      continue
-    }
-    if (reply?.status === "approved" && typeof reply.machineID === "string" && typeof reply.machineToken === "string") {
-      return { status: "approved", machineID: reply.machineID, machineToken: reply.machineToken }
-    }
-    if (reply?.status === "denied" || reply?.status === "expired") return { status: reply.status }
-  }
-}
+// Device-code enrollment lives in the spoke SDK (packages/spoke-sdk); re-exported by relative path.
+export * from "../../packages/spoke-sdk/src/enroll.ts"