@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/heart/daemon/cli-types.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * CLI command types and dependency interface.
+ *
+ * Extracted from daemon-cli.ts — the OuroCliCommand union and OuroCliDeps
+ * interface are the contract between parsing, execution, and default wiring.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/heart/daemon/connect-bay.js

@@ -0,0 +1,323 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.summarizeProviderLane = summarizeProviderLane;
+exports.summarizeProvidersForConnect = summarizeProvidersForConnect;
+exports.connectEntryNeedsAttention = connectEntryNeedsAttention;
+exports.renderConnectBay = renderConnectBay;
+const runtime_1 = require("../../nerves/runtime");
+const terminal_ui_1 = require("./terminal-ui");
+const readiness_repair_1 = require("./readiness-repair");
+const CONNECT_STATUS_PRIORITY = {
+    "needs attention": 0,
+    locked: 1,
+    "needs credentials": 2,
+    "needs setup": 3,
+    missing: 4,
+    "not attached": 5,
+    ready: 6,
+    attached: 6,
+};
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function cleanExtractedCommand(command) {
+    const cleaned = command?.trim().replace(/[`'",;:.)]+$/g, "").trim();
+    return cleaned && cleaned.length > 0 ? cleaned : undefined;
+}
+function extractCommand(fixHint, commandPrefix) {
+    const escapedPrefix = escapeRegExp(commandPrefix);
+    const commandBody = `${escapedPrefix}(?=\\s|$)[^\`'"]*`;
+    const quoted = fixHint.match(new RegExp(`[\`'"](${commandBody})[\`'"]`, "i"))?.[1];
+    const unquoted = fixHint.match(new RegExp(`(${escapedPrefix}(?=\\s|$)[^\\n,;.]+)`, "i"))?.[1];
+    return cleanExtractedCommand(quoted) ?? cleanExtractedCommand(unquoted);
+}
+function resolveProviderHealthStatus(providerHealth) {
+    if (!providerHealth || providerHealth.ok)
+        return undefined;
+    const issue = providerHealth.issue;
+    if (issue?.kind === "vault-locked")
+        return "locked";
+    if (issue?.kind === "vault-unconfigured")
+        return "needs setup";
+    if (issue?.kind === "provider-credentials-missing")
+        return "needs credentials";
+    if (issue?.kind === "provider-live-check-failed")
+        return "needs attention";
+    const error = String(providerHealth.error).toLowerCase();
+    const fix = String(providerHealth.fix).toLowerCase();
+    if (error.includes("failed live check"))
+        return "needs attention";
+    if (error.includes("has no credentials"))
+        return "needs credentials";
+    if (error.includes("missing") && error.includes("provider"))
+        return "needs setup";
+    if (error.includes("vault is locked") || error.includes("vault locked"))
+        return "locked";
+    if (fix.includes("ouro auth verify"))
+        return "needs attention";
+    if (fix.includes("ouro auth"))
+        return "needs credentials";
+    if (fix.includes("ouro use"))
+        return "needs setup";
+    if (fix.includes("vault unlock"))
+        return "locked";
+    return "needs attention";
+}
+function resolveProviderHealthCommand(providerHealth, status) {
+    const issueCommand = (0, readiness_repair_1.preferredConnectRepairAction)(providerHealth?.issue)?.command;
+    if (issueCommand)
+        return issueCommand;
+    const fixHint = providerHealth?.fix;
+    if (!fixHint)
+        return undefined;
+    const prefixes = status === "locked"
+        ? ["ouro vault unlock", "ouro vault replace", "ouro vault recover"]
+        : status === "needs credentials"
+            ? ["ouro auth", "ouro connect", "ouro provider refresh", "ouro up"]
+            : status === "needs setup"
+                ? ["ouro use", "ouro connect", "ouro auth", "ouro up"]
+                : ["ouro auth verify", "ouro auth", "ouro provider refresh", "ouro use", "ouro connect", "ouro vault unlock", "ouro up"];
+    for (const prefix of prefixes) {
+        const command = extractCommand(fixHint, prefix);
+        if (command)
+            return command;
+    }
+    return undefined;
+}
+function providerHealthTargetLane(providerHealth) {
+    const issue = providerHealth?.issue;
+    const actionLane = issue?.actions
+        .map((action) => "lane" in action && action.lane ? action.lane : undefined)
+        .find((lane) => lane === "outward" || lane === "inner");
+    if (actionLane)
+        return actionLane;
+    const text = [issue?.summary, issue?.detail, providerHealth?.error]
+        .filter(Boolean)
+        .join(" ")
+        .toLowerCase();
+    if (/\boutward provider\b/.test(text) || /\boutward lane\b/.test(text))
+        return "outward";
+    if (/\binner provider\b/.test(text) || /\binner lane\b/.test(text))
+        return "inner";
+    return undefined;
+}
+function providerHealthAppliesToLane(providerHealth, lane) {
+    const targetLane = providerHealthTargetLane(providerHealth);
+    return !targetLane || targetLane === lane.lane;
+}
+function providerHealthDetail(providerHealth, status) {
+    if (status === "locked")
+        return "vault locked on this machine";
+    if (status === "needs credentials")
+        return "credentials missing";
+    if (status === "needs setup") {
+        return providerHealth?.issue?.detail ?? providerHealth?.error ?? "needs setup";
+    }
+    const detail = providerHealth?.issue?.detail ?? providerHealth?.error;
+    if (!detail)
+        return "live check needs attention";
+    return /failed live check/i.test(detail) ? detail : `failed live check: ${detail}`;
+}
+function isProblemStatus(status) {
+    return status !== "ready" && status !== "attached";
+}
+function providerEntrySummary(entry) {
+    return entry.description ?? "Selected provider lanes for this machine.";
+}
+function providerEntryDetailLines(entry) {
+    const lines = [];
+    if (entry.nextNote && !/^(Outward|Inner) lane: /.test(entry.nextNote)) {
+        lines.push(entry.nextNote);
+    }
+    if (entry.laneSummaries && entry.laneSummaries.length > 0) {
+        for (const lane of entry.laneSummaries) {
+            const laneLabel = lane.lane === "outward" ? "Outward lane" : "Inner lane";
+            lines.push(`${laneLabel}: ${lane.title} — ${lane.detail}`);
+        }
+        return lines;
+    }
+    return [...lines, ...(entry.detailLines ?? [])];
+}
+function capabilityEntryDetailLines(entry) {
+    return [
+        ...(entry.detailLines ?? []),
+        ...(entry.nextNote ? [entry.nextNote] : []),
+    ];
+}
+function entryToWizardItem(entry) {
+    return {
+        key: entry.option,
+        label: entry.name,
+        status: entry.status,
+        ...(entry.section === "Providers"
+            ? { summary: providerEntrySummary(entry) }
+            : entry.description
+                ? { summary: entry.description }
+                : {}),
+        detailLines: entry.section === "Providers"
+            ? providerEntryDetailLines(entry)
+            : capabilityEntryDetailLines(entry),
+        ...(entry.nextAction ? { command: entry.nextAction } : {}),
+    };
+}
+function nextStepFor(entries) {
+    const nextEntry = entries.find((entry) => isProblemStatus(entry.status));
+    if (!nextEntry) {
+        return {
+            label: "Everything here is already connected.",
+            detail: "Pick any capability if you want to review it, refresh it, or change its setup.",
+        };
+    }
+    return {
+        label: `Start with ${nextEntry.name}.`,
+        detail: nextEntry.nextNote ?? nextEntry.description ?? `Status: ${nextEntry.status}.`,
+        command: nextEntry.nextAction,
+    };
+}
+function sectionToWizard(entries, section, summary) {
+    return {
+        title: section,
+        summary,
+        items: entries.filter((entry) => entry.section === section).map((entry) => entryToWizardItem(entry)),
+    };
+}
+function summarizeProviderLane(agent, lane, providerHealth) {
+    const providerHealthStatus = resolveProviderHealthStatus(providerHealth);
+    const providerHealthCommand = resolveProviderHealthCommand(providerHealth, providerHealthStatus);
+    if (lane.status === "unconfigured") {
+        return {
+            lane: lane.lane,
+            status: "needs setup",
+            title: "choose provider and model",
+            detail: "needs setup",
+            action: lane.repairCommand,
+        };
+    }
+    const fallbackAction = providerHealthCommand ?? lane.credential.repairCommand;
+    if (providerHealth?.ok) {
+        return {
+            lane: lane.lane,
+            status: "ready",
+            title: `${lane.provider} / ${lane.model}`,
+            detail: "ready",
+        };
+    }
+    if (providerHealthStatus && providerHealthAppliesToLane(providerHealth, lane)) {
+        return {
+            lane: lane.lane,
+            status: providerHealthStatus,
+            title: `${lane.provider} / ${lane.model}`,
+            detail: providerHealthDetail(providerHealth, providerHealthStatus),
+            action: fallbackAction,
+        };
+    }
+    if (lane.credential.status === "missing") {
+        return {
+            lane: lane.lane,
+            status: "needs credentials",
+            title: `${lane.provider} / ${lane.model}`,
+            detail: "credentials missing",
+            action: fallbackAction,
+        };
+    }
+    if (lane.credential.status === "invalid-pool") {
+        return {
+            lane: lane.lane,
+            status: providerHealthStatus === "locked" ? "locked" : "needs attention",
+            title: `${lane.provider} / ${lane.model}`,
+            detail: providerHealthStatus === "locked" ? "vault locked on this machine" : "vault unavailable",
+            action: fallbackAction,
+        };
+    }
+    if (lane.readiness.status === "failed") {
+        return {
+            lane: lane.lane,
+            status: "needs attention",
+            title: `${lane.provider} / ${lane.model}`,
+            detail: `failed live check: ${lane.readiness.error ?? "unknown error"}`,
+            action: providerHealthCommand ?? providerHealth?.fix ?? `ouro auth --agent ${agent} --provider ${lane.provider}`,
+        };
+    }
+    if (lane.readiness.status === "stale") {
+        return {
+            lane: lane.lane,
+            status: "needs attention",
+            title: `${lane.provider} / ${lane.model}`,
+            detail: ["live check is stale", lane.readiness.reason].filter(Boolean).join(": "),
+            action: providerHealth?.fix,
+        };
+    }
+    if (lane.readiness.status === "ready") {
+        return {
+            lane: lane.lane,
+            status: "ready",
+            title: `${lane.provider} / ${lane.model}`,
+            detail: "ready",
+        };
+    }
+    return {
+        lane: lane.lane,
+        status: "needs attention",
+        title: `${lane.provider} / ${lane.model}`,
+        detail: "live check did not complete yet",
+        action: providerHealth?.fix,
+    };
+}
+function summarizeProvidersForConnect(agent, visibility, providerHealth) {
+    const laneSummaries = visibility.lanes.map((lane) => summarizeProviderLane(agent, lane, providerHealth));
+    const worstLaneStatus = laneSummaries.reduce((worst, lane) => CONNECT_STATUS_PRIORITY[lane.status] < CONNECT_STATUS_PRIORITY[worst] ? lane.status : worst, "ready");
+    const providerHealthStatus = resolveProviderHealthStatus(providerHealth);
+    const providerHealthCommand = resolveProviderHealthCommand(providerHealth, providerHealthStatus);
+    const nextLane = laneSummaries.find((lane) => isProblemStatus(lane.status));
+    return {
+        status: providerHealthStatus ?? worstLaneStatus,
+        laneSummaries,
+        detailLines: laneSummaries.flatMap((lane) => [
+            `${lane.lane === "outward" ? "Outward lane" : "Inner lane"}: ${lane.title}`,
+            lane.detail,
+        ]),
+        nextAction: providerHealthCommand ?? nextLane?.action,
+        nextNote: providerHealthStatus === "locked"
+            ? "Unlock this agent's credential vault on this machine."
+            : nextLane
+                ? `${nextLane.lane === "outward" ? "Outward lane" : "Inner lane"}: ${nextLane.detail}`
+                : undefined,
+    };
+}
+function connectEntryNeedsAttention(entry) {
+    return isProblemStatus(entry.status);
+}
+function renderConnectBay(entries, options) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.connect_bay_rendered",
+        message: "rendered connect bay",
+        meta: {
+            agent: options.agent,
+            isTTY: options.isTTY,
+            entryCount: entries.length,
+            columns: options.columns ?? null,
+        },
+    });
+    return (0, terminal_ui_1.renderTerminalWizard)({
+        isTTY: options.isTTY,
+        columns: options.columns,
+        masthead: {
+            subtitle: "Set up connections one step at a time.",
+        },
+        title: `Connect ${options.agent}`,
+        summary: "Choose one capability to bring online. Each row tells you whether Ouro checked it live just now or is showing saved setup on this machine.",
+        nextStep: nextStepFor(entries),
+        sections: [
+            sectionToWizard(entries, "Providers", "Selected outward and inner lanes for this machine."),
+            sectionToWizard(entries, "Portable", "These travel with the agent bundle when their secrets are portable."),
+            sectionToWizard(entries, "This machine", "These depend on local attachments or machine-specific setup."),
+        ],
+        footerLines: [
+            "6. Not now",
+            "Choose a number, or type the capability name.",
+        ],
+        prompt: options.prompt,
+        suppressEvent: true,
+    });
+}

package/dist/heart/daemon/container-credential-bootstrap.js

@@ -0,0 +1,273 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDefaultContainerCredentialBootstrapPath = getDefaultContainerCredentialBootstrapPath;
+exports.loadContainerCredentialBootstrap = loadContainerCredentialBootstrap;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const runtime_credentials_1 = require("../runtime-credentials");
+const runtime_1 = require("../../nerves/runtime");
+const machine_identity_1 = require("../machine-identity");
+const MAX_BOOTSTRAP_BYTES = 128 * 1024;
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function parseEnvelope(raw) {
+    const value = JSON.parse(raw);
+    if (!isRecord(value) || value.schemaVersion !== 1 || !Array.isArray(value.credentials)) {
+        throw new Error("container credential bootstrap envelope is invalid");
+    }
+    if (Object.keys(value).sort().join(",") !== "credentials,schemaVersion") {
+        throw new Error("container credential bootstrap has unsupported fields");
+    }
+    if (value.credentials.length === 0) {
+        throw new Error("container credential bootstrap must contain at least one credential");
+    }
+    return value;
+}
+function fsyncDirectory(directoryPath) {
+    const descriptor = fs.openSync(directoryPath, "r");
+    try {
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function deleteDurably(filePath) {
+    fs.unlinkSync(filePath);
+    fsyncDirectory(path.dirname(filePath));
+}
+function assertSafeBootstrapFile(stat, label) {
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error(`container credential ${label} must be a regular file`);
+    }
+    if ((stat.mode & 0o077) !== 0)
+        throw new Error("container credential bootstrap must have mode 0600");
+    if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+        throw new Error("container credential bootstrap must be owned by the runtime user");
+    }
+    if (stat.size > MAX_BOOTSTRAP_BYTES)
+        throw new Error("container credential bootstrap is too large");
+}
+function getDefaultContainerCredentialBootstrapPath() {
+    return path.join(os.homedir(), ".ouro-cli", "container-credentials.json");
+}
+function optionalStat(filePath) {
+    try {
+        return fs.lstatSync(filePath);
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function loadContainerCredentialBootstrap(enabledAgents, options = {}) {
+    const filePath = options.path ?? getDefaultContainerCredentialBootstrapPath();
+    const consumingPath = `${filePath}.consuming`;
+    let sourceStat = optionalStat(filePath);
+    const claimedStat = optionalStat(consumingPath);
+    if (sourceStat && claimedStat) {
+        assertSafeBootstrapFile(sourceStat, "bootstrap");
+        assertSafeBootstrapFile(claimedStat, "consuming state");
+        const sourceBytes = fs.readFileSync(filePath);
+        const claimedBytes = fs.readFileSync(consumingPath);
+        if (!sourceBytes.equals(claimedBytes)) {
+            throw new Error("human-required: container credential source and claim differ; securely compare and quarantine them without printing their contents");
+        }
+        deleteDurably(filePath);
+        sourceStat = null;
+    }
+    if (claimedStat)
+        assertSafeBootstrapFile(claimedStat, "consuming state");
+    let stat;
+    if (sourceStat) {
+        if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
+            throw new Error("container credential bootstrap must be a regular file");
+        }
+        fs.renameSync(filePath, consumingPath);
+        fsyncDirectory(path.dirname(filePath));
+        stat = sourceStat;
+    }
+    else if (claimedStat) {
+        stat = claimedStat;
+    }
+    else {
+        return [];
+    }
+    assertSafeBootstrapFile(stat, claimedStat ? "consuming state" : "bootstrap");
+    const envelope = parseEnvelope(fs.readFileSync(consumingPath, "utf8"));
+    const allowed = new Set(enabledAgents);
+    const loaded = new Set();
+    for (const message of envelope.credentials) {
+        if (!isRecord(message) || typeof message.agentName !== "string" || !allowed.has(message.agentName)) {
+            throw new Error("container credential bootstrap agent is not enabled");
+        }
+        if (loaded.has(message.agentName))
+            throw new Error("container credential bootstrap contains a duplicate agent");
+        loaded.add(message.agentName);
+    }
+    const migration = options.machineIdMigration;
+    const discardProviderCredentialRecords = migration?.discardProviderCredentialRecords;
+    if (discardProviderCredentialRecords === undefined) {
+        for (const message of envelope.credentials) {
+            if (!(0, runtime_credentials_1.isRuntimeCredentialBootstrapMessage)(message)) {
+                throw new Error("container credential bootstrap message is invalid");
+            }
+        }
+    }
+    const machineId = (0, machine_identity_1.loadOrCreateMachineIdentity)().machineId;
+    let messages = envelope.credentials;
+    let discardedProviderRecordCount = 0;
+    if (migration) {
+        const { sourceMachineId, targetMachineId } = migration;
+        if (!sourceMachineId
+            || !targetMachineId
+            || sourceMachineId !== sourceMachineId.trim()
+            || targetMachineId !== targetMachineId.trim()
+            || sourceMachineId === targetMachineId) {
+            throw new Error("container credential bootstrap machineId migration is invalid");
+        }
+        if (machineId !== targetMachineId) {
+            throw new Error("container credential bootstrap machineId migration target does not match this machine");
+        }
+        for (const message of messages) {
+            if (!isRecord(message) || message.machineId !== sourceMachineId) {
+                throw new Error("container credential bootstrap machineId migration source does not match");
+            }
+        }
+        if (discardProviderCredentialRecords !== undefined) {
+            if (!isRecord(discardProviderCredentialRecords) || !Array.isArray(discardProviderCredentialRecords.providers)) {
+                throw new Error("container credential bootstrap provider discard policy is invalid");
+            }
+            const configuredProviders = discardProviderCredentialRecords.providers;
+            if (configuredProviders.length === 0
+                || configuredProviders.some((provider) => (typeof provider !== "string" || provider.length === 0 || provider !== provider.trim()))
+                || new Set(configuredProviders).size !== configuredProviders.length) {
+                throw new Error("container credential bootstrap provider discard allowlist is invalid");
+            }
+            const legacyProviders = [];
+            for (const message of messages) {
+                const records = message.providerCredentialRecords;
+                if (records === undefined)
+                    continue;
+                if (!Array.isArray(records) || records.length === 0) {
+                    throw new Error("container credential bootstrap discarded provider records are invalid");
+                }
+                for (const record of records) {
+                    if (!isRecord(record) || typeof record.provider !== "string" || record.provider.length === 0) {
+                        throw new Error("container credential bootstrap discarded provider record is invalid");
+                    }
+                    legacyProviders.push(record.provider);
+                }
+            }
+            if (new Set(legacyProviders).size !== legacyProviders.length) {
+                throw new Error("container credential bootstrap discarded providers contain duplicates");
+            }
+            if ([...legacyProviders].sort().join(",")
+                !== [...configuredProviders].sort().join(",")) {
+                throw new Error("container credential bootstrap discarded providers do not match the allowlist");
+            }
+            discardedProviderRecordCount = legacyProviders.length;
+        }
+        messages = messages.map((message) => {
+            const projected = { ...message, machineId: targetMachineId };
+            if (discardProviderCredentialRecords !== undefined)
+                delete projected.providerCredentialRecords;
+            return projected;
+        });
+    }
+    else {
+        for (const message of messages) {
+            if (isRecord(message) && typeof message.machineId === "string" && message.machineId !== machineId) {
+                throw new Error("container credential bootstrap machineId does not match this machine");
+            }
+        }
+    }
+    if (discardProviderCredentialRecords !== undefined) {
+        for (const message of messages) {
+            if (!(0, runtime_credentials_1.isRuntimeCredentialBootstrapMessage)(message)) {
+                throw new Error("container credential bootstrap message is invalid");
+            }
+        }
+    }
+    const persist = options.persist ?? ((message) => (0, runtime_credentials_1.persistRuntimeCredentialBootstrapMessage)(message, {
+        machineId,
+    }));
+    try {
+        for (const message of messages) {
+            if (!await persist(message))
+                throw new Error("invalid bootstrap message");
+        }
+    }
+    catch {
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "config/identity",
+            event: "config.container_credentials_persist_error",
+            message: "container credential bootstrap persistence failed; recoverable claim retained",
+            meta: { agents: [...loaded].sort(), count: loaded.size, claimedPath: consumingPath },
+        });
+        throw new Error("container credential bootstrap persistence failed; recoverable claim retained for reconciliation");
+    }
+    if (options.apply) {
+        for (const message of messages) {
+            if (!options.apply(message))
+                throw new Error("container credential bootstrap message is invalid");
+        }
+    }
+    deleteDurably(consumingPath);
+    if (discardedProviderRecordCount > 0) {
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.container_provider_credentials_discarded",
+            message: "discarded allowlisted legacy provider credentials during container migration",
+            meta: {
+                agentCount: loaded.size,
+                recordCount: discardedProviderRecordCount,
+                mode: "machine-id-migration",
+            },
+        });
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.container_credentials_loaded",
+        message: "loaded container credential bootstrap",
+        meta: { agents: [...loaded].sort(), count: loaded.size },
+    });
+    return [...loaded].sort();
+}