@sealant/mend 0.36.0-next.684 → 0.36.0-next.721

package/dist/main.js

@@ -54,6 +54,8 @@ import {
   repositoryCloneUrlIssue,
   sameGrant,
   serviceStartCorrelation,
+  serviceViewAttempt,
+  serviceViewStatus,
   servicesHoldOf,
   sessionDisplayName,
   sessionWorkspaceLines,
@@ -71,14 +73,14 @@ import {
   workspaceRetirementLine,
   worktreeJoinLine,
   worktreeListsPeople
-} from "./chunk-DHM7VXTR.js";
+} from "./chunk-GF5A6W2Y.js";
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
 import * as crypto from "node:crypto";
 import * as fs21 from "node:fs";
 import { createRequire } from "node:module";
-import * as net5 from "node:net";
+import * as net6 from "node:net";
 import * as os13 from "node:os";
 import * as path21 from "node:path";
 
@@ -102,12 +104,12 @@ var claudeMemoryDirFor = (repoRoot, home = claudeHome()) => {
 var scanClaudeMemory = (dir) => {
   const files = [];
   const notes = [];
-  const walk2 = (abs, rel) => {
+  const walk3 = (abs, rel) => {
     for (const entry of fs.readdirSync(abs, { withFileTypes: true }).toSorted((a, b) => a.name < b.name ? -1 : 1)) {
       const at = rel === "" ? entry.name : `${rel}/${entry.name}`;
       const full = path.join(abs, entry.name);
       if (entry.isDirectory()) {
-        walk2(full, at);
+        walk3(full, at);
         continue;
       }
       if (!entry.isFile()) continue;
@@ -126,7 +128,7 @@ var scanClaudeMemory = (dir) => {
       );
     }
   };
-  walk2(dir, "");
+  walk3(dir, "");
   return { dir, files, notes };
 };
 var machineIdFor = (configDir, create) => {
@@ -1280,7 +1282,15 @@ var isTenancy = (value) => TENANCIES.some((tenancy) => tenancy === value);
 var EDGE_IMAGE = "caddy:2.10-alpine";
 var EDGE_COMPOSE_FILE = "compose.edge.yaml";
 var POSTURE_COMPOSE_FILE = "compose.posture.yaml";
-var DECLARABLE_ITEMS = ["core-private", "edge-tls", "workspace-ssh"];
+var T3_GATEWAY_COMPOSE_FILE = "compose.t3.yaml";
+var T3_GATEWAY_CONTAINER_PORT = 3120;
+var DEFAULT_T3_GATEWAY_PORT = 3120;
+var DECLARABLE_ITEMS = [
+  "core-private",
+  "edge-tls",
+  "workspace-ssh",
+  "t3code-gateway"
+];
 var isDeclarableItem = (value) => DECLARABLE_ITEMS.some((item) => item === value);
 var publishedAddress = (address, port) => `${net2.isIP(address) === 6 ? `[${address}]` : address}:${port}`;
 var parseEdgeHost = (value) => {
@@ -1307,6 +1317,7 @@ var postureEnvironment = (posture) => {
 };
 var postureEnvLines = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [`MEND_EDGE_HOST=${posture.edgeHost}`],
+  ...posture.t3GatewayPort === void 0 ? [] : [`MEND_T3_GATEWAY_PORT=${posture.t3GatewayPort}`],
   ...postureEnvironment(posture).map(([key, value]) => `${key}=${value}`)
 ];
 var renderPostureOverlay = (posture) => {
@@ -1326,10 +1337,33 @@ var renderPostureOverlay = (posture) => {
     ""
   ].join("\n");
 };
+var T3_GATEWAY_VOLUME = "mend-t3-gateway";
+var T3_GATEWAY_IMAGE_LABEL = "dev.sealant.mend.t3-gateway";
+var T3_GATEWAY_STATE_DIR = "/opt/mend-t3-gateway/state";
+var renderT3GatewayOverlay = (posture) => {
+  if (posture.t3GatewayPort === void 0) return void 0;
+  return [
+    "# Written by mend server setup --t3-gateway: the t3code gateway (docs/adr/0012), its own",
+    "# listener beside Mend's, published on loopback only. Reaching it from elsewhere is an",
+    "# exposure the operator declares (docs/adr/0004). mend server setup --no-t3-gateway removes it.",
+    "services:",
+    "  mend:",
+    "    environment:",
+    '      MEND_T3_GATEWAY_ENABLED: "true"',
+    "    ports:",
+    `      - "127.0.0.1:\${MEND_T3_GATEWAY_PORT:?set MEND_T3_GATEWAY_PORT in server.env}:${T3_GATEWAY_CONTAINER_PORT}"`,
+    "    volumes:",
+    `      - ${T3_GATEWAY_VOLUME}:${T3_GATEWAY_STATE_DIR}`,
+    "volumes:",
+    `  ${T3_GATEWAY_VOLUME}:`,
+    ""
+  ].join("\n");
+};
 var composeOverlays = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [EDGE_COMPOSE_FILE],
   ...renderPostureOverlay(posture) === void 0 ? [] : [POSTURE_COMPOSE_FILE],
-  ...runsMirrors(posture.mirrors) ? [MIRRORS_COMPOSE_FILE] : []
+  ...runsMirrors(posture.mirrors) ? [MIRRORS_COMPOSE_FILE] : [],
+  ...posture.t3GatewayPort === void 0 ? [] : [T3_GATEWAY_COMPOSE_FILE]
 ];
 var record = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? new Map(Object.entries(value)) : null;
 var healthPosture = (body) => {
@@ -1353,6 +1387,9 @@ var healthPosture = (body) => {
 };
 var declaredPostureLines = (posture) => [
   ...posture.edgeHost === void 0 ? [] : [`edge \xB7 ${posture.edgeHost} \xB7 ${EDGE_IMAGE} on 80 and 443 \xB7 Mend's own port on loopback`],
+  ...posture.t3GatewayPort === void 0 ? [] : [
+    `t3code gateway \xB7 on \xB7 127.0.0.1:${posture.t3GatewayPort} \xB7 loopback only \xB7 reaching it from elsewhere is an exposure you declare`
+  ],
   `exposure \xB7 declared ${posture.exposure ?? "private"}${posture.exposure === void 0 ? " \xB7 the default, not set on this install" : ""}`,
   `tenancy \xB7 declared ${posture.tenancy ?? "single"}${posture.tenancy === void 0 ? " \xB7 the default, not set on this install" : ""}`,
   ...posture.sshBind === void 0 || posture.sshPort === void 0 ? [] : [
@@ -2328,6 +2365,7 @@ var COMMANDS = [
     synopsis: ["[--no-tunnel]"],
     description: [
       "A full-screen view of every project and session, updating live. The session pane takes three quarters of the screen: a read-only detail for the selected session with the conversation record it has written so far. The remaining quarter is a sidebar of three stacked sections, projects then worktrees then sessions, where the section you are in stands open and the other two fold to the line that says what is selected. Bare mend with no command opens the same thing.",
+      "Every pane carries its number in its title, as lazygit's do: [1] projects, [2] worktrees, [3] sessions, and [0] the session pane. A digit jumps to its pane, tab and Shift+Tab cycle through them and come back round, and esc goes back to where you came from. ? lists every key, / filters the focused list (enter keeps the filter, esc clears it), and + and _ cycle the screen mode: normal, half (the sidebar takes half the width) and full (the side you are on takes the screen).",
       "Moving the selection only ever navigates: arrows or j/k move inside the open section, enter and the arrows move between the sidebar and the session pane, and nothing takes this terminal until you ask. Reading the record leaves the sidebar as it was. The verbs are a to attach a live session, r to resume a settled one, n for another session in the selected worktree, w for a new worktree, e to rename, v to review the change, o to open it in the browser, Shift+K to stop (on a row whose agent has stopped while its Services keep the workspace up, Shift+K stops those Services), Shift+D to remove, and Shift+R to refresh.",
       "Nothing is ever squeezed. A terminal too narrow for both gives the whole width to the side you are on, a terminal too short for three drawn panes shows the open section alone, and a one-line breadcrumb states whatever did not fit.",
       "On a server that is not this machine, the selected session's live Services declared --http or --https are tunneled to this machine's loopback while it stays selected, and the session pane shows where each one opens, for example web \u2192 http://localhost:5173.",
@@ -2342,7 +2380,7 @@ var COMMANDS = [
     summary: "the dashboard, with snake over it",
     synopsis: [],
     description: [
-      "Opens the dashboard with a game of snake floating over it. The arrows steer, space pauses, and esc or q closes the game and leaves you in the dashboard, which has been live underneath the whole time. The same game appears on its own in the session pane while a session is starting: a first session on a new project setup builds its image before it boots, about seven minutes on some families.",
+      "Opens the dashboard with a game of snake floating over it. It counts down 3, 2, 1, go before the snake moves. The arrows or h j k l steer, space or p pauses (and counts down again to resume), and esc or q closes the game and leaves you in the dashboard, which has been live underneath the whole time. The same game appears in the session pane while a session is starting: a first session on a new project setup builds its image before it boots, about seven minutes on some families. A start or resume from the dashboard hands the game the keyboard, as does enter or \u2192 into that pane; esc or q gives it back to the list you were in.",
       "Needs Node 26 or newer, like the dashboard."
     ],
     see: ["ui"]
@@ -3161,7 +3199,7 @@ var COMMANDS = [
     summary: "how this instance is exposed, as declared and as observed",
     synopsis: [],
     description: [
-      "Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item that blocks a start is open: every item the server can observe, and workspace-ssh until you declare it. Items it cannot observe say what would verify them; once you have verified core-private, edge-tls or workspace-ssh (SSH published apart from the web port) from outside, name it in MEND_EXPOSURE_DECLARED, or with mend server setup --declare. The report is what was observed; it is not a statement that the instance is fit to expose."
+      "Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item that blocks a start is open: every item the server can observe, and workspace-ssh until you declare it. Items it cannot observe say what would verify them; once you have verified core-private, edge-tls, workspace-ssh (SSH published apart from the web port) or (while it is enabled) t3code-gateway from outside, name it in MEND_EXPOSURE_DECLARED, or with mend server setup --declare. The report is what was observed; it is not a statement that the instance is fit to expose."
     ],
     see: ["operator gate", "doctor"]
   },
@@ -3245,20 +3283,28 @@ var COMMANDS = [
   {
     name: "server setup",
     section: "this machine",
-    summary: "install or repair the local Mend server",
+    summary: "install or change the local Mend server, guided",
     synopsis: [
-      "[--context <name>] [--version <version|latest>] [--bind <ip>] [--ssh-bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--edge <host> | --no-edge] [--exposure <loopback|private|public>] [--tenancy <single|multi>] [--declare <item>...] [--npm-mirror | --no-npm-mirror] [--npm-mirror-max-size <size>] [--docker-mirror | --no-docker-mirror] [--docker-mirror-max-size <size>] [--docker-hub-username <name> --docker-hub-token-stdin --docker-hub-public-only | --no-docker-hub-login] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
+      "",
+      "[--yes] [--context <name>] [--version <version|latest>] [--bind <ip>] [--ssh-bind <ip>] [--url <origin>] [--origin <origin>...] [--port <n>] [--ssh-port <n>] [--edge <host> | --no-edge] [--exposure <loopback|private|public>] [--tenancy <single|multi>] [--declare <item>...] [--undeclare <item>...] [--t3-gateway [--t3-gateway-port <n>] | --no-t3-gateway] [--npm-mirror | --no-npm-mirror] [--npm-mirror-max-size <size>] [--docker-mirror | --no-docker-mirror] [--docker-mirror-max-size <size>] [--docker-hub-username <name> --docker-hub-token-stdin --docker-hub-public-only | --no-docker-hub-login] [--docker-socket <path>] [--assets-dir <dir>] [--offline]"
     ],
     description: [
+      "On a terminal with no flags, setup asks its questions in plain words, one at a time: how people reach this Mend (just this machine, your private network or Tailscale, or the public internet with HTTPS), whether VS Code Remote-SSH reaches it from other machines, the T3 Code gateway, the mirrors, and one organization or several. It looks before it asks and says what it observed: Tailscale's name and address and what Tailscale Serve forwards, where your domain resolves, and whether ports 80 and 443 are taken. It never asks for an address to bind: that follows from the answers. On an existing install it shows what is saved and lets you keep it, change one thing, or go through every question. It ends with what changes, in words, and the same command with flags; nothing applies until you say yes.",
+      "Flags are for scripts and CI, and teach what the questions do. Each changes only what it names; everything else is kept from the saved install, so mend server setup --t3-gateway turns the gateway on and nothing more. When there is an install, a run with flags says what it changes. With no terminal and no flags, a fresh install is refused rather than guessed: --yes takes the defaults.",
       "Checks a local Unix-socket Docker context and the Compose plugin, downloads the compose and Postgres initialization assets for one Mend release, preserves existing data and secrets, and starts the server. Re-running repairs the same pinned version. A changed --version is refused; use mend server upgrade. Updating this CLI never updates an existing server pin.",
       "The default listens only on localhost at http://localhost:3105. Non-local access requires both --bind and --url. Every extra browser origin must be named with --origin; setup never guesses from the request Host header or network interfaces.",
       "--edge <host> runs a TLS edge in front of Mend: Caddy on ports 80 and 443 of every interface, which obtains and renews a certificate for the host and proxies to Mend's web tier. Mend's own port stays on loopback and the browser origin is https://<host>. The edge's compose overlay and Caddyfile are written into the generation beside compose.yaml, so start, restart and upgrade run them every time. --no-edge takes it away again, and the edge's container with it. A fresh install cannot start with the edge: until the first account exists, registration is open to whoever reaches the origin first, so set up on localhost, create the account, then add the edge.",
+      "--t3-gateway turns on the t3code gateway (docs/adr/0012): t3code's desktop, mobile and web clients add it as an environment, pair with a code from mend pair, and see this Mend's projects and sessions. It runs in the Mend container, confined to a root and a uid of its own, on a listener of its own published on 127.0.0.1 only (port 3120, or --t3-gateway-port): reaching it from another machine is an exposure you put in front of it and declare. Setup refuses it on a Mend image that has no gateway, and says whether it answered. It is kept across reruns and upgrades; --no-t3-gateway turns it off, and its state stays in its own volume, mend-t3-gateway. Off, nothing of it runs.",
       "--exposure declares how the instance is reached, and --tenancy whether one organization or many use it. Both are written into the generation and kept across reruns and upgrades. public needs the edge and an existing first account. With multi, or with public, the multi mode gate's settings follow: MEND_SOURCE_POLICY=tenant and MEND_CAPTURE_REQUIRE_SIZES=true, and public sets MEND_URL_BEARERS=refuse. The server still decides whether it starts, and mend server status shows what it reports.",
       "Two mirrors run beside Mend unless turned off: an npm mirror (nginx caching npmjs.org, capped at 10g by default, least recently used out) and a Docker mirror (a pull-through cache of Docker Hub, capped at 20g by default: over the cap its cache is cleared). Both leave 5g free on their disk: below that, nginx evicts and the Docker mirror pauses, and sessions pull from Docker Hub directly. Neither publishes a host port. Sessions install npm packages and pull Docker Hub images through them; a project's own npm settings win, and a mirror that is down sends sessions upstream instead. Both are kept across reruns and upgrades, and an upgrade adds them to an install from before them. The Docker mirror pulls anonymously unless given a Docker Hub login: --docker-hub-username with the access token piped on standard input, kept in server.env only. The mirror has no login of its own, so every session that reaches it can pull whatever that token can read: setup takes a login only with --docker-hub-public-only, your statement that the token's access permission is Public Repo Read-only. Mend cannot check a token's scope.",
       "Docker Desktop on Linux and macOS, and OrbStack on macOS, expose client-side proxy sockets. Containers use the daemon-side /var/run/docker.sock. --docker-socket overrides detection and is retained on reruns.",
       "Setup holds an exclusive process lock through startup and health checks. A busy lock reports its owner and manual recovery steps. Never remove a live lock. Private configuration uses immutable generations and an atomic active pointer; failed attempts retain credentials and never delete Docker volumes."
     ],
     options: [
+      {
+        flag: "--yes",
+        text: "no questions: a fresh install takes the defaults (this machine only, http://localhost:3105), an existing one keeps what is saved"
+      },
       {
         flag: "--context <name>",
         text: "local Docker context to persist; the global context is unchanged"
@@ -3275,7 +3321,7 @@ var COMMANDS = [
       { flag: "--url <origin>", text: "advertised browser URL, required with a non-loopback bind" },
       {
         flag: "--origin <origin>",
-        text: "additional exact browser origin; repeat for more than one"
+        text: "additional exact browser origin; repeat for more than one. The list given replaces the saved one; none clears it"
       },
       { flag: "--port <n>", text: "external web port. Default: 3105" },
       {
@@ -3287,6 +3333,15 @@ var COMMANDS = [
         text: "run the Caddy TLS edge for this DNS name on 80 and 443; the origin becomes https://<host>, --bind stays on loopback, and the first account must already exist"
       },
       { flag: "--no-edge", text: "take a saved edge away; the origin returns to http://localhost" },
+      {
+        flag: "--t3-gateway",
+        text: "run the t3code gateway, published on 127.0.0.1:3120 only; kept across reruns and upgrades"
+      },
+      {
+        flag: "--t3-gateway-port <n>",
+        text: "the gateway's port on 127.0.0.1; implies --t3-gateway"
+      },
+      { flag: "--no-t3-gateway", text: "turn the t3code gateway off; its state stays" },
       {
         flag: "--exposure <v>",
         text: "declare loopback, private or public; kept across reruns and upgrades. public needs --edge and an existing first account"
@@ -3297,7 +3352,11 @@ var COMMANDS = [
       },
       {
         flag: "--declare <item>",
-        text: "state a gate item you verified from outside: core-private, edge-tls or workspace-ssh; repeat for more, none clears. Kept across reruns. public with --ssh-bind beyond loopback needs workspace-ssh"
+        text: "state a gate item you verified from outside: core-private, edge-tls, workspace-ssh or t3code-gateway. Adds to what is saved; repeat for more, none clears. public with --ssh-bind beyond loopback needs workspace-ssh"
+      },
+      {
+        flag: "--undeclare <item>",
+        text: "take one statement back; the others stay. Repeat for more"
       },
       {
         flag: "--npm-mirror, --no-npm-mirror",
@@ -3339,7 +3398,18 @@ var COMMANDS = [
       { flag: "--docker-socket <path>", text: "daemon-side socket mount override for diagnostics" }
     ],
     examples: [
-      { command: "mend server setup", text: "localhost, using the current local Docker context" },
+      {
+        command: "mend server setup",
+        text: "on a terminal: the questions, then what changes and the same command with flags"
+      },
+      {
+        command: "mend server setup --t3-gateway",
+        text: "on an existing install: turn the T3 Code gateway on, and keep everything else"
+      },
+      {
+        command: "mend server setup --yes",
+        text: "no questions: localhost on a fresh install, using the current local Docker context"
+      },
       {
         command: "mend server setup --context orbstack --bind 0.0.0.0 --url http://100.70.80.90:3105",
         text: "explicit private-network exposure (a tailnet, a LAN, a VPN)"
@@ -5445,9 +5515,9 @@ var resolveServerUrl = async (args, deps) => {
   }
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const typed = (await rl.question(`mend server url ${dim3(`[${deps.defaultUrl}]`)}: `)).trim();
+  const typed2 = (await rl.question(`mend server url ${dim3(`[${deps.defaultUrl}]`)}: `)).trim();
   rl.close();
-  const chosen = typed === "" ? deps.defaultUrl : typed;
+  const chosen = typed2 === "" ? deps.defaultUrl : typed2;
   return normalizeServerUrl(chosen) ?? fail3(`"${chosen}" is not a URL the CLI can dial`);
 };
 var loginCommand = async (args, deps) => {
@@ -5603,7 +5673,7 @@ var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var scanFolder = (dir) => {
   const files = [];
   const skipped = [];
-  const walk2 = (relative5) => {
+  const walk3 = (relative5) => {
     const entries = fs12.readdirSync(path12.join(dir, relative5), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       const child = relative5 === "" ? entry.name : `${relative5}/${entry.name}`;
@@ -5611,7 +5681,7 @@ var scanFolder = (dir) => {
         skipped.push({ path: child, reason: "symlink" });
       } else if (entry.isDirectory()) {
         if (SKIPPED_DIRECTORIES.has(entry.name)) skipped.push({ path: child, reason: "skipped" });
-        else walk2(child);
+        else walk3(child);
       } else if (entry.isFile()) {
         const size = fs12.statSync(path12.join(dir, child)).size;
         if (size > FOLDER_FILE_BYTES) skipped.push({ path: child, reason: "over 1 MiB" });
@@ -5619,7 +5689,7 @@ var scanFolder = (dir) => {
       }
     }
   };
-  walk2("");
+  walk3("");
   return { files, skipped };
 };
 var uploadBatches = (files, cap = FOLDER_REQUEST_BYTES) => {
@@ -6233,13 +6303,13 @@ var processRowOf = (detail, processId) => {
   return rows.find((row) => row.exitedAt !== null) ?? rows[0];
 };
 var commandEndOf = (detail, processId = null) => {
-  const settled = SETTLED2.has(detail.session.status);
+  const settled2 = SETTLED2.has(detail.session.status);
   if (processId !== null) {
     const target = processRowOf(detail, processId);
     if (target !== void 0 && target.exitedAt !== null) {
       return { processId, status: target.status, exitCode: target.exitCode };
     }
-    if (settled) {
+    if (settled2) {
       return { processId, status: detail.session.status, exitCode: target?.exitCode ?? null };
     }
     return null;
@@ -6249,7 +6319,7 @@ var commandEndOf = (detail, processId = null) => {
   if (agent !== null && agent.exitedAt !== null) {
     return { processId: agent.id ?? null, status: agent.status, exitCode: agent.exitCode };
   }
-  if (settled) {
+  if (settled2) {
     return {
       processId: agent?.id ?? null,
       status: detail.session.status,
@@ -6559,9 +6629,10 @@ var secretFileLines = (files) => {
 
 // src/server-setup.ts
 import { createHmac, randomBytes } from "node:crypto";
+import * as dns from "node:dns/promises";
 import * as fs16 from "node:fs";
 import { readFile } from "node:fs/promises";
-import * as net3 from "node:net";
+import * as net4 from "node:net";
 import * as os10 from "node:os";
 import * as path16 from "node:path";
 
@@ -6779,6 +6850,739 @@ var ownership = async (runtime, input, mode) => {
 var claimServerDockerVolumes = (runtime, input) => ownership(runtime, input, "claim");
 var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "verify");
 
+// src/server-setup-guide.ts
+import * as net3 from "node:net";
+var LOOPBACK = "127.0.0.1";
+var isLoopbackAddress = (address) => address === "::1" || address.startsWith("127.");
+var isLoopbackName = (hostname8) => hostname8 === "localhost" || hostname8 === "[::1]" || isLoopbackAddress(hostname8);
+var sameSet = (left, right) => left.length === right.length && left.every((item) => right.includes(item));
+var sameMirrors = (left, right) => left.npm?.maxSize === right.npm?.maxSize && left.npm === null === (right.npm === null) && left.docker === null === (right.docker === null) && left.docker?.maxSize === right.docker?.maxSize && dockerMirrorLogin(left.docker) === dockerMirrorLogin(right.docker);
+var sameSettings = (left, right) => left.bind === right.bind && left.sshBind === right.sshBind && left.appUrl === right.appUrl && sameSet(left.allowedOrigins, right.allowedOrigins) && left.appPort === right.appPort && left.sshPort === right.sshPort && left.edgeHost === right.edgeHost && left.exposure === right.exposure && left.tenancy === right.tenancy && sameSet(left.declared, right.declared) && left.t3GatewayPort === right.t3GatewayPort && sameMirrors(left.mirrors, right.mirrors);
+var flagsFor = (before, after) => {
+  const flags = [];
+  if (after.edgeHost !== before.edgeHost)
+    flags.push(...after.edgeHost === void 0 ? ["--no-edge"] : ["--edge", after.edgeHost]);
+  if (after.bind !== before.bind) flags.push("--bind", after.bind);
+  if (after.edgeHost === void 0 && after.appUrl !== before.appUrl)
+    flags.push("--url", after.appUrl);
+  if (after.appPort !== before.appPort) flags.push("--port", String(after.appPort));
+  if (after.sshPort !== before.sshPort) flags.push("--ssh-port", String(after.sshPort));
+  if (after.sshBind !== before.sshBind) flags.push("--ssh-bind", after.sshBind ?? after.bind);
+  if (!sameSet(after.allowedOrigins, before.allowedOrigins))
+    flags.push(
+      ...after.allowedOrigins.length === 0 ? ["--origin", "none"] : after.allowedOrigins.flatMap((origin) => ["--origin", origin])
+    );
+  if (after.exposure !== void 0 && after.exposure !== before.exposure)
+    flags.push("--exposure", after.exposure);
+  if (after.tenancy !== void 0 && after.tenancy !== before.tenancy)
+    flags.push("--tenancy", after.tenancy);
+  const added = after.declared.filter((item) => !before.declared.includes(item));
+  const removed = before.declared.filter((item) => !after.declared.includes(item));
+  if (after.declared.length === 0 && removed.length > 0) flags.push("--declare", "none");
+  else {
+    for (const item of added) flags.push("--declare", item);
+    for (const item of removed) flags.push("--undeclare", item);
+  }
+  if (after.t3GatewayPort !== before.t3GatewayPort) {
+    if (after.t3GatewayPort === void 0) flags.push("--no-t3-gateway");
+    else if (before.t3GatewayPort === void 0 && after.t3GatewayPort === DEFAULT_T3_GATEWAY_PORT)
+      flags.push("--t3-gateway");
+    else flags.push("--t3-gateway-port", String(after.t3GatewayPort));
+  }
+  const npmBefore = before.mirrors.npm;
+  const npmAfter = after.mirrors.npm;
+  if (npmAfter === null && npmBefore !== null) flags.push("--no-npm-mirror");
+  if (npmAfter !== null) {
+    const sized = npmAfter.maxSize !== (npmBefore?.maxSize ?? DEFAULT_NPM_MIRROR_MAX_SIZE);
+    if (sized) flags.push("--npm-mirror-max-size", npmAfter.maxSize);
+    else if (npmBefore === null) flags.push("--npm-mirror");
+  }
+  const dockerBefore = before.mirrors.docker;
+  const dockerAfter = after.mirrors.docker;
+  if (dockerAfter === null && dockerBefore !== null) flags.push("--no-docker-mirror");
+  if (dockerAfter !== null) {
+    const sized = dockerAfter.maxSize !== (dockerBefore?.maxSize ?? DEFAULT_DOCKER_MIRROR_MAX_SIZE);
+    if (sized) flags.push("--docker-mirror-max-size", dockerAfter.maxSize);
+    else if (dockerBefore === null) flags.push("--docker-mirror");
+    if (dockerMirrorLogin(dockerBefore) !== void 0 && dockerMirrorLogin(dockerAfter) === void 0)
+      flags.push("--no-docker-hub-login");
+  }
+  return flags;
+};
+var shellWord = (word) => /^[A-Za-z0-9_./:@=,+-]+$/.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
+var setupCommandOf = (flags) => ["mend", "server", "setup", ...flags.length === 0 ? ["--yes"] : flags.map(shellWord)].join(" ");
+var sshAt = (settings) => settings.sshBind ?? settings.bind;
+var sshBeyondThisMachine = (settings) => !isLoopbackAddress(sshAt(settings));
+var reachOf = (settings) => settings.edgeHost !== void 0 ? `the public internet, over HTTPS at ${settings.edgeHost} (the edge, Caddy, on 80 and 443)` : isLoopbackAddress(settings.bind) ? `this machine only, at ${settings.appUrl}` : `your network, at ${settings.appUrl} (listening on ${settings.bind})`;
+var exposureOf = (settings) => settings.exposure === void 0 ? "none declared (the server reads private)" : `declared ${settings.exposure}`;
+var sshOf = (settings) => {
+  const at = publishedAddress(sshAt(settings), settings.sshPort);
+  return sshBeyondThisMachine(settings) ? `published on ${at}, beyond this machine` : `this machine only (${at})`;
+};
+var t3Of = (settings) => settings.t3GatewayPort === void 0 ? "off" : `on, at 127.0.0.1:${settings.t3GatewayPort}`;
+var tenancyOf = (settings) => settings.tenancy === "multi" ? "several organizations (multi)" : "one organization (single)";
+var mirrorsOf = (mirrors) => {
+  const login2 = dockerMirrorLogin(mirrors.docker);
+  return [
+    `npm ${mirrors.npm === null ? "off" : `on, ${mirrors.npm.maxSize}`}`,
+    `Docker Hub ${mirrors.docker === null ? "off" : `on, ${mirrors.docker.maxSize}${login2 === void 0 ? "" : `, pulls as ${login2}`}`}`
+  ].join(" \xB7 ");
+};
+var declaredOf = (settings) => settings.declared.length === 0 ? "nothing" : settings.declared.join(", ");
+var originsOf = (settings) => settings.allowedOrigins.length === 0 ? "none" : settings.allowedOrigins.join(", ");
+var rowsOf = (settings) => [
+  ["reached", reachOf(settings)],
+  ["exposure", exposureOf(settings)],
+  ["workspace SSH", sshOf(settings)],
+  ["T3 Code gateway", t3Of(settings)],
+  ["organizations", tenancyOf(settings)],
+  ["mirrors", mirrorsOf(settings.mirrors)],
+  ["you declared", declaredOf(settings)],
+  ["extra origins", originsOf(settings)]
+];
+var LABEL_WIDTH2 = 17;
+var settingsLines = (settings) => rowsOf(settings).filter(
+  ([label]) => (label !== "you declared" || settings.exposure === "public" || settings.declared.length > 0) && (label !== "extra origins" || settings.allowedOrigins.length > 0)
+).map(([label, value]) => `  ${label.padEnd(LABEL_WIDTH2)}${value}`);
+var headlineOf = (settings) => [
+  settings.edgeHost !== void 0 ? `public HTTPS at ${settings.edgeHost}` : isLoopbackAddress(settings.bind) ? "this machine only" : `your network at ${settings.appUrl}`,
+  `VS Code SSH from other machines ${sshBeyondThisMachine(settings) ? "on" : "off"}`,
+  `T3 gateway ${settings.t3GatewayPort === void 0 ? "off" : "on"}`
+].join(", ");
+var changeLines = (before, after) => {
+  const was = new Map(rowsOf(before));
+  return rowsOf(after).flatMap(([label, value]) => {
+    const previous = was.get(label);
+    return previous === value ? [] : [`  ${label}: ${previous ?? ""} \u2192 ${value}`];
+  });
+};
+var fieldsOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? new Map(Object.entries(value)) : /* @__PURE__ */ new Map();
+var parseJson2 = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+};
+var loopbackPortOf = (target) => {
+  if (/^\d+$/.test(target)) return Number(target);
+  try {
+    const url = new URL(/^[a-z+]+:\/\//.test(target) ? target : `http://${target}`);
+    if (!isLoopbackName(url.hostname) || url.port === "") return null;
+    return Number(url.port);
+  } catch {
+    return null;
+  }
+};
+var tailscaleFactsOf = (status, serve) => {
+  const fields = fieldsOf(parseJson2(status));
+  if (!fields.has("BackendState")) return null;
+  const self = fieldsOf(fields.get("Self"));
+  const dns2 = self.get("DNSName");
+  const ips = self.get("TailscaleIPs");
+  const addresses = Array.isArray(ips) ? ips.filter((ip) => typeof ip === "string") : [];
+  const ipv4 = addresses.find((ip) => net3.isIPv4(ip));
+  const ipv6 = addresses.find((ip) => net3.isIPv6(ip));
+  const serveFields = fieldsOf(parseJson2(serve));
+  const funnel = fieldsOf(serveFields.get("AllowFunnel"));
+  const routes = [...fieldsOf(serveFields.get("Web")).entries()].flatMap(([hostPort, web]) => {
+    const match = /^(.+):(\d+)$/.exec(hostPort);
+    if (match === null) return [];
+    const [, host = "", port = ""] = match;
+    const root = fieldsOf(fieldsOf(fieldsOf(web).get("Handlers")).get("/"));
+    const proxy = root.get("Proxy");
+    return [
+      {
+        origin: port === "443" ? `https://${host}` : `https://${host}:${port}`,
+        loopbackPort: typeof proxy === "string" ? loopbackPortOf(proxy) : null,
+        funnel: funnel.get(hostPort) === true
+      }
+    ];
+  });
+  return {
+    running: fields.get("BackendState") === "Running",
+    dnsName: typeof dns2 === "string" && dns2 !== "" ? dns2.replace(/\.$/, "") : null,
+    ipv4: ipv4 ?? null,
+    ipv6: ipv6 ?? null,
+    serve: routes
+  };
+};
+var GuideStopped = class extends Error {
+  _tag = "GuideStopped";
+};
+var answer = async (io, prompt) => {
+  const line = await io.ask(prompt);
+  if (line === null) throw new GuideStopped();
+  return line.trim();
+};
+var choose = async (io, question, choices, preferred) => {
+  io.write("");
+  io.write(question);
+  choices.forEach(
+    (choice, index) => io.write(`  ${index + 1}. ${choice.label}${choice.detail === "" ? "" : ` \xB7 ${choice.detail}`}`)
+  );
+  const range = choices.length === 2 ? "1 or 2" : `1-${choices.length}`;
+  const fallback = choices[preferred] ?? choices[0];
+  for (; ; ) {
+    const given = await answer(io, `  ${range} [${preferred + 1}]: `);
+    const picked = given === "" ? fallback : /^\d+$/.test(given) ? choices[Number(given) - 1] : void 0;
+    if (picked !== void 0) return picked.value;
+    io.write(`  "${given}" is not one of the choices.`);
+  }
+};
+var yesNo = async (io, question, preferred) => {
+  for (; ; ) {
+    const given = (await answer(io, `${question} ${preferred ? "[Y/n]" : "[y/N]"} `)).toLowerCase();
+    if (given === "") return preferred;
+    if (given === "y" || given === "yes") return true;
+    if (given === "n" || given === "no") return false;
+    io.write("  y or n.");
+  }
+};
+var typed = async (io, question, preferred, parse) => {
+  for (; ; ) {
+    const given = await answer(
+      io,
+      `${question}${preferred === void 0 ? "" : ` [${preferred}]`}: `
+    );
+    const input = given === "" ? preferred : given;
+    if (input === void 0) {
+      io.write("  An answer is needed here.");
+      continue;
+    }
+    const parsed = parse(input);
+    if ("value" in parsed) return parsed.value;
+    io.write(`  ${parsed.refused}`);
+  }
+};
+var reachModeOf = (settings) => settings.edgeHost !== void 0 ? "public" : isLoopbackAddress(settings.bind) ? "machine" : "network";
+var without = (declared, item) => declared.filter((entry) => entry !== item);
+var withItem = (declared, item) => declared.includes(item) ? declared : [...declared, item];
+var originOf = (input, port) => {
+  const withScheme = /^https?:\/\//.test(input) ? input : `http://${input}`;
+  try {
+    const url = new URL(withScheme);
+    if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "")
+      return null;
+    if (url.pathname !== "/") return null;
+    if (!/^https?:\/\//.test(input) && url.port === "") url.port = String(port);
+    return url.origin;
+  } catch {
+    return null;
+  }
+};
+var tailscaleOnce = (observe) => {
+  let facts;
+  return () => facts ??= observe.tailscale();
+};
+var tailnetAddress = (tailscale) => tailscale?.running === true ? tailscale.ipv4 ?? tailscale.ipv6 : null;
+var urlHost = (address) => net3.isIPv6(address) ? `[${address}]` : address;
+var settled = (settings) => ({
+  ...settings,
+  sshBind: settings.sshBind === settings.bind ? void 0 : settings.sshBind,
+  allowedOrigins: [...new Set(settings.allowedOrigins)].filter(
+    (origin) => origin !== settings.appUrl
+  )
+});
+var toThisMachine = (settings) => ({
+  ...settings,
+  bind: isLoopbackAddress(settings.bind) ? settings.bind : LOOPBACK,
+  sshBind: void 0,
+  edgeHost: void 0,
+  appUrl: settings.edgeHost === void 0 && isLoopbackName(new URL(settings.appUrl).hostname) ? settings.appUrl : `http://localhost:${settings.appPort}`,
+  exposure: "loopback",
+  declared: without(settings.declared, "workspace-ssh")
+});
+var askNetwork = async (asked, settings) => {
+  const { io } = asked;
+  const tailscale = await asked.tailscale();
+  io.write("");
+  if (tailscale === null) io.write("Observed: tailscale did not answer on this machine.");
+  else if (!tailscale.running)
+    io.write("Observed: Tailscale is installed here and not running (tailscale up starts it).");
+  else
+    io.write(
+      `Observed: Tailscale is up; this machine is ${tailscale.dnsName ?? "unnamed"} at ${[tailscale.ipv4, tailscale.ipv6].filter((ip) => ip !== null).join(" and ") || "no address"} on your tailnet.`
+    );
+  const tailnet = tailnetAddress(tailscale);
+  const others = asked.context.observe.localAddresses().filter((address) => net3.isIPv4(address) && address !== tailnet);
+  const port = settings.appPort;
+  const listening = reachModeOf(settings) === "network" && settings.bind !== "0.0.0.0" && settings.bind !== tailnet && !others.includes(settings.bind) ? settings.bind : null;
+  const choices = [
+    ...listening === null ? [] : [
+      {
+        label: `where it listens now, ${listening}`,
+        detail: "keeps the address it is published on",
+        value: { bind: listening, host: urlHost(listening) }
+      }
+    ],
+    ...tailnet === null ? [] : [
+      {
+        label: `over Tailscale, as ${tailscale?.dnsName ?? tailnet}`,
+        detail: `listens on ${tailnet}, this machine's tailnet address, and is published there only`,
+        value: { bind: tailnet, host: tailscale?.dnsName ?? urlHost(tailnet) }
+      }
+    ],
+    ...others.map((address) => ({
+      label: `on this network address, ${address}`,
+      detail: `listens on ${address} only, and is published on that address`,
+      value: { bind: address, host: address }
+    })),
+    {
+      label: "on every address of this machine",
+      detail: "listens on 0.0.0.0, every address: who reaches it is up to your network and firewall",
+      value: { bind: "0.0.0.0", host: null }
+    }
+  ];
+  const current = choices.findIndex((choice) => choice.value.bind === settings.bind);
+  const picked = await choose(
+    io,
+    "Which network do people reach it on?",
+    choices,
+    current < 0 ? 0 : current
+  );
+  const keepsUrl = picked.bind === settings.bind && reachModeOf(settings) === "network";
+  const preferred = keepsUrl ? settings.appUrl : picked.host !== null ? `http://${picked.host}:${port}` : others[0] === void 0 ? void 0 : `http://${others[0]}:${port}`;
+  const appUrl = await typed(
+    io,
+    "The address people open in a browser",
+    preferred,
+    (input) => {
+      const origin = originOf(input, port);
+      if (origin === null)
+        return { refused: `"${input}" is not a name, an address or an http(s) origin.` };
+      if (isLoopbackName(new URL(origin).hostname))
+        return {
+          refused: "That address names this machine itself; give a name or an address other machines use."
+        };
+      return { value: origin };
+    }
+  );
+  const followsWeb = settings.sshBind === void 0 && !isLoopbackAddress(settings.bind);
+  return settled({
+    ...settings,
+    bind: picked.bind,
+    sshBind: followsWeb || reachModeOf(settings) === "machine" ? void 0 : settings.sshBind ?? settings.bind,
+    edgeHost: void 0,
+    appUrl,
+    exposure: "private"
+  });
+};
+var FRESH_PUBLIC = [
+  "A fresh install starts on this machine first. Until the first account exists, whoever reaches",
+  "the address first can register it, and the server refuses to start as public without one.",
+  "Setup installs Mend on this machine now. Create the first account at the address it prints,",
+  "then run mend server setup again and choose the public internet."
+];
+var askPublic = async (asked, settings) => {
+  const { io } = asked;
+  io.write("");
+  io.write(
+    "Mend runs an edge, Caddy, on ports 80 and 443 of every address. It gets and renews a certificate for your domain and forwards to Mend, which stays on 127.0.0.1."
+  );
+  const domain = await typed(io, "Your domain for Mend", settings.edgeHost, (input) => {
+    const host = parseEdgeHost(input);
+    return host === null ? {
+      refused: `"${input}" is not a DNS name a certificate can be issued for, such as mend.example.com.`
+    } : { value: host };
+  });
+  const resolved = await asked.context.observe.lookupHost(domain);
+  const own = asked.context.observe.localAddresses();
+  if (resolved === null || resolved.length === 0)
+    io.write(
+      `Observed: ${domain} does not resolve from this machine. Caddy cannot get a certificate until its DNS points here.`
+    );
+  else if (resolved.some((address) => own.includes(address)))
+    io.write(`Observed: ${domain} resolves to ${resolved.join(", ")}, an address of this machine.`);
+  else
+    io.write(
+      `Observed: ${domain} resolves to ${resolved.join(", ")}; this machine's own addresses are ${own.length === 0 ? "none" : own.join(", ")}. Setup cannot see a NAT or a load balancer in front of this machine; Caddy gets its certificate once 80 and 443 on this machine answer from the internet.`
+    );
+  if (settings.edgeHost === void 0) {
+    const taken = [];
+    for (const port of [80, 443]) if (await asked.context.observe.portTaken(port)) taken.push(port);
+    io.write(
+      taken.length === 0 ? "Observed: nothing on this machine listens on 80 or 443 yet." : `Observed: something on this machine already listens on ${taken.join(" and ")}; the edge needs ${taken.length === 1 ? "it" : "them"}.`
+    );
+  }
+  const publicSettings = settled({
+    ...settings,
+    edgeHost: domain,
+    appUrl: `https://${domain}`,
+    bind: isLoopbackAddress(settings.bind) ? settings.bind : LOOPBACK,
+    sshBind: reachModeOf(settings) === "machine" ? void 0 : sshAt(settings),
+    exposure: "public"
+  });
+  return askSsh(asked, publicSettings);
+};
+var askSsh = async (asked, settings) => {
+  const { io } = asked;
+  const tailnet = tailnetAddress(await asked.tailscale());
+  const port = settings.sshPort;
+  const web = isLoopbackAddress(settings.bind) ? null : settings.bind;
+  const candidates = [
+    {
+      label: "no, this machine only",
+      detail: `SSH on ${publishedAddress(LOOPBACK, port)}`,
+      value: LOOPBACK
+    },
+    ...web === null || web === "0.0.0.0" || web === tailnet ? [] : [
+      {
+        label: "yes, on the same address as the web",
+        detail: `SSH on ${publishedAddress(web, port)}`,
+        value: web
+      }
+    ],
+    ...tailnet === null ? [] : [
+      {
+        label: "yes, over Tailscale only",
+        detail: `SSH on ${publishedAddress(tailnet, port)}, the tailnet address`,
+        value: tailnet
+      }
+    ],
+    {
+      label: "yes, from any network",
+      detail: `SSH on ${publishedAddress("0.0.0.0", port)}, every address: who reaches it is up to your network and firewall`,
+      value: "0.0.0.0"
+    }
+  ];
+  const at = sshAt(settings);
+  const choices = isLoopbackAddress(at) || candidates.some((choice) => choice.value === at) ? candidates : [
+    ...candidates,
+    {
+      label: "yes, where it is published now",
+      detail: `SSH on ${publishedAddress(at, port)}`,
+      value: at
+    }
+  ];
+  const current = isLoopbackAddress(at) ? 0 : choices.findIndex((choice) => choice.value === at);
+  const chosen = await choose(
+    io,
+    `Should VS Code Remote-SSH and mend ssh reach sessions from other machines?${settings.edgeHost === void 0 ? " Workspace SSH" : " The edge carries HTTPS only; workspace SSH"} is a port of its own.`,
+    choices,
+    current < 0 ? 0 : current
+  );
+  const onLoopback = () => settled({
+    ...settings,
+    sshBind: isLoopbackAddress(settings.bind) ? void 0 : LOOPBACK,
+    declared: without(settings.declared, "workspace-ssh")
+  });
+  if (isLoopbackAddress(chosen)) return onLoopback();
+  if (settings.exposure !== "public") return settled({ ...settings, sshBind: chosen });
+  const declared = settings.declared.includes("workspace-ssh") && at === chosen;
+  const checked = await choose(
+    io,
+    `Mend cannot see who reaches ${publishedAddress(chosen, port)} from outside, and a public server does not start until you state that you checked (the exposure gate's workspace-ssh item).`,
+    [
+      {
+        label: "I checked it from a network that should not reach it",
+        detail: "declares workspace-ssh",
+        value: true
+      },
+      { label: "not yet", detail: "SSH stays on this machine for now", value: false }
+    ],
+    declared ? 0 : 1
+  );
+  return checked ? settled({
+    ...settings,
+    sshBind: chosen,
+    declared: withItem(settings.declared, "workspace-ssh")
+  }) : onLoopback();
+};
+var offerServeOrigins = async (asked, settings) => {
+  const tailscale = await asked.tailscale();
+  let next = settings;
+  for (const route of tailscale?.serve ?? []) {
+    if (route.loopbackPort !== settings.appPort || route.origin === next.appUrl || next.allowedOrigins.includes(route.origin))
+      continue;
+    asked.io.write("");
+    asked.io.write(
+      `Observed: Tailscale Serve forwards ${route.origin} to Mend's port here${route.funnel ? "; Tailscale's settings have Funnel on for it, which publishes it to the public internet as well as your tailnet" : ""}.`
+    );
+    if (await yesNo(asked.io, `Allow ${route.origin} as a browser origin too?`, true))
+      next = { ...next, allowedOrigins: [...next.allowedOrigins, route.origin] };
+  }
+  return next;
+};
+var askReach = async (asked, settings) => {
+  const reach = await choose(
+    asked.io,
+    "How will people reach this Mend?",
+    [
+      {
+        label: "just this machine",
+        detail: `a browser here opens http://localhost:${settings.appPort}`,
+        value: "machine"
+      },
+      {
+        label: "my private network or Tailscale",
+        detail: "a tailnet, a LAN or a VPN you control who joins",
+        value: "network"
+      },
+      {
+        label: "the public internet, with HTTPS",
+        detail: "your domain, and an edge that gets its certificate",
+        value: "public"
+      }
+    ],
+    asked.fresh ? 0 : ["machine", "network", "public"].indexOf(reachModeOf(settings))
+  );
+  let next;
+  if (reach === "public" && asked.fresh) {
+    asked.io.write("");
+    for (const line of FRESH_PUBLIC) asked.io.write(line);
+    next = toThisMachine(settings);
+  } else if (reach === "public") next = await askPublic(asked, settings);
+  else if (reach === "network") next = await askSsh(asked, await askNetwork(asked, settings));
+  else next = toThisMachine(settings);
+  return settled(await offerServeOrigins(asked, settled(next)));
+};
+var DECLARATIONS = [
+  {
+    item: "core-private",
+    text: () => "Sealant, the database and the mirrors do not answer from the internet"
+  },
+  {
+    item: "edge-tls",
+    text: (settings) => `the certificate for ${settings.edgeHost ?? "the edge"} chains to a public root and renews, and port 80 redirects to https`
+  },
+  {
+    item: "t3code-gateway",
+    text: (settings) => `port ${settings.t3GatewayPort ?? DEFAULT_T3_GATEWAY_PORT} answers nothing from another machine, or only through what you put in front of it`
+  }
+];
+var askDeclarations = async (asked, settings) => {
+  const { io } = asked;
+  io.write("");
+  io.write(
+    "Mend cannot observe these from inside. mend operator exposure lists each as open until you state you checked it from outside; none of them stops a start. Say yes only to what you checked."
+  );
+  let declared = settings.declared;
+  for (const { item, text } of DECLARATIONS) {
+    if (item === "t3code-gateway" && settings.t3GatewayPort === void 0) continue;
+    const checked = await yesNo(
+      io,
+      `  ${item}: ${text(settings)}. Checked?`,
+      declared.includes(item)
+    );
+    declared = checked ? withItem(declared, item) : without(declared, item);
+  }
+  return { ...settings, declared: DECLARABLE_ITEMS.filter((item) => declared.includes(item)) };
+};
+var askT3 = async (asked, settings) => {
+  const port = settings.t3GatewayPort ?? DEFAULT_T3_GATEWAY_PORT;
+  asked.io.write("");
+  asked.io.write(
+    `The T3 Code gateway lets t3code's desktop, mobile and web apps pair with this Mend (mend pair). It listens on 127.0.0.1:${port} only; from another machine, use a tunnel you run, such as ssh -L ${port}:127.0.0.1:${port} <this machine>, or tailscale serve.`
+  );
+  const on = await yesNo(
+    asked.io,
+    "Turn on the T3 Code gateway?",
+    settings.t3GatewayPort !== void 0
+  );
+  return on ? { ...settings, t3GatewayPort: port } : {
+    ...settings,
+    t3GatewayPort: void 0,
+    declared: without(settings.declared, "t3code-gateway")
+  };
+};
+var askSize = (asked, question, preferred) => typed(asked.io, question, preferred, (input) => {
+  const size = parseMirrorSize(input);
+  return size === null ? { refused: "A whole number of gibibytes or mebibytes, at least 1g, such as 20g or 1536m." } : { value: size };
+});
+var askMirrors = async (asked, settings, offerKeep) => {
+  const { io } = asked;
+  const { npm, docker: docker2 } = settings.mirrors;
+  io.write("");
+  io.write(
+    `Mirrors: ${mirrorsOf(settings.mirrors)}. Sessions fetch npm packages and Docker Hub images through them, so each is downloaded once; neither publishes a port.`
+  );
+  if (offerKeep && await yesNo(io, "Keep the mirrors as they are?", true)) return settings;
+  const npmOn = await yesNo(io, "Run the npm mirror?", npm !== null);
+  const npmSize = npmOn ? await askSize(asked, "  its disk cap", npm?.maxSize ?? DEFAULT_NPM_MIRROR_MAX_SIZE) : null;
+  const dockerOn = await yesNo(io, "Run the Docker Hub mirror?", docker2 !== null);
+  const dockerSize = dockerOn ? await askSize(asked, "  its disk cap", docker2?.maxSize ?? DEFAULT_DOCKER_MIRROR_MAX_SIZE) : null;
+  const login2 = dockerMirrorLogin(docker2);
+  if (dockerOn && login2 !== void 0)
+    io.write(`  It keeps pulling as ${login2}; flags change the login (mend help server setup).`);
+  return {
+    ...settings,
+    mirrors: {
+      npm: npmSize === null ? null : { maxSize: npmSize },
+      docker: dockerSize === null ? null : login2 === void 0 ? { maxSize: dockerSize } : { maxSize: dockerSize, upstreamUser: login2, upstreamPublicOnly: true }
+    }
+  };
+};
+var askTenancy = async (asked, settings) => {
+  const tenancy = await choose(
+    asked.io,
+    "One organization on this server, or several?",
+    [
+      {
+        label: "one organization",
+        detail: "everyone who signs in shares its projects, folders and audit log",
+        value: "single"
+      },
+      {
+        label: "several organizations",
+        detail: "each with its own members and projects; also sets the multi mode gate's settings",
+        value: "multi"
+      }
+    ],
+    settings.tenancy === "multi" ? 1 : 0
+  );
+  return tenancy === "single" && settings.tenancy === void 0 ? settings : { ...settings, tenancy };
+};
+var askOrigins = async (asked, settings) => {
+  let next = await offerServeOrigins(asked, settings);
+  for (; ; ) {
+    asked.io.write("");
+    asked.io.write(
+      `Browser origins besides ${next.appUrl}: ${next.allowedOrigins.length === 0 ? "none" : next.allowedOrigins.join(", ")}.`
+    );
+    const action = await choose(
+      asked.io,
+      "Allow another origin, or take one away?",
+      [
+        { label: "keep these", detail: "", value: "keep" },
+        { label: "add one", detail: "such as a Tailscale Serve name", value: "add" },
+        ...next.allowedOrigins.length === 0 ? [] : [{ label: "remove one", detail: "", value: "remove" }]
+      ],
+      0
+    );
+    if (action === "keep") return next;
+    if (action === "add") {
+      const origin = await typed(asked.io, "The origin", void 0, (input) => {
+        const parsed = /^https?:\/\//.test(input) ? originOf(input, next.appPort) : null;
+        return parsed === null ? { refused: "An http:// or https:// origin, such as https://mend.tail1234.ts.net:8443." } : { value: parsed };
+      });
+      if (origin !== next.appUrl && !next.allowedOrigins.includes(origin))
+        next = { ...next, allowedOrigins: [...next.allowedOrigins, origin] };
+      continue;
+    }
+    const gone = await choose(
+      asked.io,
+      "Which one?",
+      next.allowedOrigins.map((origin) => ({ label: origin, detail: "", value: origin })),
+      0
+    );
+    next = { ...next, allowedOrigins: next.allowedOrigins.filter((origin) => origin !== gone) };
+  }
+};
+var walk2 = async (asked, settings) => {
+  let next = await askReach(asked, settings);
+  next = await askT3(asked, next);
+  if (next.exposure === "public" && await yesNo(asked.io, "State what you have checked from outside the network now?", false))
+    next = await askDeclarations(asked, next);
+  next = await askMirrors(asked, next, true);
+  return askTenancy(asked, next);
+};
+var changeOne = async (asked, settings) => {
+  let next = settings;
+  for (; ; ) {
+    const topic = await choose(
+      asked.io,
+      "What should change?",
+      [
+        { label: "how people reach it", detail: reachOf(next), value: "reach" },
+        ...reachModeOf(next) === "machine" ? [] : [
+          {
+            label: "VS Code Remote-SSH from other machines",
+            detail: sshOf(next),
+            value: "ssh"
+          }
+        ],
+        { label: "the T3 Code gateway", detail: t3Of(next), value: "t3" },
+        ...next.exposure === "public" ? [
+          {
+            label: "what you checked from outside",
+            detail: declaredOf(next),
+            value: "declared"
+          }
+        ] : [],
+        { label: "the mirrors", detail: mirrorsOf(next.mirrors), value: "mirrors" },
+        { label: "one organization or several", detail: tenancyOf(next), value: "tenancy" },
+        { label: "extra browser origins", detail: originsOf(next), value: "origins" }
+      ],
+      0
+    );
+    if (topic === "reach") next = await askReach(asked, next);
+    else if (topic === "ssh") next = await askSsh(asked, next);
+    else if (topic === "t3") next = await askT3(asked, next);
+    else if (topic === "declared") next = await askDeclarations(asked, next);
+    else if (topic === "mirrors") next = await askMirrors(asked, next, false);
+    else if (topic === "tenancy") next = await askTenancy(asked, next);
+    else next = await askOrigins(asked, next);
+    asked.io.write("");
+    if (!await yesNo(asked.io, "Change something else?", false)) return next;
+  }
+};
+var runGuide = async (io, context) => {
+  const base = context.saved ?? context.defaults;
+  const asked = {
+    io,
+    context,
+    tailscale: tailscaleOnce(context.observe),
+    fresh: context.saved === null
+  };
+  try {
+    let target;
+    if (context.saved === null) {
+      io.write("Mend server setup. A few questions; enter takes the answer in brackets.");
+      target = await walk2(asked, base);
+    } else {
+      io.write(`Currently: ${headlineOf(base)}.`);
+      for (const line of settingsLines(base)) io.write(line);
+      const how = await choose(
+        io,
+        "What would you like to do?",
+        [
+          {
+            label: "keep it as it is",
+            detail: "setup checks this install and starts it again",
+            value: "keep"
+          },
+          { label: "change something", detail: "pick it, answer, done", value: "change" },
+          { label: "go through every question", detail: "", value: "walk" }
+        ],
+        0
+      );
+      target = how === "keep" ? base : how === "change" ? await changeOne(asked, base) : await walk2(asked, base);
+    }
+    target = settled(target);
+    const flags = flagsFor(base, target);
+    let resolved;
+    try {
+      resolved = context.resolve(flags);
+    } catch (cause) {
+      return { _tag: "refused", message: cause instanceof Error ? cause.message : String(cause) };
+    }
+    if (!sameSettings(resolved, target))
+      return {
+        _tag: "refused",
+        message: `Setup could not say these answers as flags: ${setupCommandOf(flags)} would set something else. Nothing changed; please report this.`
+      };
+    io.write("");
+    if (context.saved === null) {
+      io.write("Setup will install:");
+      for (const line of settingsLines(target)) io.write(line);
+    } else {
+      const changes = changeLines(base, target);
+      if (changes.length === 0)
+        io.write("Nothing changes: setup checks this install and starts it as it is.");
+      else {
+        io.write("What changes:");
+        for (const line of changes) io.write(line);
+      }
+    }
+    io.write(`Same as: ${setupCommandOf(flags)}`);
+    return await yesNo(io, "Apply?", true) ? { _tag: "apply", flags } : { _tag: "stopped" };
+  } catch (cause) {
+    if (cause instanceof GuideStopped) return { _tag: "stopped" };
+    throw cause;
+  }
+};
+
 // src/server-store.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import * as fs14 from "node:fs";
@@ -6835,7 +7639,8 @@ var optionalFileKeys = [
   "caddyfile",
   "mirrors",
   "npmMirrorConf",
-  "dockerMirrorGuard"
+  "dockerMirrorGuard",
+  "t3Gateway"
 ];
 var fileNames = {
   identity: "identity.env",
@@ -6848,7 +7653,8 @@ var fileNames = {
   caddyfile: "Caddyfile",
   mirrors: "compose.mirrors.yaml",
   npmMirrorConf: "npm-mirror.conf",
-  dockerMirrorGuard: "docker-mirror-guard.sh"
+  dockerMirrorGuard: "docker-mirror-guard.sh",
+  t3Gateway: "compose.t3.yaml"
 };
 var fileModes = {
   identity: 384,
@@ -6861,7 +7667,8 @@ var fileModes = {
   caddyfile: 420,
   mirrors: 384,
   npmMirrorConf: 420,
-  dockerMirrorGuard: 420
+  dockerMirrorGuard: 420,
+  t3Gateway: 384
 };
 var allFiles = (files) => [...fileKeys, ...optionalFileKeys].map((key) => [key, files[key]]);
 var parseLockOwner = (raw) => {
@@ -6968,6 +7775,7 @@ var readActive = (paths) => {
   const mirrors = optional("mirrors");
   const npmMirrorConf = optional("npmMirrorConf");
   const dockerMirrorGuard = optional("dockerMirrorGuard");
+  const t3Gateway = optional("t3Gateway");
   const files = {
     identity: fs14.readFileSync(path15.join(directory, fileNames.identity), "utf8"),
     config: fs14.readFileSync(path15.join(directory, fileNames.config), "utf8"),
@@ -6979,7 +7787,8 @@ var readActive = (paths) => {
     ...caddyfile === void 0 ? {} : { caddyfile },
     ...mirrors === void 0 ? {} : { mirrors },
     ...npmMirrorConf === void 0 ? {} : { npmMirrorConf },
-    ...dockerMirrorGuard === void 0 ? {} : { dockerMirrorGuard }
+    ...dockerMirrorGuard === void 0 ? {} : { dockerMirrorGuard },
+    ...t3Gateway === void 0 ? {} : { t3Gateway }
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -7539,7 +8348,12 @@ var SETUP_FLAGS = /* @__PURE__ */ new Set([
   "--docker-hub-username",
   "--docker-hub-token-stdin",
   "--docker-hub-public-only",
-  "--no-docker-hub-login"
+  "--no-docker-hub-login",
+  "--t3-gateway",
+  "--t3-gateway-port",
+  "--no-t3-gateway",
+  "--undeclare",
+  "--yes"
 ]);
 var SWITCHES = /* @__PURE__ */ new Set([
   "--offline",
@@ -7550,8 +8364,12 @@ var SWITCHES = /* @__PURE__ */ new Set([
   "--no-docker-mirror",
   "--docker-hub-token-stdin",
   "--docker-hub-public-only",
-  "--no-docker-hub-login"
+  "--no-docker-hub-login",
+  "--t3-gateway",
+  "--no-t3-gateway",
+  "--yes"
 ]);
+var REPEATABLE = /* @__PURE__ */ new Set(["--origin", "--declare", "--undeclare"]);
 var parseExposure = (value) => {
   if (!isExposure(value))
     throw setupError(`--exposure must be one of ${EXPOSURES.join(", ")}, not "${value}".`);
@@ -7562,14 +8380,14 @@ var parseTenancy = (value) => {
     throw setupError(`--tenancy must be one of ${TENANCIES.join(", ")}, not "${value}".`);
   return value;
 };
-var parseDeclared = (values) => {
-  if (values.length === 1 && values[0] === "none") return [];
+var parseDeclared = (values, flag) => {
+  if (flag === "--declare" && values.length === 1 && values[0] === "none") return [];
   return [
     ...new Set(
       values.map((value) => {
         if (!isDeclarableItem(value)) {
           throw setupError(
-            `--declare takes ${DECLARABLE_ITEMS.join(", ")} or none, not "${value}". Every other gate item is observed by the server, never stated.`
+            `${flag} takes ${DECLARABLE_ITEMS.join(", ")}${flag === "--declare" ? " or none" : ""}, not "${value}". Every other gate item is observed by the server, never stated.`
           );
         }
         return value;
@@ -7601,7 +8419,7 @@ var parseSetupOptions = (args) => {
     const [value, valueIndex] = nextFlagValue(args, index, flag);
     index = valueIndex;
     const previous = values.get(flag) ?? [];
-    if (flag !== "--origin" && flag !== "--declare" && previous.length > 0) {
+    if (!REPEATABLE.has(flag) && previous.length > 0) {
       throw setupError(`${flag} may be supplied only once.`);
     }
     previous.push(value);
@@ -7616,6 +8434,14 @@ var parseSetupOptions = (args) => {
   const exposure = flagValue3("--exposure");
   const tenancy = flagValue3("--tenancy");
   const declared = values.get("--declare");
+  const declaredItems = declared === void 0 ? void 0 : parseDeclared(declared, "--declare");
+  const undeclared = parseDeclared(values.get("--undeclare") ?? [], "--undeclare");
+  const both = undeclared.filter((item) => declaredItems?.includes(item) === true);
+  if (both.length > 0) throw setupError(`--declare and --undeclare both name ${both.join(", ")}.`);
+  if (declaredItems?.length === 0 && undeclared.length > 0)
+    throw setupError("--declare none already clears every statement; drop --undeclare.");
+  if (origins !== void 0 && origins.includes("none") && origins.length > 1)
+    throw setupError("--origin none clears the extra origins and goes alone.");
   if (edge !== void 0 && values.has("--no-edge"))
     throw setupError("--edge and --no-edge contradict each other.");
   const pair = (on, off) => {
@@ -7663,13 +8489,18 @@ var parseSetupOptions = (args) => {
     throw setupError(
       `--docker-hub-username and ${noDockerHubLogin ? "--no-docker-hub-login" : "--no-docker-mirror"} contradict each other.`
     );
+  const t3GatewayPort = flagValue3("--t3-gateway-port");
+  if (values.has("--no-t3-gateway") && (values.has("--t3-gateway") || t3GatewayPort !== void 0)) {
+    throw setupError("--no-t3-gateway contradicts --t3-gateway and --t3-gateway-port.");
+  }
   return {
     context: flagValue3("--context"),
     version: version === void 0 ? void 0 : parseVersion(version),
     bind: flagValue3("--bind"),
     sshBind: flagValue3("--ssh-bind"),
     url: flagValue3("--url"),
-    origins: origins === void 0 ? void 0 : origins,
+    // `--origin none`: no extra origins at all.
+    origins: origins === void 0 ? void 0 : origins[0] === "none" ? [] : origins,
     appPort: appPort === void 0 ? void 0 : parsePort(appPort, "--port"),
     sshPort: sshPort === void 0 ? void 0 : parsePort(sshPort, "--ssh-port"),
     dockerSocket: flagValue3("--docker-socket"),
@@ -7679,14 +8510,19 @@ var parseSetupOptions = (args) => {
     noEdge: values.has("--no-edge"),
     exposure: exposure === void 0 ? void 0 : parseExposure(exposure),
     tenancy: tenancy === void 0 ? void 0 : parseTenancy(tenancy),
-    declared: declared === void 0 ? void 0 : parseDeclared(declared),
+    declared: declaredItems,
+    undeclared,
+    yes: values.has("--yes"),
     npmMirror,
     npmMirrorMaxSize,
     dockerMirror,
     dockerMirrorMaxSize,
     dockerHubUsername,
     dockerHubTokenStdin,
-    noDockerHubLogin
+    noDockerHubLogin,
+    t3Gateway: values.has("--t3-gateway"),
+    t3GatewayPort: t3GatewayPort === void 0 ? void 0 : parsePort(t3GatewayPort, "--t3-gateway-port"),
+    noT3Gateway: values.has("--no-t3-gateway")
   };
 };
 var resolveMirrors = (saved, options) => {
@@ -7829,13 +8665,13 @@ var validateExposure = (existing, options) => {
     throw setupError("--port and --ssh-port must use different ports.");
   }
   const bind = options.bind ?? existing?.bind ?? DEFAULT_BIND;
-  if (net3.isIP(bind) === 0) {
+  if (net4.isIP(bind) === 0) {
     throw setupError(
       "--bind must be a literal IPv4 or IPv6 address, such as 127.0.0.1 or 0.0.0.0."
     );
   }
   const requestedSshBind = options.sshBind ?? existing?.sshBind;
-  if (requestedSshBind !== void 0 && net3.isIP(requestedSshBind) === 0) {
+  if (requestedSshBind !== void 0 && net4.isIP(requestedSshBind) === 0) {
     throw setupError(
       "--ssh-bind must be a literal IPv4 or IPv6 address, such as 127.0.0.1 or 0.0.0.0."
     );
@@ -7844,7 +8680,18 @@ var validateExposure = (existing, options) => {
   const edgeHost = options.noEdge ? void 0 : options.edge ?? existing?.edgeHost;
   const exposure = options.exposure ?? existing?.exposure;
   const tenancy = options.tenancy ?? existing?.tenancy;
-  const declared = options.declared ?? existing?.declared ?? [];
+  const t3GatewayPort = options.noT3Gateway ? void 0 : options.t3GatewayPort ?? existing?.t3GatewayPort ?? (options.t3Gateway ? DEFAULT_T3_GATEWAY_PORT : void 0);
+  if (t3GatewayPort !== void 0 && [appPort, sshPort].includes(t3GatewayPort)) {
+    throw setupError(
+      `--t3-gateway-port ${t3GatewayPort} is Mend's own --port or --ssh-port: the gateway needs a port of its own.`
+    );
+  }
+  if (t3GatewayPort !== void 0 && edgeHost !== void 0 && [80, 443].includes(t3GatewayPort)) {
+    throw setupError("With an edge, --t3-gateway-port must not be 80 or 443: the edge has them.");
+  }
+  const saved = existing?.declared ?? [];
+  const stated = options.declared === void 0 ? saved : options.declared.length === 0 ? [] : [.../* @__PURE__ */ new Set([...saved, ...options.declared])];
+  const declared = stated.filter((item) => !options.undeclared.includes(item));
   checkPosture(bind, sshBind ?? bind, { appPort, sshPort }, edgeHost, exposure, declared);
   const appUrl = resolveAppUrl(existing, options, appPort, edgeHost);
   if (edgeHost === void 0)
@@ -7864,9 +8711,31 @@ var validateExposure = (existing, options) => {
     ...edgeHost === void 0 ? {} : { edgeHost },
     ...exposure === void 0 ? {} : { exposure },
     ...tenancy === void 0 ? {} : { tenancy },
-    ...declared.length === 0 ? {} : { declared }
+    ...declared.length === 0 ? {} : { declared },
+    ...t3GatewayPort === void 0 ? {} : { t3GatewayPort }
   };
 };
+var settingsOf = (config) => ({
+  bind: config.bind,
+  sshBind: config.sshBind,
+  appUrl: config.appUrl,
+  allowedOrigins: config.allowedOrigins,
+  appPort: config.appPort,
+  sshPort: config.sshPort,
+  edgeHost: config.edgeHost,
+  exposure: config.exposure,
+  tenancy: config.tenancy,
+  declared: config.declared ?? [],
+  t3GatewayPort: config.t3GatewayPort,
+  mirrors: config.mirrors
+});
+var resolveSetupSettings = (existing, flags) => {
+  const options = parseSetupOptions(flags);
+  return settingsOf({
+    ...validateExposure(existing, options),
+    mirrors: resolveMirrors(existing?.mirrors, options)
+  });
+};
 var parseServerConfig = (raw) => {
   let decoded;
   try {
@@ -7910,6 +8779,7 @@ var parseServerConfig = (raw) => {
     );
   }
   const declared = Array.isArray(declaredField) ? declaredField.filter((item) => isDeclarableItem(String(item))) : [];
+  const t3GatewayPort = fields.has("t3GatewayPort") ? requiredInteger(fields, "t3GatewayPort") : void 0;
   const config = {
     schemaVersion: requiredInteger(fields, "schemaVersion"),
     assetContract: requiredString(fields, "assetContract"),
@@ -7932,7 +8802,8 @@ var parseServerConfig = (raw) => {
     ...exposure === void 0 ? {} : { exposure },
     ...tenancy === void 0 ? {} : { tenancy },
     ...declared.length === 0 ? {} : { declared },
-    ...fields.has("mirrors") ? { mirrors: parseMirrorsField(fields.get("mirrors")) } : {}
+    ...fields.has("mirrors") ? { mirrors: parseMirrorsField(fields.get("mirrors")) } : {},
+    ...t3GatewayPort === void 0 ? {} : { t3GatewayPort }
   };
   if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT && !LEGACY_ASSET_CONTRACTS.has(config.assetContract)) {
     throw setupError(
@@ -7943,6 +8814,8 @@ var parseServerConfig = (raw) => {
   parsePort(String(config.sshPort), "Server config sshPort");
   if (config.registryPort !== void 0)
     parsePort(String(config.registryPort), "Server config registryPort");
+  if (config.t3GatewayPort !== void 0)
+    parsePort(String(config.t3GatewayPort), "Server config t3GatewayPort");
   validateExposure(null, {
     context: void 0,
     version: void 0,
@@ -7960,13 +8833,18 @@ var parseServerConfig = (raw) => {
     exposure: config.exposure,
     tenancy: config.tenancy,
     declared: config.declared,
+    undeclared: [],
+    yes: false,
     npmMirror: void 0,
     npmMirrorMaxSize: void 0,
     dockerMirror: void 0,
     dockerMirrorMaxSize: void 0,
     dockerHubUsername: void 0,
     dockerHubTokenStdin: false,
-    noDockerHubLogin: false
+    noDockerHubLogin: false,
+    t3Gateway: false,
+    t3GatewayPort: config.t3GatewayPort,
+    noT3Gateway: false
   });
   return config;
 };
@@ -8307,7 +9185,7 @@ var renderGarage = (secrets, config) => {
   ];
 };
 var namespaceOf = (config) => config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
-var composeHost = (address) => net3.isIP(address) === 6 ? `[${address}]` : address;
+var composeHost = (address) => net4.isIP(address) === 6 ? `[${address}]` : address;
 var renderSecrets = (secrets, config) => {
   const sshHost = parseUrl(config.appUrl, "Server config appUrl").hostname.replace(/^\[|\]$/g, "");
   const composeBind = composeHost(config.bind);
@@ -8360,12 +9238,22 @@ var validateOverlays = (config, files) => {
   }
   for (const line of postureEnvLines(config)) {
     const key = line.slice(0, line.indexOf("="));
-    if (key !== "MEND_EDGE_HOST" && !(files.posture ?? "").includes(`      ${key}: \${${key}`)) {
+    if (key !== "MEND_EDGE_HOST" && key !== "MEND_T3_GATEWAY_PORT" && !(files.posture ?? "").includes(`      ${key}: \${${key}`)) {
       throw setupError(
         `Server generation is corrupt: compose.posture.yaml does not hand ${key} to Mend.`
       );
     }
   }
+  if (config.t3GatewayPort === void 0 !== (files.t3Gateway === void 0)) {
+    throw setupError(
+      "Server generation is corrupt: compose.t3.yaml does not match the persisted server config."
+    );
+  }
+  if (files.t3Gateway !== void 0 && (!files.t3Gateway.includes('MEND_T3_GATEWAY_ENABLED: "true"') || !files.t3Gateway.includes('"127.0.0.1:${MEND_T3_GATEWAY_PORT'))) {
+    throw setupError(
+      "Server generation is corrupt: compose.t3.yaml is not the gateway overlay on loopback."
+    );
+  }
   if (config.edgeHost === void 0 !== (files.edge === void 0) || config.edgeHost === void 0 !== (files.caddyfile === void 0)) {
     throw setupError(
       "Server generation is corrupt: compose.edge.yaml and Caddyfile do not match the persisted server config."
@@ -8478,7 +9366,8 @@ var readServerInstallationFacts = async (configDir) => {
           ...generation.files.posture === void 0 ? [] : [{ name: "compose.posture.yaml", content: generation.files.posture }],
           ...generation.files.mirrors === void 0 ? [] : [{ name: MIRRORS_COMPOSE_FILE, content: generation.files.mirrors }],
           ...generation.files.npmMirrorConf === void 0 ? [] : [{ name: NPM_MIRROR_CONF_NAME, content: generation.files.npmMirrorConf }],
-          ...generation.files.dockerMirrorGuard === void 0 ? [] : [{ name: DOCKER_MIRROR_GUARD_NAME, content: generation.files.dockerMirrorGuard }]
+          ...generation.files.dockerMirrorGuard === void 0 ? [] : [{ name: DOCKER_MIRROR_GUARD_NAME, content: generation.files.dockerMirrorGuard }],
+          ...generation.files.t3Gateway === void 0 ? [] : [{ name: "compose.t3.yaml", content: generation.files.t3Gateway }]
         ],
         envKeys: envKeyNames(generation.files.env)
       };
@@ -8491,6 +9380,7 @@ var readServerInstallationFacts = async (configDir) => {
 var generationFiles = (config, secrets, assets, identity = renderIdentity(secrets)) => {
   const posture = renderPostureOverlay(config);
   const mirrors = renderMirrorsOverlay(config.mirrors);
+  const t3Gateway = renderT3GatewayOverlay(config);
   return {
     identity,
     config: `${JSON.stringify(config, null, 2)}
@@ -8498,6 +9388,7 @@ var generationFiles = (config, secrets, assets, identity = renderIdentity(secret
     env: renderSecrets(secrets, config),
     ...assets,
     ...posture === void 0 ? {} : { posture },
+    ...t3Gateway === void 0 ? {} : { t3Gateway },
     ...config.edgeHost === void 0 ? {} : { edge: EDGE_COMPOSE_OVERLAY, caddyfile: EDGE_CADDYFILE },
     ...mirrors === void 0 ? {} : { mirrors },
     ...config.mirrors === void 0 || config.mirrors.npm === null ? {} : { npmMirrorConf: NPM_MIRROR_CONF },
@@ -8507,10 +9398,22 @@ var generationFiles = (config, secrets, assets, identity = renderIdentity(secret
 var persistSetup = (store, config, secrets, assets) => storeValue(store.prepare(generationFiles(config, secrets, assets)));
 var healthOrigin = (config) => {
   if (config.edgeHost === void 0) return config.appUrl;
-  const host = net3.isIP(config.bind) === 6 ? `[${config.bind}]` : config.bind;
+  const host = net4.isIP(config.bind) === 6 ? `[${config.bind}]` : config.bind;
   return `http://${host}:${config.appPort}`;
 };
 var reachableLine = (config) => config.edgeHost === void 0 ? `Mend ${config.serverVersion} is reachable at ${config.appUrl}` : `Mend ${config.serverVersion} answers at ${healthOrigin(config)} on this machine \xB7 the edge is set up for ${config.appUrl}`;
+var T3_GATEWAY_OBSERVE_ATTEMPTS = 15;
+var observeT3Gateway = async (runtime, port) => {
+  const url = `http://127.0.0.1:${port}/.well-known/t3/environment`;
+  for (let attempt2 = 0; attempt2 < T3_GATEWAY_OBSERVE_ATTEMPTS; attempt2 += 1) {
+    const response = await runtime.fetchText(url, 2e3);
+    if (response.error === void 0 && response.status === 200) {
+      return `The t3code gateway answered at 127.0.0.1:${port}, observed from this machine; it is published there only. In t3code, add it as an environment at http://127.0.0.1:${port} and pair with a code from mend pair; reaching it from elsewhere is an exposure you put in front of it and declare (docs/adr/0004).`;
+    }
+    if (attempt2 < T3_GATEWAY_OBSERVE_ATTEMPTS - 1) await runtime.sleep(2e3);
+  }
+  return `The t3code gateway did not answer at 127.0.0.1:${port} from this machine within about a minute. Mend runs without it; mend server logs shows what it said, and mend server status looks again.`;
+};
 var probeHealth = async (runtime, appUrl, expectedVersion) => {
   const healthUrl = `${appUrl}/api/health`;
   let lastFailure = "request did not complete";
@@ -8639,6 +9542,22 @@ var checkLocalImages = async (runtime, installation, policy = "local") => {
       `Image ${image} must carry org.opencontainers.image.version=${config.serverVersion}.`
     );
   }
+  if (config.t3GatewayPort !== void 0) {
+    const gateway = await runtime.run("docker", [
+      "--context",
+      config.dockerContext,
+      "image",
+      "inspect",
+      image,
+      "--format",
+      `{{index .Config.Labels "${T3_GATEWAY_IMAGE_LABEL}"}}`
+    ]);
+    if (gateway.status !== 0 || gateway.stdout.trim() !== "1") {
+      throw setupError(
+        `Mend ${config.serverVersion} has no t3code gateway (its image carries no ${T3_GATEWAY_IMAGE_LABEL} label). Upgrade to a version that has one with mend server upgrade --version <version>, then turn it on; or run mend server setup --no-t3-gateway`
+      );
+    }
+  }
   const postgres = await inspectImage(
     runtime,
     config.dockerContext,
@@ -8896,12 +9815,90 @@ var mirrorsChangedLines = (before, config) => {
   );
   return lines;
 };
-var setupServer = async (args, runtime, store) => {
+var UNASKED_FRESH_SETUP = "No terminal to ask on and no flags, so setup does not guess how this Mend is reached. Run mend server setup in a terminal to answer its questions, or say it with flags: --yes takes the defaults (this machine only, http://localhost:3105); --bind <address> --url <origin> serves a private network (a tailnet, a LAN, a VPN); for public HTTPS, set up on this machine first, create the first account, then run mend server setup --edge <host> --exposure public. mend help server setup lists every flag.";
+var refuseLegacyContract = (existing) => {
+  if (existing !== null && existing.config.assetContract !== ASSET_CONTRACT) {
+    throw setupError(
+      `Mend ${existing.config.serverVersion} was installed under the ${existing.config.assetContract} bundle contract. Use mend server upgrade --version latest to move it to ${ASSET_CONTRACT}; setup cannot repair it in place.`
+    );
+  }
+};
+var guideObservations = (runtime) => ({
+  tailscale: async () => {
+    const status = await runtime.run("tailscale", ["status", "--json"], { timeoutMs: 5e3 });
+    if (status.stdout.trim() === "") return null;
+    const serve = await runtime.run("tailscale", ["serve", "status", "--json"], {
+      timeoutMs: 5e3
+    });
+    return tailscaleFactsOf(status.stdout, serve.status === 0 ? serve.stdout : "");
+  },
+  lookupHost: runtime.lookupHost ?? (async () => null),
+  localAddresses: runtime.localAddresses ?? (() => []),
+  portTaken: runtime.portTaken ?? (async () => false)
+});
+var guidedSetup = async (runtime, prompter) => {
+  if (runtime.platform !== "linux" && runtime.platform !== "darwin") {
+    throw setupError(`mend server setup supports Linux and macOS, not ${runtime.platform}.`);
+  }
+  const read = await withServerStore(
+    runtime.configDir,
+    async (store) => storeValue(readServerInstallation(store)),
+    { create: true }
+  );
+  if (read._tag === "error") return { _tag: "error", message: read.error.message };
+  const existing = read.value;
+  refuseLegacyContract(existing);
+  const outcome = await runGuide(
+    { write: runtime.writeLine, ask: prompter },
+    {
+      saved: existing === null ? null : resolveSetupSettings(existing.config, []),
+      defaults: resolveSetupSettings(null, []),
+      observe: guideObservations(runtime),
+      resolve: (flags) => resolveSetupSettings(existing?.config ?? null, flags)
+    }
+  );
+  if (outcome._tag === "refused") return { _tag: "error", message: outcome.message };
+  if (outcome._tag === "stopped") {
+    runtime.writeLine("Nothing changed.");
+    return { _tag: "ok" };
+  }
+  return underLock(
+    runtime.configDir,
+    (store) => setupServer(outcome.flags, runtime, store, { askedAgainst: existing?.directory ?? null }),
+    { create: true }
+  );
+};
+var underLock = async (configDir, operation, options) => {
+  let refused;
+  const result = await withServerStore(
+    configDir,
+    async (store) => {
+      try {
+        await operation(store);
+      } catch (cause) {
+        if (!(cause instanceof ServerSetupError)) throw cause;
+        refused = cause;
+      }
+    },
+    options
+  );
+  if (result._tag === "error") return { _tag: "error", message: result.error.message };
+  return refused === void 0 ? { _tag: "ok" } : { _tag: "error", message: refused.message };
+};
+var setupServer = async (args, runtime, store, run2 = {}) => {
   if (runtime.platform !== "linux" && runtime.platform !== "darwin") {
     throw setupError(`mend server setup supports Linux and macOS, not ${runtime.platform}.`);
   }
   const options = parseSetupOptions(args);
   const existing = storeValue(readServerInstallation(store));
+  if (run2.askedAgainst !== void 0 && (existing?.directory ?? null) !== run2.askedAgainst) {
+    throw setupError(
+      "The install changed while you answered: another mend server setup or upgrade ran. This one changed nothing; run mend server setup again to see the install as it is now."
+    );
+  }
+  if (run2.askedAgainst === void 0 && args.length === 0 && existing === null) {
+    throw setupError(UNASKED_FRESH_SETUP);
+  }
   const savedIdentity = storeValue(store.readIdentity());
   const savedSecrets = savedIdentity === null ? null : parseSecrets(savedIdentity);
   if (existing !== null && options.version !== void 0 && options.version !== existing.config.serverVersion) {
@@ -8909,11 +9906,7 @@ var setupServer = async (args, runtime, store) => {
       `Setup retains Mend ${existing.config.serverVersion}. Use mend server upgrade --version ${options.version} to change the server pin.`
     );
   }
-  if (existing !== null && existing.config.assetContract !== ASSET_CONTRACT) {
-    throw setupError(
-      `Mend ${existing.config.serverVersion} was installed under the ${existing.config.assetContract} bundle contract. Use mend server upgrade --version latest to move it to ${ASSET_CONTRACT}; setup cannot repair it in place.`
-    );
-  }
+  refuseLegacyContract(existing);
   const selectedContext = await selectDockerContext(
     runtime,
     options.context ?? existing?.config.dockerContext
@@ -8956,6 +9949,16 @@ var setupServer = async (args, runtime, store) => {
     ...configWithoutBucket,
     ...bucket === void 0 ? {} : { bucket }
   };
+  if (existing !== null && run2.askedAgainst === void 0) {
+    const changes = changeLines(
+      resolveSetupSettings(existing.config, []),
+      settingsOf({ ...configWithoutBucket, mirrors })
+    );
+    if (changes.length > 0) {
+      runtime.writeLine("This run changes:");
+      for (const line of changes) runtime.writeLine(line);
+    }
+  }
   if (existing === null && (config.edgeHost !== void 0 || config.exposure === "public")) {
     throw setupError(
       `A fresh install cannot start with the edge or as public: until the first account exists, registration is open to whoever reaches the origin first, and the server refuses MEND_EXPOSURE=public without an operator account. Run mend server setup without --edge and --exposure public, create the first account at http://localhost:${config.appPort}, then run mend server setup --edge <host> and declare the posture.`
@@ -8965,6 +9968,11 @@ var setupServer = async (args, runtime, store) => {
     ...savedSecrets ?? createSecrets(runtime),
     ...dockerHubToken === void 0 ? {} : { dockerHubToken }
   };
+  if (config.t3GatewayPort !== void 0 && config.t3GatewayPort !== existing?.config.t3GatewayPort && config.dockerEndpoint.startsWith("unix://") && runtime.portTaken !== void 0 && await runtime.portTaken(config.t3GatewayPort)) {
+    throw setupError(
+      `127.0.0.1:${config.t3GatewayPort} is already in use on this machine, so the t3code gateway cannot be published there and Mend would not start. Free it, or pick another with --t3-gateway-port <n>`
+    );
+  }
   const generation = persistSetup(store, config, secrets, assets);
   const installation = {
     directory: generation.directory,
@@ -8994,6 +10002,14 @@ var setupServer = async (args, runtime, store) => {
   if (edgeStarted !== null) runtime.writeLine(edgeStarted);
   const sshPublication = await sshPublicationLine(runtime, config);
   if (sshPublication !== null) runtime.writeLine(sshPublication);
+  if (config.t3GatewayPort !== void 0) {
+    runtime.writeLine(await observeT3Gateway(runtime, config.t3GatewayPort));
+  }
+  if (existing?.config.t3GatewayPort !== void 0 && config.t3GatewayPort === void 0) {
+    runtime.writeLine(
+      `The t3code gateway is off. Its state (pairings and the device tokens they hold, queued messages) stays in its volume and comes back if you turn it on again; to remove it: docker --context ${config.dockerContext} volume rm mend_${T3_GATEWAY_VOLUME}`
+    );
+  }
   if (existing?.config.edgeHost !== void 0 && config.edgeHost === void 0) {
     runtime.writeLine(
       `The edge for ${existing.config.edgeHost} is gone. Its certificate volumes stay until you remove them: docker --context ${config.dockerContext} volume rm mend_mend-edge-data mend_mend-edge-config`
@@ -9627,6 +10643,15 @@ var serverStatus = async (runtime, installation) => {
   }
   for (const line of await mirrorStatusLines(runtime, installation, runningServices))
     runtime.writeLine(line);
+  if (config.t3GatewayPort !== void 0 && runningServices.includes("mend")) {
+    const gateway = await runtime.fetchText(
+      `http://127.0.0.1:${config.t3GatewayPort}/.well-known/t3/environment`,
+      2e3
+    );
+    runtime.writeLine(
+      gateway.error === void 0 && gateway.status === 200 ? `t3code gateway \xB7 observed answering at 127.0.0.1:${config.t3GatewayPort} from this machine` : `t3code gateway \xB7 not observed at 127.0.0.1:${config.t3GatewayPort} from this machine \xB7 mend server logs shows what it said`
+    );
+  }
   if (!runningServices.includes("mend")) {
     runtime.writeLine("Mend is stopped. No health claim was made.");
     return;
@@ -9743,6 +10768,17 @@ var nodeServerRuntime = () => {
     dockerDaemonFacts: hostDockerDaemonFacts,
     readLogin: (configDir) => savedLogin(configDir, environment),
     probeSsh: probeSshFromHere,
+    portTaken: portTakenHere,
+    ...process.stdin.isTTY === true && process.stdout.isTTY === true ? { prompter: askOnTerminal } : {},
+    lookupHost: async (host) => {
+      try {
+        return (await dns.lookup(host, { all: true })).map((entry) => entry.address);
+      } catch {
+        return null;
+      }
+    },
+    // Container and VM bridges (Docker's own among them) are never where people reach Mend.
+    localAddresses: () => Object.entries(os10.networkInterfaces()).filter(([name]) => !/^(docker|br-|veth|virbr|cni|flannel|vmnet|vboxnet)/.test(name)).flatMap(([, entries]) => entries ?? []).filter((entry) => !entry.internal).map((entry) => entry.address),
     readStdin: async () => {
       const chunks = [];
       for await (const chunk of process.stdin)
@@ -9751,8 +10787,21 @@ var nodeServerRuntime = () => {
     }
   };
 };
+var askOnTerminal = async (prompt) => {
+  const readline = await import("node:readline/promises");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await new Promise((resolve8) => {
+      rl.once("close", () => resolve8(null));
+      rl.once("SIGINT", () => rl.close());
+      rl.question(prompt).then(resolve8, () => resolve8(null));
+    });
+  } finally {
+    rl.close();
+  }
+};
 var sshBannerAt = async (host, port, timeoutMs) => {
-  const socket = net3.connect({ host, port });
+  const socket = net4.connect({ host, port });
   let deadline;
   try {
     return await Promise.race([
@@ -9774,6 +10823,11 @@ var sshBannerAt = async (host, port, timeoutMs) => {
     socket.destroy();
   }
 };
+var portTakenHere = (port) => new Promise((resolve8) => {
+  const server = net4.createServer();
+  server.once("error", (error) => resolve8(error.code === "EADDRINUSE"));
+  server.listen(port, "127.0.0.1", () => server.close(() => resolve8(false)));
+});
 var probeSshFromHere = async (bind, port) => {
   const unspecified = bind === "0.0.0.0" || bind === "::";
   const addresses = unspecified ? Object.values(os10.networkInterfaces()).flatMap((entries) => entries ?? []).filter(
@@ -9808,15 +10862,14 @@ var serverCommand = async (args, runtime = nodeServerRuntime()) => {
     };
   }
   try {
-    const result = await withServerStore(
+    if (command === "setup" && rest.length === 0 && runtime.prompter !== void 0) {
+      return await guidedSetup(runtime, runtime.prompter);
+    }
+    return await underLock(
       runtime.configDir,
-      async (store) => {
-        if (command === "setup") await setupServer(rest, runtime, store);
-        else await manageServer(command, rest, runtime, store);
-      },
+      (store) => command === "setup" ? setupServer(rest, runtime, store) : manageServer(command, rest, runtime, store),
       { create: command === "setup" }
     );
-    return result._tag === "error" ? { _tag: "error", message: result.error.message } : { _tag: "ok" };
   } catch (cause) {
     if (cause instanceof ServerSetupError) return { _tag: "error", message: cause.message };
     const detail = cause instanceof Error ? cause.message : String(cause);
@@ -10003,7 +11056,7 @@ var renderMendToml = (proposals) => {
 };
 
 // src/service-tunnels.ts
-import * as net4 from "node:net";
+import * as net5 from "node:net";
 var attachTunnelTargets = (services, sessionId) => services.filter(
   (service) => service.sessionId === sessionId && service.protocol === "tcp" && service.browserScheme !== null
 );
@@ -10115,7 +11168,7 @@ var createServiceTunnels = (options) => {
   };
   const openFor = async (service) => {
     const sockets = /* @__PURE__ */ new Set();
-    const server = net4.createServer((socket) => {
+    const server = net5.createServer((socket) => {
       sockets.add(socket);
       socket.on("close", () => sockets.delete(socket));
       pumpConnection(socket, options.tunnelUrl(service.id));
@@ -10748,11 +11801,65 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   try {
     fs18.mkdirSync(path18.dirname(configFile), { recursive: true, mode: 448 });
     fs18.chmodSync(path18.dirname(configFile), 448);
-    fs18.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs18.chmodSync(configFile, 384);
+    replaceFileAtomically(configFile, reconciled.value, 384);
     return success(void 0);
   } catch (cause) {
-    return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
+    return failure(
+      new WorkspaceSshError(
+        "config",
+        `Could not write ${configFile}${cause instanceof Error ? `: ${cause.message}` : "."}`,
+        cause
+      )
+    );
+  }
+};
+var linkTarget = (file) => {
+  let current = file;
+  for (let hops = 0; hops < 40; hops += 1) {
+    let stat;
+    try {
+      stat = fs18.lstatSync(current);
+    } catch {
+      if (current !== file && !fs18.existsSync(path18.dirname(current))) {
+        throw new Error(
+          `${file} is a symlink to ${current}, whose directory does not exist. Create it, or replace the link with a file; Mend left the link as it is.`
+        );
+      }
+      return current;
+    }
+    if (!stat.isSymbolicLink()) return current;
+    current = path18.resolve(path18.dirname(current), fs18.readlinkSync(current));
+  }
+  throw new Error(`${file} is a chain of symlinks too long to follow; Mend left it as it is.`);
+};
+var replaceFileAtomically = (file, contents, mode) => {
+  const destination = linkTarget(file);
+  const temporary = path18.join(
+    path18.dirname(destination),
+    `.${path18.basename(destination)}.mend-${process.pid}-${createHash3("sha256").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 12)}`
+  );
+  let descriptor = null;
+  try {
+    descriptor = fs18.openSync(temporary, "wx", mode);
+    fs18.writeFileSync(descriptor, contents);
+    fs18.fsyncSync(descriptor);
+    fs18.closeSync(descriptor);
+    descriptor = null;
+    fs18.chmodSync(temporary, mode);
+    fs18.renameSync(temporary, destination);
+  } catch (cause) {
+    if (descriptor !== null) fs18.closeSync(descriptor);
+    fs18.rmSync(temporary, { force: true });
+    throw cause;
+  }
+  try {
+    const directory = fs18.openSync(path18.dirname(destination), "r");
+    try {
+      fs18.fsyncSync(directory);
+    } finally {
+      fs18.closeSync(directory);
+    }
+  } catch {
   }
 };
 
@@ -11112,6 +12219,17 @@ var describeUninstall = async (runtime, scope) => {
         dockerContext: read.value.config.dockerContext,
         edgeHost: read.value.config.edgeHost ?? null,
         mirrors: mirrorServices(read.value.config.mirrors),
+        t3GatewayVolume: read.value.config.t3GatewayPort !== void 0 || (await runtime.server.run(
+          "docker",
+          dockerArgs(
+            read.value.config.dockerContext,
+            "volume",
+            "inspect",
+            `mend_${T3_GATEWAY_VOLUME}`,
+            "--format",
+            "{{json .}}"
+          )
+        )).status === 0,
         generations: countEntries(path20.join(configDir, "generations")),
         backups: countEntries(path20.join(configDir, "backups"))
       };
@@ -11145,7 +12263,9 @@ var planLines = (plan, configDir) => {
       const edge = [...edgeHost === null ? [] : ["edge"], ...mirrors];
       const edgeVolumes = [
         ...edgeHost === null ? [] : ["mend-edge-data", "mend-edge-config"],
-        ...mirrors.map((service) => `mend-${service}`)
+        ...mirrors.map((service) => `mend-${service}`),
+        // The t3code gateway's state, with paired people's device tokens, when it is there.
+        ...plan.server.t3GatewayVolume === true ? [T3_GATEWAY_VOLUME] : []
       ];
       lines.push(
         `         containers ${["mend", "postgres", "garage", ...edge].join(", ")} \xB7 volumes ${[MEND_DOCKER_NAMESPACE_WITH_GARAGE.store, ...secondaryVolumesOf(MEND_DOCKER_NAMESPACE_WITH_GARAGE), "mend-config", "mend-ssh", "mend-postgres", ...edgeVolumes].join(", ")} \xB7 image ghcr.io/sealant-sh/mend:${version}${edgeHost === null ? "" : ` \xB7 the edge for ${edgeHost}`}`
@@ -11211,6 +12331,24 @@ var removeServer = async (runtime, failures, leftovers) => {
         server.writeLine(
           `removed containers ${["mend", "postgres", "garage", ...mirrorServices(installation.config.mirrors)].join(", ")} and the Compose-owned volumes`
         );
+        const gatewayVolume = `mend_${T3_GATEWAY_VOLUME}`;
+        const gatewayLeft = await server.run(
+          "docker",
+          dockerArgs(context, "volume", "inspect", gatewayVolume, "--format", "{{json .}}")
+        );
+        if (gatewayLeft.status === 0) {
+          const gone = await server.run(
+            "docker",
+            dockerArgs(context, "volume", "rm", gatewayVolume)
+          );
+          if (gone.status === 0) {
+            server.writeLine(`removed volume ${gatewayVolume}, the t3code gateway's state`);
+          } else {
+            failures.push(
+              `could not remove volume ${gatewayVolume} (the t3code gateway's state, with paired device tokens): ${(gone.error ?? gone.stderr.trim()) || "no output"}`
+            );
+          }
+        }
         const namespace = installation.config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
         const dataVolumes = [namespace.store, ...secondaryVolumesOf(namespace)];
         const identity = store.readIdentity();
@@ -11881,8 +13019,8 @@ var askWorktreeName = async () => {
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const answer = (await rl.question(`  worktree name ${dim7("(enter for auto)")}: `)).trim();
-    return answer === "" ? null : normalizeProjectName(answer);
+    const answer2 = (await rl.question(`  worktree name ${dim7("(enter for auto)")}: `)).trim();
+    return answer2 === "" ? null : normalizeProjectName(answer2);
   } finally {
     rl.close();
   }
@@ -12534,10 +13672,10 @@ var pickSessionInteractively = async (rows) => {
   });
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await rl.question("  session #: ");
+  const answer2 = await rl.question("  session #: ");
   rl.close();
-  const chosen = rows[Number(answer.trim()) - 1];
-  if (chosen === void 0) return fail7(`"${answer.trim()}" is not one of the choices`);
+  const chosen = rows[Number(answer2.trim()) - 1];
+  if (chosen === void 0) return fail7(`"${answer2.trim()}" is not one of the choices`);
   return chosen.session;
 };
 var resolveLiveSession = async (config, prefix, command) => {
@@ -12600,8 +13738,7 @@ var shellCommand = async (config, args) => {
   process.exit(0);
 };
 var flattenService = (view) => {
-  const attempt2 = view.service.currentAttemptId === null ? null : view.attempts.find((candidate) => candidate.id === view.service.currentAttemptId) ?? null;
-  const observation = view.currentForward !== null && view.latestObservation?.forwardId === view.currentForward.id ? view.latestObservation : null;
+  const attempt2 = serviceViewAttempt(view);
   const endpoint = view.endpoints.find((candidate) => candidate.scope === "private") ?? view.endpoints[0] ?? null;
   const browserUrl = view.endpoints.find((candidate) => candidate.browserUrl !== null)?.browserUrl ?? null;
   return {
@@ -12609,7 +13746,7 @@ var flattenService = (view) => {
     processId: attempt2?.id ?? null,
     sessionId: view.service.sessionId,
     label: view.service.name,
-    status: observation?.state ?? view.currentForward?.state ?? attempt2?.status ?? "stopped",
+    status: serviceViewStatus(view),
     workspacePort: view.service.workspacePort,
     hostPort: endpoint?.hostPort ?? null,
     authority: endpoint?.authority ?? null,
@@ -13171,9 +14308,9 @@ var serviceInit = async (args) => {
     }
     const readline = await import("node:readline/promises");
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    const answer = await rl.question("write it? [y/N] ");
+    const answer2 = await rl.question("write it? [y/N] ");
     rl.close();
-    if (answer.trim().toLowerCase() !== "y") {
+    if (answer2.trim().toLowerCase() !== "y") {
       say7(dim7("nothing written"));
       return;
     }
@@ -13184,7 +14321,7 @@ var serviceInit = async (args) => {
 var tunnelServices = async (config, services, portOverride) => {
   for (const service of services) {
     const port = portOverride ?? service.hostPort ?? service.workspacePort;
-    const server = net5.createServer(
+    const server = net6.createServer(
       (socket) => pumpConnection(socket, tunnelUrlFor(config, service.id))
     );
     await listenLocal(server, port, false).catch(
@@ -13756,19 +14893,19 @@ var askUninstallScope = async () => {
   UNINSTALL_CHOICES.forEach((choice, index) => say7(`  ${index + 1}. ${choice.text}`));
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = (await rl.question("  1, 2 or 3: ")).trim();
+  const answer2 = (await rl.question("  1, 2 or 3: ")).trim();
   rl.close();
-  const chosen = UNINSTALL_CHOICES[Number(answer) - 1];
-  if (chosen === void 0) return fail7(`"${answer}" is not one of the choices`);
+  const chosen = UNINSTALL_CHOICES[Number(answer2) - 1];
+  if (chosen === void 0) return fail7(`"${answer2}" is not one of the choices`);
   return chosen.scope;
 };
 var confirmUninstall = async (word) => {
   if (process.stdin.isTTY !== true) return fail7("non-interactive \u2014 pass --yes to remove");
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const answer = (await rl.question(word === "y" ? "remove? [y/N] " : `type ${word} to remove: `)).trim().toLowerCase();
+  const answer2 = (await rl.question(word === "y" ? "remove? [y/N] " : `type ${word} to remove: `)).trim().toLowerCase();
   rl.close();
-  return answer === word;
+  return answer2 === word;
 };
 var uninstallCommand = async (config, args) => {
   const parsed = parseUninstallArgs(args);
@@ -14334,7 +15471,7 @@ _mend() {
         compadd setup status start stop restart logs upgrade
       else
         case $words[3] in
-          setup) compadd -- --version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket ;;
+          setup) compadd -- --yes --version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket ;;
           upgrade) compadd -- --version --assets-dir --offline --from-preview ;;
           start|restart) compadd -- --offline ;;
           logs) compadd -- --tail ;;
@@ -14363,7 +15500,7 @@ var BASH_COMPLETIONS = `_mend() {
         options="setup status start stop restart logs upgrade"
       else
         case \${COMP_WORDS[2]} in
-          setup) options="--version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket" ;;
+          setup) options="--yes --version --assets-dir --offline --context --port --ssh-port --bind --url --origin --docker-socket" ;;
           upgrade) options="--version --assets-dir --offline --from-preview" ;;
           start|restart) options="--offline" ;;
           logs) options="--tail" ;;
@@ -15236,7 +16373,7 @@ var dashboard = async (config, options = {}) => {
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-OBFWHSPD.js");
+  const { runDashboard } = await import("./dashboard-MPO6H5YF.js");
   const agentShare = await startShareIfBridge(config);
   const tunnels = options.noTunnel === true || serverIsLocal(config) ? null : createServiceTunnels({
     listServices: () => fetchServices(config),