rovloom 0.5.0 → 0.6.1

package/dist/src/chunk-erdq0rn8.js

@@ -1,1300 +0,0 @@
-// @bun
-import {
-  windowsCurrentUserSid
-} from "./chunk-09f9q26d.js";
-import {
-  digest2
-} from "./chunk-d71r315c.js";
-import {
-  parseNativeJson2
-} from "./chunk-7crhmqn2.js";
-import {
-  object2,
-  fields2,
-  id2,
-  uint2,
-  boundedJson2,
-  hash2,
-  validatePolicies2
-} from "./chunk-qt9m2kg2.js";
-import {
-  observedHerdrSource
-} from "./chunk-9tt13dm0.js";
-import"./chunk-g7pnjzkk.js";
-import"./chunk-fnakrk0a.js";
-import"./chunk-mqyq5jh6.js";
-import"./chunk-zj48jvfe.js";
-import {
-  setupTarget,
-  selectedSetupPolicies,
-  setupReference,
-  setupSessionsFor,
-  GatewaySetup
-} from "./chunk-n073xnr1.js";
-import {
-  compileHerdrSchemas2
-} from "./chunk-5h82060k.js";
-import"./chunk-d4ejrtjq.js";
-import {
-  LuvusAdapterError2
-} from "./chunk-57ayxqnb.js";
-import {
-  HerdrLocalError,
-  measureHerdrInstallation,
-  verifyHerdrInstallation
-} from "./chunk-q5pgbwb3.js";
-import {
-  isStoppedHerdrCommandCancellation,
-  herdrDeadline,
-  runHerdrCommand
-} from "./chunk-863tk45b.js";
-import"./chunk-zb641qa3.js";
-import"./chunk-ttsrctxg.js";
-import"./chunk-5svt6rwr.js";
-import {
-  parseHerdrProviderRefConfig2
-} from "./chunk-2tn0r64b.js";
-import {
-  localLimits,
-  verifyInstallation,
-  runFixedProcess
-} from "./chunk-0xgpxdgc.js";
-import"./chunk-hz8pm6hz.js";
-import"./chunk-y4hksha9.js";
-import {
-  initializeManagedLuvusRoot2,
-  discoverLuvusInstallation,
-  MANAGED_LUVUS_REVISION2,
-  MANAGED_LUVUS_CLASSIFICATION2
-} from "./chunk-5s2emvww.js";
-import {
-  setupFileStamp,
-  writeSetupFile,
-  readSetupJson,
-  writeSetupJson
-} from "./chunk-ebm3kvnq.js";
-import {
-  readRuntimeConfig2
-} from "./chunk-bspzg8er.js";
-import {
-  privateDirectory
-} from "./chunk-64ftwe9b.js";
-import"./chunk-1bf0wmgk.js";
-import {
-  runtimeReference
-} from "./chunk-z7kkfrgz.js";
-import {
-  herdrMode,
-  luvusMode,
-  selectedNativeProviders,
-  CliError2,
-  CliCancelled,
-  parseConfig2,
-  configDocument2,
-  readConfig2
-} from "./chunk-hpzr94hm.js";
-import {
-  createFileCredentialSink2,
-  loadCredential2
-} from "./chunk-vwcntax3.js";
-import {
-  LuvusDispatchClaims2
-} from "./chunk-gbsbwssz.js";
-import {
-  effectiveBinDirectories
-} from "./chunk-3nnahj0j.js";
-import"./chunk-zdxww7ms.js";
-import"./chunk-0pewfj89.js";
-import"./chunk-0y5542k8.js";
-
-// src/cli/setup-terminal.ts
-import { isatty } from "tty";
-import { userInfo } from "os";
-import { Writable } from "stream";
-import { createInterface } from "readline/promises";
-function hasLocalTerminal(io) {
-  const input = io.stdin.fd;
-  const output = io.stderr.fd;
-  return Number.isSafeInteger(input) && Number.isSafeInteger(output) && isatty(input) && isatty(output);
-}
-
-class SetupTerminal {
-  configPath;
-  config;
-  io;
-  actor;
-  uid;
-  sid;
-  #reader;
-  #output;
-  #muted = false;
-  #closed = false;
-  #questionsClosed = false;
-  #queue = Promise.resolve();
-  constructor(configPath, config, io) {
-    this.configPath = configPath;
-    this.config = config;
-    this.io = io;
-    this.uid = process.platform === "win32" ? 0 : userInfo().uid;
-    this.sid = process.platform === "win32" ? windowsCurrentUserSid() : undefined;
-    this.actor = "operator_" + (this.sid ?? this.uid);
-    this.assertOwner();
-    this.#output = new Writable({
-      write: (chunk, _encoding, callback) => {
-        if (!this.#muted) {
-          io.stderr.write(chunk);
-        }
-        callback();
-      }
-    });
-    this.#reader = createInterface({ input: io.stdin, output: this.#output, terminal: true });
-    this.#reader.on("SIGINT", this.#interrupt);
-    io.signal.addEventListener("abort", this.#abort, { once: true });
-  }
-  static open(path, config, io) {
-    return hasLocalTerminal(io) ? new SetupTerminal(path, config, io) : undefined;
-  }
-  assertOwner() {
-    if (this.io.signal.aborted) {
-      throw new CliCancelled;
-    }
-    if (this.#closed || !hasLocalTerminal(this.io) || !this.#ownerUnchanged()) {
-      throw new CliError2("configuration_required");
-    }
-    const current = readConfig2(this.configPath);
-    if (current.role !== this.config.role || current.state_dir !== this.config.state_dir) {
-      throw new CliError2("configuration_required");
-    }
-  }
-  #ownerUnchanged() {
-    if (process.platform === "win32") {
-      return this.sid !== undefined && windowsCurrentUserSid() === this.sid;
-    }
-    const user = userInfo();
-    return (process.platform === "linux" || process.platform === "darwin") && user.uid >= 0 && user.uid === this.uid && process.getuid?.() === this.uid && process.geteuid?.() === this.uid;
-  }
-  ask(prompt, secret = false, signal = this.io.signal) {
-    const active = AbortSignal.any([signal, this.io.signal]);
-    const operation = this.#queue.then(async () => {
-      this.assertOwner();
-      if (this.#questionsClosed || active.aborted) {
-        throw new CliError2("configuration_required");
-      }
-      try {
-        if (secret) {
-          this.io.stderr.write(prompt);
-          this.#muted = true;
-        }
-        let answer;
-        try {
-          answer = await this.#reader.question(secret ? "" : prompt, { signal: active });
-        } catch (error) {
-          if (this.io.signal.aborted && (error === active.reason || error instanceof Error && error.name === "AbortError")) {
-            throw new CliCancelled;
-          }
-          throw error;
-        }
-        this.assertOwner();
-        if (active.aborted) {
-          throw new CliError2("configuration_required");
-        }
-        return answer.trim();
-      } finally {
-        this.#muted = false;
-        if (secret) {
-          this.io.stderr.write(`
-`);
-        }
-      }
-    });
-    this.#queue = operation.catch(() => {});
-    return operation;
-  }
-  async confirm(description, signal = this.io.signal) {
-    const answer = (await this.ask(description + " [y/N] ", false, signal)).toLowerCase();
-    return answer === "y" || answer === "yes";
-  }
-  show(text) {
-    this.assertOwner();
-    this.io.stderr.write(text);
-  }
-  #abort = () => this.close();
-  #interrupt = () => {
-    process.kill(process.pid, "SIGINT");
-  };
-  finishQuestions() {
-    if (!this.#questionsClosed) {
-      this.#questionsClosed = true;
-      this.#reader.off("SIGINT", this.#interrupt);
-      this.#reader.close();
-      this.#queue.then(() => {
-        this.#output.end();
-      });
-    }
-  }
-  close() {
-    if (this.#closed) {
-      return;
-    }
-    this.#closed = true;
-    this.io.signal.removeEventListener("abort", this.#abort);
-    this.finishQuestions();
-  }
-}
-
-// src/cli/setup-native.ts
-import { existsSync, mkdirSync } from "fs";
-import { homedir } from "os";
-import { isAbsolute, join } from "path";
-
-// src/cli/setup-prompts.ts
-function connectorNativePrompt(enabled, kind = "Luvus", attach = false) {
-  if (attach) {
-    return enabled === true ? `Attach to your running ${kind} session (or start one in your own config directory if none is running); remote callers will act on your REAL workspaces (terminal execution ENABLED in user config)? / \u9644\u7740\u5230\u4F60\u6B63\u5728\u8FD0\u884C\u7684 ${kind} \u4F1A\u8BDD\uFF08\u6CA1\u6709\u5219\u5728\u4F60\u81EA\u5DF1\u7684\u914D\u7F6E\u76EE\u5F55\u91CC\u542F\u52A8\u4E00\u4E2A\uFF09\uFF0C\u8FDC\u7A0B\u8C03\u7528\u5C06\u76F4\u63A5\u64CD\u4F5C\u4F60\u7684\u771F\u5B9E\u5DE5\u4F5C\u533A\uFF08\u7528\u6237\u914D\u7F6E\u5DF2\u5F00\u542F\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F` : `Attach to your running ${kind} session (or start one in your own config directory if none is running); remote callers will act on your REAL workspaces (terminal execution disabled)? / \u9644\u7740\u5230\u4F60\u6B63\u5728\u8FD0\u884C\u7684 ${kind} \u4F1A\u8BDD\uFF08\u6CA1\u6709\u5219\u5728\u4F60\u81EA\u5DF1\u7684\u914D\u7F6E\u76EE\u5F55\u91CC\u542F\u52A8\u4E00\u4E2A\uFF09\uFF0C\u8FDC\u7A0B\u8C03\u7528\u5C06\u76F4\u63A5\u64CD\u4F5C\u4F60\u7684\u771F\u5B9E\u5DE5\u4F5C\u533A\uFF08\u5173\u95ED\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F`;
-  }
-  return enabled === true ? `Discover ${kind} and create isolated state (terminal execution ENABLED in user config)? / \u53D1\u73B0 ${kind} \u5E76\u521B\u5EFA\u9694\u79BB\u72B6\u6001\uFF08\u7528\u6237\u914D\u7F6E\u5DF2\u5F00\u542F\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F` : `Discover this ${kind} installation and create its isolated local state (terminal execution disabled)? / \u53D1\u73B0 ${kind} \u5E76\u521B\u5EFA\u9694\u79BB\u72B6\u6001\uFF08\u5173\u95ED\u7EC8\u7AEF\u6267\u884C\uFF09\uFF1F`;
-}
-
-// src/cli/setup-native.ts
-function assertSetupNativePath(config, terminal) {
-  if (selectedNativeProviders(config).includes("luvus") && luvusMode(config) === "managed" && Buffer.byteLength(join(config.state_dir, "n")) > 52) {
-    terminal.show(`native_state_path_too_long: choose a shorter data.directory before initialization (Luvus state path maximum 52 UTF-8 bytes). / \u521D\u59CB\u5316\u524D\u8BF7\u7F29\u77ED data.directory\uFF08Luvus \u72B6\u6001\u8DEF\u5F84\u6700\u591A52\u4E2AUTF-8\u5B57\u8282\uFF09\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-  if (selectedNativeProviders(config).includes("herdr") && herdrMode(config) === "managed" && process.platform !== "win32" && Buffer.byteLength(join(config.state_dir, "hr/c/herdr/herdr-client.sock")) > 107) {
-    terminal.show(`native_state_path_too_long: choose a shorter data.directory for the private Herdr sockets (herdr.sock and herdr-client.sock). / \u8BF7\u7F29\u77ED data.directory \u4EE5\u5BB9\u7EB3\u9694\u79BB Herdr \u7684 socket\uFF08\u542B herdr-client.sock\uFF09\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-}
-function setupBinary(config, kind = "luvus") {
-  const fallback = process.platform === "win32" ? [] : ["/usr/bin", "/bin"];
-  const name = process.platform === "win32" ? kind + ".exe" : kind;
-  for (const directory of [...effectiveBinDirectories(config.native?.runtime_bin_dirs), ...fallback]) {
-    const path = join(directory, name);
-    if (existsSync(path)) {
-      return path;
-    }
-  }
-  throw new CliError2("configuration_required");
-}
-function setupAgentDirectories(config) {
-  const directories = effectiveBinDirectories(config.native?.agent_bin_dirs);
-  return directories.length > 0 ? { agent_bin_dirs: directories } : {};
-}
-function userLuvusHome(config) {
-  const configured = config.native?.luvus?.state_root;
-  const environment = process.env.LUVUS_HOME;
-  const path = configured ?? (environment && isAbsolute(environment) ? environment : join(homedir(), ".luvus"));
-  mkdirSync(path, { recursive: true, mode: 448 });
-  return path;
-}
-function prepared(value, attempt, machine, config) {
-  const row = object2(value);
-  fields2(row, ["schema_version", "attempt_id", "machine_id", "phase", "settings", "reference", "local", "remote"]);
-  if (row.schema_version !== 1 || row.attempt_id !== attempt || row.machine_id !== machine || row.phase !== "prepared" || row.reference !== setupReference(attempt) || boundedJson2(row.settings) !== boundedJson2(config.native ?? {})) {
-    throw new CliError2("configuration_required");
-  }
-  return row;
-}
-async function prepareSetupNative(config, terminal, credential, attempt, authorization) {
-  terminal.assertOwner();
-  id2(attempt);
-  id2(authorization.principal_id);
-  validatePolicies2(authorization.policies);
-  const path = runtimeReference(config.state_dir, "native-setup");
-  const existing = readSetupJson(path, 1048576);
-  if (existing !== undefined) {
-    return prepared(existing, attempt, credential.machine_id, config);
-  }
-  const binary = setupBinary(config);
-  const attach = luvusMode(config) === "attach";
-  if (!attach && process.platform === "win32") {
-    terminal.show(`luvus_managed_unsupported_on_windows: set native.luvus.mode to "attach". / Windows \u4E0A\u6682\u4E0D\u652F\u6301 managed\uFF0C\u8BF7\u628A native.luvus.mode \u8BBE\u4E3A "attach"\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-  if (!attach && process.platform === "darwin") {
-    terminal.show(`luvus_managed_unsupported_on_macos: set native.luvus.mode to "attach". / macOS \u4E0A\u6682\u4E0D\u652F\u6301 managed\uFF0C\u8BF7\u628A native.luvus.mode \u8BBE\u4E3A "attach"\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-  if (!await terminal.confirm(connectorNativePrompt(config.allow_terminal_execution, "Luvus", attach))) {
-    throw new CliError2("configuration_required");
-  }
-  const control = join(config.state_dir, "control");
-  const stateRoot = attach ? userLuvusHome(config) : join(config.state_dir, "n");
-  const home = join(config.state_dir, "h");
-  const work = join(config.state_dir, "w");
-  assertSetupNativePath(config, terminal);
-  for (const directory of [
-    control,
-    ...attach ? [] : [stateRoot],
-    home,
-    work,
-    ...["config", "data", "cache", "runtime"].map((name) => join(home, name))
-  ]) {
-    privateDirectory(directory);
-  }
-  const reference = setupReference(attempt);
-  const target = setupTarget(credential.machine_id, "luvus", setupSessionsFor(config));
-  const discovered = await discoverLuvusInstallation({
-    target,
-    config_ref: reference,
-    binding_revision: 1,
-    binary,
-    state_root: stateRoot,
-    home,
-    cwd: work,
-    transport: "ipc",
-    allow_terminal_execution: false,
-    ...attach ? { attach: true, user_home: homedir() } : {},
-    ...setupAgentDirectories(config)
-  }, { revision: MANAGED_LUVUS_REVISION2, signal: terminal.io.signal });
-  const schema = await runFixedProcess(discovered.config, localLimits(discovered.config.limits), "schema", terminal.io.signal);
-  if (schema.exit_code !== 0 || hash2(schema.stdout) !== discovered.compiled.identity.schema_sha256) {
-    throw new CliError2("configuration_required");
-  }
-  await verifyInstallation(discovered.config);
-  const remote = {
-    kind: "luvus",
-    authentication: "remote_connector",
-    binding: {
-      machine_id: target.machine_id,
-      provider_id: target.provider_id,
-      kind: "luvus",
-      config_ref: reference,
-      binding_revision: 1,
-      enabled: true
-    },
-    target,
-    contract: {
-      binary_version: discovered.binaryVersion,
-      binary_sha256: discovered.config.binary_sha256,
-      schema_sha256: discovered.compiled.identity.schema_sha256,
-      adapter_revision: MANAGED_LUVUS_REVISION2,
-      classification_revision: MANAGED_LUVUS_CLASSIFICATION2,
-      schema_bundle: schema.stdout.toString("utf8")
-    },
-    peer_policy_revision: authorization.policies.local.revision,
-    raw_grant: {
-      principal_id: authorization.principal_id,
-      methods: [...authorization.policies.caller.grants[0].methods]
-    }
-  };
-  boundedJson2(remote, 1048576);
-  terminal.assertOwner();
-  writeSetupJson(path, {
-    schema_version: 1,
-    attempt_id: attempt,
-    machine_id: credential.machine_id,
-    phase: "initializing"
-  });
-  if (attach) {
-    const ledgerId = hash2(boundedJson2([reference, "user", target]));
-    new LuvusDispatchClaims2({
-      path: join(control, "luvus-claims.db"),
-      mode: "create",
-      ledger_id: ledgerId,
-      limits: { entries: 1024, bytes: 4194304 },
-      now: Date.now
-    }).close();
-    const result = {
-      schema_version: 1,
-      attempt_id: attempt,
-      machine_id: credential.machine_id,
-      phase: "prepared",
-      settings: config.native ?? {},
-      reference,
-      local: {
-        kind: "luvus",
-        authentication: "local_owner",
-        native: { mode: "user", config: discovered.config },
-        peer_policy_revision: remote.peer_policy_revision,
-        principal_id: authorization.principal_id,
-        policies: authorization.policies,
-        storage_mode: "open"
-      },
-      remote
-    };
-    writeSetupJson(path, result, true, 1048576);
-    return result;
-  }
-  const rootRecord = join(control, "luvus-root.json");
-  const root = await initializeManagedLuvusRoot2({
-    record_path: rootRecord,
-    config: discovered.config
-  });
-  try {
-    const ledgerId = hash2(boundedJson2([reference, root.root_id, root.root_revision, root.config.target]));
-    const claims = new LuvusDispatchClaims2({
-      path: join(control, "luvus-claims.db"),
-      mode: "create",
-      ledger_id: ledgerId,
-      limits: { entries: 1024, bytes: 4194304 },
-      now: Date.now
-    });
-    claims.close();
-    const result = {
-      schema_version: 1,
-      attempt_id: attempt,
-      machine_id: credential.machine_id,
-      phase: "prepared",
-      settings: config.native ?? {},
-      reference,
-      local: {
-        kind: "luvus",
-        authentication: "local_owner",
-        native: {
-          mode: "managed",
-          root_record: rootRecord,
-          expected_root_id: root.root_id,
-          expected_root_revision: root.root_revision
-        },
-        peer_policy_revision: remote.peer_policy_revision,
-        principal_id: authorization.principal_id,
-        policies: authorization.policies,
-        storage_mode: "open"
-      },
-      remote
-    };
-    writeSetupJson(path, result, true, 1048576);
-    return result;
-  } finally {
-    root.close();
-  }
-}
-
-// src/cli/setup-herdr.ts
-import { mkdirSync as mkdirSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute2, join as join2 } from "path";
-function attachedDirectories(config) {
-  const home = homedir2();
-  if (process.platform === "win32") {
-    const roaming = config.native?.herdr?.config_home ?? process.env.APPDATA ?? join2(home, "AppData", "Roaming");
-    const local = process.env.LOCALAPPDATA ?? join2(home, "AppData", "Local");
-    for (const path of [roaming, local]) {
-      mkdirSync2(path, { recursive: true });
-    }
-    return { home, config_home: roaming, state_home: local, cache_home: local, cwd: home };
-  }
-  const xdg = (variable, fallback) => {
-    const value = process.env[variable];
-    return value && isAbsolute2(value) ? value : join2(home, fallback);
-  };
-  const directories = {
-    home,
-    config_home: config.native?.herdr?.config_home ?? xdg("XDG_CONFIG_HOME", ".config"),
-    state_home: xdg("XDG_STATE_HOME", ".local/state"),
-    cache_home: xdg("XDG_CACHE_HOME", ".cache"),
-    cwd: home
-  };
-  for (const path of [directories.config_home, directories.state_home, directories.cache_home]) {
-    mkdirSync2(path, { recursive: true, mode: 448 });
-  }
-  return directories;
-}
-async function version(config, signal) {
-  const scope = herdrDeadline(signal, 1000);
-  try {
-    const raw = await runHerdrCommand(config, "version", scope.signal);
-    const label = raw.toString("utf8").trim().replace(/^herdr\s+/i, "");
-    return label.length > 0 && label.length <= 128 && [...label].every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127) ? label : "unavailable";
-  } catch (error) {
-    if (error instanceof HerdrLocalError && (error.code === "herdr_cli_exit" || error.code === "herdr_timeout" && !signal.aborted)) {
-      return "unavailable";
-    }
-    throw error;
-  } finally {
-    scope.close();
-  }
-}
-function prepared2(value, config, attempt, machine) {
-  const row = object2(value);
-  fields2(row, ["schema_version", "attempt_id", "machine_id", "phase", "settings", "reference", "local", "remote"]);
-  if (row.schema_version !== 1 || row.attempt_id !== attempt || row.machine_id !== machine || row.phase !== "prepared" || row.reference !== setupReference(attempt, "herdr") || boundedJson2(row.settings) !== boundedJson2(config.native ?? {})) {
-    throw new CliError2("configuration_required");
-  }
-  return row;
-}
-async function prepareSetupHerdr(config, terminal, credential, attempt, authorization) {
-  terminal.assertOwner();
-  const path = runtimeReference(config.state_dir, "herdr-setup");
-  const existing = readSetupJson(path, 1048576);
-  if (existing !== undefined) {
-    return prepared2(existing, config, attempt, credential.machine_id);
-  }
-  const binary = setupBinary(config, "herdr");
-  const attach = herdrMode(config) === "attach";
-  if (!attach && process.platform === "win32") {
-    terminal.show(`herdr_managed_unsupported_on_windows: set native.herdr.mode to "attach". / Windows \u4E0A\u6682\u4E0D\u652F\u6301 managed\uFF0C\u8BF7\u628A native.herdr.mode \u8BBE\u4E3A "attach"\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-  if (!attach && process.platform === "darwin") {
-    terminal.show(`herdr_managed_unsupported_on_macos: set native.herdr.mode to "attach". / macOS \u4E0A\u6682\u4E0D\u652F\u6301 managed\uFF0C\u8BF7\u628A native.herdr.mode \u8BBE\u4E3A "attach"\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-  if (!await terminal.confirm(connectorNativePrompt(config.allow_terminal_execution, "Herdr", attach))) {
-    throw new CliError2("configuration_required");
-  }
-  assertSetupNativePath(config, terminal);
-  const root = join2(config.state_dir, "hr");
-  privateDirectory(root);
-  for (const name of ["h", "c", "s", "k", "t", "w", "control"]) {
-    privateDirectory(join2(root, name));
-  }
-  const target = setupTarget(credential.machine_id, "herdr");
-  const reference = setupReference(attempt, "herdr");
-  const local = {
-    target,
-    binding_revision: 1,
-    config_ref: reference,
-    binary,
-    ...attach ? attachedDirectories(config) : {
-      home: join2(root, "h"),
-      config_home: join2(root, "c"),
-      state_home: join2(root, "s"),
-      cache_home: join2(root, "k"),
-      cwd: join2(root, "w")
-    },
-    temporary_home: join2(root, "t"),
-    allow_terminal_execution: false,
-    ...attach ? { attach: true } : {},
-    ...setupAgentDirectories(config)
-  };
-  const measured = measureHerdrInstallation(local);
-  const scope = herdrDeadline(terminal.io.signal, 1e4);
-  let raw;
-  let source;
-  try {
-    const label = await version(local, scope.signal);
-    raw = await runHerdrCommand(local, "schema", scope.signal);
-    const compiled = await compileHerdrSchemas2(raw, scope.signal);
-    if (verifyHerdrInstallation(local, measured.sha256) !== measured.stamp || compiled.schema_sha256 !== hash2(raw)) {
-      throw new CliError2("configuration_required");
-    }
-    source = observedHerdrSource(label, measured.sha256, compiled.schema_sha256, compiled.protocol);
-  } catch (error) {
-    if (terminal.io.signal.aborted && isStoppedHerdrCommandCancellation(error)) {
-      throw new CliCancelled;
-    }
-    throw error;
-  } finally {
-    scope.close();
-  }
-  const shared = {
-    version: 1,
-    target,
-    binding_revision: 1,
-    config_ref: reference,
-    expected_source: source,
-    peer_policy_revision: authorization.policies.local.revision
-  };
-  const control = join2(root, "control");
-  const schemaPath = join2(control, "schema.json");
-  const limits = { entries: 1024, bytes: 4194304 };
-  const claimsRef = {
-    path: join2(control, "claims.db"),
-    mode: "open",
-    ledger_id: hash2(boundedJson2([reference, target, source, "claims"])),
-    limits
-  };
-  const provider = parseHerdrProviderRefConfig2({
-    ...shared,
-    schema_path: schemaPath,
-    connector: {
-      local,
-      principal_id: authorization.principal_id,
-      claims: claimsRef
-    }
-  });
-  terminal.assertOwner();
-  writeSetupJson(path, {
-    schema_version: 1,
-    attempt_id: attempt,
-    machine_id: credential.machine_id,
-    phase: "initializing"
-  });
-  writeSetupFile(schemaPath, raw);
-  const claims = new LuvusDispatchClaims2({ ...claimsRef, mode: "create", now: Date.now });
-  try {} finally {
-    claims.close();
-  }
-  const result = {
-    schema_version: 1,
-    attempt_id: attempt,
-    machine_id: credential.machine_id,
-    phase: "prepared",
-    settings: config.native ?? {},
-    reference,
-    local: {
-      kind: "herdr",
-      config: provider,
-      native: { mode: attach ? "attach" : "managed" },
-      policies: authorization.policies
-    },
-    remote: { kind: "herdr", config: shared, schema_bundle: raw.toString("utf8") }
-  };
-  writeSetupJson(path, result, true, 1048576);
-  return result;
-}
-
-// src/cli/setup-connector.ts
-import { join as join3 } from "path";
-async function responseJson(response) {
-  if (!response.body || response.status !== 200) {
-    await response.body?.cancel().catch(() => {});
-    throw new CliError2("configuration_required");
-  }
-  const reader = response.body.getReader();
-  const chunks = [];
-  let bytes = 0;
-  try {
-    while (true) {
-      const value = await reader.read();
-      if (value.done) {
-        break;
-      }
-      bytes += value.value.length;
-      if (bytes > 16384) {
-        throw new CliError2("configuration_required");
-      }
-      chunks.push(value.value);
-    }
-    const parsed = parseNativeJson2(Buffer.concat(chunks, bytes), { object_bytes: 16384 });
-    if (!parsed.ok) {
-      throw new CliError2("configuration_required");
-    }
-    return object2(parsed.value);
-  } finally {
-    await reader.cancel().catch(() => {});
-    reader.releaseLock();
-  }
-}
-async function post(config, path, value, signal, timeout = 5000) {
-  const origin = new URL(config.gateway_url);
-  origin.protocol = origin.protocol === "wss:" ? "https:" : "http:";
-  return await responseJson(await fetch(new URL(path, origin), {
-    method: "POST",
-    redirect: "error",
-    headers: { "content-type": "application/json" },
-    body: boundedJson2(value, path === "/pairing/native" || path === "/pairing/claim/activation/native" ? 1048576 : 16384),
-    signal: AbortSignal.any([signal, AbortSignal.timeout(timeout)])
-  }));
-}
-function attempt(value, config) {
-  const row = object2(value);
-  fields2(row, ["schema_version", "attempt_id", "machine_id", "gateway_url", "phase"]);
-  id2(row.attempt_id);
-  id2(row.machine_id);
-  if (row.schema_version !== 1 || row.gateway_url !== config.gateway_url || !["requesting", "credential_saved", "paired", "configured"].includes(String(row.phase))) {
-    throw new CliError2("configuration_required");
-  }
-  return row;
-}
-async function pair(config, terminal) {
-  const path = runtimeReference(config.state_dir, "pairing");
-  const credentialPath = runtimeReference(config.state_dir, "device");
-  const previous = readSetupJson(path);
-  let current;
-  let credential;
-  if (previous === undefined) {
-    const value = await terminal.ask("One-time pairing code / \u4E00\u6B21\u6027\u914D\u5BF9\u7801: ", true);
-    const parts = value.split(".");
-    if (parts.length !== 3) {
-      throw new CliError2("configuration_required");
-    }
-    const [machine, original, enrollment] = parts;
-    id2(machine);
-    id2(original);
-    if (!enrollment || !/^[A-Za-z0-9_-]{32,256}$/.test(enrollment)) {
-      throw new CliError2("configuration_required");
-    }
-    if (!await terminal.confirm("Trust this Gateway address for one-time device enrollment and reviewed native setup? / \u4FE1\u4EFB\u6B64 Gateway \u5730\u5740\u5E76\u5151\u6362\u4E00\u6B21\u6027\u8BBE\u5907\u914D\u5BF9\uFF1F")) {
-      throw new CliError2("configuration_required");
-    }
-    current = {
-      schema_version: 1,
-      attempt_id: original,
-      machine_id: machine,
-      gateway_url: config.gateway_url,
-      phase: "requesting"
-    };
-    writeSetupJson(path, current);
-    const delivery = await post(config, "/pairing/redeem", { attempt_id: original, machine_id: machine, enrollment }, terminal.io.signal);
-    fields2(delivery, [
-      "attempt_id",
-      "delivery_id",
-      "revision",
-      "machine_id",
-      "recovery_generation",
-      "credential",
-      "state",
-      "expires_at"
-    ]);
-    id2(delivery.delivery_id);
-    id2(delivery.recovery_generation);
-    uint2(delivery.revision, true);
-    if (delivery.attempt_id !== original || delivery.machine_id !== machine || delivery.state !== "persist_and_acknowledge" || typeof delivery.credential !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(delivery.credential) || !Number.isSafeInteger(delivery.expires_at) || Number(delivery.expires_at) <= Date.now()) {
-      throw new CliError2("configuration_required");
-    }
-    credential = {
-      machine_id: machine,
-      recovery_generation: delivery.recovery_generation,
-      credential: delivery.credential
-    };
-    const sink = createFileCredentialSink2(credentialPath, credential);
-    try {
-      const ack = await sink.deliver(credential, terminal.io.signal, {
-        delivery_id: delivery.delivery_id,
-        revision: delivery.revision
-      });
-      current = { ...current, phase: "credential_saved" };
-      writeSetupJson(path, current, true);
-      try {
-        const receipt = await post(config, "/pairing/ack", { attempt_id: original, authentication: credential, acknowledgement: ack }, terminal.io.signal);
-        fields2(receipt, ["machine_id", "delivery_id", "state", "attempt_id"]);
-        if (receipt.machine_id !== machine || receipt.delivery_id !== delivery.delivery_id || receipt.state !== "delivered" || receipt.attempt_id !== original) {
-          throw new CliError2("configuration_required");
-        }
-      } catch {
-        terminal.assertOwner();
-      }
-    } finally {
-      sink.close();
-    }
-  } else {
-    current = attempt(previous, config);
-    if (current.phase === "requesting") {
-      throw new CliError2("configuration_required");
-    }
-    credential = loadCredential2(credentialPath);
-    if (credential.machine_id !== current.machine_id) {
-      throw new CliError2("configuration_required");
-    }
-  }
-  const status = await post(config, "/pairing/status", {
-    attempt_id: current.attempt_id,
-    authentication: credential,
-    providers: selectedNativeProviders(config),
-    sessions: setupSessionsFor(config)
-  }, terminal.io.signal);
-  fields2(status, ["attempt_id", "machine_id", "recovery_generation", "phase", "authorization"], ["lineage"]);
-  if (status.lineage !== undefined) {
-    id2(status.lineage);
-  }
-  if (status.attempt_id !== current.attempt_id || status.machine_id !== credential.machine_id || status.recovery_generation !== credential.recovery_generation || !["paired", "native_approved", "configured"].includes(String(status.phase))) {
-    throw new CliError2("configuration_required");
-  }
-  const authorization = object2(status.authorization);
-  fields2(authorization, ["principal_id", "policies"]);
-  id2(authorization.principal_id);
-  const expected = selectedSetupPolicies({
-    attempt_id: current.attempt_id,
-    actor: authorization.principal_id,
-    ...status.lineage ? { lineage: status.lineage } : {}
-  }, credential.machine_id, selectedNativeProviders(config), setupSessionsFor(config));
-  if (boundedJson2(authorization) !== boundedJson2(expected)) {
-    throw new CliError2("configuration_required");
-  }
-  current = { ...current, phase: "paired" };
-  writeSetupJson(path, current, true);
-  return { current, credential, authorization: expected };
-}
-async function setupConnector(config, terminal) {
-  if (readRuntimeConfig2(config).providers.length > 0) {
-    terminal.finishQuestions();
-    return config;
-  }
-  if (!config.gateway_url) {
-    const previous = setupFileStamp(terminal.configPath);
-    if (boundedJson2(configDocument2(readConfig2(terminal.configPath))) !== boundedJson2(configDocument2(config))) {
-      throw new CliError2("config_changed");
-    }
-    const address = await terminal.ask("Gateway address (ws://host:port or wss://host) / Gateway \u5730\u5740: ");
-    config = parseConfig2({ ...configDocument2(config), gateway: { url: address } });
-    writeSetupFile(terminal.configPath, JSON.stringify(configDocument2(config), null, 2) + `
-`, true, previous);
-  }
-  assertSetupNativePath(config, terminal);
-  privateDirectory(config.state_dir);
-  privateDirectory(join3(config.state_dir, "managed"));
-  const paired = await pair(config, terminal);
-  terminal.show(`pairing_completed / \u8BBE\u5907\u8EAB\u4EFD\u5DF2\u6301\u4E45\u914D\u5BF9\uFF1B\u63A5\u4E0B\u6765\u53D1\u73B0\u6240\u9009\u539F\u751F\u5B89\u88C5\u3002
-`);
-  const prepared = [];
-  for (const kind of selectedNativeProviders(config)) {
-    prepared.push(await (kind === "luvus" ? prepareSetupNative : prepareSetupHerdr)(config, terminal, paired.credential, paired.current.attempt_id, paired.authorization));
-  }
-  const installations = prepared.map((native) => ({
-    reference: native.reference,
-    value: native.remote
-  }));
-  const installation = installations.length === 1 && selectedNativeProviders(config)[0] === "luvus" ? installations[0] : { installations };
-  const expected = hash2(boundedJson2(installation, 1048576));
-  try {
-    const applied = await post(config, "/pairing/native", { attempt_id: paired.current.attempt_id, authentication: paired.credential, installation }, terminal.io.signal, 300000);
-    fields2(applied, ["state", "fingerprint"]);
-    if (applied.state !== "configured" || applied.fingerprint !== expected) {
-      throw new CliError2("configuration_required");
-    }
-  } catch {
-    terminal.show(`Native setup response unavailable; retain the original setup and rerun Connector to check it. / \u539F\u751F\u8BBE\u7F6E\u54CD\u5E94\u4E0D\u53EF\u7528\uFF1B\u4FDD\u7559\u539F\u72B6\u6001\uFF0C\u91CD\u65B0\u8FD0\u884C Connector \u6838\u5BF9\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-  writeSetupJson(runtimeReference(config.state_dir, "providers"), {
-    schema_version: 1,
-    role: "connector",
-    providers: prepared.map((native) => ({
-      reference: native.reference,
-      value: native.local
-    }))
-  }, false, 1048576);
-  writeSetupJson(runtimeReference(config.state_dir, "pairing"), { ...paired.current, phase: "configured" }, true);
-  terminal.show(`Native state prepared; starting the real Connector. Watch Gateway for connector_ready. / \u539F\u751F\u72B6\u6001\u5DF2\u51C6\u5907\uFF1B\u542F\u52A8\u6B63\u5F0F Connector\uFF0C\u4EE5 Gateway \u7684\u5B9E\u9645\u5C31\u7EEA\u63D0\u793A\u4E3A\u51C6\u3002
-`);
-  terminal.finishQuestions();
-  return config;
-}
-
-// src/cli/setup-repair.ts
-async function repairConnector(config, terminal) {
-  const credentialPath = runtimeReference(config.state_dir, "device");
-  if (!config.gateway_url || readRuntimeConfig2(config).providers.length === 0) {
-    throw new CliError2("configuration_required");
-  }
-  const old = loadCredential2(credentialPath);
-  terminal.show("This Connector is paired as " + old.machine_id + ". Re-pairing replaces only its Gateway credential; native setup is kept. Stop any other running Connector for this device first. / \u6B64 Connector \u5DF2\u914D\u5BF9\u4E3A " + old.machine_id + `\u3002\u91CD\u65B0\u914D\u5BF9\u53EA\u66F4\u6362\u4E0E Gateway \u7684\u51ED\u636E\uFF0C\u4FDD\u7559\u539F\u751F\u8BBE\u7F6E\uFF1B\u8BF7\u5148\u505C\u6B62\u8BE5\u8BBE\u5907\u4E0A\u5176\u5B83\u6B63\u5728\u8FD0\u884C\u7684 Connector\u3002
-`);
-  const value = await terminal.ask("One-time re-pairing code from rovloom gateway --repair-device / \u6765\u81EA rovloom gateway --repair-device \u7684\u4E00\u6B21\u6027\u7801: ", true);
-  const parts = value.split(".");
-  if (parts.length !== 3) {
-    throw new CliError2("configuration_required");
-  }
-  const [machine, attempt, enrollment] = parts;
-  id2(machine);
-  id2(attempt);
-  if (machine !== old.machine_id || !enrollment || !/^[A-Za-z0-9_-]{32,256}$/.test(enrollment)) {
-    throw new CliError2("configuration_required");
-  }
-  if (!await terminal.confirm("Trust this Gateway address and replace this device credential with a new one? / \u4FE1\u4EFB\u6B64 Gateway \u5730\u5740\u5E76\u7528\u65B0\u51ED\u636E\u66FF\u6362\u672C\u673A\u8BBE\u5907\u51ED\u636E\uFF1F")) {
-    throw new CliError2("configuration_required");
-  }
-  const delivery = await post(config, "/pairing/redeem", { attempt_id: attempt, machine_id: machine, enrollment }, terminal.io.signal);
-  fields2(delivery, [
-    "attempt_id",
-    "delivery_id",
-    "revision",
-    "machine_id",
-    "recovery_generation",
-    "credential",
-    "state",
-    "expires_at"
-  ]);
-  id2(delivery.delivery_id);
-  id2(delivery.recovery_generation);
-  uint2(delivery.revision, true);
-  if (delivery.attempt_id !== attempt || delivery.machine_id !== machine || delivery.state !== "persist_and_acknowledge" || typeof delivery.credential !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(delivery.credential) || !Number.isSafeInteger(delivery.expires_at) || Number(delivery.expires_at) <= Date.now()) {
-    throw new CliError2("configuration_required");
-  }
-  const credential = {
-    machine_id: machine,
-    recovery_generation: delivery.recovery_generation,
-    credential: delivery.credential
-  };
-  const sink = createFileCredentialSink2(credentialPath, credential, true);
-  try {
-    const ack = await sink.deliver(credential, terminal.io.signal, {
-      delivery_id: delivery.delivery_id,
-      revision: delivery.revision
-    });
-    try {
-      const receipt = await post(config, "/pairing/ack", { attempt_id: attempt, authentication: credential, acknowledgement: ack }, terminal.io.signal);
-      fields2(receipt, ["machine_id", "delivery_id", "state", "attempt_id"]);
-      if (receipt.machine_id !== machine || receipt.delivery_id !== delivery.delivery_id || receipt.state !== "delivered" || receipt.attempt_id !== attempt) {
-        throw new CliError2("configuration_required");
-      }
-    } catch {
-      terminal.assertOwner();
-      terminal.show(`Gateway confirmation unavailable; if this Connector cannot authenticate, run the re-pairing again. / \u672A\u6536\u5230 Gateway \u7684\u786E\u8BA4\uFF1B\u82E5 Connector \u4E4B\u540E\u65E0\u6CD5\u8BA4\u8BC1\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C\u91CD\u65B0\u914D\u5BF9\u3002
-`);
-    }
-  } finally {
-    sink.close();
-  }
-  terminal.show(`device_repaired / \u8BBE\u5907\u51ED\u636E\u5DF2\u66F4\u6362\uFF1B\u6B63\u5728\u542F\u52A8 Connector\u3002
-`);
-}
-
-// src/cli/online-claim.ts
-import { randomBytes } from "crypto";
-import { existsSync as existsSync2 } from "fs";
-import { join as join4 } from "path";
-function record(value, config) {
-  const row = object2(value);
-  fields2(row, ["schema_version", "claim_id", "machine_id", "pairing_id", "gateway_url", "phase"], ["secret", "expires_at", "credential_hash", "recovery_generation"]);
-  id2(row.claim_id);
-  id2(row.machine_id);
-  id2(row.pairing_id);
-  if (row.expires_at !== undefined && (!Number.isSafeInteger(row.expires_at) || Number(row.expires_at) < 0) || (row.credential_hash !== undefined || row.recovery_generation !== undefined) && (typeof row.credential_hash !== "string" || !/^[0-9a-f]{64}$/.test(row.credential_hash) || typeof row.recovery_generation !== "string") || row.schema_version !== 1 || row.gateway_url !== config.gateway_url || !["waiting", "credential_saved", "paired", "configured"].includes(String(row.phase)) || row.phase !== "paired" && row.phase !== "configured" && (typeof row.secret !== "string" || !/^[A-Za-z0-9_-]{16,256}$/.test(row.secret))) {
-    throw new CliError2("configuration_required");
-  }
-  if (row.recovery_generation !== undefined) {
-    id2(row.recovery_generation);
-  }
-  return row;
-}
-var POLL_BUDGET_MS = 600000;
-var POLL_INTERVAL_MS = 2000;
-async function claimConnector(config, terminal) {
-  const credentialPath = runtimeReference(config.state_dir, "device");
-  if (!config.gateway_url) {
-    const previous = setupFileStamp(terminal.configPath);
-    if (boundedJson2(configDocument2(readConfig2(terminal.configPath))) !== boundedJson2(configDocument2(config))) {
-      throw new CliError2("config_changed");
-    }
-    const address = await terminal.ask("Gateway address (ws://host:port or wss://host) / Gateway \u5730\u5740: ");
-    config = parseConfig2({ ...configDocument2(config), gateway: { url: address } });
-    writeSetupFile(terminal.configPath, JSON.stringify(configDocument2(config), null, 2) + `
-`, true, previous);
-  }
-  privateDirectory(config.state_dir);
-  privateDirectory(join4(config.state_dir, "managed"));
-  const path = runtimeReference(config.state_dir, "pairing-claim");
-  const previous = readSetupJson(path);
-  if (previous === undefined && (readRuntimeConfig2(config).providers.length > 0 || existsSync2(credentialPath))) {
-    throw new CliError2("configuration_required");
-  }
-  let current = previous === undefined ? undefined : record(previous, config);
-  if (existsSync2(credentialPath)) {
-    if (!current || !matchesSavedCredential(current, credentialPath)) {
-      throw new CliError2("configuration_required");
-    }
-    if (current.phase === "configured") {
-      terminal.show(`pairing_completed / \u8BBE\u5907\u8EAB\u4EFD\u5DF2\u6301\u4E45\u914D\u5BF9\uFF0C\u539F\u751F\u6FC0\u6D3B\u5DF2\u5B8C\u6210\u3002
-`);
-      return config;
-    }
-    if (current.phase === "paired") {
-      return await activate(config, terminal, current);
-    }
-    if (current.phase !== "credential_saved") {
-      current = { ...current, phase: "credential_saved" };
-      writeSetupJson(path, current, true);
-    }
-    const paired = await acknowledge(config, terminal, current);
-    return await activate(config, terminal, paired);
-  }
-  if (current && current.phase !== "waiting") {
-    throw new CliError2("configuration_required");
-  }
-  current ??= await startClaim(config, terminal, path, false);
-  let deadline = Date.now() + POLL_BUDGET_MS;
-  for (;; ) {
-    if (terminal.io.signal.aborted) {
-      throw new CliError2("configuration_required");
-    }
-    if (current.expires_at !== undefined && Date.now() >= current.expires_at) {
-      current = await restartClaim(config, terminal, path, credentialPath);
-      deadline = Date.now() + POLL_BUDGET_MS;
-      continue;
-    }
-    if (Date.now() > deadline) {
-      terminal.show(`Approval wait ended; rerun the same command to resume this claim. / \u7B49\u5F85\u6279\u51C6\u5DF2\u7ED3\u675F\uFF1B\u91CD\u65B0\u8FD0\u884C\u540C\u4E00\u547D\u4EE4\u53EF\u7EE7\u7EED\u539F\u8BA4\u9886\u3002
-`);
-      throw new CliError2("configuration_required");
-    }
-    let status;
-    try {
-      status = await post(config, "/pairing/claim/status", { claim_id: current.claim_id, secret: current.secret }, terminal.io.signal);
-    } catch {
-      status = undefined;
-    }
-    if (status?.status === "approved") {
-      fields2(status, ["status", "credential", "machine_id", "recovery_generation", "revision"]);
-      id2(status.recovery_generation);
-      uint2(status.revision, true);
-      if (status.machine_id !== current.machine_id || typeof status.credential !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(status.credential)) {
-        throw new CliError2("configuration_required");
-      }
-      const credential = {
-        machine_id: current.machine_id,
-        recovery_generation: status.recovery_generation,
-        credential: status.credential
-      };
-      current = {
-        ...current,
-        credential_hash: digest2(credential.credential),
-        recovery_generation: credential.recovery_generation
-      };
-      writeSetupJson(path, current, true);
-      const sink = createFileCredentialSink2(credentialPath, credential);
-      try {
-        await sink.deliver(credential, terminal.io.signal, { delivery_id: current.claim_id, revision: status.revision });
-      } finally {
-        sink.close();
-      }
-      current = { ...current, phase: "credential_saved" };
-      writeSetupJson(path, current, true);
-      const paired = await acknowledge(config, terminal, current);
-      return await activate(config, terminal, paired);
-    }
-    if (status?.status === "delivered") {
-      if (!existsSync2(credentialPath) || !matchesSavedCredential(current, credentialPath)) {
-        throw new CliError2("configuration_required");
-      }
-      const paired = await acknowledge(config, terminal, current);
-      return await activate(config, terminal, paired);
-    }
-    if (status?.status === "failed" || status?.status === "cancelled" || status?.status === "expired") {
-      current = await restartClaim(config, terminal, path, credentialPath);
-      deadline = Date.now() + POLL_BUDGET_MS;
-      continue;
-    }
-    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
-  }
-}
-function matchesSavedCredential(current, path) {
-  const credential = loadCredential2(path);
-  return credential.machine_id === current.machine_id && credential.recovery_generation === current.recovery_generation && digest2(credential.credential) === current.credential_hash;
-}
-async function restartClaim(config, terminal, path, credentialPath) {
-  if (terminal.io.signal.aborted || existsSync2(credentialPath) || !await terminal.confirm("Start a new claim with a new pairing application? / \u539F\u8BA4\u9886\u5DF2\u7EC8\u6B62\u6216\u8FC7\u671F\uFF0C\u662F\u5426\u4F7F\u7528\u65B0\u7684\u914D\u5BF9\u7533\u8BF7\u91CD\u65B0\u8BA4\u9886\uFF1F")) {
-    throw new CliError2("configuration_required");
-  }
-  return startClaim(config, terminal, path, true);
-}
-async function startClaim(config, terminal, path, replace) {
-  const pairing_id = await terminal.ask("Pairing application ID / \u914D\u5BF9\u7533\u8BF7 ID: ");
-  id2(pairing_id);
-  if (!await terminal.confirm("Trust this Gateway address for online device enrollment? / \u4FE1\u4EFB\u6B64 Gateway \u5730\u5740\u5E76\u5728\u7EBF\u8BA4\u9886\u8BBE\u5907\u914D\u5BF9\uFF1F")) {
-    throw new CliError2("configuration_required");
-  }
-  const secret = randomBytes(32).toString("base64url");
-  const created = await post(config, "/pairing/claim", { pairing_id, secret_hash: digest2(secret) }, terminal.io.signal);
-  fields2(created, ["claim_id", "machine_id", "user_code", "expires_at"]);
-  id2(created.claim_id);
-  id2(created.machine_id);
-  if (typeof created.user_code !== "string" || !/^[A-Z0-9]{8}$/.test(created.user_code) || !Number.isSafeInteger(created.expires_at)) {
-    throw new CliError2("configuration_required");
-  }
-  const current = {
-    schema_version: 1,
-    claim_id: created.claim_id,
-    machine_id: created.machine_id,
-    pairing_id,
-    gateway_url: config.gateway_url,
-    secret,
-    expires_at: Number(created.expires_at),
-    phase: "waiting"
-  };
-  writeSetupJson(path, current, replace);
-  terminal.show("Claim code / \u6838\u5BF9\u7801: " + created.user_code + `
-Approve this exact code for machine ` + current.machine_id + ` in the management page. / \u8BF7\u5728\u7BA1\u7406\u9875\u4E3A\u8BE5\u8BBE\u5907\u6838\u5BF9\u5E76\u6279\u51C6\u6B64\u7801\u3002
-`);
-  return current;
-}
-async function acknowledge(config, terminal, current) {
-  try {
-    const receipt = await post(config, "/pairing/claim/ack", { claim_id: current.claim_id, secret: current.secret }, terminal.io.signal);
-    fields2(receipt, ["status"]);
-    if (receipt.status !== "delivered") {
-      throw new CliError2("configuration_required");
-    }
-  } catch {
-    const status = await post(config, "/pairing/claim/status", { claim_id: current.claim_id, secret: current.secret }, terminal.io.signal);
-    if (status.status !== "delivered") {
-      throw new CliError2("configuration_required");
-    }
-  }
-  const { secret: _secret, ...rest } = current;
-  const paired = { ...rest, phase: "paired" };
-  writeSetupJson(runtimeReference(config.state_dir, "pairing-claim"), paired, true);
-  terminal.show(`pairing_completed / \u8BBE\u5907\u8EAB\u4EFD\u5DF2\u6301\u4E45\u914D\u5BF9\uFF1B\u63A5\u4E0B\u6765\u53D1\u73B0\u6240\u9009\u539F\u751F\u5B89\u88C5\u3002
-`);
-  return paired;
-}
-async function activate(config, terminal, current) {
-  assertSetupNativePath(config, terminal);
-  const credential = loadCredential2(runtimeReference(config.state_dir, "device"));
-  if (credential.machine_id !== current.machine_id) {
-    throw new CliError2("configuration_required");
-  }
-  const status = await post(config, "/pairing/claim/activation/status", {
-    attempt_id: current.claim_id,
-    authentication: credential,
-    providers: selectedNativeProviders(config),
-    sessions: setupSessionsFor(config)
-  }, terminal.io.signal);
-  fields2(status, ["attempt_id", "machine_id", "recovery_generation", "phase", "authorization"], ["lineage"]);
-  if (status.lineage !== undefined) {
-    id2(status.lineage);
-  }
-  if (status.attempt_id !== current.claim_id || status.machine_id !== credential.machine_id || status.recovery_generation !== credential.recovery_generation || !["paired", "configured"].includes(String(status.phase))) {
-    throw new CliError2("configuration_required");
-  }
-  const authorization = object2(status.authorization);
-  fields2(authorization, ["principal_id", "policies"]);
-  id2(authorization.principal_id);
-  const expected = selectedSetupPolicies({
-    attempt_id: current.claim_id,
-    actor: authorization.principal_id,
-    ...status.lineage ? { lineage: status.lineage } : {}
-  }, credential.machine_id, selectedNativeProviders(config), setupSessionsFor(config));
-  if (boundedJson2(authorization) !== boundedJson2(expected)) {
-    throw new CliError2("configuration_required");
-  }
-  const prepared = [];
-  for (const kind of selectedNativeProviders(config)) {
-    prepared.push(await (kind === "luvus" ? prepareSetupNative : prepareSetupHerdr)(config, terminal, credential, current.claim_id, expected));
-  }
-  const installations = prepared.map((native) => ({ reference: native.reference, value: native.remote }));
-  const installation = installations.length === 1 && selectedNativeProviders(config)[0] === "luvus" ? installations[0] : { installations };
-  const fingerprint = hash2(boundedJson2(installation, 1048576));
-  try {
-    const applied = await post(config, "/pairing/claim/activation/native", { attempt_id: current.claim_id, authentication: credential, installation }, terminal.io.signal, 300000);
-    fields2(applied, ["state", "fingerprint"]);
-    if (applied.state !== "configured" || applied.fingerprint !== fingerprint) {
-      throw new CliError2("configuration_required");
-    }
-  } catch {
-    terminal.show(`Native activation response unavailable; rerun the same command to check the original claim. / \u539F\u751F\u6FC0\u6D3B\u54CD\u5E94\u4E0D\u53EF\u7528\uFF1B\u91CD\u65B0\u8FD0\u884C\u540C\u4E00\u547D\u4EE4\u6309\u539F\u8BA4\u9886\u6838\u5BF9\u3002
-`);
-    throw new CliError2("configuration_required");
-  }
-  const providersPath = runtimeReference(config.state_dir, "providers");
-  const providersDocument = {
-    schema_version: 1,
-    role: "connector",
-    providers: prepared.map((native) => ({ reference: native.reference, value: native.local }))
-  };
-  const existingProviders = readSetupJson(providersPath, 1048576);
-  if (existingProviders === undefined) {
-    writeSetupJson(providersPath, providersDocument, false, 1048576);
-  } else if (boundedJson2(existingProviders, 1048576) !== boundedJson2(providersDocument, 1048576)) {
-    throw new CliError2("configuration_required");
-  }
-  const pairingPath = runtimeReference(config.state_dir, "pairing");
-  const pairingDocument = {
-    schema_version: 1,
-    attempt_id: current.claim_id,
-    machine_id: current.machine_id,
-    gateway_url: config.gateway_url,
-    phase: "configured"
-  };
-  const existingPairing = readSetupJson(pairingPath);
-  if (existingPairing === undefined) {
-    writeSetupJson(pairingPath, pairingDocument);
-  } else if (boundedJson2(existingPairing) !== boundedJson2(pairingDocument)) {
-    throw new CliError2("configuration_required");
-  }
-  writeSetupJson(runtimeReference(config.state_dir, "pairing-claim"), { ...current, phase: "configured" }, true);
-  terminal.show(`Native state prepared; starting the real Connector. / \u539F\u751F\u72B6\u6001\u5DF2\u51C6\u5907\uFF1B\u542F\u52A8\u6B63\u5F0F Connector\u3002
-`);
-  terminal.finishQuestions();
-  return config;
-}
-
-// src/cli/setup-runtime.ts
-class CliSetup {
-  #terminal;
-  #gateway;
-  #observation;
-  async prepare(config, path, io, options) {
-    const terminal = SetupTerminal.open(path, config, io);
-    if (!terminal) {
-      if (options?.repair || options?.addDevice || options?.claim) {
-        throw new CliError2("configuration_required");
-      }
-      return config;
-    }
-    this.#terminal = terminal;
-    if (config.role === "connector") {
-      if (options?.repair) {
-        await repairConnector(config, terminal);
-        terminal.finishQuestions();
-        return config;
-      }
-      if (options?.claim) {
-        const claimed = await claimConnector(config, terminal);
-        terminal.finishQuestions();
-        return claimed;
-      }
-      return await setupConnector(config, terminal);
-    }
-    if (options?.addDevice) {
-      if (readSetupJson(runtimeReference(config.state_dir, "setup-active")) === undefined) {
-        throw new CliError2("configuration_required");
-      }
-      this.#gateway = new GatewaySetup(config, terminal, { addDevice: true });
-      return config;
-    }
-    if (options?.repair) {
-      if (readSetupJson(runtimeReference(config.state_dir, "setup-active")) === undefined) {
-        throw new CliError2("configuration_required");
-      }
-      this.#gateway = new GatewaySetup(config, terminal, { repair: true });
-      return config;
-    }
-    if (readRuntimeConfig2(config).providers.length && readSetupJson(runtimeReference(config.state_dir, "setup-active")) === undefined) {
-      terminal.finishQuestions();
-      return config;
-    }
-    this.#gateway = new GatewaySetup(config, terminal);
-    return config;
-  }
-  gateway(config) {
-    return this.#gateway?.config === config ? this.#gateway : undefined;
-  }
-  nativeFailed(error) {
-    if ((error instanceof LuvusAdapterError2 || error instanceof HerdrLocalError) && /^[a-z_]{1,80}$/.test(error.code)) {
-      this.#terminal?.show("native_unavailable " + error.code + `
-`);
-    }
-  }
-  observe(running) {
-    if (!running.transport || !this.#terminal) {
-      return;
-    }
-    let previous = "";
-    this.#observation = setInterval(() => {
-      try {
-        const status = running.transport.status();
-        const ready = status.providers.some((provider) => provider.ready);
-        const current = status.phase + ":" + ready + ":" + (status.failure ?? "");
-        if (current !== previous) {
-          previous = current;
-          this.#terminal.show("connector_transport " + status.phase + " provider_ready=" + String(ready) + (status.capacity ? " capacity=" + status.capacity.resource + " reclaim_at=" + String(status.capacity.reclaim_at) : "") + (status.failure ? " reason=" + status.failure : "") + `
-`);
-        }
-      } catch {
-        clearInterval(this.#observation);
-        this.#observation = undefined;
-      }
-    }, 250);
-    running.closed.then(() => {
-      clearInterval(this.#observation);
-      this.#observation = undefined;
-    }, () => {
-      clearInterval(this.#observation);
-      this.#observation = undefined;
-    });
-  }
-  close() {
-    clearInterval(this.#observation);
-    this.#observation = undefined;
-    this.#terminal?.close();
-    this.#terminal = undefined;
-    this.#gateway = undefined;
-  }
-}
-export {
-  CliSetup
-};
-
-//# debugId=C698A949CB8251CE64756E2164756E21