rovloom 0.6.0 → 0.6.1

package/dist/src/chunk-zjkjjm81.js

@@ -1,1114 +0,0 @@
-// @bun
-import {
-  parseNativeJson2
-} from "./chunk-7crhmqn2.js";
-import {
-  object2,
-  fields2,
-  id2,
-  sha2,
-  boundedJson2,
-  hash2
-} from "./chunk-qt9m2kg2.js";
-import {
-  HERDR_WORKFLOW_METHODS
-} from "./chunk-9tt13dm0.js";
-import {
-  LUVUS_OPERATION_METHODS2
-} from "./chunk-zj48jvfe.js";
-import {
-  compileHerdrSchemas2
-} from "./chunk-5h82060k.js";
-import {
-  createHerdrCodec2
-} from "./chunk-zb641qa3.js";
-import {
-  parseHerdrProviderRefConfig2,
-  createHerdrGatewayResources2
-} from "./chunk-2tn0r64b.js";
-import {
-  checkedRemoteLuvusConfig,
-  createPinnedRemoteLuvus
-} from "./chunk-5s2emvww.js";
-import {
-  cliMessages2,
-  formatMessage2
-} from "./chunk-5b8g62kw.js";
-import {
-  writeAdminFiles2,
-  managementSourceExists2
-} from "./chunk-yv9px0f5.js";
-import {
-  setupFileStamp,
-  writeSetupFile,
-  readSetupJson,
-  writeSetupJson,
-  REGISTRY_MAX_BYTES,
-  parseRegistry,
-  isAdminPlaceholder
-} from "./chunk-wxqhscsw.js";
-import {
-  readRuntimeConfig2
-} from "./chunk-bspzg8er.js";
-import {
-  runtimeReference,
-  readRuntimeFile,
-  readRuntimeJson
-} from "./chunk-z7kkfrgz.js";
-import {
-  luvusMode,
-  CliError2
-} from "./chunk-hpzr94hm.js";
-import {
-  canonicalLoopbackHost
-} from "./chunk-6n9s7nfe.js";
-import {
-  PairingAdmin2,
-  createPairingDelivery2
-} from "./chunk-vwcntax3.js";
-
-// src/cli/pairing-http.ts
-import { createHash, timingSafeEqual } from "crypto";
-
-// src/cli/setup-policy.ts
-function setupSessions(input) {
-  if (input === undefined) {
-    return Object.freeze({});
-  }
-  const row = input;
-  if (row === null || typeof row !== "object" || Array.isArray(row) || Object.keys(row).some((key) => key !== "luvus") || row.luvus !== undefined && row.luvus !== "default" && row.luvus !== "rovloom") {
-    throw new CliError2("configuration_required");
-  }
-  return Object.freeze(row.luvus === undefined ? {} : { luvus: row.luvus });
-}
-function setupTarget(machine, kind = "luvus", sessions = {}) {
-  return {
-    machine_id: machine,
-    provider_id: kind,
-    profile: "session",
-    session: kind === "luvus" ? sessions.luvus ?? "rovloom" : "default"
-  };
-}
-function setupProviderKinds(input) {
-  if (!Array.isArray(input) || input.some((kind) => kind !== "luvus" && kind !== "herdr") || !["luvus", "herdr", "luvus,herdr"].includes(input.join(","))) {
-    throw new CliError2("configuration_required");
-  }
-  return Object.freeze([...input]);
-}
-function selectedSetupPolicies(plan, machine, kinds, sessions = {}) {
-  const grants = setupProviderKinds(kinds).map((kind) => ({
-    target: setupTarget(machine, kind, sessions),
-    methods: [...kind === "luvus" ? LUVUS_OPERATION_METHODS2 : HERDR_WORKFLOW_METHODS],
-    actions: ["dispatch", "read", "cancel"]
-  }));
-  return {
-    principal_id: plan.actor,
-    policies: {
-      caller: { revision: "setup_caller_" + (plan.lineage ?? plan.attempt_id), grants },
-      local: { revision: "setup_local_" + (plan.lineage ?? plan.attempt_id), grants: structuredClone(grants) }
-    }
-  };
-}
-function setupReference(attempt, kind = "luvus") {
-  return kind + "_" + attempt;
-}
-function setupSessionsFor(config) {
-  return Object.freeze({ luvus: luvusMode(config) === "attach" ? "default" : "rovloom" });
-}
-
-// src/cli/pairing-http.ts
-function setupReply(value, status = 200) {
-  return new Response(JSON.stringify(value), {
-    status,
-    headers: {
-      "content-type": "application/json",
-      "cache-control": "no-store",
-      "x-content-type-options": "nosniff"
-    }
-  });
-}
-async function requestJson(request, maximum, stopped) {
-  const signal = AbortSignal.any([request.signal, stopped, AbortSignal.timeout(5000)]);
-  const reader = request.body?.getReader();
-  if (!reader) {
-    throw new Error("setup_request_invalid");
-  }
-  const chunks = [];
-  let bytes = 0;
-  try {
-    while (true) {
-      let abort;
-      const cancelled = new Promise((_resolve, reject) => {
-        abort = () => reject(new Error("setup_request_closed"));
-        signal.addEventListener("abort", abort, { once: true });
-      });
-      let result;
-      try {
-        if (signal.aborted) {
-          throw new Error("setup_request_closed");
-        }
-        result = await Promise.race([reader.read(), cancelled]);
-      } finally {
-        signal.removeEventListener("abort", abort);
-      }
-      if (result.done) {
-        break;
-      }
-      bytes += result.value.length;
-      if (bytes > maximum || signal.aborted) {
-        throw new Error("setup_request_invalid");
-      }
-      chunks.push(result.value);
-    }
-    const parsed = parseNativeJson2(Buffer.concat(chunks, bytes), { object_bytes: maximum });
-    if (!parsed.ok) {
-      throw new Error("setup_request_invalid");
-    }
-    return object2(parsed.value);
-  } finally {
-    reader.cancel().catch(() => {});
-    reader.releaseLock();
-  }
-}
-function device(value) {
-  const input = object2(value);
-  fields2(input, ["machine_id", "recovery_generation", "credential"]);
-  id2(input.machine_id);
-  id2(input.recovery_generation);
-  if (typeof input.credential !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(input.credential)) {
-    throw new Error("setup_request_invalid");
-  }
-  return input;
-}
-
-class GatewayPairingHttp {
-  state;
-  approval;
-  native;
-  repaired;
-  #exchanges = new Map;
-  #requests = new Set;
-  #stop = new AbortController;
-  #closed = false;
-  constructor(state, approval, native, repaired = () => {}) {
-    this.state = state;
-    this.approval = approval;
-    this.native = native;
-    this.repaired = repaired;
-  }
-  async authenticated(credential, run) {
-    const host = this.state.lifecycle.identityHost;
-    const active = host.authenticate(credential.machine_id, credential.recovery_generation, credential.credential);
-    try {
-      host.assert(active.identity, active.lease);
-      const value = await run();
-      host.assert(active.identity, active.lease);
-      return value;
-    } finally {
-      host.disconnect(active.identity);
-    }
-  }
-  handle(request) {
-    const url = new URL(request.url);
-    if (!["/pairing/redeem", "/pairing/ack", "/pairing/status", "/pairing/native"].includes(url.pathname)) {
-      return;
-    }
-    if (this.#closed || request.method !== "POST" || request.headers.has("origin") || url.search || url.hash || url.username || url.password || request.headers.get("content-type")?.split(";")[0]?.trim() !== "application/json") {
-      return Promise.resolve(setupReply({ error: "setup_request_refused" }, 403));
-    }
-    if (this.#requests.size >= 16) {
-      return Promise.resolve(setupReply({ error: "setup_busy" }, 503));
-    }
-    const task = this.respond(request, url.pathname);
-    this.#requests.add(task);
-    task.then(() => this.#requests.delete(task), () => this.#requests.delete(task));
-    return task;
-  }
-  async respond(request, path) {
-    try {
-      const input = await requestJson(request, path === "/pairing/native" ? 1048576 : 16384, this.#stop.signal);
-      if (this.#closed) {
-        throw new Error("setup_closed");
-      }
-      if (path === "/pairing/redeem") {
-        return await this.redeem(input);
-      }
-      const credential = device(input.authentication);
-      id2(input.attempt_id);
-      if (this.approval.read(input.attempt_id).phase === "ready") {
-        throw new Error("setup_closed");
-      }
-      return await this.authenticated(credential, async () => {
-        const plan = this.approval.read(input.attempt_id);
-        if (plan.machine_id !== credential.machine_id || plan.generation !== credential.recovery_generation) {
-          throw new Error("setup_target_mismatch");
-        }
-        if (path === "/pairing/ack") {
-          fields2(input, ["attempt_id", "authentication", "acknowledgement"]);
-          return await this.acknowledge(input.attempt_id, credential, input.acknowledgement);
-        }
-        if (path === "/pairing/status") {
-          fields2(input, ["attempt_id", "authentication"], ["providers", "sessions"]);
-          const providers = setupProviderKinds(input.providers ?? ["luvus"]);
-          const sessions = setupSessions(input.sessions);
-          if (plan.providers && boundedJson2(plan.providers) !== boundedJson2(providers)) {
-            throw new Error("setup_provider_selection_changed");
-          }
-          return setupReply({
-            attempt_id: plan.attempt_id,
-            machine_id: plan.machine_id,
-            recovery_generation: plan.generation,
-            phase: plan.phase,
-            ...plan.lineage ? { lineage: plan.lineage } : {},
-            authorization: selectedSetupPolicies(plan, credential.machine_id, providers, sessions)
-          });
-        }
-        fields2(input, ["attempt_id", "authentication", "installation"]);
-        if (!["paired", "native_approved", "configured"].includes(plan.phase)) {
-          throw new Error("setup_not_paired");
-        }
-        return setupReply(await this.native({
-          plan,
-          credential,
-          input: input.installation,
-          signal: AbortSignal.any([request.signal, this.#stop.signal])
-        }));
-      });
-    } catch {
-      return setupReply({ error: "setup_not_completed" }, 409);
-    }
-  }
-  async redeem(input) {
-    fields2(input, ["attempt_id", "machine_id", "enrollment"]);
-    id2(input.attempt_id);
-    id2(input.machine_id);
-    if (this.#exchanges.size >= 4 || this.#exchanges.has(input.attempt_id)) {
-      throw new Error("setup_exchange_unavailable");
-    }
-    const plan = this.approval.claim(input.attempt_id, input.machine_id, input.enrollment);
-    let deliver;
-    let refuse;
-    const response = new Promise((resolve, reject) => {
-      deliver = resolve;
-      refuse = reject;
-    });
-    let acknowledge;
-    let rejectAck;
-    const ack = new Promise((resolve, reject) => {
-      acknowledge = resolve;
-      rejectAck = reject;
-    });
-    ack.catch(() => {});
-    const custody = createPairingDelivery2({
-      backend: this.state.store,
-      identities: this.state.credentials,
-      authorizeChannel: (context) => {
-        if (this.#closed || context.operation !== "enroll" || context.machine_id !== plan.machine_id) {
-          throw new Error("setup_channel_refused");
-        }
-        return {
-          deliver: async (credential, signal, delivery) => {
-            if (this.#closed || signal.aborted || credential.machine_id !== plan.machine_id || credential.recovery_generation !== plan.generation) {
-              throw new Error("setup_channel_refused");
-            }
-            exchange.context = delivery;
-            exchange.credential_sha256 = createHash("sha256").update(credential.credential).digest();
-            exchange.acknowledgement = acknowledge;
-            deliver(setupReply({
-              attempt_id: plan.attempt_id,
-              ...delivery,
-              ...credential,
-              state: "persist_and_acknowledge",
-              expires_at: plan.expires_at
-            }));
-            return await ack;
-          },
-          close: () => {
-            rejectAck(new Error("setup_delivery_closed"));
-          }
-        };
-      }
-    });
-    const task = custody.redeem({ registration_id: plan.machine_id, enrollment: input.enrollment }).then((receipt) => {
-      this.approval.finishDelivery(plan.attempt_id, true);
-      return receipt;
-    }, (error) => {
-      try {
-        this.approval.finishDelivery(plan.attempt_id, false);
-      } catch {}
-      refuse(new Error("setup_delivery_unknown"));
-      throw error;
-    }).finally(() => {
-      custody.close();
-      exchange.credential_sha256?.fill(0);
-      exchange.credential_sha256 = undefined;
-      exchange.acknowledgement = undefined;
-    });
-    const exchange = {
-      plan,
-      task,
-      close: () => custody.close()
-    };
-    this.#exchanges.set(plan.attempt_id, exchange);
-    task.catch(() => {});
-    return await response;
-  }
-  async acknowledge(attempt, credential, value) {
-    const ack = object2(value);
-    fields2(ack, ["delivery_id", "revision", "machine_id", "recovery_generation"]);
-    const exchange = this.#exchanges.get(attempt);
-    if (!exchange?.context || !exchange.acknowledgement || !exchange.credential_sha256 || ack.delivery_id !== exchange.context.delivery_id || ack.revision !== exchange.context.revision || ack.machine_id !== credential.machine_id || ack.recovery_generation !== credential.recovery_generation || !timingSafeEqual(createHash("sha256").update(credential.credential).digest(), exchange.credential_sha256)) {
-      throw new Error("setup_ack_refused");
-    }
-    exchange.acknowledgement(ack);
-    const receipt = await exchange.task;
-    if (this.approval.read(attempt).repair) {
-      this.repaired();
-    }
-    return setupReply({ ...receipt, attempt_id: attempt });
-  }
-  async close() {
-    this.#closed = true;
-    this.#stop.abort();
-    for (const exchange of this.#exchanges.values()) {
-      exchange.close();
-    }
-    await Promise.allSettled([...this.#exchanges.values()].map((value) => value.task));
-    await Promise.allSettled(this.#requests);
-    this.#exchanges.clear();
-  }
-}
-
-// src/cli/setup-manifest.ts
-function label(value) {
-  if (value === null) {
-    return "unavailable";
-  }
-  if (!value.length || value.length > 128 || [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127)) {
-    throw new CliError2("configuration_required");
-  }
-  return value;
-}
-async function reviewSetupManifest(input, plan, machine, directory, signal) {
-  const row = object2(input);
-  let entries;
-  if (Object.hasOwn(row, "installations")) {
-    fields2(row, ["installations"]);
-    if (!Array.isArray(row.installations)) {
-      throw new CliError2("configuration_required");
-    }
-    entries = row.installations;
-  } else {
-    fields2(row, ["reference", "value"]);
-    entries = [row];
-  }
-  const kinds = setupProviderKinds(entries.map((entry) => object2(object2(entry).value).kind));
-  if (plan.providers && boundedJson2(plan.providers) !== boundedJson2(kinds)) {
-    throw new CliError2("configuration_required");
-  }
-  const luvusIndex = kinds.indexOf("luvus");
-  const sessions = setupSessions(luvusIndex < 0 ? undefined : { luvus: object2(object2(object2(entries[luvusIndex]).value).target).session });
-  const authorization = selectedSetupPolicies(plan, machine, kinds, sessions);
-  const reviewed = [];
-  for (let index = 0;index < entries.length; index++) {
-    const kind = kinds[index];
-    const entry = object2(entries[index]);
-    fields2(entry, ["reference", "value"]);
-    const reference = setupReference(plan.attempt_id, kind);
-    const target = setupTarget(machine, kind, sessions);
-    if (entry.reference !== reference) {
-      throw new CliError2("configuration_required");
-    }
-    if (kind === "luvus") {
-      const remote = checkedRemoteLuvusConfig(reference, entry.value);
-      const expectedGrant = authorization.policies.caller.grants.find((grant) => boundedJson2(grant.target) === boundedJson2(target));
-      if (boundedJson2(remote.target) !== boundedJson2(target) || remote.binding.binding_revision !== 1 || !remote.binding.enabled || remote.peer_policy_revision !== authorization.policies.local.revision || boundedJson2(remote.raw_grant) !== boundedJson2({ principal_id: authorization.principal_id, methods: expectedGrant.methods })) {
-        throw new CliError2("configuration_required");
-      }
-      const verified = await createPinnedRemoteLuvus(remote);
-      verified.close();
-      reviewed.push({
-        kind,
-        reference,
-        target,
-        binding: remote.binding,
-        value: remote,
-        label: label(remote.contract.binary_version),
-        binary_sha256: remote.contract.binary_sha256
-      });
-    } else {
-      const remote = object2(entry.value);
-      fields2(remote, ["kind", "config", "schema_bundle"]);
-      const config = object2(remote.config);
-      fields2(config, ["version", "target", "binding_revision", "config_ref", "expected_source", "peer_policy_revision"]);
-      if (remote.kind !== "herdr" || typeof remote.schema_bundle !== "string" || Buffer.byteLength(remote.schema_bundle) > 524288) {
-        throw new CliError2("configuration_required");
-      }
-      const path = runtimeReference(directory, "herdr-schema_" + plan.attempt_id);
-      const parsed = parseHerdrProviderRefConfig2({ ...config, schema_path: path });
-      const bytes = Buffer.from(remote.schema_bundle, "utf8");
-      if (parsed.config_ref !== reference || parsed.binding_revision !== 1 || boundedJson2(parsed.target) !== boundedJson2(target) || parsed.peer_policy_revision !== authorization.policies.local.revision || hash2(bytes) !== parsed.expected_source.schema_sha256) {
-        throw new CliError2("configuration_required");
-      }
-      const compiled = await compileHerdrSchemas2(bytes, signal);
-      createHerdrCodec2(parsed.expected_source, compiled);
-      const binding = {
-        machine_id: machine,
-        provider_id: kind,
-        kind,
-        config_ref: reference,
-        binding_revision: 1,
-        enabled: true
-      };
-      reviewed.push({
-        kind,
-        reference,
-        target,
-        binding,
-        value: { kind, config: parsed },
-        label: label(parsed.expected_source.binary_version),
-        binary_sha256: parsed.expected_source.binary_sha256,
-        schema: { path, bytes }
-      });
-    }
-  }
-  return { kinds, reviewed, authorization, fingerprint: hash2(boundedJson2(input, 1048576)) };
-}
-async function publishSetupSchemas(entries, signal) {
-  for (const entry of entries) {
-    if (!entry.schema) {
-      continue;
-    }
-    const { path, bytes } = entry.schema;
-    let previous;
-    try {
-      previous = readRuntimeFile(path, 524288);
-    } catch (error) {
-      if (!(error instanceof CliError2 && error.code === "backend_unavailable")) {
-        throw error;
-      }
-    }
-    if (previous === undefined) {
-      writeSetupFile(path, bytes);
-    } else if (!previous.equals(bytes)) {
-      throw new CliError2("configuration_required");
-    }
-    const value = entry.value;
-    const verified = await createHerdrGatewayResources2({ config: value.config, signal });
-    await verified.release();
-  }
-}
-
-// src/cli/setup-gateway.ts
-import { createHash as createHash3, randomBytes } from "crypto";
-
-// src/cli/setup-approval.ts
-import { createHash as createHash2, randomUUID, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var phases = new Set([
-  "registering",
-  "reserved",
-  "issued",
-  "redeeming",
-  "paired",
-  "native_approved",
-  "configured",
-  "ready",
-  "unknown"
-]);
-function plan(value) {
-  try {
-    const row = object2(value);
-    fields2(row, ["schema_version", "attempt_id", "actor", "uid", "generation", "name", "created_at", "expires_at", "phase"], ["machine_id", "enrollment_sha256", "native_fingerprint", "providers", "repair", "lineage"]);
-    for (const key of ["attempt_id", "actor", "generation", "name", ...row.machine_id ? ["machine_id"] : []]) {
-      id2(row[key]);
-    }
-    if (row.schema_version !== 1 || !Number.isSafeInteger(row.uid) || Number(row.uid) < 0 || !Number.isSafeInteger(row.created_at) || !Number.isSafeInteger(row.expires_at) || Number(row.expires_at) <= Number(row.created_at) || !phases.has(String(row.phase))) {
-      throw new CliError2("invalid_config");
-    }
-    if (row.enrollment_sha256 !== undefined) {
-      sha2(row.enrollment_sha256);
-    }
-    if (row.native_fingerprint !== undefined) {
-      sha2(row.native_fingerprint);
-    }
-    if (row.providers !== undefined) {
-      setupProviderKinds(row.providers);
-    }
-    if (row.repair !== undefined && (row.repair !== true || row.providers === undefined)) {
-      throw new CliError2("invalid_config");
-    }
-    if (row.lineage !== undefined) {
-      id2(row.lineage);
-    }
-    if (!["registering", "reserved"].includes(String(row.phase)) && (!row.machine_id || !row.enrollment_sha256)) {
-      throw new CliError2("invalid_config");
-    }
-    return Object.freeze({
-      ...row,
-      ...row.providers ? { providers: setupProviderKinds(row.providers) } : {}
-    });
-  } catch {
-    throw new CliError2("invalid_config");
-  }
-}
-
-class SetupApproval {
-  terminal;
-  directory;
-  #providers = new Map;
-  #resets = new Map;
-  #state;
-  constructor(terminal, directory) {
-    this.terminal = terminal;
-    this.directory = directory;
-  }
-  attach(state) {
-    this.terminal.assertOwner();
-    this.#state = state;
-  }
-  detach(state) {
-    if (this.#state === state) {
-      this.#state = undefined;
-    }
-  }
-  state() {
-    this.terminal.assertOwner();
-    if (!this.#state) {
-      throw new CliError2("backend_unavailable", 3);
-    }
-    return this.#state;
-  }
-  path(attempt) {
-    id2(attempt);
-    return runtimeReference(this.directory, "setup_" + attempt);
-  }
-  read(attempt) {
-    const state = this.state();
-    const result = plan(readSetupJson(this.path(attempt)));
-    if (result.attempt_id !== attempt || result.actor !== this.terminal.actor || result.uid !== this.terminal.uid || result.generation !== state.store.generation()) {
-      throw new CliError2("configuration_required");
-    }
-    return result;
-  }
-  active() {
-    const raw = readSetupJson(runtimeReference(this.directory, "setup-active"));
-    if (raw === undefined) {
-      return;
-    }
-    const value = object2(raw);
-    fields2(value, ["attempt_id"]);
-    id2(value.attempt_id);
-    return this.read(value.attempt_id);
-  }
-  save(value, replace) {
-    const checked = plan(value);
-    writeSetupJson(this.path(checked.attempt_id), checked, replace);
-    return checked;
-  }
-  async issue() {
-    const state = this.state();
-    const previous = this.active();
-    if (previous && previous.phase !== "ready") {
-      if (!["issued", "paired", "native_approved"].includes(previous.phase) || previous.phase === "issued" && Date.now() >= previous.expires_at) {
-        throw new CliError2("configuration_required");
-      }
-      if (!await this.terminal.confirm(cliMessages2(this.terminal.io.language)["setup.approval.resumeConfirm"])) {
-        throw new CliError2("configuration_required");
-      }
-      return { plan: previous };
-    }
-    if (!await this.terminal.confirm(cliMessages2(this.terminal.io.language)["setup.approval.pairConfirm"])) {
-      return { declined: true };
-    }
-    const now = Date.now();
-    const attempt = randomUUID();
-    const lineage = previous?.phase === "ready" ? previous.lineage ?? previous.attempt_id : undefined;
-    let current = this.save({
-      schema_version: 1,
-      attempt_id: attempt,
-      actor: this.terminal.actor,
-      uid: this.terminal.uid,
-      generation: state.store.generation(),
-      ...lineage ? { lineage } : {},
-      name: "connector-" + attempt.slice(0, 8),
-      created_at: now,
-      expires_at: now + 300000,
-      phase: "registering"
-    }, false);
-    writeSetupJson(runtimeReference(this.directory, "setup-active"), { attempt_id: attempt }, previous !== undefined);
-    let registration = false;
-    let issuance = false;
-    const admin = new PairingAdmin2(state.store, {
-      authorize: (action, machine) => {
-        this.state();
-        if (this.#state !== state || Date.now() >= current.expires_at) {
-          throw new CliError2("configuration_required");
-        }
-        if (action === "register" && machine === undefined && !registration && current.phase === "registering") {
-          registration = true;
-          return;
-        }
-        if (action === "enroll" && machine === current.machine_id && !issuance && current.phase === "reserved") {
-          issuance = true;
-          return;
-        }
-        throw new CliError2("configuration_required");
-      }
-    });
-    const machine = admin.register(current.name);
-    current = this.save({ ...current, phase: "reserved", machine_id: machine.machine_id }, true);
-    const enrollment = admin.issue(machine.machine_id, Math.max(1, current.expires_at - Date.now()));
-    current = this.save({ ...current, phase: "issued", enrollment_sha256: createHash2("sha256").update(enrollment).digest("hex") }, true);
-    return { plan: current, code: machine.machine_id + "." + current.attempt_id + "." + enrollment };
-  }
-  async issueRepair() {
-    const state = this.state();
-    const previous = this.active();
-    const retry = previous?.repair === true && ["issued", "redeeming", "unknown"].includes(previous.phase);
-    if (!previous?.machine_id || !previous.providers || previous.phase !== "ready" && !retry) {
-      throw new CliError2("configuration_required");
-    }
-    const machine = previous.machine_id;
-    const device = state.store.machine(machine);
-    if (device.status === "revoked") {
-      throw new CliError2("configuration_required");
-    }
-    if (!await this.terminal.confirm(formatMessage2(cliMessages2(this.terminal.io.language)["setup.approval.repairDeviceConfirm"], {
-      name: device.name,
-      machine
-    }))) {
-      throw new CliError2("configuration_required");
-    }
-    for (let attempt = 0;; attempt++) {
-      const epoch = state.store.deviceEpoch(machine);
-      const generation = state.store.generation();
-      this.#resets.set(machine, {
-        confirmation: randomUUID(),
-        expires: Date.now() + 60000,
-        fence: boundedJson2({ recovery_generation: generation, connection_epoch: epoch })
-      });
-      try {
-        state.store.resetDeviceEnrollment(machine, generation, epoch);
-        state.channels.blockAndClose(machine);
-        break;
-      } catch (error) {
-        this.#resets.delete(machine);
-        if (attempt >= 2) {
-          throw error;
-        }
-      }
-    }
-    const now = Date.now();
-    const attempt = randomUUID();
-    let current = this.save({
-      schema_version: 1,
-      attempt_id: attempt,
-      actor: this.terminal.actor,
-      uid: this.terminal.uid,
-      generation: state.store.generation(),
-      name: previous.name,
-      created_at: now,
-      expires_at: now + 300000,
-      phase: "reserved",
-      machine_id: machine,
-      providers: previous.providers,
-      repair: true,
-      ...previous.lineage ? { lineage: previous.lineage } : {}
-    }, false);
-    let issuance = false;
-    const admin = new PairingAdmin2(state.store, {
-      authorize: (action, target) => {
-        this.state();
-        if (this.#state !== state || Date.now() >= current.expires_at || action !== "enroll" || target !== machine || issuance) {
-          throw new CliError2("configuration_required");
-        }
-        issuance = true;
-      }
-    });
-    const enrollment = admin.issue(machine, Math.max(1, current.expires_at - Date.now()));
-    current = this.save({ ...current, phase: "issued", enrollment_sha256: createHash2("sha256").update(enrollment).digest("hex") }, true);
-    writeSetupJson(runtimeReference(this.directory, "setup-active"), { attempt_id: attempt }, true);
-    return { plan: current, code: machine + "." + current.attempt_id + "." + enrollment };
-  }
-  claim(attempt, machine, enrollment) {
-    const current = this.read(attempt);
-    if (current.phase !== "issued" || current.machine_id !== machine || Date.now() >= current.expires_at || typeof enrollment !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(enrollment) || !timingSafeEqual2(createHash2("sha256").update(enrollment).digest(), Buffer.from(current.enrollment_sha256, "hex"))) {
-      throw new CliError2("configuration_required");
-    }
-    return this.save({ ...current, phase: "redeeming" }, true);
-  }
-  finishDelivery(attempt, delivered) {
-    const current = this.read(attempt);
-    if (current.phase !== "redeeming") {
-      throw new CliError2("configuration_required");
-    }
-    return this.save({ ...current, phase: delivered ? current.repair ? "configured" : "paired" : "unknown" }, true);
-  }
-  async approveNative(attempt, provider, fingerprint, description, signal = this.terminal.io.signal) {
-    const state = this.state();
-    const current = this.read(attempt);
-    const providers = setupProviderKinds(typeof provider === "string" ? [provider] : provider);
-    sha2(fingerprint);
-    if (!["paired", "native_approved"].includes(current.phase)) {
-      throw new CliError2("configuration_required");
-    }
-    if (current.phase === "native_approved" && current.native_fingerprint !== fingerprint) {
-      throw new CliError2("configuration_required");
-    }
-    if (current.providers && boundedJson2(current.providers) !== boundedJson2(providers)) {
-      throw new CliError2("configuration_required");
-    }
-    if (!await this.terminal.confirm(description, signal)) {
-      throw new CliError2("configuration_required");
-    }
-    const checked = this.read(attempt);
-    if (checked.phase !== current.phase || checked.native_fingerprint !== current.native_fingerprint || this.#state !== state) {
-      throw new CliError2("configuration_required");
-    }
-    for (const kind of providers) {
-      this.#providers.set(current.machine_id + "/" + kind, {
-        confirmation: randomUUID(),
-        expires: Date.now() + 300000,
-        generation: current.generation
-      });
-    }
-    return this.save({ ...current, phase: "native_approved", native_fingerprint: fingerprint, providers }, true);
-  }
-  authorizeManagement(request) {
-    const state = this.state();
-    if (request.action === "device_enrollment_reset") {
-      const reset = this.#resets.get(request.target);
-      if (!reset || reset.fence !== request.fence || Date.now() >= reset.expires) {
-        throw new CliError2("configuration_required");
-      }
-      this.#resets.delete(request.target);
-      return { actor: this.terminal.actor, confirmation_id: reset.confirmation };
-    }
-    const permit = this.#providers.get(request.target);
-    if (request.action !== "providers_manage" || request.fence !== "new" || !permit || permit.generation !== state.store.generation() || Date.now() >= permit.expires) {
-      throw new CliError2("configuration_required");
-    }
-    this.#providers.delete(request.target);
-    return { actor: this.terminal.actor, confirmation_id: permit.confirmation };
-  }
-  finishNative(attempt, fingerprint) {
-    const current = this.read(attempt);
-    if (current.phase !== "native_approved" || current.native_fingerprint !== fingerprint) {
-      throw new CliError2("configuration_required");
-    }
-    return this.save({ ...current, phase: "configured" }, true);
-  }
-  finishReady(attempt) {
-    const current = this.read(attempt);
-    if (current.phase !== "configured") {
-      throw new CliError2("configuration_required");
-    }
-    this.save({ ...current, phase: "ready" }, true);
-  }
-}
-
-// src/cli/setup-gateway.ts
-function publish(path, value, maximum = 16384) {
-  const current = readSetupJson(path, maximum);
-  if (current === undefined) {
-    writeSetupJson(path, value, false, maximum);
-  } else if (boundedJson2(current, maximum) !== boundedJson2(value, maximum)) {
-    throw new CliError2("configuration_required");
-  }
-}
-function unionGrants(existing, added) {
-  const merged = [...existing];
-  for (const grant of added) {
-    const found = merged.find((entry) => boundedJson2(entry.target) === boundedJson2(grant.target));
-    if (!found) {
-      merged.push(grant);
-    } else if (boundedJson2(found) !== boundedJson2(grant)) {
-      throw new CliError2("configuration_required");
-    }
-  }
-  return merged;
-}
-function publishFirstCallers(path, resource, authorization, caller) {
-  const previous = readSetupJson(path, REGISTRY_MAX_BYTES);
-  const created = {
-    schema_version: 1,
-    kind: "mcp-caller-source",
-    resource,
-    local_policy: authorization.policies.local,
-    callers: [caller]
-  };
-  if (previous === undefined) {
-    parseRegistry(JSON.parse(boundedJson2(created, REGISTRY_MAX_BYTES)));
-    writeSetupFile(path, boundedJson2(created, REGISTRY_MAX_BYTES), false);
-    return;
-  }
-  const registry = parseRegistry(previous, resource);
-  const kept = registry.callers.filter((entry) => isAdminPlaceholder(entry) || entry.scope === "gateway" || boundedJson2(entry, REGISTRY_MAX_BYTES) === boundedJson2(caller, REGISTRY_MAX_BYTES));
-  if (kept.length !== registry.callers.length) {
-    throw new CliError2("configuration_required");
-  }
-  const callers = [...kept];
-  if (!callers.some((entry) => boundedJson2(entry, REGISTRY_MAX_BYTES) === boundedJson2(caller, REGISTRY_MAX_BYTES))) {
-    callers.push(caller);
-  }
-  const merged = { ...created, callers };
-  parseRegistry(JSON.parse(boundedJson2(merged, REGISTRY_MAX_BYTES)), resource);
-  const stamp = setupFileStamp(path);
-  writeSetupFile(path, boundedJson2(merged, REGISTRY_MAX_BYTES), true, stamp);
-}
-
-class GatewaySetup {
-  config;
-  terminal;
-  options;
-  approval;
-  #begun = false;
-  #active;
-  #timer;
-  #reload;
-  reconfigure = new Promise(() => {});
-  constructor(config, terminal, options = {}) {
-    this.config = config;
-    this.terminal = terminal;
-    this.options = options;
-    this.approval = new SetupApproval(terminal, config.state_dir);
-  }
-  attach(state) {
-    this.approval.attach(state);
-    this.reconfigure = new Promise((resolve) => {
-      this.#reload = resolve;
-    });
-    const http = new GatewayPairingHttp(state, this.approval, (request) => this.native(state, request), () => setImmediate(() => this.#reload?.()));
-    this.#active = http;
-    return http;
-  }
-  async listening(gateway, mcpUrl) {
-    if (this.options.repair && !this.#begun) {
-      this.#begun = true;
-      const active = this.approval.active();
-      if (active?.repair && active.phase === "configured") {
-        this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.resumeRePairing"]);
-      } else {
-        const issued = await this.approval.issueRepair();
-        this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.repairCodeBlock"], {
-          mcpUrl,
-          endpoint: gateway.transport.url.replace(/\/connector$/, ""),
-          code: issued.code
-        }));
-      }
-    }
-    const current = this.approval.active();
-    if (!this.#begun && (current?.phase === "ready" ? this.options.addDevice === true : current?.phase !== "configured")) {
-      this.#begun = true;
-      this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.endpoints"], {
-        mcpUrl,
-        endpoint: gateway.transport.url.replace(/\/connector$/, "")
-      }));
-      const issued = await this.approval.issue();
-      if (issued.declined) {
-        const page = this.config.management_enabled ? "http://127.0.0.1:" + this.config.management_port + "/" : "";
-        this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.unpairedRunning"] + (page ? formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.managementFirstPairing"], { page }) : cliMessages2(this.terminal.io.language)["setup.gateway.managementDisabled"]));
-        this.terminal.finishQuestions();
-        return;
-      }
-      if (issued.code) {
-        this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.pairingCodeBlock"], { code: issued.code }));
-      } else {
-        this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.resumingExisting"]);
-      }
-    }
-    const plan = this.approval.active();
-    if (plan?.phase === "ready") {
-      this.terminal.finishQuestions();
-      return;
-    }
-    if (plan?.phase === "configured") {
-      this.terminal.finishQuestions();
-      let previous = "";
-      this.#timer = setInterval(() => {
-        try {
-          const device = gateway.transport.status().devices.find((entry) => entry.machine_id === plan.machine_id);
-          const current = device?.authenticated ? "connector_authenticated native_pending" : "gateway_waiting_for_connector";
-          if (current !== previous) {
-            previous = current;
-            this.terminal.show(current + `
-`);
-          }
-          if (device?.authenticated && device.ready && (plan.providers ?? ["luvus"]).every((kind) => device.providers.some((entry) => entry.provider_id === kind && entry.ready))) {
-            this.approval.finishReady(plan.attempt_id);
-            this.terminal.show(cliMessages2(this.terminal.io.language)["setup.gateway.connectorReady"]);
-            clearInterval(this.#timer);
-            this.#timer = undefined;
-          }
-        } catch {
-          this.terminal.io.stderr.write(`setup_observation_unavailable
-`);
-          clearInterval(this.#timer);
-          this.#timer = undefined;
-        }
-      }, 250);
-    }
-  }
-  async native(state, request) {
-    const { reviewed, kinds, authorization, fingerprint } = await reviewSetupManifest(request.input, request.plan, request.credential.machine_id, this.config.state_dir, request.signal);
-    if (request.plan.phase === "configured") {
-      if (request.plan.native_fingerprint !== fingerprint) {
-        throw new CliError2("configuration_required");
-      }
-      return { state: "configured", fingerprint };
-    }
-    if (request.signal.aborted) {
-      throw new CliError2("configuration_required");
-    }
-    const providers = readRuntimeConfig2(this.config).providers;
-    const additional = request.plan.lineage !== undefined;
-    if (providers.some((entry) => {
-      const expected = reviewed.find((value) => value.reference === entry.reference);
-      return expected ? boundedJson2(entry.value, 1048576) !== boundedJson2(expected.value, 1048576) : !additional;
-    })) {
-      throw new CliError2("configuration_required");
-    }
-    await this.approval.approveNative(request.plan.attempt_id, kinds, fingerprint, formatMessage2(cliMessages2(this.terminal.io.language)["setup.prompt.gatewayNativeInstallations"], {
-      entries: reviewed.map((entry) => entry.kind + " " + entry.label + ", Target " + boundedJson2(entry.target) + ", binary SHA-256 " + entry.binary_sha256).join("; ")
-    }), request.signal);
-    this.terminal.assertOwner();
-    if (request.signal.aborted) {
-      throw new CliError2("configuration_required");
-    }
-    await publishSetupSchemas(reviewed, request.signal);
-    const hostname = canonicalLoopbackHost(this.config.mcp_hostname);
-    const resource = new URL("http://" + hostname + ":" + this.config.mcp_port + "/mcp").href;
-    const clientPath = runtimeReference(this.config.state_dir, "mcp-client");
-    const original = readSetupJson(clientPath);
-    if (additional && original === undefined) {
-      throw new CliError2("configuration_required");
-    }
-    const client = original === undefined ? {
-      schema_version: 1,
-      kind: "mcp-client-credential",
-      attempt_id: request.plan.attempt_id,
-      resource,
-      principal_id: authorization.principal_id,
-      token: randomBytes(32).toString("base64url"),
-      issued_at: Date.now(),
-      expires_at: Date.now() + 30 * 86400000
-    } : object2(original);
-    fields2(client, [
-      "schema_version",
-      "kind",
-      "attempt_id",
-      "resource",
-      "principal_id",
-      "token",
-      "issued_at",
-      "expires_at"
-    ]);
-    if (client.schema_version !== 1 || client.kind !== "mcp-client-credential" || client.attempt_id !== (request.plan.lineage ?? request.plan.attempt_id) || client.resource !== resource || client.principal_id !== authorization.principal_id || typeof client.token !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(client.token) || !Number.isSafeInteger(client.issued_at) || !Number.isSafeInteger(client.expires_at) || Number(client.expires_at) <= Date.now()) {
-      throw new CliError2("configuration_required");
-    }
-    publish(clientPath, client);
-    const callersPath = runtimeReference(this.config.state_dir, "mcp-callers");
-    const providersPath = runtimeReference(this.config.state_dir, "providers");
-    const reviewedEntries = reviewed.map((entry) => ({
-      reference: entry.reference,
-      value: entry.value
-    }));
-    if (!additional) {
-      publishFirstCallers(callersPath, resource, authorization, {
-        principal: { id: authorization.principal_id, policy: authorization.policies.caller },
-        token_sha256: createHash3("sha256").update(client.token).digest("hex"),
-        issued_at: client.issued_at,
-        expires_at: client.expires_at
-      });
-      publish(providersPath, { schema_version: 1, role: "gateway", providers: reviewedEntries }, 1048576);
-    } else {
-      mergeSetupCallers(callersPath, resource, authorization);
-      mergeSetupProviders(providersPath, reviewedEntries);
-    }
-    for (const entry of reviewed) {
-      const binding = state.store.provider(entry.target.machine_id, entry.target.provider_id);
-      if (!binding) {
-        state.store.defineProvider(entry.binding);
-      } else if (boundedJson2(binding) !== boundedJson2(entry.binding)) {
-        throw new CliError2("configuration_required");
-      }
-    }
-    this.approval.finishNative(request.plan.attempt_id, fingerprint);
-    let adminNote = "";
-    if (this.config.management_enabled && !managementSourceExists2(this.config)) {
-      const page = "http://127.0.0.1:" + this.config.management_port + "/";
-      try {
-        const admin = writeAdminFiles2(this.config, "admin", Date.now());
-        adminNote = formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.adminBlock"], {
-          page,
-          secret: admin.secret
-        });
-      } catch {
-        adminNote = cliMessages2(this.terminal.io.language)["setup.gateway.adminNotCreated"];
-      }
-    }
-    this.terminal.show(formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.nativeSaved"], {
-      clientPath,
-      url: this.config.mcp_public_url ?? resource,
-      targets: boundedJson2(reviewed.map((entry) => entry.target))
-    }) + (additional ? cliMessages2(this.terminal.io.language)["setup.gateway.bearerAdditional"] : formatMessage2(cliMessages2(this.terminal.io.language)["setup.gateway.bearerSecret"], {
-      token: client.token
-    })) + adminNote + `
-`);
-    setImmediate(() => this.#reload?.());
-    return { state: "configured", fingerprint };
-  }
-  async detach(state) {
-    if (this.#timer) {
-      clearInterval(this.#timer);
-      this.#timer = undefined;
-    }
-    const http = this.#active;
-    this.#active = undefined;
-    await http?.close();
-    this.approval.detach(state);
-  }
-}
-function mergeSetupCallers(path, resource, authorization) {
-  const stamp = setupFileStamp(path);
-  const registry = structuredClone(parseRegistry(readRuntimeJson(path, REGISTRY_MAX_BYTES), resource));
-  if (registry.local_policy.revision !== authorization.policies.local.revision) {
-    throw new CliError2("configuration_required");
-  }
-  registry.local_policy.grants = unionGrants(registry.local_policy.grants, authorization.policies.local.grants);
-  for (const entry of registry.callers) {
-    if (entry.principal.id === authorization.principal_id) {
-      if (entry.principal.policy.revision !== authorization.policies.caller.revision) {
-        throw new CliError2("configuration_required");
-      }
-      entry.principal.policy.grants = unionGrants(entry.principal.policy.grants, authorization.policies.caller.grants);
-    }
-  }
-  parseRegistry(JSON.parse(boundedJson2(registry, REGISTRY_MAX_BYTES)), resource);
-  writeSetupFile(path, boundedJson2(registry, REGISTRY_MAX_BYTES), true, stamp);
-}
-function mergeSetupProviders(path, entries) {
-  const stamp = setupFileStamp(path);
-  const document = object2(readRuntimeJson(path, 1048576));
-  fields2(document, ["schema_version", "role", "providers"]);
-  if (document.schema_version !== 1 || document.role !== "gateway" || !Array.isArray(document.providers)) {
-    throw new CliError2("configuration_required");
-  }
-  const merged = [...document.providers];
-  for (const entry of entries) {
-    const found = merged.find((value) => value.reference === entry.reference);
-    if (!found) {
-      merged.push(entry);
-    } else if (boundedJson2(found.value, 1048576) !== boundedJson2(entry.value, 1048576)) {
-      throw new CliError2("configuration_required");
-    }
-  }
-  if (merged.length > 32) {
-    throw new CliError2("configuration_required");
-  }
-  writeSetupFile(path, boundedJson2({ ...document, providers: merged }, 1048576), true, stamp);
-}
-
-export { setupSessions, setupTarget, setupProviderKinds, selectedSetupPolicies, setupReference, setupSessionsFor, setupReply, requestJson, device, reviewSetupManifest, publishSetupSchemas, publish, publishFirstCallers, GatewaySetup, mergeSetupCallers, mergeSetupProviders };
-
-//# debugId=0EFB955908D6EDF264756E2164756E21