@sealant/mend 0.36.0-next.684 → 0.36.0-next.708

package/dist/main.js

@@ -1280,7 +1280,15 @@ var isTenancy = (value) => TENANCIES.some((tenancy) => tenancy === value);
 var EDGE_IMAGE = "caddy:2.10-alpine";
 var EDGE_COMPOSE_FILE = "compose.edge.yaml";
 var POSTURE_COMPOSE_FILE = "compose.posture.yaml";
-var DECLARABLE_ITEMS = ["core-private", "edge-tls", "workspace-ssh"];
+var T3_GATEWAY_COMPOSE_FILE = "compose.t3.yaml";
+var T3_GATEWAY_CONTAINER_PORT = 3120;
+var DEFAULT_T3_GATEWAY_PORT = 3120;
+var DECLARABLE_ITEMS = [
+  "core-private",
+  "edge-tls",
+  "workspace-ssh",
+  "t3code-gateway"
+];
 var isDeclarableItem = (value) => DECLARABLE_ITEMS.some((item) => item === value);
 var publishedAddress = (address, port) => `${net2.isIP(address) === 6 ? `[${address}]` : address}:${port}`;
 var parseEdgeHost = (value) => {
@@ -1307,6 +1315,7 @@ var postureEnvironment = (posture) => {
 };
 var postureEnvLines = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [`MEND_EDGE_HOST=${posture.edgeHost}`],
+  ...posture.t3GatewayPort === void 0 ? [] : [`MEND_T3_GATEWAY_PORT=${posture.t3GatewayPort}`],
   ...postureEnvironment(posture).map(([key, value]) => `${key}=${value}`)
 ];
 var renderPostureOverlay = (posture) => {
@@ -1326,10 +1335,33 @@ var renderPostureOverlay = (posture) => {
     ""
   ].join("\n");
 };
+var T3_GATEWAY_VOLUME = "mend-t3-gateway";
+var T3_GATEWAY_IMAGE_LABEL = "dev.sealant.mend.t3-gateway";
+var T3_GATEWAY_STATE_DIR = "/opt/mend-t3-gateway/state";
+var renderT3GatewayOverlay = (posture) => {
+  if (posture.t3GatewayPort === void 0) return void 0;
+  return [
+    "# Written by mend server setup --t3-gateway: the t3code gateway (docs/adr/0012), its own",
+    "# listener beside Mend's, published on loopback only. Reaching it from elsewhere is an",
+    "# exposure the operator declares (docs/adr/0004). mend server setup --no-t3-gateway removes it.",
+    "services:",
+    "  mend:",
+    "    environment:",
+    '      MEND_T3_GATEWAY_ENABLED: "true"',
+    "    ports:",
+    `      - "127.0.0.1:\${MEND_T3_GATEWAY_PORT:?set MEND_T3_GATEWAY_PORT in server.env}:${T3_GATEWAY_CONTAINER_PORT}"`,
+    "    volumes:",
+    `      - ${T3_GATEWAY_VOLUME}:${T3_GATEWAY_STATE_DIR}`,
+    "volumes:",
+    `  ${T3_GATEWAY_VOLUME}:`,
+    ""
+  ].join("\n");
+};
 var composeOverlays = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [EDGE_COMPOSE_FILE],
   ...renderPostureOverlay(posture) === void 0 ? [] : [POSTURE_COMPOSE_FILE],
-  ...runsMirrors(posture.mirrors) ? [MIRRORS_COMPOSE_FILE] : []
+  ...runsMirrors(posture.mirrors) ? [MIRRORS_COMPOSE_FILE] : [],
+  ...posture.t3GatewayPort === void 0 ? [] : [T3_GATEWAY_COMPOSE_FILE]
 ];
 var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? new Map(Object.entries(value)) : null;
 var healthPosture = (body) => {
@@ -1353,6 +1385,9 @@ var healthPosture = (body) => {
 };
 var declaredPostureLines = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [`edge \xB7 ${posture.edgeHost} \xB7 ${EDGE_IMAGE} on 80 and 443 \xB7 Mend's own port on loopback`],
+  ...posture.t3GatewayPort === void 0 ? [] : [
+    `t3code gateway \xB7 on \xB7 127.0.0.1:${posture.t3GatewayPort} \xB7 loopback only \xB7 reaching it from elsewhere is an exposure you declare`
+  ],
   `exposure \xB7 declared ${posture.exposure ?? "private"}${posture.exposure === void 0 ? " \xB7 the default, not set on this install" : ""}`,
   `tenancy \xB7 declared ${posture.tenancy ?? "single"}${posture.tenancy === void 0 ? " \xB7 the default, not set on this install" : ""}`,
   ...posture.sshBind === void 0 || posture.sshPort === void 0 ? [] : [
@@ -3161,7 +3196,7 @@ var COMMANDS = [
     summary: "how this instance is exposed, as declared and as observed",
     synopsis: [],
     description: [
-      "Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item that blocks a start is open: every item the server can observe, and workspace-ssh until you declare it. Items it cannot observe say what would verify them; once you have verified core-private, edge-tls or workspace-ssh (SSH published apart from the web port) from outside, name it in MEND_EXPOSURE_DECLARED, or with mend server setup --declare. The report is what was observed; it is not a statement that the instance is fit to expose."
+      "Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item that blocks a start is open: every item the server can observe, and workspace-ssh until you declare it. Items it cannot observe say what would verify them; once you have verified core-private, edge-tls, workspace-ssh (SSH published apart from the web port) or (while it is enabled) t3code-gateway from outside, name it in MEND_EXPOSURE_DECLARED, or with mend server setup --declare. The report is what was observed; it is not a statement that the instance is fit to expose."
     ],
     see: ["operator gate", "doctor"]
   },
@@ -3247,12 +3282,13 @@ var COMMANDS = [
     section: "this machine",
     summary: "install or repair the local Mend server",
     synopsis: [
-      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--ssh-bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--edge <host> | --no-edge] [--exposure <loopback|private|public>] [--tenancy <single|multi>] [--declare <item>...] [--npm-mirror | --no-npm-mirror] [--npm-mirror-max-size <size>] [--docker-mirror | --no-docker-mirror] [--docker-mirror-max-size <size>] [--docker-hub-username <name> --docker-hub-token-stdin --docker-hub-public-only | --no-docker-hub-login] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
+      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--ssh-bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--edge <host> | --no-edge] [--exposure <loopback|private|public>] [--tenancy <single|multi>] [--declare <item>...] [--t3-gateway [--t3-gateway-port <n>] | --no-t3-gateway] [--npm-mirror | --no-npm-mirror] [--npm-mirror-max-size <size>] [--docker-mirror | --no-docker-mirror] [--docker-mirror-max-size <size>] [--docker-hub-username <name> --docker-hub-token-stdin --docker-hub-public-only | --no-docker-hub-login] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
     ],
     description: [
       "Checks a local Unix-socket Docker context and the Compose plugin, downloads the compose and Postgres initialization assets for one Mend release, preserves existing data and secrets, and starts the server. Re-running repairs the same pinned version. A changed --version is refused; use mend server upgrade. Updating this CLI never updates an existing server pin.",
       "The default listens only on localhost at http://localhost:3105. Non-local access requires both --bind and --url. Every extra browser origin must be named with --origin; setup never guesses from the request Host header or network interfaces.",
       "--edge <host> runs a TLS edge in front of Mend: Caddy on ports 80 and 443 of every interface, which obtains and renews a certificate for the host and proxies to Mend's web tier. Mend's own port stays on loopback and the browser origin is https://<host>. The edge's compose overlay and Caddyfile are written into the generation beside compose.yaml, so start, restart and upgrade run them every time. --no-edge takes it away again, and the edge's container with it. A fresh install cannot start with the edge: until the first account exists, registration is open to whoever reaches the origin first, so set up on localhost, create the account, then add the edge.",
+      "--t3-gateway turns on the t3code gateway (docs/adr/0012): t3code's desktop, mobile and web clients add it as an environment, pair with a code from mend pair, and see this Mend's projects and sessions. It runs in the Mend container, confined to a root and a uid of its own, on a listener of its own published on 127.0.0.1 only (port 3120, or --t3-gateway-port): reaching it from another machine is an exposure you put in front of it and declare. Setup refuses it on a Mend image that has no gateway, and says whether it answered. It is kept across reruns and upgrades; --no-t3-gateway turns it off, and its state stays in its own volume, mend-t3-gateway. Off, nothing of it runs.",
       "--exposure declares how the instance is reached, and --tenancy whether one organization or many use it. Both are written into the generation and kept across reruns and upgrades. public needs the edge and an existing first account. With multi, or with public, the multi mode gate's settings follow: MEND_SOURCE_POLICY=tenant and MEND_CAPTURE_REQUIRE_SIZES=true, and public sets MEND_URL_BEARERS=refuse. The server still decides whether it starts, and mend server status shows what it reports.",
       "Two mirrors run beside Mend unless turned off: an npm mirror (nginx caching npmjs.org, capped at 10g by default, least recently used out) and a Docker mirror (a pull-through cache of Docker Hub, capped at 20g by default: over the cap its cache is cleared). Both leave 5g free on their disk: below that, nginx evicts and the Docker mirror pauses, and sessions pull from Docker Hub directly. Neither publishes a host port. Sessions install npm packages and pull Docker Hub images through them; a project's own npm settings win, and a mirror that is down sends sessions upstream instead. Both are kept across reruns and upgrades, and an upgrade adds them to an install from before them. The Docker mirror pulls anonymously unless given a Docker Hub login: --docker-hub-username with the access token piped on standard input, kept in server.env only. The mirror has no login of its own, so every session that reaches it can pull whatever that token can read: setup takes a login only with --docker-hub-public-only, your statement that the token's access permission is Public Repo Read-only. Mend cannot check a token's scope.",
       "Docker Desktop on Linux and macOS, and OrbStack on macOS, expose client-side proxy sockets. Containers use the daemon-side /var/run/docker.sock. --docker-socket overrides detection and is retained on reruns.",
@@ -3287,6 +3323,15 @@ var COMMANDS = [
         text: "run the Caddy TLS edge for this DNS name on 80 and 443; the origin becomes https://<host>, --bind stays on loopback, and the first account must already exist"
       },
       { flag: "--no-edge", text: "take a saved edge away; the origin returns to http://localhost" },
+      {
+        flag: "--t3-gateway",
+        text: "run the t3code gateway, published on 127.0.0.1:3120 only; kept across reruns and upgrades"
+      },
+      {
+        flag: "--t3-gateway-port <n>",
+        text: "the gateway's port on 127.0.0.1; implies --t3-gateway"
+      },
+      { flag: "--no-t3-gateway", text: "turn the t3code gateway off; its state stays" },
       {
         flag: "--exposure <v>",
         text: "declare loopback, private or public; kept across reruns and upgrades. public needs --edge and an existing first account"
@@ -6835,7 +6880,8 @@ var optionalFileKeys = [
   "caddyfile",
   "mirrors",
   "npmMirrorConf",
-  "dockerMirrorGuard"
+  "dockerMirrorGuard",
+  "t3Gateway"
 ];
 var fileNames = {
   identity: "identity.env",
@@ -6848,7 +6894,8 @@ var fileNames = {
   caddyfile: "Caddyfile",
   mirrors: "compose.mirrors.yaml",
   npmMirrorConf: "npm-mirror.conf",
-  dockerMirrorGuard: "docker-mirror-guard.sh"
+  dockerMirrorGuard: "docker-mirror-guard.sh",
+  t3Gateway: "compose.t3.yaml"
 };
 var fileModes = {
   identity: 384,
@@ -6861,7 +6908,8 @@ var fileModes = {
   caddyfile: 420,
   mirrors: 384,
   npmMirrorConf: 420,
-  dockerMirrorGuard: 420
+  dockerMirrorGuard: 420,
+  t3Gateway: 384
 };
 var allFiles = (files) => [...fileKeys, ...optionalFileKeys].map((key) => [key, files[key]]);
 var parseLockOwner = (raw) => {
@@ -6968,6 +7016,7 @@ var readActive = (paths) => {
   const mirrors = optional("mirrors");
   const npmMirrorConf = optional("npmMirrorConf");
   const dockerMirrorGuard = optional("dockerMirrorGuard");
+  const t3Gateway = optional("t3Gateway");
   const files = {
     identity: fs14.readFileSync(path15.join(directory, fileNames.identity), "utf8"),
     config: fs14.readFileSync(path15.join(directory, fileNames.config), "utf8"),
@@ -6979,7 +7028,8 @@ var readActive = (paths) => {
     ...caddyfile === void 0 ? {} : { caddyfile },
     ...mirrors === void 0 ? {} : { mirrors },
     ...npmMirrorConf === void 0 ? {} : { npmMirrorConf },
-    ...dockerMirrorGuard === void 0 ? {} : { dockerMirrorGuard }
+    ...dockerMirrorGuard === void 0 ? {} : { dockerMirrorGuard },
+    ...t3Gateway === void 0 ? {} : { t3Gateway }
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -7539,7 +7589,10 @@ var SETUP_FLAGS = /* @__PURE__ */ new Set([
   "--docker-hub-username",
   "--docker-hub-token-stdin",
   "--docker-hub-public-only",
-  "--no-docker-hub-login"
+  "--no-docker-hub-login",
+  "--t3-gateway",
+  "--t3-gateway-port",
+  "--no-t3-gateway"
 ]);
 var SWITCHES = /* @__PURE__ */ new Set([
   "--offline",
@@ -7550,7 +7603,9 @@ var SWITCHES = /* @__PURE__ */ new Set([
   "--no-docker-mirror",
   "--docker-hub-token-stdin",
   "--docker-hub-public-only",
-  "--no-docker-hub-login"
+  "--no-docker-hub-login",
+  "--t3-gateway",
+  "--no-t3-gateway"
 ]);
 var parseExposure = (value) => {
   if (!isExposure(value))
@@ -7663,6 +7718,10 @@ var parseSetupOptions = (args) => {
     throw setupError(
       `--docker-hub-username and ${noDockerHubLogin ? "--no-docker-hub-login" : "--no-docker-mirror"} contradict each other.`
     );
+  const t3GatewayPort = flagValue3("--t3-gateway-port");
+  if (values.has("--no-t3-gateway") && (values.has("--t3-gateway") || t3GatewayPort !== void 0)) {
+    throw setupError("--no-t3-gateway contradicts --t3-gateway and --t3-gateway-port.");
+  }
   return {
     context: flagValue3("--context"),
     version: version === void 0 ? void 0 : parseVersion(version),
@@ -7686,7 +7745,10 @@ var parseSetupOptions = (args) => {
     dockerMirrorMaxSize,
     dockerHubUsername,
     dockerHubTokenStdin,
-    noDockerHubLogin
+    noDockerHubLogin,
+    t3Gateway: values.has("--t3-gateway"),
+    t3GatewayPort: t3GatewayPort === void 0 ? void 0 : parsePort(t3GatewayPort, "--t3-gateway-port"),
+    noT3Gateway: values.has("--no-t3-gateway")
   };
 };
 var resolveMirrors = (saved, options) => {
@@ -7844,6 +7906,15 @@ var validateExposure = (existing, options) => {
   const edgeHost = options.noEdge ? void 0 : options.edge ?? existing?.edgeHost;
   const exposure = options.exposure ?? existing?.exposure;
   const tenancy = options.tenancy ?? existing?.tenancy;
+  const t3GatewayPort = options.noT3Gateway ? void 0 : options.t3GatewayPort ?? existing?.t3GatewayPort ?? (options.t3Gateway ? DEFAULT_T3_GATEWAY_PORT : void 0);
+  if (t3GatewayPort !== void 0 && [appPort, sshPort].includes(t3GatewayPort)) {
+    throw setupError(
+      `--t3-gateway-port ${t3GatewayPort} is Mend's own --port or --ssh-port: the gateway needs a port of its own.`
+    );
+  }
+  if (t3GatewayPort !== void 0 && edgeHost !== void 0 && [80, 443].includes(t3GatewayPort)) {
+    throw setupError("With an edge, --t3-gateway-port must not be 80 or 443: the edge has them.");
+  }
   const declared = options.declared ?? existing?.declared ?? [];
   checkPosture(bind, sshBind ?? bind, { appPort, sshPort }, edgeHost, exposure, declared);
   const appUrl = resolveAppUrl(existing, options, appPort, edgeHost);
@@ -7864,7 +7935,8 @@ var validateExposure = (existing, options) => {
     ...edgeHost === void 0 ? {} : { edgeHost },
     ...exposure === void 0 ? {} : { exposure },
     ...tenancy === void 0 ? {} : { tenancy },
-    ...declared.length === 0 ? {} : { declared }
+    ...declared.length === 0 ? {} : { declared },
+    ...t3GatewayPort === void 0 ? {} : { t3GatewayPort }
   };
 };
 var parseServerConfig = (raw) => {
@@ -7910,6 +7982,7 @@ var parseServerConfig = (raw) => {
     );
   }
   const declared = Array.isArray(declaredField) ? declaredField.filter((item) => isDeclarableItem(String(item))) : [];
+  const t3GatewayPort = fields.has("t3GatewayPort") ? requiredInteger(fields, "t3GatewayPort") : void 0;
   const config = {
     schemaVersion: requiredInteger(fields, "schemaVersion"),
     assetContract: requiredString(fields, "assetContract"),
@@ -7932,7 +8005,8 @@ var parseServerConfig = (raw) => {
     ...exposure === void 0 ? {} : { exposure },
     ...tenancy === void 0 ? {} : { tenancy },
     ...declared.length === 0 ? {} : { declared },
-    ...fields.has("mirrors") ? { mirrors: parseMirrorsField(fields.get("mirrors")) } : {}
+    ...fields.has("mirrors") ? { mirrors: parseMirrorsField(fields.get("mirrors")) } : {},
+    ...t3GatewayPort === void 0 ? {} : { t3GatewayPort }
   };
   if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT && !LEGACY_ASSET_CONTRACTS.has(config.assetContract)) {
     throw setupError(
@@ -7943,6 +8017,8 @@ var parseServerConfig = (raw) => {
   parsePort(String(config.sshPort), "Server config sshPort");
   if (config.registryPort !== void 0)
     parsePort(String(config.registryPort), "Server config registryPort");
+  if (config.t3GatewayPort !== void 0)
+    parsePort(String(config.t3GatewayPort), "Server config t3GatewayPort");
   validateExposure(null, {
     context: void 0,
     version: void 0,
@@ -7966,7 +8042,10 @@ var parseServerConfig = (raw) => {
     dockerMirrorMaxSize: void 0,
     dockerHubUsername: void 0,
     dockerHubTokenStdin: false,
-    noDockerHubLogin: false
+    noDockerHubLogin: false,
+    t3Gateway: false,
+    t3GatewayPort: config.t3GatewayPort,
+    noT3Gateway: false
   });
   return config;
 };
@@ -8360,12 +8439,22 @@ var validateOverlays = (config, files) => {
   }
   for (const line of postureEnvLines(config)) {
     const key = line.slice(0, line.indexOf("="));
-    if (key !== "MEND_EDGE_HOST" && !(files.posture ?? "").includes(`      ${key}: \${${key}`)) {
+    if (key !== "MEND_EDGE_HOST" && key !== "MEND_T3_GATEWAY_PORT" && !(files.posture ?? "").includes(`      ${key}: \${${key}`)) {
       throw setupError(
         `Server generation is corrupt: compose.posture.yaml does not hand ${key} to Mend.`
       );
     }
   }
+  if (config.t3GatewayPort === void 0 !== (files.t3Gateway === void 0)) {
+    throw setupError(
+      "Server generation is corrupt: compose.t3.yaml does not match the persisted server config."
+    );
+  }
+  if (files.t3Gateway !== void 0 && (!files.t3Gateway.includes('MEND_T3_GATEWAY_ENABLED: "true"') || !files.t3Gateway.includes('"127.0.0.1:${MEND_T3_GATEWAY_PORT'))) {
+    throw setupError(
+      "Server generation is corrupt: compose.t3.yaml is not the gateway overlay on loopback."
+    );
+  }
   if (config.edgeHost === void 0 !== (files.edge === void 0) || config.edgeHost === void 0 !== (files.caddyfile === void 0)) {
     throw setupError(
       "Server generation is corrupt: compose.edge.yaml and Caddyfile do not match the persisted server config."
@@ -8478,7 +8567,8 @@ var readServerInstallationFacts = async (configDir) => {
           ...generation.files.posture === void 0 ? [] : [{ name: "compose.posture.yaml", content: generation.files.posture }],
           ...generation.files.mirrors === void 0 ? [] : [{ name: MIRRORS_COMPOSE_FILE, content: generation.files.mirrors }],
           ...generation.files.npmMirrorConf === void 0 ? [] : [{ name: NPM_MIRROR_CONF_NAME, content: generation.files.npmMirrorConf }],
-          ...generation.files.dockerMirrorGuard === void 0 ? [] : [{ name: DOCKER_MIRROR_GUARD_NAME, content: generation.files.dockerMirrorGuard }]
+          ...generation.files.dockerMirrorGuard === void 0 ? [] : [{ name: DOCKER_MIRROR_GUARD_NAME, content: generation.files.dockerMirrorGuard }],
+          ...generation.files.t3Gateway === void 0 ? [] : [{ name: "compose.t3.yaml", content: generation.files.t3Gateway }]
         ],
         envKeys: envKeyNames(generation.files.env)
       };
@@ -8491,6 +8581,7 @@ var readServerInstallationFacts = async (configDir) => {
 var generationFiles = (config, secrets, assets, identity = renderIdentity(secrets)) => {
   const posture = renderPostureOverlay(config);
   const mirrors = renderMirrorsOverlay(config.mirrors);
+  const t3Gateway = renderT3GatewayOverlay(config);
   return {
     identity,
     config: `${JSON.stringify(config, null, 2)}
@@ -8498,6 +8589,7 @@ var generationFiles = (config, secrets, assets, identity = renderIdentity(secret
     env: renderSecrets(secrets, config),
     ...assets,
     ...posture === void 0 ? {} : { posture },
+    ...t3Gateway === void 0 ? {} : { t3Gateway },
     ...config.edgeHost === void 0 ? {} : { edge: EDGE_COMPOSE_OVERLAY, caddyfile: EDGE_CADDYFILE },
     ...mirrors === void 0 ? {} : { mirrors },
     ...config.mirrors === void 0 || config.mirrors.npm === null ? {} : { npmMirrorConf: NPM_MIRROR_CONF },
@@ -8511,6 +8603,18 @@ var healthOrigin = (config) => {
   return `http://${host}:${config.appPort}`;
 };
 var reachableLine = (config) => config.edgeHost === void 0 ? `Mend ${config.serverVersion} is reachable at ${config.appUrl}` : `Mend ${config.serverVersion} answers at ${healthOrigin(config)} on this machine \xB7 the edge is set up for ${config.appUrl}`;
+var T3_GATEWAY_OBSERVE_ATTEMPTS = 15;
+var observeT3Gateway = async (runtime, port) => {
+  const url = `http://127.0.0.1:${port}/.well-known/t3/environment`;
+  for (let attempt2 = 0; attempt2 < T3_GATEWAY_OBSERVE_ATTEMPTS; attempt2 += 1) {
+    const response = await runtime.fetchText(url, 2e3);
+    if (response.error === void 0 && response.status === 200) {
+      return `The t3code gateway answered at 127.0.0.1:${port}, observed from this machine; it is published there only. In t3code, add it as an environment at http://127.0.0.1:${port} and pair with a code from mend pair; reaching it from elsewhere is an exposure you put in front of it and declare (docs/adr/0004).`;
+    }
+    if (attempt2 < T3_GATEWAY_OBSERVE_ATTEMPTS - 1) await runtime.sleep(2e3);
+  }
+  return `The t3code gateway did not answer at 127.0.0.1:${port} from this machine within about a minute. Mend runs without it; mend server logs shows what it said, and mend server status looks again.`;
+};
 var probeHealth = async (runtime, appUrl, expectedVersion) => {
   const healthUrl = `${appUrl}/api/health`;
   let lastFailure = "request did not complete";
@@ -8639,6 +8743,22 @@ var checkLocalImages = async (runtime, installation, policy = "local") => {
       `Image ${image} must carry org.opencontainers.image.version=${config.serverVersion}.`
     );
   }
+  if (config.t3GatewayPort !== void 0) {
+    const gateway = await runtime.run("docker", [
+      "--context",
+      config.dockerContext,
+      "image",
+      "inspect",
+      image,
+      "--format",
+      `{{index .Config.Labels "${T3_GATEWAY_IMAGE_LABEL}"}}`
+    ]);
+    if (gateway.status !== 0 || gateway.stdout.trim() !== "1") {
+      throw setupError(
+        `Mend ${config.serverVersion} has no t3code gateway (its image carries no ${T3_GATEWAY_IMAGE_LABEL} label). Upgrade to a version that has one with mend server upgrade --version <version>, then turn it on; or run mend server setup --no-t3-gateway`
+      );
+    }
+  }
   const postgres = await inspectImage(
     runtime,
     config.dockerContext,
@@ -8965,6 +9085,11 @@ var setupServer = async (args, runtime, store) => {
     ...savedSecrets ?? createSecrets(runtime),
     ...dockerHubToken === void 0 ? {} : { dockerHubToken }
   };
+  if (config.t3GatewayPort !== void 0 && config.t3GatewayPort !== existing?.config.t3GatewayPort && config.dockerEndpoint.startsWith("unix://") && runtime.portTaken !== void 0 && await runtime.portTaken(config.t3GatewayPort)) {
+    throw setupError(
+      `127.0.0.1:${config.t3GatewayPort} is already in use on this machine, so the t3code gateway cannot be published there and Mend would not start. Free it, or pick another with --t3-gateway-port <n>`
+    );
+  }
   const generation = persistSetup(store, config, secrets, assets);
   const installation = {
     directory: generation.directory,
@@ -8994,6 +9119,14 @@ var setupServer = async (args, runtime, store) => {
   if (edgeStarted !== null) runtime.writeLine(edgeStarted);
   const sshPublication = await sshPublicationLine(runtime, config);
   if (sshPublication !== null) runtime.writeLine(sshPublication);
+  if (config.t3GatewayPort !== void 0) {
+    runtime.writeLine(await observeT3Gateway(runtime, config.t3GatewayPort));
+  }
+  if (existing?.config.t3GatewayPort !== void 0 && config.t3GatewayPort === void 0) {
+    runtime.writeLine(
+      `The t3code gateway is off. Its state (pairings and the device tokens they hold, queued messages) stays in its volume and comes back if you turn it on again; to remove it: docker --context ${config.dockerContext} volume rm mend_${T3_GATEWAY_VOLUME}`
+    );
+  }
   if (existing?.config.edgeHost !== void 0 && config.edgeHost === void 0) {
     runtime.writeLine(
       `The edge for ${existing.config.edgeHost} is gone. Its certificate volumes stay until you remove them: docker --context ${config.dockerContext} volume rm mend_mend-edge-data mend_mend-edge-config`
@@ -9627,6 +9760,15 @@ var serverStatus = async (runtime, installation) => {
   }
   for (const line of await mirrorStatusLines(runtime, installation, runningServices))
     runtime.writeLine(line);
+  if (config.t3GatewayPort !== void 0 && runningServices.includes("mend")) {
+    const gateway = await runtime.fetchText(
+      `http://127.0.0.1:${config.t3GatewayPort}/.well-known/t3/environment`,
+      2e3
+    );
+    runtime.writeLine(
+      gateway.error === void 0 && gateway.status === 200 ? `t3code gateway \xB7 observed answering at 127.0.0.1:${config.t3GatewayPort} from this machine` : `t3code gateway \xB7 not observed at 127.0.0.1:${config.t3GatewayPort} from this machine \xB7 mend server logs shows what it said`
+    );
+  }
   if (!runningServices.includes("mend")) {
     runtime.writeLine("Mend is stopped. No health claim was made.");
     return;
@@ -9743,6 +9885,7 @@ var nodeServerRuntime = () => {
     dockerDaemonFacts: hostDockerDaemonFacts,
     readLogin: (configDir) => savedLogin(configDir, environment),
     probeSsh: probeSshFromHere,
+    portTaken: portTakenHere,
     readStdin: async () => {
       const chunks = [];
       for await (const chunk of process.stdin)
@@ -9774,6 +9917,11 @@ var sshBannerAt = async (host, port, timeoutMs) => {
     socket.destroy();
   }
 };
+var portTakenHere = (port) => new Promise((resolve8) => {
+  const server = net3.createServer();
+  server.once("error", (error) => resolve8(error.code === "EADDRINUSE"));
+  server.listen(port, "127.0.0.1", () => server.close(() => resolve8(false)));
+});
 var probeSshFromHere = async (bind, port) => {
   const unspecified = bind === "0.0.0.0" || bind === "::";
   const addresses = unspecified ? Object.values(os10.networkInterfaces()).flatMap((entries) => entries ?? []).filter(
@@ -10748,11 +10896,65 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   try {
     fs18.mkdirSync(path18.dirname(configFile), { recursive: true, mode: 448 });
     fs18.chmodSync(path18.dirname(configFile), 448);
-    fs18.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs18.chmodSync(configFile, 384);
+    replaceFileAtomically(configFile, reconciled.value, 384);
     return success(void 0);
   } catch (cause) {
-    return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
+    return failure(
+      new WorkspaceSshError(
+        "config",
+        `Could not write ${configFile}${cause instanceof Error ? `: ${cause.message}` : "."}`,
+        cause
+      )
+    );
+  }
+};
+var linkTarget = (file) => {
+  let current = file;
+  for (let hops = 0; hops < 40; hops += 1) {
+    let stat;
+    try {
+      stat = fs18.lstatSync(current);
+    } catch {
+      if (current !== file && !fs18.existsSync(path18.dirname(current))) {
+        throw new Error(
+          `${file} is a symlink to ${current}, whose directory does not exist. Create it, or replace the link with a file; Mend left the link as it is.`
+        );
+      }
+      return current;
+    }
+    if (!stat.isSymbolicLink()) return current;
+    current = path18.resolve(path18.dirname(current), fs18.readlinkSync(current));
+  }
+  throw new Error(`${file} is a chain of symlinks too long to follow; Mend left it as it is.`);
+};
+var replaceFileAtomically = (file, contents, mode) => {
+  const destination = linkTarget(file);
+  const temporary = path18.join(
+    path18.dirname(destination),
+    `.${path18.basename(destination)}.mend-${process.pid}-${createHash3("sha256").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 12)}`
+  );
+  let descriptor = null;
+  try {
+    descriptor = fs18.openSync(temporary, "wx", mode);
+    fs18.writeFileSync(descriptor, contents);
+    fs18.fsyncSync(descriptor);
+    fs18.closeSync(descriptor);
+    descriptor = null;
+    fs18.chmodSync(temporary, mode);
+    fs18.renameSync(temporary, destination);
+  } catch (cause) {
+    if (descriptor !== null) fs18.closeSync(descriptor);
+    fs18.rmSync(temporary, { force: true });
+    throw cause;
+  }
+  try {
+    const directory = fs18.openSync(path18.dirname(destination), "r");
+    try {
+      fs18.fsyncSync(directory);
+    } finally {
+      fs18.closeSync(directory);
+    }
+  } catch {
   }
 };
 
@@ -11112,6 +11314,17 @@ var describeUninstall = async (runtime, scope) => {
         dockerContext: read.value.config.dockerContext,
         edgeHost: read.value.config.edgeHost ?? null,
         mirrors: mirrorServices(read.value.config.mirrors),
+        t3GatewayVolume: read.value.config.t3GatewayPort !== void 0 || (await runtime.server.run(
+          "docker",
+          dockerArgs(
+            read.value.config.dockerContext,
+            "volume",
+            "inspect",
+            `mend_${T3_GATEWAY_VOLUME}`,
+            "--format",
+            "{{json .}}"
+          )
+        )).status === 0,
         generations: countEntries(path20.join(configDir, "generations")),
         backups: countEntries(path20.join(configDir, "backups"))
       };
@@ -11145,7 +11358,9 @@ var planLines = (plan, configDir) => {
       const edge = [...edgeHost === null ? [] : ["edge"], ...mirrors];
       const edgeVolumes = [
         ...edgeHost === null ? [] : ["mend-edge-data", "mend-edge-config"],
-        ...mirrors.map((service) => `mend-${service}`)
+        ...mirrors.map((service) => `mend-${service}`),
+        // The t3code gateway's state, with paired people's device tokens, when it is there.
+        ...plan.server.t3GatewayVolume === true ? [T3_GATEWAY_VOLUME] : []
       ];
       lines.push(
         `         containers ${["mend", "postgres", "garage", ...edge].join(", ")} \xB7 volumes ${[MEND_DOCKER_NAMESPACE_WITH_GARAGE.store, ...secondaryVolumesOf(MEND_DOCKER_NAMESPACE_WITH_GARAGE), "mend-config", "mend-ssh", "mend-postgres", ...edgeVolumes].join(", ")} \xB7 image ghcr.io/sealant-sh/mend:${version}${edgeHost === null ? "" : ` \xB7 the edge for ${edgeHost}`}`
@@ -11211,6 +11426,24 @@ var removeServer = async (runtime, failures, leftovers) => {
         server.writeLine(
           `removed containers ${["mend", "postgres", "garage", ...mirrorServices(installation.config.mirrors)].join(", ")} and the Compose-owned volumes`
         );
+        const gatewayVolume = `mend_${T3_GATEWAY_VOLUME}`;
+        const gatewayLeft = await server.run(
+          "docker",
+          dockerArgs(context, "volume", "inspect", gatewayVolume, "--format", "{{json .}}")
+        );
+        if (gatewayLeft.status === 0) {
+          const gone = await server.run(
+            "docker",
+            dockerArgs(context, "volume", "rm", gatewayVolume)
+          );
+          if (gone.status === 0) {
+            server.writeLine(`removed volume ${gatewayVolume}, the t3code gateway's state`);
+          } else {
+            failures.push(
+              `could not remove volume ${gatewayVolume} (the t3code gateway's state, with paired device tokens): ${(gone.error ?? gone.stderr.trim()) || "no output"}`
+            );
+          }
+        }
         const namespace = installation.config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
         const dataVolumes = [namespace.store, ...secondaryVolumesOf(namespace)];
         const identity = store.readIdentity();

package/man/mend-accounts.1

@@ -1,4 +1,4 @@
-.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ACCOUNTS 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-accounts \- your connected accounts on the platform
 .SH SYNOPSIS

package/man/mend-adopt.1

@@ -1,4 +1,4 @@
-.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ADOPT 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-adopt \- adopt a repository into the store
 .SH SYNOPSIS

package/man/mend-attach.1

@@ -1,4 +1,4 @@
-.TH MEND-ATTACH 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ATTACH 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-attach \- reattach this terminal to a running session
 .SH SYNOPSIS

package/man/mend-codex.1

@@ -1,4 +1,4 @@
-.TH MEND-CODEX 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CODEX 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-codex \- launch codex, claude, opencode or pi in a recorded worktree
 .SH SYNOPSIS

package/man/mend-completions.1

@@ -1,4 +1,4 @@
-.TH MEND-COMPLETIONS 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-COMPLETIONS 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-completions \- print the TAB\-completion hook
 .SH SYNOPSIS

package/man/mend-connect-pi.1

@@ -1,4 +1,4 @@
-.TH MEND-CONNECT-PI 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CONNECT-PI 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-connect\-pi \- send your pi setup to every pi session of yours
 .SH SYNOPSIS

package/man/mend-connect.1

@@ -1,4 +1,4 @@
-.TH MEND-CONNECT 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CONNECT 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-connect \- send this machine's provider credential to the platform
 .SH SYNOPSIS

package/man/mend-continue.1

@@ -1,4 +1,4 @@
-.TH MEND-CONTINUE 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-CONTINUE 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-continue \- resume a session with its pending review follow\-up
 .SH SYNOPSIS

package/man/mend-doctor.1

@@ -1,4 +1,4 @@
-.TH MEND-DOCTOR 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOCTOR 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-doctor \- check this machine's setup, or bundle it for a bug report
 .SH SYNOPSIS

package/man/mend-dotfiles-repo.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES-REPO 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOTFILES-REPO 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-dotfiles\-repo \- set or clear the repository the server clones at launch
 .SH SYNOPSIS

package/man/mend-dotfiles-sync.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES-SYNC 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOTFILES-SYNC 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-dotfiles\-sync \- capture config files from this machine into your store
 .SH SYNOPSIS

package/man/mend-dotfiles.1

@@ -1,4 +1,4 @@
-.TH MEND-DOTFILES 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-DOTFILES 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-dotfiles \- your dotfiles on the server: repo and synced files
 .SH SYNOPSIS

package/man/mend-env-cluster.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-CLUSTER 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ENV-CLUSTER 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-env\-cluster \- bind Kubernetes secrets and configmaps to the workspaces
 .SH SYNOPSIS

package/man/mend-env-load.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-LOAD 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ENV-LOAD 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-env\-load \- load a .env into the project
 .SH SYNOPSIS

package/man/mend-env-show.1

@@ -1,4 +1,4 @@
-.TH MEND-ENV-SHOW 1 "" "mend 0.36.0\-next.684" "mend manual"
+.TH MEND-ENV-SHOW 1 "" "mend 0.36.0\-next.708" "mend manual"
 .SH NAME
 mend\-env\-show \- what the project store holds: names only, never values
 .SH SYNOPSIS