@corenel/config 0.2.0 → 0.4.0

package/dist/daemonConfig.d.ts

@@ -17,6 +17,11 @@ export interface DaemonConfig {
     endpoint?: string;
     allowShell?: boolean;
     keepTranscripts?: boolean;
+    /** The daemon's operating mode, matching `--mode <name>`. Only `'team'` is
+     * known; anything else is ignored with a warning rather than coerced, since
+     * this setting changes WHO is asked for permission and a typo that silently
+     * left the daemon fanning out looks exactly like it working. */
+    mode?: string;
     isolation?: string;
     msbBin?: string;
     guestImage?: string;
@@ -37,6 +42,33 @@ export interface DaemonConfig {
      * down as one that predates the key. A plain `string[]`, not its own
      * command, so `corenel config add|remove|list mcpAllow` work for free. */
     mcpAllow?: string[];
+    /** OIDC issuer whose session tokens prove who a paired browser is (spec
+     * 2026-09-25-verified-identity), matching `--identity-issuer <url>`. */
+    identityIssuer?: string;
+    /** Verification on/off, matching `--no-identity` inverted: `false` disables
+     * it. Strict boolean -- anything else is ignored with a warning, never
+     * coerced (see config/layer.ts). */
+    identity?: boolean;
+    /** Web push on/off, matching `--no-push` inverted: `false` disables it
+     * (the PHI/self-host story -- see 2026-09-25-web-push-bcd Task 12). Strict
+     * boolean, same reasoning as `identity` above -- a non-boolean value is
+     * ignored with a warning, never coerced (see config/layer.ts). */
+    push?: boolean;
+    /** Write the local audit log for crew runs. Absent means on. Strict boolean
+     * -- a non-boolean is ignored with a warning, never coerced (see
+     * config/layer.ts). Security state: daemon.json only, never a workspace
+     * file. */
+    audit?: boolean;
+    /** "Send telemetry" (spec 2026-09-26-audit-log §6). Absent means off.
+     * Strict boolean, same reasoning as `audit`. */
+    sendTelemetry?: boolean;
+    /** Human allows of one tool before the daemon offers a standing approval; 0
+     * turns suggestions off. An integer >= 0, anything else is ignored with a
+     * warning. Security state: daemon.json only. */
+    approvalsThreshold?: number;
+    /** Keep full tool arguments (each <= 2 KB) in the daemon's local decision
+     * log. Absent means off. Strict boolean. Security state: daemon.json only. */
+    approvalsCaptureRawArgs?: boolean;
 }
 /** Keys this file must never carry. `--acp-auth` and tunnel credentials belong
  * in auth.json: daemon.json is meant to be safe to paste into a support thread
@@ -52,5 +84,77 @@ export declare function readDaemonConfig(stateDir: string): Promise<{
     unknown: Record<string, unknown>;
     corrupt: boolean;
 }>;
+export declare function isValidConfigEnvName(name: string): boolean;
+/** Thrown for anything wrong with a NAMED environment: an invalid name, a
+ * missing overlay file, a corrupt one, or one that carries a credential.
+ * Every one of these means "do not start", never "fall back to the base
+ * file quietly" -- see the module comment above. */
+export declare class DaemonConfigEnvError extends Error {
+}
+/**
+ * `source` names where `name` actually came from, in the error text -- a
+ * value read from `CORENEL_ENV` that fails validation must say so,
+ * not blame `--env`, or an operator debugging an exported env var
+ * goes looking at the wrong thing. Defaults to `--env` for every
+ * caller that validates a value it did not itself resolve from a source
+ * (the overlay reader below, `readDaemonConfigLayered`'s eager checks in
+ * `configCmd.ts`/`mcpCmd.ts`/`setup.ts`/`pathList.ts`), all of which receive
+ * an ALREADY-SELECTED env with no record of which of the two named it.
+ */
+export declare function assertValidConfigEnvName(name: string, source?: string): void;
+export declare function daemonEnvConfigPath(stateDir: string, env: string): string;
+export declare function readDaemonConfigOverlay(stateDir: string, env: string): Promise<{
+    config: DaemonConfig;
+    unknown: Record<string, unknown>;
+}>;
+/**
+ * The same read as `readDaemonConfigOverlay`, for the ONE caller that means
+ * to CREATE the overlay rather than consume an existing one: an explicit
+ * `corenel config set|unset|add|remove ... --env <name>` (brief.md section
+ * 2). Every other reader of a named environment asked to consume a SPECIFIC
+ * file and must fail loudly when it is missing (see the module comment
+ * above); this one is how an operator brings that file into existence, so a
+ * missing overlay returns the SAME empty shape `readDaemonConfig` returns for
+ * a missing `daemon.json` -- `existed: false` -- rather than throwing. It
+ * still throws for a file that EXISTS but cannot be trusted: corrupt JSON,
+ * JSON that isn't an object, or one that carries a SECRET_KEYS entry -- an
+ * unusable overlay must never be silently overwritten.
+ */
+export declare function readDaemonConfigOverlayForWrite(stateDir: string, env: string): Promise<{
+    config: DaemonConfig;
+    unknown: Record<string, unknown>;
+    existed: boolean;
+}>;
+/**
+ * Write `daemon.<env>.json`, the same shape and same atomicity `writeDaemonConfig`
+ * uses for the base file (whole-file overwrite via `writeFile`, directory
+ * created if needed). Key typing, SECRET_KEYS refusal and unknown-key
+ * preservation are the CALLER's job (`configCmd.ts`'s `keyOrReason`/`commit`),
+ * exactly as they are for the base file -- this function only persists what
+ * it is given.
+ */
+export declare function writeDaemonConfigOverlay(stateDir: string, env: string, next: DaemonConfig, unknown?: Record<string, unknown>): Promise<void>;
+/**
+ * The EFFECTIVE file config a daemon would actually layer under its flags:
+ * `daemon.json`, with every key PRESENT in `daemon.<env>.json` (when `env` is
+ * given) replacing the base value WHOLESALE -- an overlay `roots` array
+ * replaces the base array outright, never merges element-by-element.
+ *
+ * `overlayKeys` names exactly which keys came from the overlay, not the base
+ * file -- `layer.ts`'s provenance ('default' | 'file' | 'overlay' | 'flag')
+ * and its per-key warning wording both need that distinction, and it is lost
+ * the moment the two objects are merged into one if it is not carried
+ * alongside.
+ *
+ * No `env` (the ordinary case): identical to `readDaemonConfig` plus an empty
+ * `overlayKeys`, so every caller can use this unconditionally rather than
+ * branching on whether an environment is active.
+ */
+export declare function readDaemonConfigLayered(stateDir: string, env?: string): Promise<{
+    config: DaemonConfig;
+    unknown: Record<string, unknown>;
+    corrupt: boolean;
+    overlayKeys: Set<string>;
+}>;
 export declare function writeDaemonConfig(stateDir: string, next: DaemonConfig, unknown?: Record<string, unknown>): Promise<void>;
 //# sourceMappingURL=daemonConfig.d.ts.map

package/dist/daemonConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemonConfig.d.ts","sourceRoot":"","sources":["../src/daemonConfig.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C;;;;;;8EAM0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;iBAGiB;AACjB,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAwC,CAAC;AAElF;8CAC8C;AAC9C,eAAO,MAAM,UAAU,EAAE,SAAS,CAAC,MAAM,YAAY,CAAC,EAMrD,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiCvF;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACpC,OAAO,CAAC,IAAI,CAAC,CAKf"}
+{"version":3,"file":"daemonConfig.d.ts","sourceRoot":"","sources":["../src/daemonConfig.ts"],"names":[],"mappings":"AAkEA,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;oEAGgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C;;;;;;8EAM0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;4EACwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;wCAEoC;IACpC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;sEAGkE;IAClE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;eAGW;IACX,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;oDACgD;IAChD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;oDAEgD;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;kFAC8E;IAC9E,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;iBAGiB;AACjB,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAwC,CAAC;AAElF;8CAC8C;AAC9C,eAAO,MAAM,UAAU,EAAE,SAAS,CAAC,MAAM,YAAY,CAAC,EAOrD,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiCvF;AAyBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;oDAGoD;AACpD,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAU,GAAG,IAAI,CAM7E;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzE;AA+CD,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAUrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAUvF;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACpC,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAYjH;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACpC,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/daemonConfig.js

@@ -11,8 +11,59 @@
  * exactly as it was, because a command that silently drops last month's
  * settings is worse than the flag wall it replaces.
  */
-import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { readFile, writeFile, mkdir, rename, unlink } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+/**
+ * Write `body` to `path` ATOMICALLY: a temp file in the SAME directory (so
+ * the rename is on one filesystem, never a cross-device copy), then
+ * `rename()` over the real path. `rename()` on both POSIX and Windows
+ * replaces the destination in one filesystem operation -- a reader never
+ * observes a partially-written file, and a process that dies mid-write
+ * leaves the OLD file intact rather than a truncated or half-flushed one.
+ * The temp name carries a random suffix so two concurrent writers (an
+ * operator running `config set` twice at once, or a CLI write racing the
+ * daemon's own `roots add`) never collide on the same temp path.
+ */
+/** Windows refuses to rename over a file another process holds open (the
+ * running daemon, an editor, antivirus) with one of these codes. The lock is
+ * usually momentary, so retry briefly; if it persists, fall back to writing the
+ * target in place -- exactly what this module did before writes were atomic --
+ * rather than failing a save that used to succeed. */
+const RENAME_BUSY_CODES = new Set(['EPERM', 'EBUSY', 'EACCES']);
+const RENAME_RETRY_DELAYS_MS = [50, 100, 200];
+function errCode(e) {
+    return e && typeof e === 'object' && 'code' in e && typeof e.code === 'string'
+        ? e.code
+        : undefined;
+}
+async function writeFileAtomic(path, body) {
+    await mkdir(dirname(path), { recursive: true });
+    const tmp = join(dirname(path), `.${basename(path)}.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        await writeFile(tmp, body, 'utf8');
+        for (let attempt = 0;; attempt++) {
+            try {
+                await rename(tmp, path);
+                return;
+            }
+            catch (e) {
+                const code = errCode(e);
+                if (!code || !RENAME_BUSY_CODES.has(code))
+                    throw e;
+                if (attempt >= RENAME_RETRY_DELAYS_MS.length)
+                    break;
+                await new Promise((r) => setTimeout(r, RENAME_RETRY_DELAYS_MS[attempt]));
+            }
+        }
+        await writeFile(path, body, 'utf8');
+    }
+    finally {
+        // The temp file is gone after a successful rename; after any failure or the
+        // in-place fallback it is an orphan -- never leave one beside daemon.json.
+        await unlink(tmp).catch(() => { });
+    }
+}
 export const DAEMON_CONFIG_VERSION = 1;
 /** Keys this file must never carry. `--acp-auth` and tunnel credentials belong
  * in auth.json: daemon.json is meant to be safe to paste into a support thread
@@ -25,8 +76,9 @@ export const KNOWN_KEYS = [
     'version', 'port', 'host', 'roots', 'addUnder', 'cloneUnder', 'allowLan',
     'allowOrigins', 'tlsCert', 'tlsKey', 'selfSigned', 'tunnel', 'tunnelName',
     'tunnelHostname', 'endpoint', 'allowShell', 'keepTranscripts', 'isolation',
-    'msbBin', 'guestImage', 'maxChainDepth', 'name', 'appUrl',
-    'defaultModel', 'mcpServers', 'mcpAllow',
+    'msbBin', 'guestImage', 'maxChainDepth', 'name', 'appUrl', 'mode',
+    'defaultModel', 'mcpServers', 'mcpAllow', 'identityIssuer', 'identity', 'push',
+    'audit', 'sendTelemetry', 'approvalsThreshold', 'approvalsCaptureRawArgs',
 ];
 export function daemonConfigPath(stateDir) {
     return join(stateDir, 'daemon.json');
@@ -69,10 +121,184 @@ export async function readDaemonConfig(stateDir) {
     }
     return { config, unknown, corrupt: false };
 }
+/* NAMED CONFIG ENVIRONMENTS: defaults < daemon.json < daemon.<name>.json < flags.
+ *
+ * `--env local` (or `CORENEL_ENV=local`) layers `daemon.local.json`
+ * on top of the base file, in the SAME state dir. The first use is pointing
+ * `identityIssuer` at a local corenel-api without hand-editing daemon.json back
+ * and forth between a real deployment and a laptop.
+ *
+ * The name is restricted to `^[a-z0-9-]{1,32}$` for one reason: this string
+ * becomes a filename (`daemon.<name>.json`). Anything else -- `../x`, `a/b`, an
+ * empty string, uppercase -- either could not be a path segment safely or is not
+ * a name anyone meant to type, so it is refused rather than resolved.
+ *
+ * An overlay is requested BY NAME, unlike the base file: a machine with no
+ * daemon.json quietly runs on defaults (the ordinary fresh-machine case), but
+ * an operator who typed `--env qa` asked for a SPECIFIC file. Starting
+ * without it, or on a corrupt or unusable one, would run the wrong config
+ * silently -- worse than refusing to start. `DaemonConfigEnvError` is how every
+ * caller (cli.ts's own try/catches, or the top-level `main().catch`) turns that
+ * into the same non-zero exit + message every other bad flag already gets.
+ */
+const CONFIG_ENV_NAME_RE = /^[a-z0-9-]{1,32}$/;
+export function isValidConfigEnvName(name) {
+    return CONFIG_ENV_NAME_RE.test(name);
+}
+/** Thrown for anything wrong with a NAMED environment: an invalid name, a
+ * missing overlay file, a corrupt one, or one that carries a credential.
+ * Every one of these means "do not start", never "fall back to the base
+ * file quietly" -- see the module comment above. */
+export class DaemonConfigEnvError extends Error {
+}
+/**
+ * `source` names where `name` actually came from, in the error text -- a
+ * value read from `CORENEL_ENV` that fails validation must say so,
+ * not blame `--env`, or an operator debugging an exported env var
+ * goes looking at the wrong thing. Defaults to `--env` for every
+ * caller that validates a value it did not itself resolve from a source
+ * (the overlay reader below, `readDaemonConfigLayered`'s eager checks in
+ * `configCmd.ts`/`mcpCmd.ts`/`setup.ts`/`pathList.ts`), all of which receive
+ * an ALREADY-SELECTED env with no record of which of the two named it.
+ */
+export function assertValidConfigEnvName(name, source = '--env') {
+    if (!isValidConfigEnvName(name)) {
+        throw new DaemonConfigEnvError(`${source} "${name}" is not a valid environment name (lowercase letters, digits and hyphens, 1-32 characters)`);
+    }
+}
+export function daemonEnvConfigPath(stateDir, env) {
+    return join(stateDir, `daemon.${env}.json`);
+}
+/**
+ * Read ONE overlay file, `daemon.<env>.json`, with the SAME parsing rules as
+ * `readDaemonConfig` -- same KNOWN_KEYS split, same unknown-keys bucket -- but
+ * where the base file never throws, this one does, for every way it could be
+ * unusable: missing, corrupt JSON, JSON that isn't an object, or one that
+ * carries a SECRET_KEYS entry (a credential does not belong in EITHER file,
+ * and here it makes the whole overlay unusable rather than just being ignored
+ * as an unknown key the way it silently would be in the base file today).
+ */
+/** Shared by `readDaemonConfigOverlay` and `readDaemonConfigOverlayForWrite`:
+ * turn ALREADY-READ file text into `{ config, unknown }`, or throw for every
+ * way the text itself is unusable (corrupt JSON, JSON that isn't an object,
+ * or a SECRET_KEYS entry). Missing-file handling differs between the two
+ * callers, so it stays out of this function entirely. */
+function parseOverlaySource(env, path, raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new DaemonConfigEnvError(`env "${env}": ${basename(path)} is not valid JSON`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new DaemonConfigEnvError(`env "${env}": ${basename(path)} is not a JSON object`);
+    }
+    const src = parsed;
+    for (const secret of SECRET_KEYS) {
+        if (secret in src) {
+            throw new DaemonConfigEnvError(`env "${env}": ${basename(path)} contains "${secret}", a credential that does not belong in a daemon config file (it goes in auth.json)`);
+        }
+    }
+    const config = { version: DAEMON_CONFIG_VERSION };
+    const unknown = {};
+    for (const [k, v] of Object.entries(src)) {
+        if (k === 'version')
+            continue;
+        if (KNOWN_KEYS.includes(k)) {
+            config[k] = v;
+        }
+        else {
+            unknown[k] = v;
+        }
+    }
+    return { config, unknown };
+}
+export async function readDaemonConfigOverlay(stateDir, env) {
+    assertValidConfigEnvName(env);
+    const path = daemonEnvConfigPath(stateDir, env);
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch {
+        throw new DaemonConfigEnvError(`env "${env}": ${basename(path)} not found in ${stateDir}`);
+    }
+    return parseOverlaySource(env, path, raw);
+}
+/**
+ * The same read as `readDaemonConfigOverlay`, for the ONE caller that means
+ * to CREATE the overlay rather than consume an existing one: an explicit
+ * `corenel config set|unset|add|remove ... --env <name>` (brief.md section
+ * 2). Every other reader of a named environment asked to consume a SPECIFIC
+ * file and must fail loudly when it is missing (see the module comment
+ * above); this one is how an operator brings that file into existence, so a
+ * missing overlay returns the SAME empty shape `readDaemonConfig` returns for
+ * a missing `daemon.json` -- `existed: false` -- rather than throwing. It
+ * still throws for a file that EXISTS but cannot be trusted: corrupt JSON,
+ * JSON that isn't an object, or one that carries a SECRET_KEYS entry -- an
+ * unusable overlay must never be silently overwritten.
+ */
+export async function readDaemonConfigOverlayForWrite(stateDir, env) {
+    assertValidConfigEnvName(env);
+    const path = daemonEnvConfigPath(stateDir, env);
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch {
+        return { config: { version: DAEMON_CONFIG_VERSION }, unknown: {}, existed: false };
+    }
+    return { ...parseOverlaySource(env, path, raw), existed: true };
+}
+/**
+ * Write `daemon.<env>.json`, the same shape and same atomicity `writeDaemonConfig`
+ * uses for the base file (whole-file overwrite via `writeFile`, directory
+ * created if needed). Key typing, SECRET_KEYS refusal and unknown-key
+ * preservation are the CALLER's job (`configCmd.ts`'s `keyOrReason`/`commit`),
+ * exactly as they are for the base file -- this function only persists what
+ * it is given.
+ */
+export async function writeDaemonConfigOverlay(stateDir, env, next, unknown = {}) {
+    assertValidConfigEnvName(env);
+    const body = { ...unknown, ...next, version: DAEMON_CONFIG_VERSION };
+    const path = daemonEnvConfigPath(stateDir, env);
+    await writeFileAtomic(path, `${JSON.stringify(body, null, 2)}\n`);
+}
+/**
+ * The EFFECTIVE file config a daemon would actually layer under its flags:
+ * `daemon.json`, with every key PRESENT in `daemon.<env>.json` (when `env` is
+ * given) replacing the base value WHOLESALE -- an overlay `roots` array
+ * replaces the base array outright, never merges element-by-element.
+ *
+ * `overlayKeys` names exactly which keys came from the overlay, not the base
+ * file -- `layer.ts`'s provenance ('default' | 'file' | 'overlay' | 'flag')
+ * and its per-key warning wording both need that distinction, and it is lost
+ * the moment the two objects are merged into one if it is not carried
+ * alongside.
+ *
+ * No `env` (the ordinary case): identical to `readDaemonConfig` plus an empty
+ * `overlayKeys`, so every caller can use this unconditionally rather than
+ * branching on whether an environment is active.
+ */
+export async function readDaemonConfigLayered(stateDir, env) {
+    const base = await readDaemonConfig(stateDir);
+    if (!env)
+        return { ...base, overlayKeys: new Set() };
+    const overlay = await readDaemonConfigOverlay(stateDir, env);
+    const config = { ...base.config };
+    const overlayKeys = new Set();
+    for (const [k, v] of Object.entries(overlay.config)) {
+        if (k === 'version')
+            continue;
+        config[k] = v;
+        overlayKeys.add(k);
+    }
+    return { config, unknown: base.unknown, corrupt: base.corrupt, overlayKeys };
+}
 export async function writeDaemonConfig(stateDir, next, unknown = {}) {
     const body = { ...unknown, ...next, version: DAEMON_CONFIG_VERSION };
     const path = daemonConfigPath(stateDir);
-    await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, `${JSON.stringify(body, null, 2)}\n`, 'utf8');
+    await writeFileAtomic(path, `${JSON.stringify(body, null, 2)}\n`);
 }
 //# sourceMappingURL=daemonConfig.js.map

package/dist/daemonConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemonConfig.js","sourceRoot":"","sources":["../src/daemonConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAuCvC;;;iBAGiB;AACjB,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAElF;8CAC8C;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAoC;IACzD,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU;IACxE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY;IACzE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW;IAC1E,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ;IACzD,cAAc,EAAE,YAAY,EAAE,UAAU;CACzC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB;IAEhB,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3H,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,oDAAoD;IAC3E,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oDAAoD;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IAEvF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,MAAM,GAAiB,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAChE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAA6C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,IAAkB,EAClB,UAAmC,EAAE;IAErC,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"daemonConfig.js","sourceRoot":"","sources":["../src/daemonConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;GAUG;AACH;;;;sDAIsD;AACtD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChE,MAAM,sBAAsB,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE9C,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,IAAI,OAAQ,CAAuB,CAAC,IAAI,KAAK,QAAQ;QACnG,CAAC,CAAE,CAAsB,CAAC,IAAI;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,OAAO,IAAI,sBAAsB,CAAC,MAAM;oBAAE,MAAM;gBACpD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAuEvC;;;iBAGiB;AACjB,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAElF;8CAC8C;AAC9C,MAAM,CAAC,MAAM,UAAU,GAAoC;IACzD,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU;IACxE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY;IACzE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW;IAC1E,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IACjE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM;IAC9E,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,yBAAyB;CAC1E,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB;IAEhB,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3H,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,oDAAoD;IAC3E,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oDAAoD;IAC1E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IAEvF,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,MAAM,GAAiB,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAChE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAA6C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;oDAGoD;AACpD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,MAAM,GAAG,OAAO;IACrE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC5B,GAAG,MAAM,KAAK,IAAI,4FAA4F,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,GAAW;IAC/D,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH;;;;yDAIyD;AACzD,SAAS,kBAAkB,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IAChE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,oBAAoB,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,oBAAoB,CAC5B,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,MAAM,qFAAqF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAChE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAK,UAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAA6C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,GAAW;IAEX,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAAgB,EAChB,GAAW;IAEX,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,GAAW,EACX,IAAkB,EAClB,UAAmC,EAAE;IAErC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,GAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAiB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC7B,MAA6C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAgB,EAChB,IAAkB,EAClB,UAAmC,EAAE;IAErC,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/config",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "license": "Elastic-2.0",
   "type": "module",
   "description": "Corenel config — the single reader and writer of the dot-dir's daemon.json and auth.json. Two independent readers of one file drift, and the symptom is silence.",
@@ -18,7 +18,7 @@
     "dist"
   ],
   "dependencies": {
-    "@corenel/tools-node": "0.5.0"
+    "@corenel/tools-node": "0.5.1"
   },
   "devDependencies": {
     "@types/node": "^24.13.1",