rovloom 0.6.0 → 0.6.1

package/dist/src/chunk-yasqw2vj.js

@@ -0,0 +1,756 @@
+// @bun
+import {
+  parseNativeJson2
+} from "./chunk-7crhmqn2.js";
+import"./chunk-d71r315c.js";
+import {
+  object2,
+  fields2,
+  id2,
+  boundedJson2,
+  hash2,
+  validatePolicies2
+} from "./chunk-qt9m2kg2.js";
+import {
+  observedHerdrSource
+} from "./chunk-9tt13dm0.js";
+import"./chunk-g7pnjzkk.js";
+import {
+  cliMessages2,
+  formatMessage2
+} from "./chunk-pgs9jp6t.js";
+import"./chunk-mqyq5jh6.js";
+import"./chunk-hz8pm6hz.js";
+import"./chunk-8fy8w7ds.js";
+import"./chunk-vdwzb63d.js";
+import {
+  localLimits,
+  verifyInstallation,
+  runFixedProcess
+} from "./chunk-bbdtsg4b.js";
+import"./chunk-y4hksha9.js";
+import {
+  initializeManagedLuvusRoot2,
+  discoverLuvusInstallation,
+  MANAGED_LUVUS_REVISION2,
+  MANAGED_LUVUS_CLASSIFICATION2
+} from "./chunk-j6svdqr8.js";
+import"./chunk-efty77sb.js";
+import {
+  compileHerdrSchemas2
+} from "./chunk-5h82060k.js";
+import {
+  HerdrLocalError,
+  measureHerdrInstallation,
+  verifyHerdrInstallation
+} from "./chunk-e7jgpxkf.js";
+import {
+  isStoppedHerdrCommandCancellation,
+  herdrDeadline,
+  runHerdrCommand
+} from "./chunk-41fny9qm.js";
+import"./chunk-6n6b1xpy.js";
+import"./chunk-zb641qa3.js";
+import"./chunk-hxmq28pg.js";
+import"./chunk-5svt6rwr.js";
+import {
+  parseHerdrProviderRefConfig2
+} from "./chunk-9h9x79bx.js";
+import {
+  hasPairingState2,
+  retirePairingState2
+} from "./chunk-y8zm75jt.js";
+import {
+  setupTarget,
+  setupReference,
+  setupSessionsFor,
+  simpleSetupAuthorization
+} from "./chunk-qn5xae7g.js";
+import {
+  setupFileStamp,
+  writeSetupFile,
+  readSetupJson,
+  writeSetupJson
+} from "./chunk-1xer1ent.js";
+import {
+  readRuntimeConfig2
+} from "./chunk-bspzg8er.js";
+import {
+  privateDirectory
+} from "./chunk-8ykrqhxh.js";
+import"./chunk-1bf0wmgk.js";
+import {
+  runtimeReference
+} from "./chunk-z7kkfrgz.js";
+import {
+  herdrMode,
+  luvusMode,
+  selectedNativeProviders,
+  CliError2,
+  CliCancelled,
+  parseConfig2,
+  configDocument2,
+  readConfig2
+} from "./chunk-hpzr94hm.js";
+import {
+  createFileCredentialSink2
+} from "./chunk-5w5srj3b.js";
+import {
+  LuvusDispatchClaims2
+} from "./chunk-sf4ztxba.js";
+import {
+  LuvusAdapterError2
+} from "./chunk-pksaqt9a.js";
+import {
+  effectiveBinDirectories
+} from "./chunk-3nnahj0j.js";
+import"./chunk-h3xyq7zk.js";
+import"./chunk-qp8tgms2.js";
+import"./chunk-0y5542k8.js";
+
+// src/cli/join-connector.ts
+import { existsSync as existsSync2 } from "fs";
+import { join as join3 } from "path";
+
+// src/cli/setup-native.ts
+import { existsSync, mkdirSync } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join } from "path";
+function assertSetupNativePath(config, console) {
+  if (selectedNativeProviders(config).includes("luvus") && luvusMode(config) === "managed" && Buffer.byteLength(join(config.state_dir, "n")) > 52) {
+    console.show(cliMessages2(console.io.language)["setup.native.statePathTooLongLuvus"]);
+    throw new CliError2("configuration_required");
+  }
+  if (selectedNativeProviders(config).includes("herdr") && herdrMode(config) === "managed" && process.platform !== "win32" && Buffer.byteLength(join(config.state_dir, "hr/c/herdr/herdr-client.sock")) > 107) {
+    console.show(cliMessages2(console.io.language)["setup.native.statePathTooLongHerdr"]);
+    throw new CliError2("configuration_required");
+  }
+}
+function setupBinary(config, kind = "luvus") {
+  const fallback = process.platform === "win32" ? [] : ["/usr/bin", "/bin"];
+  const name = process.platform === "win32" ? kind + ".exe" : kind;
+  for (const directory of [...effectiveBinDirectories(config.native?.runtime_bin_dirs), ...fallback]) {
+    const path = join(directory, name);
+    if (existsSync(path)) {
+      return path;
+    }
+  }
+  throw new CliError2("configuration_required");
+}
+function setupAgentDirectories(config) {
+  const directories = effectiveBinDirectories(config.native?.agent_bin_dirs);
+  return directories.length > 0 ? { agent_bin_dirs: directories } : {};
+}
+function userLuvusHome(config) {
+  const configured = config.native?.luvus?.state_root;
+  const environment = process.env.LUVUS_HOME;
+  const path = configured ?? (environment && isAbsolute(environment) ? environment : join(homedir(), ".luvus"));
+  mkdirSync(path, { recursive: true, mode: 448 });
+  return path;
+}
+function prepared(value, attempt, machine, config) {
+  const row = object2(value);
+  fields2(row, ["schema_version", "attempt_id", "machine_id", "phase", "settings", "reference", "local", "remote"]);
+  if (row.schema_version !== 1 || row.attempt_id !== attempt || row.machine_id !== machine || row.phase !== "prepared" || row.reference !== setupReference(attempt) || boundedJson2(row.settings) !== boundedJson2(config.native ?? {})) {
+    throw new CliError2("configuration_required");
+  }
+  return row;
+}
+async function prepareSetupNative(config, console, machine, attempt, authorization) {
+  console.assertOwner();
+  id2(attempt);
+  id2(machine);
+  id2(authorization.principal_id);
+  validatePolicies2(authorization.policies);
+  const path = runtimeReference(config.state_dir, "native-setup");
+  const existing = readSetupJson(path, 1048576);
+  if (existing !== undefined) {
+    return prepared(existing, attempt, machine, config);
+  }
+  const binary = setupBinary(config);
+  const attach = luvusMode(config) === "attach";
+  if (!attach && process.platform === "win32") {
+    console.show(formatMessage2(cliMessages2(console.io.language)["setup.native.managedUnsupportedWindows"], {
+      provider: "luvus",
+      configKey: "luvus"
+    }));
+    throw new CliError2("configuration_required");
+  }
+  if (!attach && process.platform === "darwin") {
+    console.show(formatMessage2(cliMessages2(console.io.language)["setup.native.managedUnsupportedMacos"], {
+      provider: "luvus",
+      configKey: "luvus"
+    }));
+    throw new CliError2("configuration_required");
+  }
+  const control = join(config.state_dir, "control");
+  const stateRoot = attach ? userLuvusHome(config) : join(config.state_dir, "n");
+  const home = join(config.state_dir, "h");
+  const work = join(config.state_dir, "w");
+  assertSetupNativePath(config, console);
+  for (const directory of [
+    control,
+    ...attach ? [] : [stateRoot],
+    home,
+    work,
+    ...["config", "data", "cache", "runtime"].map((name) => join(home, name))
+  ]) {
+    privateDirectory(directory);
+  }
+  const reference = setupReference(attempt);
+  const target = setupTarget(machine, "luvus", setupSessionsFor(config));
+  const discovered = await discoverLuvusInstallation({
+    target,
+    config_ref: reference,
+    binding_revision: 1,
+    binary,
+    state_root: stateRoot,
+    home,
+    cwd: work,
+    transport: "ipc",
+    allow_terminal_execution: false,
+    ...attach ? { attach: true, user_home: homedir() } : {},
+    ...setupAgentDirectories(config)
+  }, { revision: MANAGED_LUVUS_REVISION2, signal: console.io.signal });
+  const schema = await runFixedProcess(discovered.config, localLimits(discovered.config.limits), "schema", console.io.signal);
+  if (schema.exit_code !== 0 || hash2(schema.stdout) !== discovered.compiled.identity.schema_sha256) {
+    throw new CliError2("configuration_required");
+  }
+  await verifyInstallation(discovered.config);
+  const remote = {
+    kind: "luvus",
+    authentication: "remote_connector",
+    binding: {
+      machine_id: target.machine_id,
+      provider_id: target.provider_id,
+      kind: "luvus",
+      config_ref: reference,
+      binding_revision: 1,
+      enabled: true
+    },
+    target,
+    contract: {
+      binary_version: discovered.binaryVersion,
+      binary_sha256: discovered.config.binary_sha256,
+      schema_sha256: discovered.compiled.identity.schema_sha256,
+      adapter_revision: MANAGED_LUVUS_REVISION2,
+      classification_revision: MANAGED_LUVUS_CLASSIFICATION2,
+      schema_bundle: schema.stdout.toString("utf8")
+    },
+    peer_policy_revision: authorization.policies.local.revision,
+    raw_grant: {
+      principal_id: authorization.principal_id,
+      methods: [...authorization.policies.caller.grants[0].methods]
+    }
+  };
+  boundedJson2(remote, 1048576);
+  console.assertOwner();
+  writeSetupJson(path, {
+    schema_version: 1,
+    attempt_id: attempt,
+    machine_id: machine,
+    phase: "initializing"
+  });
+  if (attach) {
+    const ledgerId = hash2(boundedJson2([reference, "user", target]));
+    new LuvusDispatchClaims2({
+      path: join(control, "luvus-claims.db"),
+      mode: "create",
+      ledger_id: ledgerId,
+      limits: { entries: 1024, bytes: 4194304 },
+      now: Date.now
+    }).close();
+    const result = {
+      schema_version: 1,
+      attempt_id: attempt,
+      machine_id: machine,
+      phase: "prepared",
+      settings: config.native ?? {},
+      reference,
+      local: {
+        kind: "luvus",
+        authentication: "local_owner",
+        native: { mode: "user", config: discovered.config },
+        peer_policy_revision: remote.peer_policy_revision,
+        principal_id: authorization.principal_id,
+        policies: authorization.policies,
+        storage_mode: "open"
+      },
+      remote
+    };
+    writeSetupJson(path, result, true, 1048576);
+    return result;
+  }
+  const rootRecord = join(control, "luvus-root.json");
+  const root = await initializeManagedLuvusRoot2({
+    record_path: rootRecord,
+    config: discovered.config
+  });
+  try {
+    const ledgerId = hash2(boundedJson2([reference, root.root_id, root.root_revision, root.config.target]));
+    const claims = new LuvusDispatchClaims2({
+      path: join(control, "luvus-claims.db"),
+      mode: "create",
+      ledger_id: ledgerId,
+      limits: { entries: 1024, bytes: 4194304 },
+      now: Date.now
+    });
+    claims.close();
+    const result = {
+      schema_version: 1,
+      attempt_id: attempt,
+      machine_id: machine,
+      phase: "prepared",
+      settings: config.native ?? {},
+      reference,
+      local: {
+        kind: "luvus",
+        authentication: "local_owner",
+        native: {
+          mode: "managed",
+          root_record: rootRecord,
+          expected_root_id: root.root_id,
+          expected_root_revision: root.root_revision
+        },
+        peer_policy_revision: remote.peer_policy_revision,
+        principal_id: authorization.principal_id,
+        policies: authorization.policies,
+        storage_mode: "open"
+      },
+      remote
+    };
+    writeSetupJson(path, result, true, 1048576);
+    return result;
+  } finally {
+    root.close();
+  }
+}
+
+// src/cli/setup-herdr.ts
+import { mkdirSync as mkdirSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { isAbsolute as isAbsolute2, join as join2 } from "path";
+function attachedDirectories(config) {
+  const home = homedir2();
+  if (process.platform === "win32") {
+    const roaming = config.native?.herdr?.config_home ?? process.env.APPDATA ?? join2(home, "AppData", "Roaming");
+    const local = process.env.LOCALAPPDATA ?? join2(home, "AppData", "Local");
+    for (const path of [roaming, local]) {
+      mkdirSync2(path, { recursive: true });
+    }
+    return { home, config_home: roaming, state_home: local, cache_home: local, cwd: home };
+  }
+  const xdg = (variable, fallback) => {
+    const value = process.env[variable];
+    return value && isAbsolute2(value) ? value : join2(home, fallback);
+  };
+  const directories = {
+    home,
+    config_home: config.native?.herdr?.config_home ?? xdg("XDG_CONFIG_HOME", ".config"),
+    state_home: xdg("XDG_STATE_HOME", ".local/state"),
+    cache_home: xdg("XDG_CACHE_HOME", ".cache"),
+    cwd: home
+  };
+  for (const path of [directories.config_home, directories.state_home, directories.cache_home]) {
+    mkdirSync2(path, { recursive: true, mode: 448 });
+  }
+  return directories;
+}
+async function version(config, signal) {
+  const scope = herdrDeadline(signal, 1000);
+  try {
+    const raw = await runHerdrCommand(config, "version", scope.signal);
+    const label = raw.toString("utf8").trim().replace(/^herdr\s+/i, "");
+    return label.length > 0 && label.length <= 128 && [...label].every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127) ? label : "unavailable";
+  } catch (error) {
+    if (error instanceof HerdrLocalError && (error.code === "herdr_cli_exit" || error.code === "herdr_timeout" && !signal.aborted)) {
+      return "unavailable";
+    }
+    throw error;
+  } finally {
+    scope.close();
+  }
+}
+function prepared2(value, config, attempt, machine) {
+  const row = object2(value);
+  fields2(row, ["schema_version", "attempt_id", "machine_id", "phase", "settings", "reference", "local", "remote"]);
+  if (row.schema_version !== 1 || row.attempt_id !== attempt || row.machine_id !== machine || row.phase !== "prepared" || row.reference !== setupReference(attempt, "herdr") || boundedJson2(row.settings) !== boundedJson2(config.native ?? {})) {
+    throw new CliError2("configuration_required");
+  }
+  return row;
+}
+async function prepareSetupHerdr(config, console, machine, attempt, authorization) {
+  console.assertOwner();
+  const path = runtimeReference(config.state_dir, "herdr-setup");
+  const existing = readSetupJson(path, 1048576);
+  if (existing !== undefined) {
+    return prepared2(existing, config, attempt, machine);
+  }
+  const binary = setupBinary(config, "herdr");
+  const attach = herdrMode(config) === "attach";
+  if (!attach && process.platform === "win32") {
+    console.show(formatMessage2(cliMessages2(console.io.language)["setup.native.managedUnsupportedWindows"], {
+      provider: "herdr",
+      configKey: "herdr"
+    }));
+    throw new CliError2("configuration_required");
+  }
+  if (!attach && process.platform === "darwin") {
+    console.show(formatMessage2(cliMessages2(console.io.language)["setup.native.managedUnsupportedMacos"], {
+      provider: "herdr",
+      configKey: "herdr"
+    }));
+    throw new CliError2("configuration_required");
+  }
+  assertSetupNativePath(config, console);
+  const root = join2(config.state_dir, "hr");
+  privateDirectory(root);
+  for (const name of ["h", "c", "s", "k", "t", "w", "control"]) {
+    privateDirectory(join2(root, name));
+  }
+  const target = setupTarget(machine, "herdr");
+  const reference = setupReference(attempt, "herdr");
+  const local = {
+    target,
+    binding_revision: 1,
+    config_ref: reference,
+    binary,
+    ...attach ? attachedDirectories(config) : {
+      home: join2(root, "h"),
+      config_home: join2(root, "c"),
+      state_home: join2(root, "s"),
+      cache_home: join2(root, "k"),
+      cwd: join2(root, "w")
+    },
+    temporary_home: join2(root, "t"),
+    allow_terminal_execution: false,
+    ...attach ? { attach: true } : {},
+    ...setupAgentDirectories(config)
+  };
+  const measured = measureHerdrInstallation(local);
+  const scope = herdrDeadline(console.io.signal, 1e4);
+  let raw;
+  let source;
+  try {
+    const label = await version(local, scope.signal);
+    raw = await runHerdrCommand(local, "schema", scope.signal);
+    const compiled = await compileHerdrSchemas2(raw, scope.signal);
+    if (verifyHerdrInstallation(local, measured.sha256) !== measured.stamp || compiled.schema_sha256 !== hash2(raw)) {
+      throw new CliError2("configuration_required");
+    }
+    source = observedHerdrSource(label, measured.sha256, compiled.schema_sha256, compiled.protocol);
+  } catch (error) {
+    if (console.io.signal.aborted && isStoppedHerdrCommandCancellation(error)) {
+      throw new CliCancelled;
+    }
+    throw error;
+  } finally {
+    scope.close();
+  }
+  const shared = {
+    version: 1,
+    target,
+    binding_revision: 1,
+    config_ref: reference,
+    expected_source: source,
+    peer_policy_revision: authorization.policies.local.revision
+  };
+  const control = join2(root, "control");
+  const schemaPath = join2(control, "schema.json");
+  const limits = { entries: 1024, bytes: 4194304 };
+  const claimsRef = {
+    path: join2(control, "claims.db"),
+    mode: "open",
+    ledger_id: hash2(boundedJson2([reference, target, source, "claims"])),
+    limits
+  };
+  const provider = parseHerdrProviderRefConfig2({
+    ...shared,
+    schema_path: schemaPath,
+    connector: {
+      local,
+      principal_id: authorization.principal_id,
+      claims: claimsRef
+    }
+  });
+  console.assertOwner();
+  writeSetupJson(path, {
+    schema_version: 1,
+    attempt_id: attempt,
+    machine_id: machine,
+    phase: "initializing"
+  });
+  writeSetupFile(schemaPath, raw);
+  const claims = new LuvusDispatchClaims2({ ...claimsRef, mode: "create", now: Date.now });
+  try {} finally {
+    claims.close();
+  }
+  const result = {
+    schema_version: 1,
+    attempt_id: attempt,
+    machine_id: machine,
+    phase: "prepared",
+    settings: config.native ?? {},
+    reference,
+    local: {
+      kind: "herdr",
+      config: provider,
+      native: { mode: attach ? "attach" : "managed" },
+      policies: authorization.policies
+    },
+    remote: { kind: "herdr", config: shared, schema_bundle: raw.toString("utf8") }
+  };
+  writeSetupJson(path, result, true, 1048576);
+  return result;
+}
+
+// src/cli/setup-console.ts
+function silentConsole(io) {
+  return {
+    io,
+    show: (text) => {
+      io.stderr.write(text);
+    },
+    confirm: async () => true,
+    assertOwner: () => {}
+  };
+}
+
+// src/cli/join-connector.ts
+function parseJoinValue(value) {
+  const hash = value.indexOf("#");
+  if (typeof value !== "string" || hash <= 0 || hash === value.length - 1) {
+    throw new CliError2("invalid_arguments");
+  }
+  const url = value.slice(0, hash);
+  const parts = value.slice(hash + 1).split(".");
+  if (parts.length !== 3) {
+    throw new CliError2("invalid_arguments");
+  }
+  const [machine, attempt, secret] = parts;
+  id2(machine);
+  id2(attempt);
+  if (typeof secret !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(secret)) {
+    throw new CliError2("invalid_arguments");
+  }
+  const parsed = new URL(url);
+  if (!["ws:", "wss:"].includes(parsed.protocol) || !parsed.hostname || parsed.username || parsed.password || parsed.search || parsed.hash || !["/", ""].includes(parsed.pathname)) {
+    throw new CliError2("invalid_arguments");
+  }
+  return { url: parsed.origin, machine, attempt, secret, value: machine + "." + attempt + "." + secret };
+}
+async function responseJson(response) {
+  if (!response.body || response.status !== 200) {
+    await response.body?.cancel().catch(() => {});
+    throw new CliError2("configuration_required");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  try {
+    while (true) {
+      const value = await reader.read();
+      if (value.done) {
+        break;
+      }
+      bytes += value.value.length;
+      if (bytes > 262144) {
+        throw new CliError2("configuration_required");
+      }
+      chunks.push(value.value);
+    }
+    const parsed = parseNativeJson2(Buffer.concat(chunks, bytes), { object_bytes: 262144 });
+    if (!parsed.ok) {
+      throw new CliError2("configuration_required");
+    }
+    return object2(parsed.value);
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+async function post(config, path, value, signal, timeout = 300000) {
+  const origin = new URL(config.gateway_url);
+  origin.protocol = origin.protocol === "wss:" ? "https:" : "http:";
+  return await responseJson(await fetch(new URL(path, origin), {
+    method: "POST",
+    redirect: "error",
+    headers: { "content-type": "application/json" },
+    body: boundedJson2(value, 1048576),
+    signal: AbortSignal.any([signal, AbortSignal.timeout(timeout)])
+  }));
+}
+async function joinConnector(config, path, io, value) {
+  const code = parseJoinValue(value);
+  const console = silentConsole(io);
+  const providers = readRuntimeConfig2(config).providers;
+  const hasCredential = existsSync2(runtimeReference(config.state_dir, "device"));
+  if (hasPairingState2(config.state_dir)) {
+    const paired = readSetupJson(runtimeReference(config.state_dir, "pairing"));
+    const current = paired === undefined ? undefined : object2(paired);
+    const machine = current && "machine_id" in current ? String(current.machine_id) : undefined;
+    if (hasCredential && existsSync2(runtimeReference(config.state_dir, "providers")) && machine === code.machine && config.gateway_url === code.url) {
+      return config;
+    }
+    const prepared = ["native-setup", "herdr-setup"].map((reference) => readSetupJson(runtimeReference(config.state_dir, reference), 1048576)).filter((entry) => entry !== undefined);
+    const resume = !hasCredential && providers.length === 0 && config.gateway_url === code.url && prepared.length > 0 && prepared.every((entry) => {
+      const row = object2(entry);
+      return row.phase === "prepared" && row.machine_id === code.machine && row.attempt_id === code.attempt;
+    });
+    if (!resume) {
+      const retired = retirePairingState2(config, console);
+      if (retired !== undefined) {
+        console.show(formatMessage2(cliMessages2(io.language)[config.gateway_url === code.url ? "setup.join.resettingState" : "setup.join.switchingGateway"], { retired }));
+      }
+    }
+  }
+  if (config.gateway_url !== code.url) {
+    if (boundedJson2(configDocument2(readConfig2(path))) !== boundedJson2(configDocument2(config))) {
+      throw new CliError2("config_changed");
+    }
+    config = parseConfig2({ ...configDocument2(config), gateway: { url: code.url } });
+    writeSetupFile(path, JSON.stringify(configDocument2(config), null, 2) + `
+`, true, setupFileStamp(path));
+  }
+  privateDirectory(config.state_dir);
+  privateDirectory(join3(config.state_dir, "managed"));
+  assertSetupNativePath(config, console);
+  const authorization = simpleSetupAuthorization(code.machine, selectedNativeProviders(config), setupSessionsFor(config));
+  const prepared = [];
+  for (const kind of selectedNativeProviders(config)) {
+    prepared.push(await (kind === "luvus" ? prepareSetupNative : prepareSetupHerdr)(config, console, code.machine, code.attempt, authorization));
+  }
+  const installations = prepared.map((native) => ({
+    reference: native.reference,
+    value: native.remote
+  }));
+  const installation = installations.length === 1 && selectedNativeProviders(config)[0] === "luvus" ? installations[0] : { installations };
+  const applied = await post(config, "/pairing", { code: code.value, installation }, io.signal);
+  fields2(applied, ["state", "machine_id", "recovery_generation", "credential"], ["mcp", "replayed"]);
+  id2(applied.machine_id);
+  id2(applied.recovery_generation);
+  if (applied.state !== "paired" || applied.machine_id !== code.machine || typeof applied.credential !== "string" || !/^[A-Za-z0-9_-]{32,256}$/.test(applied.credential)) {
+    throw new CliError2("configuration_required");
+  }
+  const credential = {
+    machine_id: code.machine,
+    recovery_generation: applied.recovery_generation,
+    credential: applied.credential
+  };
+  const credentialPath = runtimeReference(config.state_dir, "device");
+  const sink = createFileCredentialSink2(credentialPath, credential, existsSync2(credentialPath));
+  try {
+    await sink.deliver(credential, io.signal, { delivery_id: "join_" + code.attempt, revision: 0 });
+  } finally {
+    sink.close();
+  }
+  writeSetupJson(runtimeReference(config.state_dir, "providers"), {
+    schema_version: 1,
+    role: "connector",
+    providers: prepared.map((native) => ({
+      reference: native.reference,
+      value: native.local
+    }))
+  }, false, 1048576);
+  writeSetupJson(runtimeReference(config.state_dir, "pairing"), {
+    schema_version: 1,
+    attempt_id: code.attempt,
+    machine_id: code.machine,
+    gateway_url: config.gateway_url,
+    phase: "configured"
+  }, false);
+  console.show(formatMessage2(cliMessages2(io.language)["setup.join.completed"], {
+    machine: code.machine,
+    url: config.gateway_url
+  }) + formatMessage2(cliMessages2(io.language)["setup.join.providers"], {
+    entries: prepared.map((native) => native.reference).join(", ")
+  }));
+  if (applied.mcp !== undefined) {
+    const mcp = object2(applied.mcp);
+    fields2(mcp, ["url", "token"]);
+    if (typeof mcp.url !== "string" || typeof mcp.token !== "string") {
+      throw new CliError2("configuration_required");
+    }
+    console.show(formatMessage2(cliMessages2(io.language)["setup.join.mcpBlock"], { url: mcp.url, token: mcp.token }));
+  }
+  return config;
+}
+
+// src/cli/setup-runtime.ts
+class CliSetup {
+  #io;
+  #issueCode = false;
+  #issued = false;
+  #observation;
+  async prepare(config, path, io, options) {
+    this.#io = io;
+    if (config.role === "connector") {
+      if (options?.join !== undefined) {
+        const joined = await joinConnector(config, path, io, options.join);
+        io.stderr.write(`
+`);
+        return joined;
+      }
+      return config;
+    }
+    this.#issueCode = options?.issueCode === true;
+    return config;
+  }
+  async gatewayListening(issue) {
+    const io = this.#io;
+    if (!io || !this.#issueCode || this.#issued || io.signal.aborted) {
+      return;
+    }
+    const value = await issue();
+    if (value !== undefined) {
+      this.#issued = true;
+      io.stderr.write(formatMessage2(cliMessages2(io.language)["setup.gateway.joinCommandBlock"], {
+        command: "rovloom connector --join " + value
+      }));
+    }
+  }
+  nativeFailed(error) {
+    if ((error instanceof LuvusAdapterError2 || error instanceof HerdrLocalError) && /^[a-z_]{1,80}$/.test(error.code)) {
+      this.#io?.stderr.write("native_unavailable " + error.code + `
+`);
+    }
+  }
+  observe(running) {
+    if (!running.transport) {
+      return;
+    }
+    let previous = "";
+    this.#observation = setInterval(() => {
+      try {
+        const status = running.transport.status();
+        const ready = status.providers.some((provider) => provider.ready);
+        const current = status.phase + ":" + ready + ":" + (status.failure ?? "");
+        if (current !== previous) {
+          previous = current;
+          this.#io?.stderr.write("connector_transport " + status.phase + " provider_ready=" + String(ready) + (status.capacity ? " capacity=" + status.capacity.resource + " reclaim_at=" + String(status.capacity.reclaim_at) : "") + (status.failure ? " reason=" + status.failure : "") + `
+`);
+        }
+      } catch {
+        clearInterval(this.#observation);
+        this.#observation = undefined;
+      }
+    }, 250);
+    running.closed.then(() => {
+      clearInterval(this.#observation);
+      this.#observation = undefined;
+    }, () => {
+      clearInterval(this.#observation);
+      this.#observation = undefined;
+    });
+  }
+  close() {
+    clearInterval(this.#observation);
+    this.#observation = undefined;
+    this.#io = undefined;
+  }
+}
+export {
+  CliSetup
+};
+
+//# debugId=859B7FAC09008D6B64756E2164756E21