@intent-systems/nexus 2026.1.5-3

package/dist/cli/cron-cli.js

@@ -0,0 +1,454 @@
+import { danger } from "../globals.js";
+import { defaultRuntime } from "../runtime.js";
+import { addGatewayClientOptions, callGatewayFromCli } from "./gateway-rpc.js";
+async function warnIfCronSchedulerDisabled(opts) {
+    try {
+        const res = (await callGatewayFromCli("cron.status", opts, {}));
+        if (res?.enabled === true)
+            return;
+        const store = typeof res?.storePath === "string" ? res.storePath : "";
+        defaultRuntime.error([
+            "warning: cron scheduler is disabled in the Gateway; jobs are saved but will not run automatically.",
+            "Re-enable with `cron.enabled: true` (or remove `cron.enabled: false`) and restart the Gateway.",
+            store ? `store: ${store}` : "",
+        ]
+            .filter(Boolean)
+            .join("\n"));
+    }
+    catch {
+        // Ignore status failures (older gateway, offline, etc.)
+    }
+}
+function parseDurationMs(input) {
+    const raw = input.trim();
+    if (!raw)
+        return null;
+    const match = raw.match(/^(\d+(?:\.\d+)?)(ms|s|m|h|d)$/i);
+    if (!match)
+        return null;
+    const n = Number.parseFloat(match[1] ?? "");
+    if (!Number.isFinite(n) || n <= 0)
+        return null;
+    const unit = (match[2] ?? "").toLowerCase();
+    const factor = unit === "ms"
+        ? 1
+        : unit === "s"
+            ? 1000
+            : unit === "m"
+                ? 60_000
+                : unit === "h"
+                    ? 3_600_000
+                    : 86_400_000;
+    return Math.floor(n * factor);
+}
+function parseAtMs(input) {
+    const raw = input.trim();
+    if (!raw)
+        return null;
+    const asNum = Number(raw);
+    if (Number.isFinite(asNum) && asNum > 0)
+        return Math.floor(asNum);
+    const parsed = Date.parse(raw);
+    if (Number.isFinite(parsed))
+        return parsed;
+    const dur = parseDurationMs(raw);
+    if (dur)
+        return Date.now() + dur;
+    return null;
+}
+export function registerCronCli(program) {
+    addGatewayClientOptions(program
+        .command("wake")
+        .description("Enqueue a system event and optionally trigger an immediate heartbeat")
+        .requiredOption("--text <text>", "System event text")
+        .option("--mode <mode>", "Wake mode (now|next-heartbeat)", "next-heartbeat")
+        .option("--json", "Output JSON", false)).action(async (opts) => {
+        try {
+            const result = await callGatewayFromCli("wake", opts, { mode: opts.mode, text: opts.text }, { expectFinal: false });
+            if (opts.json)
+                defaultRuntime.log(JSON.stringify(result, null, 2));
+            else
+                defaultRuntime.log("ok");
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    });
+    const cron = program
+        .command("cron")
+        .description("Manage cron jobs (via Gateway)");
+    addGatewayClientOptions(cron
+        .command("status")
+        .description("Show cron scheduler status")
+        .option("--json", "Output JSON", false)
+        .action(async (opts) => {
+        try {
+            const res = await callGatewayFromCli("cron.status", opts, {});
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("list")
+        .description("List cron jobs")
+        .option("--all", "Include disabled jobs", false)
+        .option("--json", "Output JSON", false)
+        .action(async (opts) => {
+        try {
+            const res = await callGatewayFromCli("cron.list", opts, {
+                includeDisabled: Boolean(opts.all),
+            });
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("add")
+        .description("Add a cron job")
+        .requiredOption("--name <name>", "Job name")
+        .option("--description <text>", "Optional description")
+        .option("--disabled", "Create job disabled", false)
+        .option("--session <target>", "Session target (main|isolated)", "main")
+        .option("--wake <mode>", "Wake mode (now|next-heartbeat)", "next-heartbeat")
+        .option("--at <when>", "Run once at time (ISO) or +duration (e.g. 20m)")
+        .option("--every <duration>", "Run every duration (e.g. 10m, 1h)")
+        .option("--cron <expr>", "Cron expression (5-field)")
+        .option("--tz <iana>", "Timezone for cron expressions (IANA)", "")
+        .option("--system-event <text>", "System event payload (main session)")
+        .option("--message <text>", "Agent message payload")
+        .option("--thinking <level>", "Thinking level for agent jobs (off|minimal|low|medium|high)")
+        .option("--timeout-seconds <n>", "Timeout seconds for agent jobs")
+        .option("--deliver", "Deliver agent output", false)
+        .option("--provider <provider>", "Delivery provider (last|whatsapp|telegram|discord|slack|signal|imessage)", "last")
+        .option("--to <dest>", "Delivery destination (E.164, Telegram chatId, or Discord channel/user)")
+        .option("--best-effort-deliver", "Do not fail the job if delivery fails", false)
+        .option("--post-prefix <prefix>", "Prefix for summary system event", "Cron")
+        .option("--json", "Output JSON", false)
+        .action(async (opts) => {
+        try {
+            const schedule = (() => {
+                const at = typeof opts.at === "string" ? opts.at : "";
+                const every = typeof opts.every === "string" ? opts.every : "";
+                const cronExpr = typeof opts.cron === "string" ? opts.cron : "";
+                const chosen = [
+                    Boolean(at),
+                    Boolean(every),
+                    Boolean(cronExpr),
+                ].filter(Boolean).length;
+                if (chosen !== 1) {
+                    throw new Error("Choose exactly one schedule: --at, --every, or --cron");
+                }
+                if (at) {
+                    const atMs = parseAtMs(at);
+                    if (!atMs)
+                        throw new Error("Invalid --at; use ISO time or duration like 20m");
+                    return { kind: "at", atMs };
+                }
+                if (every) {
+                    const everyMs = parseDurationMs(every);
+                    if (!everyMs)
+                        throw new Error("Invalid --every; use e.g. 10m, 1h, 1d");
+                    return { kind: "every", everyMs };
+                }
+                return {
+                    kind: "cron",
+                    expr: cronExpr,
+                    tz: typeof opts.tz === "string" && opts.tz.trim()
+                        ? opts.tz.trim()
+                        : undefined,
+                };
+            })();
+            const sessionTarget = String(opts.session ?? "main");
+            if (sessionTarget !== "main" && sessionTarget !== "isolated") {
+                throw new Error("--session must be main or isolated");
+            }
+            const wakeMode = String(opts.wake ?? "next-heartbeat");
+            if (wakeMode !== "now" && wakeMode !== "next-heartbeat") {
+                throw new Error("--wake must be now or next-heartbeat");
+            }
+            const payload = (() => {
+                const systemEvent = typeof opts.systemEvent === "string"
+                    ? opts.systemEvent.trim()
+                    : "";
+                const message = typeof opts.message === "string" ? opts.message.trim() : "";
+                const chosen = [Boolean(systemEvent), Boolean(message)].filter(Boolean).length;
+                if (chosen !== 1) {
+                    throw new Error("Choose exactly one payload: --system-event or --message");
+                }
+                if (systemEvent)
+                    return { kind: "systemEvent", text: systemEvent };
+                const timeoutSeconds = opts.timeoutSeconds
+                    ? Number.parseInt(String(opts.timeoutSeconds), 10)
+                    : undefined;
+                return {
+                    kind: "agentTurn",
+                    message,
+                    thinking: typeof opts.thinking === "string" && opts.thinking.trim()
+                        ? opts.thinking.trim()
+                        : undefined,
+                    timeoutSeconds: timeoutSeconds && Number.isFinite(timeoutSeconds)
+                        ? timeoutSeconds
+                        : undefined,
+                    deliver: Boolean(opts.deliver),
+                    provider: typeof opts.provider === "string" ? opts.provider : "last",
+                    to: typeof opts.to === "string" && opts.to.trim()
+                        ? opts.to.trim()
+                        : undefined,
+                    bestEffortDeliver: Boolean(opts.bestEffortDeliver),
+                };
+            })();
+            if (sessionTarget === "main" && payload.kind !== "systemEvent") {
+                throw new Error("Main jobs require --system-event (systemEvent).");
+            }
+            if (sessionTarget === "isolated" && payload.kind !== "agentTurn") {
+                throw new Error("Isolated jobs require --message (agentTurn).");
+            }
+            const isolation = sessionTarget === "isolated"
+                ? {
+                    postToMainPrefix: typeof opts.postPrefix === "string" &&
+                        opts.postPrefix.trim()
+                        ? opts.postPrefix.trim()
+                        : "Cron",
+                }
+                : undefined;
+            const name = String(opts.name ?? "").trim();
+            if (!name)
+                throw new Error("--name is required");
+            const description = typeof opts.description === "string" && opts.description.trim()
+                ? opts.description.trim()
+                : undefined;
+            const params = {
+                name,
+                description,
+                enabled: !opts.disabled,
+                schedule,
+                sessionTarget,
+                wakeMode,
+                payload,
+                isolation,
+            };
+            const res = await callGatewayFromCli("cron.add", opts, params);
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+            await warnIfCronSchedulerDisabled(opts);
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("rm")
+        .description("Remove a cron job")
+        .argument("<id>", "Job id")
+        .option("--json", "Output JSON", false)
+        .action(async (id, opts) => {
+        try {
+            const res = await callGatewayFromCli("cron.remove", opts, { id });
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("enable")
+        .description("Enable a cron job")
+        .argument("<id>", "Job id")
+        .action(async (id, opts) => {
+        try {
+            const res = await callGatewayFromCli("cron.update", opts, {
+                id,
+                patch: { enabled: true },
+            });
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+            await warnIfCronSchedulerDisabled(opts);
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("disable")
+        .description("Disable a cron job")
+        .argument("<id>", "Job id")
+        .action(async (id, opts) => {
+        try {
+            const res = await callGatewayFromCli("cron.update", opts, {
+                id,
+                patch: { enabled: false },
+            });
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+            await warnIfCronSchedulerDisabled(opts);
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("runs")
+        .description("Show cron run history (JSONL-backed)")
+        .requiredOption("--id <id>", "Job id")
+        .option("--limit <n>", "Max entries (default 50)", "50")
+        .action(async (opts) => {
+        try {
+            const limitRaw = Number.parseInt(String(opts.limit ?? "50"), 10);
+            const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? limitRaw : 50;
+            const id = String(opts.id);
+            const res = await callGatewayFromCli("cron.runs", opts, {
+                id,
+                limit,
+            });
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("edit")
+        .description("Edit a cron job (patch fields)")
+        .argument("<id>", "Job id")
+        .option("--name <name>", "Set name")
+        .option("--description <text>", "Set description")
+        .option("--enable", "Enable job", false)
+        .option("--disable", "Disable job", false)
+        .option("--session <target>", "Session target (main|isolated)")
+        .option("--wake <mode>", "Wake mode (now|next-heartbeat)")
+        .option("--at <when>", "Set one-shot time (ISO) or duration like 20m")
+        .option("--every <duration>", "Set interval duration like 10m")
+        .option("--cron <expr>", "Set cron expression")
+        .option("--tz <iana>", "Timezone for cron expressions (IANA)")
+        .option("--system-event <text>", "Set systemEvent payload")
+        .option("--message <text>", "Set agentTurn payload message")
+        .option("--thinking <level>", "Thinking level for agent jobs")
+        .option("--timeout-seconds <n>", "Timeout seconds for agent jobs")
+        .option("--deliver", "Deliver agent output", false)
+        .option("--provider <provider>", "Delivery provider (last|whatsapp|telegram|discord|slack|signal|imessage)")
+        .option("--to <dest>", "Delivery destination (E.164, Telegram chatId, or Discord channel/user)")
+        .option("--best-effort-deliver", "Do not fail job if delivery fails", false)
+        .option("--post-prefix <prefix>", "Prefix for summary system event")
+        .action(async (id, opts) => {
+        try {
+            if (opts.session === "main" && opts.message) {
+                throw new Error("Main jobs cannot use --message; use --system-event or --session isolated.");
+            }
+            if (opts.session === "isolated" && opts.systemEvent) {
+                throw new Error("Isolated jobs cannot use --system-event; use --message or --session main.");
+            }
+            if (opts.session === "main" && typeof opts.postPrefix === "string") {
+                throw new Error("--post-prefix only applies to isolated jobs.");
+            }
+            const patch = {};
+            if (typeof opts.name === "string")
+                patch.name = opts.name;
+            if (typeof opts.description === "string")
+                patch.description = opts.description;
+            if (opts.enable && opts.disable)
+                throw new Error("Choose --enable or --disable, not both");
+            if (opts.enable)
+                patch.enabled = true;
+            if (opts.disable)
+                patch.enabled = false;
+            if (typeof opts.session === "string")
+                patch.sessionTarget = opts.session;
+            if (typeof opts.wake === "string")
+                patch.wakeMode = opts.wake;
+            const scheduleChosen = [opts.at, opts.every, opts.cron].filter(Boolean).length;
+            if (scheduleChosen > 1)
+                throw new Error("Choose at most one schedule change");
+            if (opts.at) {
+                const atMs = parseAtMs(String(opts.at));
+                if (!atMs)
+                    throw new Error("Invalid --at");
+                patch.schedule = { kind: "at", atMs };
+            }
+            else if (opts.every) {
+                const everyMs = parseDurationMs(String(opts.every));
+                if (!everyMs)
+                    throw new Error("Invalid --every");
+                patch.schedule = { kind: "every", everyMs };
+            }
+            else if (opts.cron) {
+                patch.schedule = {
+                    kind: "cron",
+                    expr: String(opts.cron),
+                    tz: typeof opts.tz === "string" && opts.tz.trim()
+                        ? opts.tz.trim()
+                        : undefined,
+                };
+            }
+            const payloadChosen = [opts.systemEvent, opts.message].filter(Boolean).length;
+            if (payloadChosen > 1)
+                throw new Error("Choose at most one payload change");
+            if (opts.systemEvent) {
+                patch.payload = {
+                    kind: "systemEvent",
+                    text: String(opts.systemEvent),
+                };
+            }
+            else if (opts.message) {
+                const timeoutSeconds = opts.timeoutSeconds
+                    ? Number.parseInt(String(opts.timeoutSeconds), 10)
+                    : undefined;
+                patch.payload = {
+                    kind: "agentTurn",
+                    message: String(opts.message),
+                    thinking: typeof opts.thinking === "string" ? opts.thinking : undefined,
+                    timeoutSeconds: timeoutSeconds && Number.isFinite(timeoutSeconds)
+                        ? timeoutSeconds
+                        : undefined,
+                    deliver: Boolean(opts.deliver),
+                    provider: typeof opts.provider === "string" ? opts.provider : undefined,
+                    to: typeof opts.to === "string" ? opts.to : undefined,
+                    bestEffortDeliver: Boolean(opts.bestEffortDeliver),
+                };
+            }
+            if (typeof opts.postPrefix === "string") {
+                patch.isolation = {
+                    postToMainPrefix: opts.postPrefix.trim()
+                        ? opts.postPrefix
+                        : "Cron",
+                };
+            }
+            const res = await callGatewayFromCli("cron.update", opts, {
+                id,
+                patch,
+            });
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+            await warnIfCronSchedulerDisabled(opts);
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+    addGatewayClientOptions(cron
+        .command("run")
+        .description("Run a cron job now (debug)")
+        .argument("<id>", "Job id")
+        .option("--force", "Run even if not due", false)
+        .action(async (id, opts) => {
+        try {
+            const res = await callGatewayFromCli("cron.run", opts, {
+                id,
+                mode: opts.force ? "force" : "due",
+            });
+            defaultRuntime.log(JSON.stringify(res, null, 2));
+        }
+        catch (err) {
+            defaultRuntime.error(danger(String(err)));
+            defaultRuntime.exit(1);
+        }
+    }));
+}

package/dist/cli/deps.js

@@ -0,0 +1,17 @@
+import { sendMessageDiscord } from "../discord/send.js";
+import { sendMessageIMessage } from "../imessage/send.js";
+import { logWebSelfId, sendMessageWhatsApp } from "../providers/web/index.js";
+import { sendMessageSignal } from "../signal/send.js";
+import { sendMessageSlack } from "../slack/send.js";
+import { sendMessageTelegram } from "../telegram/send.js";
+export function createDefaultDeps() {
+    return {
+        sendMessageWhatsApp,
+        sendMessageTelegram,
+        sendMessageDiscord,
+        sendMessageSlack,
+        sendMessageSignal,
+        sendMessageIMessage,
+    };
+}
+export { logWebSelfId };

package/dist/cli/dns-cli.js

@@ -0,0 +1,180 @@
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { loadConfig } from "../config/config.js";
+import { pickPrimaryTailnetIPv4, pickPrimaryTailnetIPv6, } from "../infra/tailnet.js";
+import { getWideAreaZonePath, WIDE_AREA_DISCOVERY_DOMAIN, } from "../infra/widearea-dns.js";
+function run(cmd, args, opts) {
+    const res = spawnSync(cmd, args, {
+        encoding: "utf-8",
+        stdio: opts?.inherit ? "inherit" : "pipe",
+    });
+    if (res.error)
+        throw res.error;
+    if (!opts?.allowFailure && res.status !== 0) {
+        const errText = typeof res.stderr === "string" && res.stderr.trim()
+            ? res.stderr.trim()
+            : `exit ${res.status ?? "unknown"}`;
+        throw new Error(`${cmd} ${args.join(" ")} failed: ${errText}`);
+    }
+    return typeof res.stdout === "string" ? res.stdout : "";
+}
+function writeFileSudoIfNeeded(filePath, content) {
+    try {
+        fs.writeFileSync(filePath, content, "utf-8");
+        return;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "EACCES" && code !== "EPERM") {
+            throw err instanceof Error ? err : new Error(String(err));
+        }
+    }
+    const res = spawnSync("sudo", ["tee", filePath], {
+        input: content,
+        encoding: "utf-8",
+        stdio: ["pipe", "ignore", "inherit"],
+    });
+    if (res.error)
+        throw res.error;
+    if (res.status !== 0) {
+        throw new Error(`sudo tee ${filePath} failed: exit ${res.status ?? "unknown"}`);
+    }
+}
+function mkdirSudoIfNeeded(dirPath) {
+    try {
+        fs.mkdirSync(dirPath, { recursive: true });
+        return;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "EACCES" && code !== "EPERM") {
+            throw err instanceof Error ? err : new Error(String(err));
+        }
+    }
+    run("sudo", ["mkdir", "-p", dirPath], { inherit: true });
+}
+function zoneFileNeedsBootstrap(zonePath) {
+    if (!fs.existsSync(zonePath))
+        return true;
+    try {
+        const content = fs.readFileSync(zonePath, "utf-8");
+        return !/\bSOA\b/.test(content) || !/\bNS\b/.test(content);
+    }
+    catch {
+        return true;
+    }
+}
+function detectBrewPrefix() {
+    const out = run("brew", ["--prefix"]);
+    const prefix = out.trim();
+    if (!prefix)
+        throw new Error("failed to resolve Homebrew prefix");
+    return prefix;
+}
+function ensureImportLine(corefilePath, importGlob) {
+    const existing = fs.readFileSync(corefilePath, "utf-8");
+    if (existing.includes(importGlob))
+        return false;
+    const next = `${existing.replace(/\s*$/, "")}\n\nimport ${importGlob}\n`;
+    writeFileSudoIfNeeded(corefilePath, next);
+    return true;
+}
+export function registerDnsCli(program) {
+    const dns = program
+        .command("dns")
+        .description("DNS helpers for wide-area discovery (Tailscale + CoreDNS)");
+    dns
+        .command("setup")
+        .description("Set up CoreDNS to serve nexus.internal for unicast DNS-SD (Wide-Area Bonjour)")
+        .option("--apply", "Install/update CoreDNS config and (re)start the service (requires sudo)", false)
+        .action(async (opts) => {
+        const cfg = loadConfig();
+        const tailnetIPv4 = pickPrimaryTailnetIPv4();
+        const tailnetIPv6 = pickPrimaryTailnetIPv6();
+        const zonePath = getWideAreaZonePath();
+        console.log(`Domain: ${WIDE_AREA_DISCOVERY_DOMAIN}`);
+        console.log(`Zone file (gateway-owned): ${zonePath}`);
+        console.log(`Detected tailnet IP: ${tailnetIPv4 ?? "—"}${tailnetIPv6 ? ` (v6 ${tailnetIPv6})` : ""}`);
+        console.log("");
+        console.log("Recommended ~/nexus/state/nexus.json:");
+        console.log(JSON.stringify({
+            bridge: { bind: "tailnet" },
+            discovery: { wideArea: { enabled: true } },
+        }, null, 2));
+        console.log("");
+        console.log("Tailscale admin (DNS → Nameservers):");
+        console.log(`- Add nameserver: ${tailnetIPv4 ?? "<this machine's tailnet IPv4>"}`);
+        console.log(`- Restrict to domain (Split DNS): nexus.internal`);
+        if (!opts.apply) {
+            console.log("");
+            console.log("Run with --apply to install CoreDNS and configure it.");
+            return;
+        }
+        if (process.platform !== "darwin") {
+            throw new Error("dns setup is currently supported on macOS only");
+        }
+        if (!tailnetIPv4 && !tailnetIPv6) {
+            throw new Error("no tailnet IP detected; ensure Tailscale is running on this machine");
+        }
+        const prefix = detectBrewPrefix();
+        const etcDir = path.join(prefix, "etc", "coredns");
+        const corefilePath = path.join(etcDir, "Corefile");
+        const confDir = path.join(etcDir, "conf.d");
+        const importGlob = path.join(confDir, "*.server");
+        const serverPath = path.join(confDir, "nexus.internal.server");
+        run("brew", ["list", "coredns"], { allowFailure: true });
+        run("brew", ["install", "coredns"], {
+            inherit: true,
+            allowFailure: true,
+        });
+        mkdirSudoIfNeeded(confDir);
+        if (!fs.existsSync(corefilePath)) {
+            writeFileSudoIfNeeded(corefilePath, `import ${importGlob}\n`);
+        }
+        else {
+            ensureImportLine(corefilePath, importGlob);
+        }
+        const bindArgs = [tailnetIPv4, tailnetIPv6].filter((v) => Boolean(v?.trim()));
+        const server = [
+            `${WIDE_AREA_DISCOVERY_DOMAIN.replace(/\.$/, "")}:53 {`,
+            `  bind ${bindArgs.join(" ")}`,
+            `  file ${zonePath} {`,
+            `    reload 10s`,
+            `  }`,
+            `  errors`,
+            `  log`,
+            `}`,
+            ``,
+        ].join("\n");
+        writeFileSudoIfNeeded(serverPath, server);
+        // Ensure the gateway can write its zone file path.
+        await fs.promises.mkdir(path.dirname(zonePath), { recursive: true });
+        if (zoneFileNeedsBootstrap(zonePath)) {
+            const y = new Date().getUTCFullYear();
+            const m = String(new Date().getUTCMonth() + 1).padStart(2, "0");
+            const d = String(new Date().getUTCDate()).padStart(2, "0");
+            const serial = `${y}${m}${d}01`;
+            const zoneLines = [
+                `; created by nexus dns setup (will be overwritten by the gateway when wide-area discovery is enabled)`,
+                `$ORIGIN ${WIDE_AREA_DISCOVERY_DOMAIN}`,
+                `$TTL 60`,
+                `@ IN SOA ns1 hostmaster ${serial} 7200 3600 1209600 60`,
+                `@ IN NS ns1`,
+                tailnetIPv4 ? `ns1 IN A ${tailnetIPv4}` : null,
+                tailnetIPv6 ? `ns1 IN AAAA ${tailnetIPv6}` : null,
+                ``,
+            ].filter((line) => Boolean(line));
+            fs.writeFileSync(zonePath, zoneLines.join("\n"), "utf-8");
+        }
+        console.log("");
+        console.log("Starting CoreDNS (sudo)…");
+        run("sudo", ["brew", "services", "restart", "coredns"], {
+            inherit: true,
+        });
+        if (cfg.discovery?.wideArea?.enabled !== true) {
+            console.log("");
+            console.log("Note: enable discovery.wideArea.enabled in ~/nexus/state/nexus.json on the gateway and restart the gateway so it writes the DNS-SD zone.");
+        }
+    });
+}