@songsid/agend 2.1.5 → 2.1.6-beta.10

package/dist/provider-secret-registry.js

@@ -0,0 +1,334 @@
+import { lookup as dnsLookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { request as httpsRequest } from "node:https";
+import { redactProviderError } from "./provider-probe.js";
+function jsonObject(body) {
+    return !!body && typeof body === "object" && !Array.isArray(body);
+}
+const modelList = (status, body) => status >= 200 && status < 300 && jsonObject(body);
+/** Initial registry.  xAI stays out until its endpoint/auth contract is fixed. */
+export const PROVIDER_SECRET_SPECS = Object.freeze([
+    {
+        id: "groq.api_key",
+        envKey: "GROQ_API_KEY",
+        displayName: "Groq API key",
+        kind: "api_key",
+        allowedHosts: ["https://api.groq.com"],
+        verifier: {
+            origin: "https://api.groq.com",
+            path: "/openai/v1/models",
+            auth: "bearer",
+            timeoutMs: 8_000,
+            maxResponseBytes: 256 * 1024,
+            expected: modelList,
+        },
+        activation: "reload_hook",
+        reloadHookId: "groq.voice",
+    },
+    {
+        id: "openai.api_key",
+        envKey: "OPENAI_API_KEY",
+        displayName: "OpenAI API key",
+        kind: "api_key",
+        allowedHosts: ["https://api.openai.com"],
+        verifier: {
+            origin: "https://api.openai.com",
+            path: "/v1/models",
+            auth: "bearer",
+            timeoutMs: 8_000,
+            maxResponseBytes: 256 * 1024,
+            expected: modelList,
+        },
+        activation: "next_use",
+    },
+    {
+        id: "anthropic.api_key",
+        envKey: "ANTHROPIC_API_KEY",
+        displayName: "Anthropic API key",
+        kind: "api_key",
+        allowedHosts: ["https://api.anthropic.com"],
+        verifier: {
+            origin: "https://api.anthropic.com",
+            path: "/v1/models",
+            auth: "anthropic",
+            timeoutMs: 8_000,
+            maxResponseBytes: 256 * 1024,
+            expected: modelList,
+        },
+        activation: "next_use",
+    },
+].map(spec => Object.freeze({
+    ...spec,
+    allowedHosts: Object.freeze([...spec.allowedHosts]),
+    verifier: spec.verifier ? Object.freeze({ ...spec.verifier }) : undefined,
+})));
+const RESERVED_ENV_KEYS = new Set(["PATH", "HOME", "PWD", "SHELL", "ENV", "BASH_ENV", "NODE_OPTIONS", "LD_PRELOAD"]);
+const ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+export function providerSecretSpec(id) {
+    return PROVIDER_SECRET_SPECS.find(spec => spec.id === id);
+}
+/** Validate immutable registry data at module load and in focused tests. */
+export function validateProviderSecretRegistry(specs = PROVIDER_SECRET_SPECS) {
+    const ids = new Set();
+    const keys = new Set();
+    for (const spec of specs) {
+        if (ids.has(spec.id))
+            throw new Error("provider secret registry contains duplicate id");
+        ids.add(spec.id);
+        if (!ENV_KEY.test(spec.envKey) || RESERVED_ENV_KEYS.has(spec.envKey))
+            throw new Error("provider secret registry contains unsafe env key");
+        if (keys.has(spec.envKey))
+            throw new Error("provider secret registry contains duplicate env key");
+        keys.add(spec.envKey);
+        for (const origin of spec.allowedHosts) {
+            const parsed = new URL(origin);
+            if (parsed.protocol !== "https:" || isIP(parsed.hostname) !== 0 || parsed.username || parsed.password || parsed.search || parsed.hash || parsed.pathname !== "/") {
+                throw new Error("provider secret registry contains unsafe origin");
+            }
+        }
+        if (!spec.verifier)
+            continue;
+        const verifierOrigin = new URL(spec.verifier.origin);
+        if (verifierOrigin.protocol !== "https:" || isIP(verifierOrigin.hostname) !== 0 || verifierOrigin.username || verifierOrigin.password || verifierOrigin.search || verifierOrigin.hash || verifierOrigin.pathname !== "/") {
+            throw new Error("provider secret verifier contains unsafe origin");
+        }
+        if (!spec.allowedHosts.includes(spec.verifier.origin))
+            throw new Error("provider verifier origin is not allowlisted");
+        if (!spec.verifier.path.startsWith("/") || spec.verifier.path.includes("?") || spec.verifier.path.includes("#") || spec.verifier.path.includes("\\")) {
+            throw new Error("provider verifier contains unsafe path");
+        }
+        if (!Number.isFinite(spec.verifier.timeoutMs) || spec.verifier.timeoutMs <= 0 || !Number.isFinite(spec.verifier.maxResponseBytes) || spec.verifier.maxResponseBytes <= 0) {
+            throw new Error("provider verifier limits are invalid");
+        }
+    }
+}
+validateProviderSecretRegistry();
+export function validateSecretHeaderValue(secret) {
+    if (!secret || secret.length > 4096 || /[\r\n\0]/.test(secret) || /[^\x20-\x7e]/.test(secret)) {
+        throw new Error("secret header value is invalid");
+    }
+}
+const PRIVATE_IPV4 = new BlockList();
+for (const [address, prefix] of [
+    ["0.0.0.0", 8], ["10.0.0.0", 8], ["100.64.0.0", 10], ["127.0.0.0", 8],
+    ["169.254.0.0", 16], ["172.16.0.0", 12], ["192.0.0.0", 24], ["192.0.2.0", 24],
+    ["192.168.0.0", 16], ["198.18.0.0", 15], ["198.51.100.0", 24], ["203.0.113.0", 24],
+    ["224.0.0.0", 4], ["240.0.0.0", 4],
+])
+    PRIVATE_IPV4.addSubnet(address, prefix, "ipv4");
+const PRIVATE_IPV6 = new BlockList();
+for (const [address, prefix] of [
+    ["::", 128], ["::1", 128], ["::ffff:0:0", 96], ["fc00::", 7], ["fe80::", 10], ["ff00::", 8],
+])
+    PRIVATE_IPV6.addSubnet(address, prefix, "ipv6");
+/**
+ * BlockList handles IPv4-mapped IPv6 spellings (including hex tails) without
+ * relying on string prefixes. Unknown address families fail closed.
+ */
+function isPrivateAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return PRIVATE_IPV4.check(address, "ipv4");
+    if (family === 6)
+        return PRIVATE_IPV6.check(address, "ipv6");
+    return true;
+}
+export function createProviderHttpClientForTests(options) {
+    if (process.env.NODE_ENV !== "test")
+        throw new Error("provider HTTP test transport is unavailable outside tests");
+    return FixedProviderHttpClient.createForTests(options);
+}
+function responseBodyText(response, maxBytes, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        let settled = false;
+        const timer = setTimeout(() => { if (!settled) {
+            settled = true;
+            response.destroy();
+            reject(new Error("provider response timeout"));
+        } }, timeoutMs);
+        timer.unref?.();
+        response.on("data", (chunk) => {
+            if (settled)
+                return;
+            size += chunk.length;
+            if (size > maxBytes) {
+                settled = true;
+                clearTimeout(timer);
+                response.destroy();
+                reject(new Error("provider response exceeded limit"));
+                return;
+            }
+            chunks.push(Buffer.from(chunk));
+        });
+        response.on("end", () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(Buffer.concat(chunks).toString("utf8"));
+        });
+        response.on("error", err => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
+/**
+ * Direct HTTPS client. It deliberately does not use fetch/undici's ambient
+ * proxy environment: the allowlisted provider is the only destination. DNS is
+ * resolved once and the resulting address is returned on every lookup call,
+ * preventing a check/connect TOCTOU window.
+ */
+export class FixedProviderHttpClient {
+    testOptions;
+    constructor(testOptions) {
+        this.testOptions = testOptions;
+    }
+    static create() {
+        return new FixedProviderHttpClient();
+    }
+    static createForTests(options) {
+        return new FixedProviderHttpClient(options);
+    }
+    async request(spec, secret) {
+        const verifier = spec.verifier;
+        if (!verifier)
+            throw new Error("unsupported verifier");
+        if (process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0")
+            throw new Error("TLS verification is disabled");
+        validateSecretHeaderValue(secret);
+        const origin = new URL(verifier.origin);
+        if (!spec.allowedHosts.includes(origin.origin))
+            throw new Error("provider origin is not allowlisted");
+        const deadline = Date.now() + verifier.timeoutMs;
+        const resolved = await Promise.race([
+            (this.testOptions?.dnsLookup
+                ? this.testOptions.dnsLookup(origin.hostname, { all: false, verbatim: true })
+                : dnsLookup(origin.hostname, { all: false, verbatim: true })),
+            new Promise((_, reject) => {
+                const timer = setTimeout(() => reject(new Error("provider DNS lookup timeout")), verifier.timeoutMs);
+                timer.unref?.();
+            }),
+        ]);
+        const address = Array.isArray(resolved) ? resolved[0] : resolved;
+        if (!address?.address)
+            throw new Error("provider DNS returned no address");
+        if (this.testOptions?.allowPrivateAddress !== true && isPrivateAddress(address.address)) {
+            throw new Error("provider address is not public");
+        }
+        const headers = { Accept: "application/json" };
+        if (verifier.auth === "bearer")
+            headers.Authorization = `Bearer ${secret}`;
+        else if (verifier.auth === "x-api-key")
+            headers["x-api-key"] = secret;
+        else {
+            headers["x-api-key"] = secret;
+            headers["anthropic-version"] = "2023-06-01";
+        }
+        const requestOptions = {
+            protocol: "https:",
+            hostname: origin.hostname,
+            port: origin.port || 443,
+            path: verifier.path,
+            method: "GET",
+            headers,
+            rejectUnauthorized: true,
+            ca: this.testOptions?.ca,
+            servername: origin.hostname,
+            // Explicitly bypass any agent/proxy supplied by ambient config.
+            agent: false,
+            lookup: (_hostname, options, callback) => {
+                this.testOptions?.onConnectLookup?.(options);
+                if (options.all)
+                    callback(null, [{ address: address.address, family: address.family }]);
+                else
+                    callback(null, address.address, address.family);
+            },
+        };
+        // Node 20+ may request an all-address lookup when autoSelectFamily is
+        // enabled by the runtime. Keep this explicit in the transport so the
+        // callback below is exercised consistently across supported Node releases.
+        requestOptions.autoSelectFamily = true;
+        const raw = await new Promise((resolve, reject) => {
+            let settled = false;
+            const remaining = Math.max(1, deadline - Date.now());
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                request.destroy(new Error("provider request timeout"));
+                reject(new Error("provider request timeout"));
+            }, remaining);
+            timer.unref?.();
+            this.testOptions?.onRequest?.(requestOptions);
+            const request = httpsRequest(requestOptions, response => {
+                responseBodyText(response, verifier.maxResponseBytes, Math.max(1, deadline - Date.now())).then(body => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(timer);
+                    resolve({ response, body });
+                }, error => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(timer);
+                    reject(error);
+                });
+            });
+            request.on("error", error => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(error);
+            });
+            request.end();
+        });
+        let body = null;
+        try {
+            body = JSON.parse(raw.body);
+        }
+        catch {
+            body = raw.body;
+        }
+        // A redirect is never followed by this client. It is classified as
+        // unavailable by verifyProviderSecret, regardless of Location contents.
+        return { status: raw.response.statusCode ?? 0, body, detail: redactProviderError(raw.body, secret) };
+    }
+}
+export async function verifyProviderSecret(spec, secret, client = FixedProviderHttpClient.create()) {
+    if (!spec?.verifier)
+        return { ok: false, status: "unsupported_verifier" };
+    try {
+        const response = await client.request(spec, secret);
+        if (response.status >= 200 && response.status < 300 && spec.verifier.expected(response.status, response.body)) {
+            return { ok: true, status: "verified", provider_status: response.status };
+        }
+        if (response.status === 401 || response.status === 403)
+            return { ok: false, status: "provider_rejected" };
+        return { ok: false, status: "provider_unavailable", error: safeProviderDetail(response.detail, secret) };
+    }
+    catch (error) {
+        return { ok: false, status: "provider_unavailable", error: safeProviderDetail(redactProviderError(error, secret), secret) };
+    }
+}
+function safeProviderDetail(detail, secret) {
+    if (!detail)
+        return undefined;
+    return redactProviderError(detail, secret)
+        .replace(/(?:Bearer|x-api-key|api-key|authorization)\s*[:=]?\s*[^\s,;]+/gi, "$1: [redacted]")
+        .slice(0, 180);
+}
+export function providerRegistryEnvKeys() {
+    return new Set(PROVIDER_SECRET_SPECS.map(spec => spec.envKey));
+}
+export function isReservedProviderEnvKey(key) {
+    return RESERVED_ENV_KEYS.has(key);
+}
+//# sourceMappingURL=provider-secret-registry.js.map

package/dist/provider-secret-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-secret-registry.js","sourceRoot":"","sources":["../src/provider-secret-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,YAAY,EAAuB,MAAM,YAAY,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AA8C1D,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,CAAC,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,IAAa,EAAW,EAAE,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAEhH,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAkC,MAAM,CAAC,MAAM,CAAC;IAChF;QACE,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,cAAc;QAC3B,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC,sBAAsB,CAAC;QACtC,QAAQ,EAAE;YACR,MAAM,EAAE,sBAAsB;YAC9B,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK;YAChB,gBAAgB,EAAE,GAAG,GAAG,IAAI;YAC5B,QAAQ,EAAE,SAAS;SACpB;QACD,UAAU,EAAE,aAAa;QACzB,YAAY,EAAE,YAAY;KAC3B;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,MAAM,EAAE,gBAAgB;QACxB,WAAW,EAAE,gBAAgB;QAC7B,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC,wBAAwB,CAAC;QACxC,QAAQ,EAAE;YACR,MAAM,EAAE,wBAAwB;YAChC,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,KAAK;YAChB,gBAAgB,EAAE,GAAG,GAAG,IAAI;YAC5B,QAAQ,EAAE,SAAS;SACpB;QACD,UAAU,EAAE,UAAU;KACvB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,MAAM,EAAE,mBAAmB;QAC3B,WAAW,EAAE,mBAAmB;QAChC,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,CAAC,2BAA2B,CAAC;QAC3C,QAAQ,EAAE;YACR,MAAM,EAAE,2BAA2B;YACnC,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,KAAK;YAChB,gBAAgB,EAAE,GAAG,GAAG,IAAI;YAC5B,QAAQ,EAAE,SAAS;SACpB;QACD,UAAU,EAAE,UAAU;KACvB;CACF,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1B,GAAG,IAAI;IACP,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IACnD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;CAC1E,CAAC,CAAyB,CAAC,CAAC;AAE7B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;AACrH,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,8BAA8B,CAAC,QAAuC,qBAAqB;IACzG,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC1I,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAClG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACjK,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC7B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,IAAI,cAAc,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACzN,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACtH,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrJ,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC;YACzK,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC;AAED,8BAA8B,EAAE,CAAC;AAEjC,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,SAAS,EAAE,CAAC;AACrC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7E,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC;IAClF,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;CAC1B;IAAE,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D,MAAM,YAAY,GAAG,IAAI,SAAS,EAAE,CAAC;AACrC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI;IAC9B,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;CACnF;IAAE,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAyBD,MAAM,UAAU,gCAAgC,CAAC,OAAsC;IACrF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAClH,OAAO,uBAAuB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAyB,EAAE,QAAgB,EAAE,SAAiB;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACrJ,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACtB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACzB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACG;IAArC,YAAqC,WAA2C;QAA3C,gBAAW,GAAX,WAAW,CAAgC;IAAG,CAAC;IAEpF,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,uBAAuB,EAAE,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,OAAsC;QAC1D,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAwB,EAAE,MAAc;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS;gBAC1B,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC7E,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACrG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,CAAC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,WAAW,EAAE,mBAAmB,KAAK,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE,CAAC;aACtE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;aACjE,CAAC;YACJ,OAAO,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;YAC9B,OAAO,CAAC,mBAAmB,CAAC,GAAG,YAAY,CAAC;QAC9C,CAAC;QACD,MAAM,cAAc,GAAmB;YACrC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;YACxB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,MAAM,EAAE,KAAK;YACb,OAAO;YACP,kBAAkB,EAAE,IAAI;YACxB,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE;YACxB,UAAU,EAAE,MAAM,CAAC,QAAQ;YAC3B,gEAAgE;YAChE,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBACvC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC7C,IAAI,OAAO,CAAC,GAAG;oBAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;;oBACnF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC;SACF,CAAC;QACF,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC1E,cAAkE,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC5F,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAA8C,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7F,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;gBACvD,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAChD,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE;gBACtD,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpG,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9B,CAAC,EAAE,KAAK,CAAC,EAAE;oBACT,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAAC,CAAC;QAC/D,mEAAmE;QACnE,wEAAwE;QACxE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IACvG,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAoC,EACpC,MAAc,EACd,SAA6B,uBAAuB,CAAC,MAAM,EAAE;IAE7D,IAAI,CAAC,IAAI,EAAE,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC1G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC3G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;IAC9H,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe,EAAE,MAAe;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC;SACvC,OAAO,CAAC,iEAAiE,EAAE,gBAAgB,CAAC;SAC5F,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/dist/quickstart-api.d.ts

@@ -0,0 +1,164 @@
+/**
+ * The Settings setup wizard's server side.
+ *
+ * Four steps, the same four `agend quickstart` walks: pick a backend and a
+ * working directory, pick a platform, prove the bot credentials, then write the
+ * files and start. The probes are the CLI's own (`provider-probe.ts`), so the
+ * wizard cannot drift into asking the providers different questions.
+ *
+ * What it deliberately does not do: apply. The last step writes the
+ * configuration and hands back, and the page then starts a normal apply job —
+ * the same one the panel uses everywhere else, with the same progress, the same
+ * idempotency key and the same disk-backed recovery across a restart.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { SecretWriteResult } from "./secret-file.js";
+import type { FleetConfig } from "./types.js";
+import { type BotIdentity, type DiscordGuild } from "./provider-probe.js";
+/** One slice of Telegram long polling, so the browser gets an answer. */
+export declare const TELEGRAM_WAIT_SLICE_MS = 25000;
+export declare const WIZARD_BACKENDS: readonly [{
+    readonly name: "claude-code";
+    readonly binary: "claude";
+}, {
+    readonly name: "codex";
+    readonly binary: "codex";
+}, {
+    readonly name: "opencode";
+    readonly binary: "opencode";
+}, {
+    readonly name: "kiro-cli";
+    readonly binary: "kiro-cli";
+}, {
+    readonly name: "antigravity";
+    readonly binary: "agy";
+}, {
+    readonly name: "grok";
+    readonly binary: "grok";
+}, {
+    readonly name: "muse";
+    readonly binary: "muse";
+}];
+export interface WizardEnvironment {
+    backends: string[];
+    /** Channels already configured, so the wizard can pre-fill and warn. */
+    channels: Array<{
+        id: string;
+        type: string;
+        token_env: string | null;
+        group_id: string | null;
+        /** Who can currently drive that connection, so a replacement can say who
+         * it is about to remove. */
+        allowed_users?: string[];
+    }>;
+    has_fleet: boolean;
+}
+export interface WizardPlanInput {
+    platform: "telegram" | "discord";
+    token_env: string;
+    backend: string;
+    working_directory: string;
+    instance_name: string;
+    group_id?: string;
+    guild_id?: string;
+    general_channel_id?: string;
+    admin_user_id?: string;
+}
+/** What the last step shows before anything is written. */
+export interface WizardPlan {
+    /** The channel entry that will be merged into fleet.yaml. */
+    channel: Record<string, unknown>;
+    instance: {
+        name: string;
+        working_directory: string;
+        backend: string;
+    };
+    /** Env var names only — never the value. */
+    env_keys: string[];
+    warnings: string[];
+}
+/**
+ * A channel id that is free, or the id of the connection being replaced.
+ *
+ * The platform name is the obvious id and the first bot gets it. A second bot on
+ * the same platform cannot have it — `duplicate channel id` — so it is
+ * qualified by the variable that holds its token. Without this the wizard can
+ * never add a second Telegram bot at all.
+ */
+export declare function nextChannelId(platform: string, tokenEnv: string, existing: ReadonlyArray<{
+    id: string;
+    token_env: string | null;
+}>): string;
+export declare function planQuickstart(input: WizardPlanInput, env: WizardEnvironment): WizardPlan;
+/** Upsert one `KEY=value` line, preserving everything else in the file. */
+export declare function upsertEnvLine(existing: string, key: string, value: string): string;
+export declare function writeQuickstartSecret(dataDir: string, key: string, value: string): SecretWriteResult;
+export type ProbeRequest = {
+    action: "verify";
+    platform: "telegram" | "discord";
+    token: string;
+} | {
+    action: "guilds";
+    token: string;
+} | {
+    action: "await-telegram-start";
+    token: string;
+    offset?: number;
+};
+export type ProbeResult = {
+    ok: true;
+    identity: BotIdentity;
+} | {
+    ok: true;
+    guilds: DiscordGuild[];
+} | {
+    ok: true;
+    found: {
+        groupId: number;
+        userId: number;
+    } | null;
+    offset: number;
+} | {
+    ok: false;
+    error: string;
+    conflict?: true;
+};
+/**
+ * Run one probe.
+ *
+ * `isTokenInUse` exists for the Telegram wait: `getUpdates` has exactly one
+ * consumer, so polling a token the running fleet already polls makes the two
+ * take turns and both miss messages. Refusing is the only honest answer — the
+ * alternative silently breaks the live bot while the wizard waits.
+ */
+export declare function runProviderProbe(request: ProbeRequest, opts?: {
+    isTokenInUse?: (token: string) => boolean;
+    deadlineMs?: number;
+}): Promise<ProbeResult>;
+export declare function detectWizardBackends(): string[];
+/**
+ * What the wizard's routes need from their host.
+ *
+ * Five fields, and none of them is a fleet: this is the whole "ConfigVerbs +
+ * ProviderProbeVerbs" surface. A running fleet supplies it from FleetManager; a
+ * pre-fleet setup host supplies it from a file. `tests/prefleet-host.test.ts`
+ * asserts this module's import graph reaches neither fleet-manager, daemon nor
+ * instance-lifecycle, so the host cannot grow a path to them by accident.
+ */
+export interface QuickstartApiContext {
+    fleetConfig: FleetConfig | null;
+    dataDir: string;
+    logger: {
+        info(obj: unknown, msg?: string): void;
+        warn(obj: unknown, msg?: string): void;
+    };
+    saveFleetConfig(): void;
+    /** Only a running fleet can answer this; without one, nothing is polling. */
+    isBotTokenInUse?(token: string): boolean;
+}
+/** The channels as the wizard sees them, from either config shape. */
+export declare function wizardChannels(cfg: FleetConfig | null): WizardEnvironment["channels"];
+/** Reject anything that would land in fleet.yaml or a shell env file unchecked. */
+export declare function validateWizardInput(input: Partial<WizardPlanInput>): string | null;
+/** Handle one wizard route. Returns false when the path is not one of ours. */
+export declare function handleQuickstartRequest(req: IncomingMessage, res: ServerResponse, url: URL, ctx: QuickstartApiContext): boolean;