@murmurv2/cli 2.11.0

package/runtime/packages/setup/dist/src/commands.js

@@ -0,0 +1,115 @@
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { access, mkdir, realpath, rmdir, stat } from 'node:fs/promises';
+import { loadConfig, readJson } from './config.js';
+import { readStatus } from './status.js';
+import { writeState } from './state.js';
+/** Observe the configured directory only; this does not prove a live daemon's log destination. */
+export async function readLogPath(context) {
+    const config = await loadConfig(context);
+    try {
+        const dataDir = await realpath(context.dataDir);
+        const logDir = await realpath(context.logDir);
+        const relative = path.relative(dataDir, logDir);
+        // Resolve aliases before containment checks; never open an unrelated directory as this profile's logs.
+        if (!relative || path.isAbsolute(relative) || relative === '..' || relative.startsWith('..' + path.sep)) {
+            throw new Error('logs.path-outside-profile');
+        }
+        if (!(await stat(logDir)).isDirectory())
+            throw new Error('logs.not-directory');
+        await access(logDir, constants.R_OK | constants.X_OK);
+        return { schema: 'murmur.logs/1', agentId: config.agentId, dataDir,
+            serviceName: context.serviceName, logDir, source: 'configured' };
+    }
+    catch (error) {
+        if (error instanceof Error && ['logs.path-outside-profile', 'logs.not-directory'].includes(error.message))
+            throw error;
+        switch (error.code) {
+            case 'ENOENT': throw new Error('logs.directory-missing');
+            case 'ENOTDIR': throw new Error('logs.not-directory');
+            case 'EACCES':
+            case 'EPERM': throw new Error('logs.directory-unreadable');
+            default: throw new Error('logs.path-unavailable');
+        }
+    }
+}
+/** Explicit local configuration mutation, serialized against other setup writers. */
+export async function setWakeEnabled(context, adapter, enabled, apply = false) {
+    const lock = path.join(context.dataDir, '.setup-write.lock');
+    await mkdir(lock, { mode: 0o700 });
+    let backup = null;
+    try {
+        const config = await loadConfig(context);
+        if ((config.wake?.enabled !== false) !== enabled) {
+            backup = path.join(context.dataDir, `agent-config.backup-${randomUUID()}.json`);
+            await writeState(context, backup, config);
+            await writeState(context, context.configPath, { ...config, wake: { ...config.wake, enabled } });
+        }
+    }
+    finally {
+        await rmdir(lock);
+    }
+    let applyError = null;
+    if (apply) {
+        try {
+            await adapter.stop(context);
+            await adapter.start(context);
+        }
+        catch {
+            applyError = 'wake.service-apply-failed';
+        }
+    }
+    const status = await readStatus({ context, adapter });
+    const effectiveEnabled = status.wake.effective.enabled;
+    return { schema: 'murmur.wake/1', configuredEnabled: enabled, effectiveEnabled,
+        restartRequired: effectiveEnabled !== enabled, backup, applyError };
+}
+/** Explicit read action only; merely displaying status never consumes unread state. */
+export async function markInboxRead(context) {
+    const { DatabaseSync } = await import('node:sqlite');
+    const config = await loadConfig(context);
+    const db = new DatabaseSync(context.storePath, { readOnly: true });
+    try {
+        const rowid = Number(db.prepare("SELECT COALESCE(MAX(rowid),0) AS rowid FROM local_messages WHERE direction='inbound'").get().rowid);
+        const state = { schema: 'murmur.read/1', agentId: config.agentId, rowid };
+        await writeState(context, path.join(context.dataDir, 'read-state.json'), state);
+        return state;
+    }
+    finally {
+        db.close();
+    }
+}
+/** Return durable inbound rows without advancing the independent read cursor. */
+export async function readInbox(context, limit = 20) {
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+        throw new Error('inbox.limit-invalid');
+    const { DatabaseSync } = await import('node:sqlite');
+    const config = await loadConfig(context);
+    const db = new DatabaseSync(context.storePath, { readOnly: true });
+    try {
+        db.exec('PRAGMA busy_timeout=1000; BEGIN');
+        const tip = Number(db.prepare("SELECT COALESCE(MAX(rowid),0) AS rowid FROM local_messages WHERE direction='inbound'").get().rowid);
+        let cursor = null;
+        try {
+            const state = await readJson(path.join(context.dataDir, 'read-state.json'));
+            if (state.schema !== 'murmur.read/1' || state.agentId !== config.agentId || !Number.isSafeInteger(state.rowid)
+                || state.rowid < 0 || state.rowid > tip)
+                throw new Error('inbox.cursor-invalid');
+            cursor = state.rowid;
+        }
+        catch { /* Reading messages must not invent or repair read state. */ }
+        const unread = cursor === null ? null : Number(db.prepare("SELECT COUNT(*) AS n FROM local_messages WHERE direction='inbound' AND rowid>?").get(cursor).n);
+        const rows = db.prepare(`SELECT rowid,conversation_id AS conversationId,msg_id AS msgId,sender,text,
+      created_at AS createdAt,transport,channel_id AS channelId,sender_member_id AS senderMemberId,
+      addressee_member_id AS addresseeMemberId FROM local_messages WHERE direction='inbound'
+      ORDER BY created_at DESC,rowid DESC LIMIT ?`).all(limit);
+        db.exec('COMMIT');
+        return { schema: 'murmur.inbox/1', agentId: config.agentId, readCursor: cursor,
+            unread,
+            messages: rows.map(({ rowid, ...row }) => ({ ...row, unread: cursor === null ? null : Number(rowid) > cursor })) };
+    }
+    finally {
+        db.close();
+    }
+}

package/runtime/packages/setup/dist/src/config.d.ts

@@ -0,0 +1,49 @@
+import type { ServiceContext } from "./types.js";
+export interface PeerConfig {
+    subject: string;
+    encryption: {
+        publicKey: string;
+    };
+    signing: {
+        publicKey: string;
+    };
+    channelId?: string;
+    memberId?: string;
+    subjectScoping?: boolean;
+}
+export interface AgentConfig {
+    agentId: string;
+    subject: string;
+    natsUrl: string;
+    natsToken?: string;
+    keys: {
+        encryption: {
+            publicKey: string;
+            privateKey: string;
+        };
+        signing: {
+            publicKey: string;
+            privateKey: string;
+        };
+    };
+    peers: Record<string, PeerConfig>;
+    memberId?: string;
+    subjectScoping?: {
+        enabled?: boolean;
+        channelIds?: string[];
+    };
+    onReceive?: string;
+    wake?: {
+        enabled?: boolean;
+        mode?: string;
+        peers?: Record<string, {
+            mode?: string;
+        }>;
+    };
+}
+export declare const validAgentId: (v: unknown) => v is string;
+export declare function validateConfig(input: unknown): AgentConfig;
+/** Read-only: status and doctor never chmod, initialize, or migrate user state. */
+export declare function readJson(file: string): Promise<any>;
+export declare function loadConfig(context: ServiceContext): Promise<AgentConfig>;
+export declare function safeError(error: unknown): string;

package/runtime/packages/setup/dist/src/config.js

@@ -0,0 +1,70 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+export const validAgentId = (v) => typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(v);
+const validKey = (v) => typeof v === "string" && Buffer.from(v, "base64").length === 32 && Buffer.from(v, "base64").toString("base64") === v;
+export function validateConfig(input) {
+    if (!object(input) || !validAgentId(input.agentId) || input.subject !== `msg.${input.agentId}`)
+        throw new Error("config.identity-invalid");
+    let url;
+    try {
+        url = new URL(input.natsUrl);
+    }
+    catch {
+        throw new Error("config.broker-url-invalid");
+    }
+    if (!["nats:", "tls:"].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+        throw new Error("config.broker-url-invalid");
+    for (const kind of ["encryption", "signing"]) {
+        if (!validKey(input.keys?.[kind]?.publicKey) || !validKey(input.keys?.[kind]?.privateKey))
+            throw new Error("config.keys-invalid");
+    }
+    if (!object(input.peers))
+        throw new Error("config.peers-invalid");
+    for (const [id, peer] of Object.entries(input.peers)) {
+        if (!validAgentId(id) || !object(peer) || typeof peer.subject !== "string" || !/^[A-Za-z0-9_.:-]+$/.test(peer.subject)
+            || !validKey(peer.encryption?.publicKey) || !validKey(peer.signing?.publicKey))
+            throw new Error("config.peer-invalid");
+    }
+    return input;
+}
+/** Read-only: status and doctor never chmod, initialize, or migrate user state. */
+export async function readJson(file) {
+    const handle = await open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > 4 * 1024 * 1024)
+            throw new Error("config.file-invalid");
+        if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+            throw new Error("config.owner-mismatch");
+        return JSON.parse(await handle.readFile("utf8"));
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function loadConfig(context) {
+    try {
+        return validateConfig(await readJson(context.configPath));
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            throw new Error("config.missing");
+        throw e;
+    }
+}
+export function safeError(error) {
+    const value = error instanceof Error ? error.message : String(error ?? "");
+    if (value === "database is locked")
+        return value;
+    // Neither command output nor transport errors may leak tokens/message content.
+    if (/^[a-zA-Z][a-zA-Z0-9_.:-]{0,150}$/.test(value))
+        return value;
+    // System error messages embed paths; their errno code and syscall alone are safe and actionable
+    // (an unreadable invite file must not surface as a bare operation-failed).
+    const { code, syscall } = (error ?? {});
+    if (typeof code === "string" && /^E[A-Z0-9]{1,30}$/.test(code)) {
+        return typeof syscall === "string" && /^[a-z_]{1,30}$/.test(syscall) ? `system.${code}:${syscall}` : `system.${code}`;
+    }
+    return "operation-failed";
+}

package/runtime/packages/setup/dist/src/doctor.d.ts

@@ -0,0 +1,25 @@
+import { type NatsConnection } from 'nats';
+import { type AgentConfig } from './config.js';
+import type { ServiceContext, PlatformAdapter } from './types.js';
+export interface DoctorOptions {
+    context: ServiceContext;
+    adapter: PlatformAdapter;
+    peer?: string;
+    timeoutMs?: number;
+}
+export declare function probeRoundtrip(c: ServiceContext, config: AgentConfig, peerId: string, connection: NatsConnection, timeoutMs: number): Promise<{
+    msgId: string;
+    replyMsgId: string;
+    peerId: string;
+    verifiedAt: string;
+}>;
+export declare function runDoctor({ context, adapter, peer, timeoutMs }: DoctorOptions): Promise<{
+    schema: string;
+    generatedAt: string;
+    agentId: string | null;
+    stages: Record<string, unknown>[];
+    summary: {
+        worst: string;
+        failedStage: null;
+    };
+}>;

package/runtime/packages/setup/dist/src/doctor.js

@@ -0,0 +1,174 @@
+import { connect, StringCodec } from 'nats';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { DatabaseSync } from 'node:sqlite';
+import path from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { buildNatsConnectionOptions } from '@murmurv2/broker-nats';
+import { channelSubjectRoutes, resolveMessageSubject, SQLiteDedupeOutboxStore, stableEnvelopePayload, isEnvelopeV1 } from '@murmurv2/core';
+import { encryptPayload, signEnvelope, verifyEnvelopeSignature, decryptPayload } from '@murmurv2/security';
+import { loadConfig, readJson, safeError } from './config.js';
+import { pairFingerprint, readStatus } from './status.js';
+import { writeState } from './state.js';
+const delay = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+export async function probeRoundtrip(c, config, peerId, connection, timeoutMs) {
+    const peer = config.peers[peerId];
+    if (!peer)
+        throw new Error('peers.unknown');
+    const nonce = randomBytes(24).toString('hex'), conversationId = `murmur:doctor:${randomUUID()}`;
+    const text = `Murmur diagnostic roundtrip. Reply in this same conversation with exactly this line: MURMUR-DOCTOR-REPLY ${nonce}`;
+    const payload = await encryptPayload(text, peer.encryption.publicKey, config.keys.encryption.privateKey);
+    const envelope = { schemaVersion: '1.0', msgId: randomUUID(), conversationId, senderAgentId: config.agentId,
+        recipients: [peerId], createdAt: new Date().toISOString(), payloadCiphertext: payload.ciphertext, payloadNonce: payload.nonce, signature: '',
+        ...(peer.channelId ? { channelId: peer.channelId } : {}), ...(config.memberId ? { senderMemberId: config.memberId } : {}), ...(peer.memberId ? { addresseeMemberId: peer.memberId } : {}) };
+    envelope.signature = await signEnvelope(stableEnvelopePayload(envelope), config.keys.signing.privateKey);
+    const codec = StringCodec();
+    // Subscribe only to this profile's receiver routes; restricted broker ACLs reject mesh-wide taps.
+    const subs = channelSubjectRoutes(config.subject, config.agentId, config.subjectScoping).map(route => connection.subscribe(route.subject));
+    const started = Date.now(), deadline = started + timeoutMs;
+    let verified = null;
+    const listener = Promise.all(subs.map(async (sub) => {
+        for await (const message of sub) {
+            try {
+                const reply = JSON.parse(codec.decode(message.data));
+                if (!isEnvelopeV1(reply) || reply.senderAgentId !== peerId || reply.conversationId !== conversationId
+                    || !reply.recipients.includes(config.agentId) || reply.channelId !== envelope.channelId
+                    || Date.parse(reply.createdAt) < started - 5000 || Date.parse(reply.createdAt) > Date.now() + 5000)
+                    continue;
+                if (!await verifyEnvelopeSignature(stableEnvelopePayload(reply), reply.signature, peer.signing.publicKey))
+                    continue;
+                const plain = await decryptPayload({ ciphertext: reply.payloadCiphertext, nonce: reply.payloadNonce, senderPublicKey: peer.encryption.publicKey }, config.keys.encryption.privateKey);
+                if (plain.trim() === `MURMUR-DOCTOR-REPLY ${nonce}`)
+                    verified = { msgId: reply.msgId, text: plain };
+            }
+            catch { /* Unrelated or untrusted frames are not probe evidence. */ }
+        }
+    }));
+    let db;
+    try {
+        await connection.flush();
+        // Reuse the real daemon outbox path. A publisher-only probe could hide a broken daemon.
+        const outbox = new SQLiteDedupeOutboxStore(c.storePath);
+        try {
+            await outbox.enqueue(resolveMessageSubject(peer, peer.channelId), envelope);
+        }
+        finally {
+            outbox.close();
+        }
+        db = new DatabaseSync(c.storePath, { readOnly: true });
+        while (Date.now() < deadline) {
+            const candidate = verified;
+            if (candidate) {
+                const row = db.prepare("SELECT text FROM local_messages WHERE direction='inbound' AND msg_id=? AND sender=? AND conversation_id=?").get(candidate.msgId, peerId, conversationId);
+                if (row?.text === candidate.text) {
+                    const verifiedAt = new Date().toISOString();
+                    let proofs = {};
+                    try {
+                        proofs = await readJson(path.join(c.dataDir, 'pair-proofs.json'));
+                    }
+                    catch { }
+                    await writeState(c, path.join(c.dataDir, 'pair-proofs.json'), { ...proofs,
+                        [peerId]: { peerId, localAgentId: config.agentId, keyFingerprint: pairFingerprint(config, peerId), verifiedAt } });
+                    return { msgId: envelope.msgId, replyMsgId: candidate.msgId, peerId, verifiedAt };
+                }
+            }
+            await delay(Math.min(50, Math.max(0, deadline - Date.now())));
+        }
+        throw new Error('roundtrip.timeout');
+    }
+    finally {
+        db?.close();
+        for (const sub of subs)
+            sub.unsubscribe();
+        await listener;
+    }
+}
+// The next command for a failure a new user meets first. Keyed by the stable reason code only; the
+// selected service name is included because a command without it would select a different service.
+// resolveContext already restricts serviceName to [A-Za-z0-9._-].
+const failureHints = (serviceName) => ({
+    'config.missing': 'No profile here yet: run murmur join --data-dir <this profile> --agent-id <your-agent-id> --invite-file <invite file> --reply-out <new reply file>',
+    'daemon.not-running': `Install or start the service: murmur service install --data-dir <this profile> --service-name ${serviceName} (or service start with the same options if installed; on Windows from an administrator terminal)`,
+});
+export async function runDoctor({ context, adapter, peer, timeoutMs = 10000 }) {
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 60000)
+        throw new Error('doctor.invalid-timeout');
+    const generatedAt = new Date().toISOString(), stages = [];
+    let config = null, connection;
+    let snapshot;
+    let failedStage = null, worst = 'ok';
+    const stage = async (id, title, fn) => {
+        const start = Date.now();
+        if (failedStage) {
+            stages.push({ id, title, state: 'skip', reason: `blocked-by:${failedStage}`, detail: 'Not measured after earlier failure', fixHint: null, elapsedMs: id === 'wake' ? null : 0, measuredAt: null });
+            return;
+        }
+        try {
+            const result = await fn(), state = result.state ?? 'ok';
+            if (state === 'warn' && worst === 'ok')
+                worst = 'warn';
+            stages.push({ id, title, state, detail: result.detail, reason: result.reason ?? null, fixHint: result.fixHint ?? null,
+                elapsedMs: id === 'wake' ? null : Date.now() - start, measuredAt: new Date().toISOString() });
+        }
+        catch (e) {
+            failedStage = id;
+            worst = 'fail';
+            stages.push({ id, title, state: 'fail', reason: safeError(e), detail: `${title}: ${safeError(e)}`, fixHint: failureHints(context.serviceName)[safeError(e)] ?? null,
+                elapsedMs: id === 'wake' ? null : Date.now() - start, measuredAt: new Date().toISOString() });
+        }
+    };
+    try {
+        await stage('config', 'Configuration', async () => { config = await loadConfig(context); return { detail: 'Identity, keys and peer configuration validated' }; });
+        await stage('daemon', 'Daemon and store', async () => {
+            snapshot = await readStatus({ context, adapter });
+            if (snapshot.service.state !== 'running')
+                throw new Error('daemon.not-running');
+            if (!snapshot.service.observedStorePath || await realpath(snapshot.service.observedStorePath) !== await realpath(context.storePath))
+                throw new Error('daemon.store-unverified');
+            return { detail: 'Service PID holds the selected database open' };
+        });
+        await stage('broker', 'Broker authentication and RTT', async () => {
+            try {
+                connection = await connect({ ...buildNatsConnectionOptions({ url: config.natsUrl, token: config.natsToken }), reconnect: false, waitOnFirstConnect: false, timeout: timeoutMs });
+                await connection.rtt();
+            }
+            catch (e) {
+                throw new Error(e.code === 'AUTHORIZATION_VIOLATION' ? 'broker.unauthorized' : 'broker.unreachable');
+            }
+            return { detail: 'Broker accepted authentication and replied' };
+        });
+        await stage('peers', 'Peer pairing evidence', async () => {
+            if (peer && !config.peers[peer])
+                throw new Error('peers.unknown');
+            if (!Object.keys(config.peers).length)
+                throw new Error('peers.none');
+            const list = snapshot.peers.list ?? [];
+            return list.every(p => p.paired === true) ? { detail: 'Fresh two-way proofs exist for configured peers' }
+                : { state: 'warn', reason: 'peers.unmeasured', detail: 'Local keys alone do not prove mutual pairing', fixHint: 'Run murmur doctor --peer <configured-agent-id> --json' };
+        });
+        await stage('roundtrip', 'Encrypted signed roundtrip', async () => {
+            if (!peer)
+                return { state: 'warn', reason: 'roundtrip.peer-required', detail: 'No diagnostic peer selected; no message sent', fixHint: 'Run murmur doctor --peer <configured-agent-id> --json' };
+            const proof = await probeRoundtrip(context, config, peer, connection, timeoutMs);
+            return { detail: `Authenticated reply persisted from ${proof.peerId}` };
+        });
+        await stage('wake', 'Wake mode and responder', async () => {
+            const s = await readStatus({ context, adapter });
+            if (s.wake.effective.enabled === null)
+                return { state: 'warn', reason: 'wake.unmeasured', detail: 'No fresh runtime evidence' };
+            if (s.wake.effective.needsRestart)
+                return { state: 'warn', reason: 'wake.mode-mismatch', detail: 'Configured and effective wake differ', fixHint: 'Run murmur wake pause --apply or murmur wake resume --apply for the intended mode' };
+            if (!s.wake.effective.enabled)
+                return { state: 'warn', reason: 'wake.paused', detail: 'Wake is paused; pending messages remain queued' };
+            if (s.wake.config.mode === 'none' || s.wake.config.responder === 'none')
+                return { state: 'warn', reason: 'wake.no-responder', detail: 'No wake responder configured' };
+            if (s.wake.faults.lastFault)
+                throw new Error(s.wake.faults.lastFault);
+            // A reply is not evidence that a particular UI/session was awakened.
+            return { state: 'warn', reason: 'wake.live-proof-required', detail: 'Wake configured; intended live-session receipt requires separate proof' };
+        });
+    }
+    finally {
+        await connection?.close();
+    }
+    return { schema: 'murmur.doctor/1', generatedAt, agentId: config?.agentId ?? null, stages, summary: { worst, failedStage } };
+}

package/runtime/packages/setup/dist/src/file-identity.d.ts

@@ -0,0 +1,3 @@
+import type { BigIntStats } from 'node:fs';
+/** Windows/libuv may omit the path's volume serial; a full inode must still match. */
+export declare function sameClientFileIdentity(a: Pick<BigIntStats, 'dev' | 'ino'>, b: Pick<BigIntStats, 'dev' | 'ino'>, platform?: NodeJS.Platform): boolean;

package/runtime/packages/setup/dist/src/file-identity.js

@@ -0,0 +1,11 @@
+/** Windows/libuv may omit the path's volume serial; a full inode must still match. */
+export function sameClientFileIdentity(a, b, platform = process.platform) {
+    if (a.ino !== b.ino)
+        return false;
+    if (platform !== 'win32')
+        return a.dev === b.dev;
+    // Node 22.13/libuv 1.49.2 can report path dev=0 with a nonzero handle dev.
+    // When both are available, compare the Windows volume serial's low 32 bits:
+    // https://github.com/libuv/libuv/commit/82cdfb75ff9bbd0dc65820ca418b7c5d412ff4d7
+    return a.dev === 0n || b.dev === 0n || BigInt.asUintN(32, a.dev) === BigInt.asUintN(32, b.dev);
+}

package/runtime/packages/setup/dist/src/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./types.js";
+export * from "./paths.js";
+export * from "./config.js";
+export * from "./status.js";
+export * from "./verdict.js";
+export * from "./status-line.js";
+export { createLinuxAdapter } from "./platform/linux.js";

package/runtime/packages/setup/dist/src/index.js

@@ -0,0 +1,7 @@
+export * from "./types.js";
+export * from "./paths.js";
+export * from "./config.js";
+export * from "./status.js";
+export * from "./verdict.js";
+export * from "./status-line.js";
+export { createLinuxAdapter } from "./platform/linux.js";

package/runtime/packages/setup/dist/src/onboarding.d.ts

@@ -0,0 +1,46 @@
+import type { ServiceContext } from './types.js';
+export declare function initialize(c: ServiceContext, options: {
+    agentId: string;
+    brokerUrl: string;
+    tokenFile?: string;
+}): Promise<{
+    schema: string;
+    agentId: string;
+    dataDir: string;
+    serviceName: string;
+    existing: boolean;
+}>;
+export declare function invite(c: ServiceContext, outFile: string): Promise<{
+    schema: string;
+    file: string;
+    containsBrokerCredential: boolean;
+    instruction: string;
+}>;
+export declare function join(c: ServiceContext, options: {
+    agentId: string;
+    inviteFile: string;
+    replyOut: string;
+}): Promise<{
+    schema: string;
+    agentId: string;
+    peerId: any;
+    paired: null;
+    replyFile: string;
+    backup: null;
+    restartRequired: boolean;
+    serviceName: string;
+}>;
+export declare function importPeer(c: ServiceContext, replyFile: string): Promise<{
+    schema: string;
+    peerId: any;
+    paired: null;
+    backup: string | null;
+    poisonReset: {
+        cleared: number;
+        reason: null;
+    } | {
+        cleared: null;
+        reason: string;
+    };
+    restartRequired: boolean;
+}>;