@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/hub/init/network.js

@@ -0,0 +1,104 @@
+/** Init preflight only: temporary TCP binds, no HTTP, TLS, directory calls or firewall changes. */
+import { lookup } from "node:dns/promises";
+import { createServer, isIP } from "node:net";
+import { join } from "node:path";
+import { loadRawFleetConfig } from "../../config.js";
+import { previewSettings } from "../../web-preview.js";
+import { listenProblems } from "./initializer.js";
+async function address(host, resolve) {
+    if (isIP(host))
+        return host;
+    let timer;
+    try {
+        return await Promise.race([resolve(host), new Promise((_, reject) => {
+                timer = setTimeout(() => reject(Error("lookup deadline")), 2000);
+            })]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+const unspecified = (host) => host === "0.0.0.0" || (isIP(host) === 6 && /^[:0]+$/.test(host.split("%")[0]));
+function mapped(host) {
+    if (isIP(host) !== 6)
+        return host;
+    try {
+        const canonical = new URL(`http://[${host}]/`).hostname;
+        return canonical === "[::ffff:7f00:1]" ? "127.0.0.1" : canonical;
+    }
+    catch {
+        return host;
+    }
+}
+/** Refresh config at each preflight; the Hub also starts the daemon's existing local dashboard/preview. */
+export async function checkHubInitNetworkForHome(home, listeners) {
+    const config = loadRawFleetConfig(join(home, "fleet.yaml"));
+    const health = config.health_port ?? 19280;
+    if (typeof health !== "number" || !Number.isInteger(health) || health < 0 || health > 65535)
+        throw Error("invalid local dashboard port");
+    const preview = previewSettings(config.web, health);
+    const reserved = [{ host: "127.0.0.1", port: health }];
+    if (preview.enabled && preview.port !== null)
+        reserved.push({ host: "127.0.0.1", port: preview.port });
+    return checkHubInitNetwork(listeners, { reserved });
+}
+/** Hold both sockets together to detect alias conflicts; close every successful bind before returning. */
+export async function checkHubInitNetwork(listeners, options = {}) {
+    const servers = [];
+    let active = "web";
+    const problems = [];
+    try {
+        for (const listener of ["web", "member"]) {
+            active = listener;
+            const input = listeners[`${listener}Listen`];
+            if (listenProblems("listener", input).length) {
+                problems.push({ listener, reason: "invalid" });
+                break;
+            }
+            let host;
+            try {
+                host = await address(input.host, options.resolve ?? (async (name) => (await lookup(name)).address));
+            }
+            catch {
+                problems.push({ listener, reason: "unresolved" });
+                break;
+            }
+            if (!isIP(host) || unspecified(host)) {
+                problems.push({ listener, reason: "invalid" });
+                break;
+            }
+            if (options.reserved?.some(r => r.port === input.port && mapped(r.host) === mapped(host))) {
+                problems.push({ listener, reason: "reserved" });
+                break;
+            }
+            const server = createServer(socket => socket.destroy());
+            servers.push(server);
+            try {
+                await new Promise((resolve, reject) => {
+                    server.once("error", reject);
+                    server.listen({ host, port: input.port, exclusive: true }, resolve);
+                });
+            }
+            catch (err) {
+                const code = err?.code;
+                const reason = code === "EADDRINUSE" ? "occupied" : code === "EADDRNOTAVAIL" ? "interface"
+                    : code === "EACCES" || code === "EPERM" ? "permission" : "unavailable";
+                problems.push({ listener, reason });
+                break;
+            }
+        }
+    }
+    finally {
+        for (const server of servers.reverse()) {
+            if (server.listening)
+                await new Promise(resolve => server.close(err => {
+                    if (err)
+                        problems.push({ listener: active, reason: "unavailable" });
+                    resolve();
+                }));
+        }
+    }
+    return problems;
+}
+//# sourceMappingURL=network.js.map

package/dist/hub/init/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/hub/init/network.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,IAAI,EAAe,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAyB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAelD,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,OAA0C;IAC7E,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBACzE,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QAAC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;AAC/C,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AACtH,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,OAAO,SAAS,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY,EAAE,SAA2B;IACxF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC;IAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK;QAAE,MAAM,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzI,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,GAAmC,EAAE,MAAM,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAgB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,OAAO,mBAAmB,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAA2B,EAAE,OAAO,GAAsB,EAAE;IACpG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAqB,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAU,EAAE,CAAC;YAClD,MAAM,GAAG,QAAQ,CAAC;YAClB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC;YAC7C,IAAI,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;YACxG,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;YAC1G,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;YAChG,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBAAC,MAAM;YACzD,CAAC;YACD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAC7B,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBACtE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;gBAClD,MAAM,MAAM,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW;oBACxF,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;gBACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAAC,MAAM;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,SAAS;gBAAE,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;oBAC1E,IAAI,GAAG;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;oBACpE,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/hub/init/plan-digest.d.ts

@@ -0,0 +1,5 @@
+export declare const PLAN_DIGEST_LABEL = "agend-hub-init-plan-v1";
+/** The fields of a hub.* block that the digest covers. Unknown or extra fields are ignored; missing ones stay missing. */
+export declare function normalizedHubSettings(hub: unknown): Record<string, unknown>;
+/** SHA-256 (hex) of the label and the normalized settings. */
+export declare function hubPlanDigest(hub: unknown): string;

package/dist/hub/init/plan-digest.js

@@ -0,0 +1,47 @@
+/**
+ * The normalized plan digest that the initialization manifest seals and the Hub mount (S1) re-checks against the
+ * current configuration (agreed in hub-s48-init). Pure and side-effect free: both sides import it.
+ *
+ * It covers exactly the hub.* settings initialization writes (not `enabled`), normalized: fixed key set, canonical
+ * JSON (sorted keys), lowercase object id. Any later edit to these settings changes the digest, so a hand-edited
+ * fleet.yaml cannot silently keep a sealed Hub enabled.
+ */
+import { createHash } from "node:crypto";
+export const PLAN_DIGEST_LABEL = "agend-hub-init-plan-v1";
+const DIRECTORY_KEYS = ["realm", "url", "caPem", "baseDn", "bindDn", "profile", "loginAttribute", "userFilter", "timeoutMs", "bindPasswordRef"];
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value).filter(([, v]) => v !== undefined);
+        entries.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+const obj = (v) => (v && typeof v === "object" && !Array.isArray(v) ? v : {});
+const listen = (v) => ({ host: obj(v).host, port: obj(v).port });
+/** The fields of a hub.* block that the digest covers. Unknown or extra fields are ignored; missing ones stay missing. */
+export function normalizedHubSettings(hub) {
+    const h = obj(hub);
+    const d = obj(h.directory);
+    const admin = obj(h.administrator);
+    return {
+        name: h.name,
+        hubId: h.hubId,
+        webOrigin: h.webOrigin,
+        memberOrigin: h.memberOrigin,
+        memberListen: listen(h.memberListen),
+        webListen: listen(h.webListen),
+        webTls: { certificateFile: obj(h.webTls).certificateFile, keyFile: obj(h.webTls).keyFile },
+        directory: Object.fromEntries(DIRECTORY_KEYS.map((k) => [k, d[k]])),
+        administrator: { realm: admin.realm, objectId: typeof admin.objectId === "string" ? admin.objectId.toLowerCase() : admin.objectId },
+        retention: { contentDays: obj(h.retention).contentDays, eventDays: obj(h.retention).eventDays },
+        coexistence: h.coexistence,
+    };
+}
+/** SHA-256 (hex) of the label and the normalized settings. */
+export function hubPlanDigest(hub) {
+    return createHash("sha256").update(`${PLAN_DIGEST_LABEL}\n${canonical(normalizedHubSettings(hub))}`).digest("hex");
+}
+//# sourceMappingURL=plan-digest.js.map

package/dist/hub/init/plan-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-digest.js","sourceRoot":"","sources":["../../../src/hub/init/plan-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,CAAU,CAAC;AAEzJ,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAU,EAA2B,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7I,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAE1E,0HAA0H;AAC1H,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;QAC1F,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;QACnI,SAAS,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE;QAC/F,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,iBAAiB,KAAK,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrH,CAAC"}

package/dist/hub/init/prompt.d.ts

@@ -0,0 +1,26 @@
+export declare class WizardCancelled extends Error {
+    constructor();
+}
+export interface WizardIO {
+    ask(question: string): Promise<string>;
+    /** Read a secret without echoing it. The value is returned once and never written anywhere. */
+    askHidden(question: string): Promise<string>;
+    say(line?: string): void;
+}
+export interface HiddenInput {
+    readonly isTTY?: boolean;
+    isRaw?: boolean;
+    setRawMode?(mode: boolean): unknown;
+    setEncoding(encoding: BufferEncoding): unknown;
+    on(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+    removeListener(event: "data", listener: (chunk: string | Buffer) => void): unknown;
+    resume(): unknown;
+    pause(): unknown;
+}
+export interface PromptOutput {
+    write(text: string): unknown;
+}
+/** Read one line in raw mode, echoing nothing. Ctrl-C (or Ctrl-D on an empty line) cancels. */
+export declare function readHidden(input: HiddenInput, output: PromptOutput, question: string): Promise<string>;
+/** The real terminal. */
+export declare function terminalIO(): WizardIO;

package/dist/hub/init/prompt.js

@@ -0,0 +1,110 @@
+/**
+ * Terminal prompts for `agend hub init`. Ordinary questions go through readline; passwords are read in raw mode and
+ * never echoed (nothing in AgEnD read hidden input before). Each ordinary question uses its own readline interface, so
+ * no readline listener is attached while a password is being typed.
+ */
+import { createInterface } from "node:readline/promises";
+export class WizardCancelled extends Error {
+    constructor() {
+        super("cancelled");
+        this.name = "WizardCancelled";
+    }
+}
+const MAX_SECRET = 1024;
+/** Read one line in raw mode, echoing nothing. Ctrl-C (or Ctrl-D on an empty line) cancels. */
+export function readHidden(input, output, question) {
+    if (!input.isTTY || typeof input.setRawMode !== "function") {
+        // Never fall back to an echoing read for a secret.
+        return Promise.reject(new Error("a password can only be typed in an interactive terminal"));
+    }
+    output.write(question);
+    return new Promise((resolve, reject) => {
+        const wasRaw = input.isRaw === true;
+        let chars = [];
+        // Escape sequences: CSI (ESC [ … final byte @–~), SS3 (ESC O + one char) and ESC + one char are all swallowed.
+        let escape = "none";
+        const cleanup = () => {
+            input.removeListener("data", onData);
+            input.setRawMode(wasRaw);
+            input.pause();
+            output.write("\n");
+        };
+        const onData = (chunk) => {
+            for (const ch of String(chunk)) {
+                if (escape === "esc") {
+                    escape = ch === "[" ? "csi" : ch === "O" ? "ss3" : "none";
+                    continue;
+                }
+                if (escape === "csi") {
+                    if (ch >= "@" && ch <= "~")
+                        escape = "none";
+                    continue;
+                }
+                if (escape === "ss3") {
+                    escape = "none";
+                    continue;
+                }
+                if (ch === "\r" || ch === "\n") {
+                    cleanup();
+                    const value = chars.join("");
+                    chars = [];
+                    resolve(value);
+                    return;
+                }
+                if (ch === "\u0003" || (ch === "\u0004" && chars.length === 0)) {
+                    chars = [];
+                    cleanup();
+                    reject(new WizardCancelled());
+                    return;
+                }
+                if (ch === "\u007f" || ch === "\b") {
+                    chars.pop();
+                    continue;
+                }
+                if (ch === "\u001b") {
+                    escape = "esc";
+                    continue;
+                }
+                if (ch < " ")
+                    continue;
+                if (chars.length < MAX_SECRET)
+                    chars.push(ch);
+            }
+        };
+        input.setRawMode(true);
+        input.setEncoding("utf8");
+        input.on("data", onData);
+        input.resume();
+    });
+}
+/** The real terminal. */
+export function terminalIO() {
+    return {
+        async ask(question) {
+            const rl = createInterface({ input: process.stdin, output: process.stdout });
+            let closedEarly = false;
+            rl.once("close", () => {
+                closedEarly = true;
+            });
+            try {
+                const answer = await rl.question(question);
+                return answer;
+            }
+            catch (err) {
+                if (closedEarly)
+                    throw new WizardCancelled();
+                throw err;
+            }
+            finally {
+                rl.close();
+            }
+        },
+        askHidden(question) {
+            return readHidden(process.stdin, process.stdout, question);
+        },
+        say(line = "") {
+            process.stdout.write(`${line}\n`);
+        },
+    };
+}
+//# sourceMappingURL=prompt.js.map

package/dist/hub/init/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../../../src/hub/init/prompt.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC;QACE,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAwBD,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,+FAA+F;AAC/F,MAAM,UAAU,UAAU,CAAC,KAAkB,EAAE,MAAoB,EAAE,QAAgB;IACnF,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC3D,mDAAmD;QACnD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;QACpC,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,+GAA+G;QAC/G,IAAI,MAAM,GAAmC,MAAM,CAAC;QACpD,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,KAAK,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,EAAE;YACxC,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;oBAC1D,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG;wBAAE,MAAM,GAAG,MAAM,CAAC;oBAC5C,SAAS;gBACX,CAAC;gBACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,MAAM,GAAG,MAAM,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAC/B,OAAO,EAAE,CAAC;oBACV,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC7B,KAAK,GAAG,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,CAAC;oBACf,OAAO;gBACT,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC/D,KAAK,GAAG,EAAE,CAAC;oBACX,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBACnC,KAAK,CAAC,GAAG,EAAE,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACpB,MAAM,GAAG,KAAK,CAAC;oBACf,SAAS;gBACX,CAAC;gBACD,IAAI,EAAE,GAAG,GAAG;oBAAE,SAAS;gBACvB,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,UAAW,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,MAAM,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,QAAgB;YACxB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpB,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3C,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,WAAW;oBAAE,MAAM,IAAI,eAAe,EAAE,CAAC;gBAC7C,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,SAAS,CAAC,QAAgB;YACxB,OAAO,UAAU,CAAC,OAAO,CAAC,KAA+B,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvF,CAAC;QACD,GAAG,CAAC,IAAI,GAAG,EAAE;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hub/init/secret-file.d.ts

@@ -0,0 +1 @@
+export declare function readHubSecretFile(input: string): string;

package/dist/hub/init/secret-file.js

@@ -0,0 +1,59 @@
+/** Local initializer only: snapshot an explicitly selected owner-only secret file; never echo or remove the source. */
+import { constants, openSync, closeSync, readSync, fstatSync, lstatSync } from "node:fs";
+import { isAbsolute, dirname, resolve } from "node:path";
+const MAXIMUM = 1024;
+const refused = () => Error("hub_secret_file_invalid");
+function same(a, b) {
+    return a.dev === b.dev && a.ino === b.ino && a.uid === b.uid && a.mode === b.mode && a.size === b.size
+        && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
+}
+export function readHubSecretFile(input) {
+    if (process.platform === "win32" || typeof process.getuid !== "function" || !isAbsolute(input) || resolve(input) !== input)
+        throw refused();
+    let fd;
+    const bytes = Buffer.alloc(MAXIMUM + 1);
+    try {
+        const parents = new Map();
+        for (let path = dirname(input);; path = dirname(path)) {
+            const stat = lstatSync(path);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                throw refused();
+            parents.set(path, stat);
+            if (dirname(path) === path)
+                break;
+        }
+        const before = lstatSync(input), mode = before.mode & 0o7777;
+        if (!before.isFile() || before.isSymbolicLink() || before.uid !== process.getuid() || ![0o400, 0o600].includes(mode)
+            || before.size < 1 || before.size > MAXIMUM)
+            throw refused();
+        fd = openSync(input, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        if (!same(before, fstatSync(fd)))
+            throw refused();
+        let length = 0, count;
+        do {
+            count = readSync(fd, bytes, length, bytes.length - length, null);
+            length += count;
+        } while (count && length < bytes.length);
+        if (length !== before.size || length > MAXIMUM || !same(before, fstatSync(fd)) || !same(before, lstatSync(input)))
+            throw refused();
+        for (const [path, original] of parents) {
+            const current = lstatSync(path);
+            if (current.isSymbolicLink() || !current.isDirectory() || current.dev !== original.dev || current.ino !== original.ino)
+                throw refused();
+        }
+        const exact = bytes.subarray(0, length);
+        const password = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(exact);
+        if (password.includes("\0") || !Buffer.from(password, "utf8").equals(exact))
+            throw refused();
+        return password;
+    }
+    catch {
+        throw refused();
+    }
+    finally {
+        bytes.fill(0);
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+//# sourceMappingURL=secret-file.js.map

package/dist/hub/init/secret-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-file.js","sourceRoot":"","sources":["../../../src/hub/init/secret-file.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;AACvD,SAAS,IAAI,CAAC,CAAQ,EAAE,CAAQ;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;WACjG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;AAC1D,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IAC5I,IAAI,EAAsB,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;QACzC,KAAK,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,MAAM,OAAO,EAAE,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM;QACpC,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;eAC/G,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,OAAO;YAAE,MAAM,OAAO,EAAE,CAAC;QAC/D,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QAClD,IAAI,MAAM,GAAG,CAAC,EAAE,KAAa,CAAC;QAC9B,GAAG,CAAC;YAAC,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC;QAAC,CAAC,QAAQ,KAAK,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE;QACjI,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QACnI,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;gBAAE,MAAM,OAAO,EAAE,CAAC;QAC1I,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1F,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QAC7F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;YACpB,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACjE,CAAC"}

package/dist/hub/init/text.d.ts

@@ -0,0 +1,127 @@
+declare const en: {
+    build_info: string;
+    build_source: string;
+    build_modified: string;
+    build_unknown: string;
+    title: string;
+    intro: string;
+    hub_exists: string;
+    incomplete: string;
+    resume_q: string;
+    restart_how: string;
+    fleet_warn_title: string;
+    fleet_warn_body: string;
+    fleet_confirm: string;
+    fleet_confirm_word: string;
+    cancelled: string;
+    name_q: string;
+    web_origin_q: string;
+    member_origin_q: string;
+    loopback_warn: string;
+    web_listen_q: string;
+    member_listen_q: string;
+    listen_need: string;
+    network_check: string;
+    network_web: string;
+    network_member: string;
+    network_both: string;
+    network_invalid: string;
+    network_unresolved: string;
+    network_interface: string;
+    network_occupied: string;
+    network_permission: string;
+    network_reserved: string;
+    network_unavailable: string;
+    network_ok: string;
+    network_unchanged: string;
+    tls_title: string;
+    tls_intro: string;
+    tls_cert_q: string;
+    tls_key_q: string;
+    tls_needed: string;
+    tls_problem: string;
+    tls_self_signed: string;
+    tls_ok: string;
+    tls_fingerprint: string;
+    tls_generate_unavailable: string;
+    tls_generate_failed: string;
+    tls_stage_kept: string;
+    retry_q: string;
+    dir_title: string;
+    dir_realm_q: string;
+    dir_url_q: string;
+    dir_ca_q: string;
+    dir_profile_q: string;
+    dir_base_q: string;
+    dir_bind_q: string;
+    dir_bind_pw_q: string;
+    dir_bind_empty: string;
+    dir_bind_source_q: string;
+    dir_bind_source_invalid: string;
+    dir_bind_file_q: string;
+    dir_bind_file_invalid: string;
+    dir_invalid: string;
+    dir_ca_unreadable: string;
+    dir_ca_compare: string;
+    dir_ca_details: string;
+    dir_ca_confirm_q: string;
+    dir_leaf_unverified: string;
+    dir_leaf_confirm_q: string;
+    dir_leaf_refused: string;
+    dir_ca_bind_needed: string;
+    dir_ca_fetch_failed: string;
+    signin_title: string;
+    signin_login_q: string;
+    signin_ok: string;
+    signin_invalid: string;
+    signin_not_eligible: string;
+    signin_unavailable: string;
+    signin_bad_input: string;
+    signin_retry_q: string;
+    signin_too_many: string;
+    admin_q: string;
+    admin_browser_next: string;
+    retention_title: string;
+    retention_content_q: string;
+    retention_event_q: string;
+    retention_need: string;
+    summary_title: string;
+    pilot_reminder: string;
+    confirm_q: string;
+    confirm_word: string;
+    failed: string;
+    stays_off: string;
+    done: string;
+    service_installed: string;
+    service_q: string;
+    service_word: string;
+    service_ok: string;
+    service_install_idle: string;
+    service_drain_wait: string;
+    service_restart_requested: string;
+    service_drain_config: string;
+    service_drain_process: string;
+    service_drain_listeners: string;
+    service_drain_timeout: string;
+    service_failed: string;
+    service_skipped: string;
+    handoff_title: string;
+    handoff_snapshot: string;
+    handoff_record: string;
+    handoff_config: string;
+    handoff_data: string;
+    handoff_log: string;
+    handoff_service: string;
+    handoff_scope: string;
+    handoff_stop: string;
+    handoff_restart: string;
+    handoff_uninstall: string;
+    handoff_preserve: string;
+    handoff_repeat: string;
+    handoff_unavailable: string;
+    pairing_title: string;
+    pairing_steps: string;
+};
+type Key = keyof typeof en;
+export declare function ht(key: Key, ...args: (string | number)[]): string;
+export {};