@goondocks/myco 0.20.2 → 0.21.1

package/dist/{chunk-OD4AA7PV.js → chunk-53RPGOEN.js}

@@ -1,7 +1,10 @@
 import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+import {
+  RuntimeIdSchema
+} from "./chunk-OUJSQSKE.js";
 import {
   SCHEDULABLE_POWER_STATES
-} from "./chunk-FLLBJLHM.js";
+} from "./chunk-6C6QZ4PM.js";
 import {
   require_dist
 } from "./chunk-6LQIMRTC.js";
@@ -35,7 +38,7 @@ var DaemonSchema = external_exports.object({
   log_retention_days: external_exports.number().int().min(1).max(365).default(30),
   /**
    * Time without new prompts before an active session is auto-completed (ms).
-   * Intelligence tasks (full-intelligence, skill-survey, etc.) only process
+   * Intelligence tasks (vault-evolve, skill-survey, etc.) only process
    * settled sessions, so this threshold directly controls how fresh their
    * inputs are. Defaults to 1 hour.
    */
@@ -49,9 +52,16 @@ var CaptureSchema = external_exports.object({
   buffer_max_events: external_exports.number().int().positive().default(500)
 });
 var ProviderOverrideSchema = external_exports.object({
-  type: external_exports.enum(["anthropic", "ollama", "lmstudio"]),
+  runtime: RuntimeIdSchema.optional(),
+  type: external_exports.enum(["anthropic", "ollama", "lmstudio", "openai", "openrouter", "openai-compatible"]),
+  local_backend: external_exports.enum(["ollama", "lmstudio"]).optional(),
   base_url: external_exports.string().optional(),
   model: external_exports.string().optional(),
+  reasoning_map: external_exports.object({
+    low: external_exports.string().optional(),
+    default: external_exports.string().optional(),
+    high: external_exports.string().optional()
+  }).optional(),
   /** Context window size for local models (Ollama num_ctx, LM Studio context_length). */
   context_length: external_exports.number().int().positive().optional()
 });
@@ -68,6 +78,7 @@ var ScheduleOverrideSchema = external_exports.object({
 }).optional();
 var TaskProviderOverrideSchema = external_exports.object({
   provider: ProviderOverrideSchema.optional(),
+  runtime: RuntimeIdSchema.optional(),
   model: external_exports.string().optional(),
   maxTurns: external_exports.number().int().positive().optional(),
   timeoutSeconds: external_exports.number().int().positive().optional(),
@@ -76,23 +87,38 @@ var TaskProviderOverrideSchema = external_exports.object({
   /** Task-specific params — keys and types vary per task. */
   params: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).optional()
 });
-var ContextSchema = external_exports.object({
-  /** Which digest tier to inject at session start. */
+var ContextSchema = external_exports.preprocess((raw) => {
+  if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+    const input = raw;
+    if ("operating_brief_enabled" in input && !("cortex_enabled" in input)) {
+      const { operating_brief_enabled, ...rest } = input;
+      return { ...rest, cortex_enabled: operating_brief_enabled };
+    }
+  }
+  return raw;
+}, external_exports.object({
+  /** Preferred digest tier when a user or agent explicitly requests Myco context. */
   digest_tier: external_exports.number().int().default(5e3),
+  /** Append the preferred digest extract at session start after Cortex instructions. */
+  session_start_digest_enabled: external_exports.boolean().default(false),
+  /** Master switch for Cortex session-start instruction injection. */
+  cortex_enabled: external_exports.boolean().default(true),
   /** Enable semantic spore search on each user prompt. */
   prompt_search: external_exports.boolean().default(true),
   /** Max spores to inject per prompt (0-10). */
   prompt_max_spores: external_exports.number().int().min(0).max(10).default(3)
-});
+}));
 var AgentSchema = external_exports.object({
   /** Number of batches between event-driven summary triggers (0 to disable). */
   summary_batch_interval: external_exports.number().int().min(0).default(5),
   /** Global toggle for PowerManager-scheduled agent tasks. */
   scheduled_tasks_enabled: external_exports.boolean().default(true),
-  /** Global toggle for event-driven agent tasks (title-summary). */
+  /** Global toggle for event-driven agent tasks (title-summary, Cortex refresh). */
   event_tasks_enabled: external_exports.boolean().default(true),
   /** Global default provider — applies to all tasks unless overridden per-task. */
   provider: ProviderOverrideSchema.optional(),
+  /** Global default runtime — applies to all tasks unless overridden per-task. */
+  runtime: RuntimeIdSchema.optional(),
   /** Global default model — applies to all tasks unless overridden per-task. */
   model: external_exports.string().optional(),
   /** Per-task overrides keyed by task name. */
@@ -339,6 +365,22 @@ var MIGRATIONS = [
       if (!("enabled" in settings)) settings.enabled = true;
       if (!("mode" in settings)) settings.mode = "banner";
     }
+  },
+  {
+    version: 6,
+    name: "rename-full-intelligence-to-vault-evolve",
+    migrate(doc, _vaultDir) {
+      const agent = doc.agent;
+      if (!agent) return;
+      const tasks = agent.tasks;
+      if (!tasks || !("full-intelligence" in tasks)) return;
+      const legacy = tasks["full-intelligence"];
+      const existing = tasks["vault-evolve"];
+      if (!existing) {
+        tasks["vault-evolve"] = legacy;
+      }
+      delete tasks["full-intelligence"];
+    }
   }
 ];
 var CURRENT_MIGRATION_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;
@@ -442,6 +484,12 @@ function loadConfig(vaultDir) {
     process.stderr.write(`[myco migration] ${msg}
 `);
   });
+  const ctx = parsed.context;
+  if (ctx && "operating_brief_enabled" in ctx && !("cortex_enabled" in ctx)) {
+    process.stderr.write(
+      "[myco config] context.operating_brief_enabled is deprecated; rename to context.cortex_enabled\n"
+    );
+  }
   const config = MycoConfigSchema.parse(parsed);
   const needsWrite = v2Migrated || migrationsRan || (parsed.config_version ?? 0) < CURRENT_MIGRATION_VERSION || parsed.version !== config.version;
   if (needsWrite) {
@@ -542,4 +590,4 @@ export {
   saveLocalConfig,
   updateLocalConfig
 };
-//# sourceMappingURL=chunk-OD4AA7PV.js.map
+//# sourceMappingURL=chunk-53RPGOEN.js.map

package/dist/chunk-53RPGOEN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/loader.ts","../src/config/appearance-values.ts","../src/config/schema.ts","../src/config/migrations.ts","../src/utils/deep-merge.ts"],"sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport YAML from 'yaml';\nimport { MycoConfigSchema, type MycoConfig, type BackupConfig, type TeamConfig } from './schema.js';\nimport { runMigrations, CURRENT_MIGRATION_VERSION } from './migrations.js';\nimport { deepMerge } from '../utils/deep-merge.js';\n\nexport const CONFIG_FILENAME = 'myco.yaml';\nexport const LOCAL_CONFIG_FILENAME = 'local.yaml';\n\nfunction localConfigPath(vaultDir: string): string {\n  // vaultDir already points at `.myco/` (see resolveVaultDir), so local.yaml\n  // sits alongside myco.yaml in the vault — no extra `.myco/` prefix.\n  return path.join(vaultDir, LOCAL_CONFIG_FILENAME);\n}\n\n/** Config overlay uses replace semantics: arrays in source overwrite arrays in target. */\nexport function deepMergeConfig<T extends Record<string, unknown>>(target: T, source: Partial<T>): T {\n  return deepMerge(target, source, { arrayStrategy: 'replace' });\n}\n\nexport function loadConfig(vaultDir: string): MycoConfig {\n  const configPath = path.join(vaultDir, CONFIG_FILENAME);\n\n  if (!fs.existsSync(configPath)) {\n    throw new Error(`myco.yaml not found in ${vaultDir}`);\n  }\n\n  const raw = fs.readFileSync(configPath, 'utf-8');\n  const parsed = YAML.parse(raw) as Record<string, unknown>;\n\n  // Detect v1 config and guide migration\n  if (parsed.version === 1 || (parsed.intelligence as Record<string, unknown>)?.backend) {\n    throw new Error(\n      'Myco config uses v1 format. Run /myco:setup-llm to reconfigure for v2.',\n    );\n  }\n\n  // --- v2 → v3 migration ---\n  let v2Migrated = false;\n  if (parsed.version === 2) {\n    // Extract intelligence.embedding to top-level embedding\n    const intel = parsed.intelligence as Record<string, unknown> | undefined;\n    const embeddingConfig = intel?.embedding as Record<string, unknown> | undefined;\n    if (embeddingConfig && !parsed.embedding) {\n      // Map v2 'lm-studio' to v3 'openai-compatible' for embedding provider\n      if (embeddingConfig.provider === 'lm-studio') {\n        embeddingConfig.provider = 'openai-compatible';\n      }\n      parsed.embedding = embeddingConfig;\n    }\n\n    // Keep daemon.port and daemon.log_level, drop grace_period and max_log_size\n    const daemon = parsed.daemon as Record<string, unknown> | undefined;\n    if (daemon) {\n      const { port, log_level } = daemon;\n      parsed.daemon = { port: port ?? null, log_level: log_level ?? 'info' };\n    }\n\n    // Keep capture basics, drop token-related fields; migrate artifact_watch → plan_dirs\n    const capture = parsed.capture as Record<string, unknown> | undefined;\n    if (capture) {\n      const { transcript_paths, artifact_watch, plan_dirs, artifact_extensions, buffer_max_events } = capture;\n      parsed.capture = {\n        transcript_paths,\n        plan_dirs: plan_dirs ?? artifact_watch,\n        artifact_extensions,\n        buffer_max_events,\n      };\n    }\n\n    // Drop removed top-level sections\n    delete parsed.intelligence;\n    delete parsed.context;\n    delete parsed.team;\n    delete parsed.digest;\n    delete parsed.pipeline;\n\n    // Set version to 3\n    parsed.version = 3;\n    v2Migrated = true;\n\n    process.stderr.write('[myco migration] Migrated config from v2 to v3\\n');\n  }\n\n  // Run numbered migrations (for v3+ forward migrations)\n  const migrationsRan = runMigrations(parsed, vaultDir, (msg) => {\n    process.stderr.write(`[myco migration] ${msg}\\n`);\n  });\n\n  // Deprecation warning for legacy context.operating_brief_enabled →\n  // context.cortex_enabled (rewrite happens inside ContextSchema.preprocess).\n  const ctx = parsed.context as Record<string, unknown> | undefined;\n  if (ctx && 'operating_brief_enabled' in ctx && !('cortex_enabled' in ctx)) {\n    process.stderr.write(\n      '[myco config] context.operating_brief_enabled is deprecated; rename to context.cortex_enabled\\n',\n    );\n  }\n\n  // Parse with Zod to fill in defaults for new config sections\n  const config = MycoConfigSchema.parse(parsed);\n\n  // Write back if v2→v3 migration ran, numbered migrations ran, or new defaults were added\n  const needsWrite = v2Migrated\n    || migrationsRan\n    || (parsed.config_version as number ?? 0) < CURRENT_MIGRATION_VERSION\n    || parsed.version !== config.version;\n\n  if (needsWrite) {\n    const fullConfig = JSON.parse(JSON.stringify(config)) as Record<string, unknown>;\n    fs.writeFileSync(configPath, YAML.stringify(fullConfig), 'utf-8');\n  }\n\n  return config;\n}\n\nexport function saveConfig(vaultDir: string, config: MycoConfig): void {\n  // Validate before writing — OAK lesson: validate on write, not just read.\n  // This is the single parse point for all write paths.\n  const validated = MycoConfigSchema.parse(config);\n\n  const configPath = path.join(vaultDir, CONFIG_FILENAME);\n  fs.mkdirSync(vaultDir, { recursive: true });\n  fs.writeFileSync(configPath, YAML.stringify(validated), 'utf-8');\n}\n\nexport function updateConfig(\n  vaultDir: string,\n  fn: (config: MycoConfig) => MycoConfig,\n): MycoConfig {\n  const current = loadConfig(vaultDir);\n  const updated = fn(current);\n  saveConfig(vaultDir, updated);\n  return updated;\n}\n\nexport function updateBackupConfig(\n  vaultDir: string,\n  backup: Partial<BackupConfig>,\n): MycoConfig {\n  return updateConfig(vaultDir, (config) => ({\n    ...config,\n    backup: { ...config.backup, ...backup },\n  }));\n}\n\n/**\n * Extract the set of enabled symbiont names from config.\n * Returns null when the `symbionts` section is absent (pre-existing installs),\n * signalling callers to fall back to their own heuristic.\n */\nexport function getEnabledSymbiontNames(config: MycoConfig): Set<string> | null {\n  if (!config.symbionts) return null;\n  return new Set(\n    Object.entries(config.symbionts)\n      .filter(([, entry]) => entry.enabled)\n      .map(([name]) => name),\n  );\n}\n\nexport function updateTeamConfig(\n  vaultDir: string,\n  team: Partial<TeamConfig>,\n): MycoConfig {\n  return updateConfig(vaultDir, (config) => ({\n    ...config,\n    team: { ...config.team, ...team },\n  }));\n}\n\n/** Return raw local overrides, or `{}` if the file is missing, empty, malformed, or not a mapping. */\nexport function loadLocalConfig(vaultDir: string): Partial<MycoConfig> {\n  const filePath = localConfigPath(vaultDir);\n  if (!fs.existsSync(filePath)) return {};\n  const raw = fs.readFileSync(filePath, 'utf-8').trim();\n  if (!raw) return {};\n\n  let parsed: unknown;\n  try {\n    parsed = YAML.parse(raw);\n  } catch (err) {\n    process.stderr.write(`[myco config] Failed to parse ${filePath}; ignoring local overrides. ${(err as Error).message}\\n`);\n    return {};\n  }\n\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    process.stderr.write(`[myco config] ${filePath} must contain a YAML mapping; ignoring local overrides.\\n`);\n    return {};\n  }\n\n  return parsed as Partial<MycoConfig>;\n}\n\n/** Load project config and overlay local overrides on top (leaf-level deep merge). */\nexport function loadMergedConfig(vaultDir: string): MycoConfig {\n  const project = loadConfig(vaultDir);\n  const local = loadLocalConfig(vaultDir);\n  const merged = deepMergeConfig(project as Record<string, unknown>, local as Record<string, unknown>);\n  return MycoConfigSchema.parse(merged);\n}\n\n/**\n * Write local.yaml only when the serialized contents differ from `current`.\n * Skips the write (and mkdirSync) on a no-op to avoid noisy file mtimes.\n */\nfunction writeLocalYamlIfChanged<T>(vaultDir: string, current: T, next: T): T {\n  const existingYaml = YAML.stringify(current);\n  const nextYaml = YAML.stringify(next);\n  if (existingYaml === nextYaml) return next;\n\n  fs.mkdirSync(vaultDir, { recursive: true });\n  fs.writeFileSync(localConfigPath(vaultDir), nextYaml, 'utf-8');\n  return next;\n}\n\n/** Write a partial to <vaultDir>/local.yaml, deep-merging with existing local content. */\nexport function saveLocalConfig(vaultDir: string, patch: Partial<MycoConfig>): Partial<MycoConfig> {\n  const existing = loadLocalConfig(vaultDir);\n  const next = deepMergeConfig(existing as Record<string, unknown>, patch as Record<string, unknown>) as Partial<MycoConfig>;\n  return writeLocalYamlIfChanged(vaultDir, existing, next);\n}\n\n/**\n * Callback-style update for local config. Replace-semantics: the value\n * returned by `fn` is written verbatim (so callers can remove keys by\n * omitting them). Callers that want merge-semantics should spread\n * `...local` inside their callback, or use `saveLocalConfig` directly.\n */\nexport function updateLocalConfig(\n  vaultDir: string,\n  fn: (local: Partial<MycoConfig>) => Partial<MycoConfig>,\n): Partial<MycoConfig> {\n  const current = loadLocalConfig(vaultDir);\n  return writeLocalYamlIfChanged(vaultDir, current, fn(current));\n}\n","/**\n * Appearance enum values shared between the Zod schema (server) and the UI.\n *\n * This file MUST stay free of Node built-ins and other server-only imports\n * so it can be consumed by browser code without pulling in the full schema\n * dependency graph.\n */\n\nexport const APPEARANCE_THEMES = ['sage', 'moss', 'terracotta', 'dusk', 'plum', 'slate'] as const;\nexport const APPEARANCE_MODES = ['light', 'dark', 'system'] as const;\nexport const APPEARANCE_FONTS = ['default', 'geist-mono', 'system', 'sf-mono', 'fira-code', 'jetbrains-mono'] as const;\nexport const APPEARANCE_DENSITIES = ['compact', 'normal', 'comfy'] as const;\n\nexport type AppearanceTheme = typeof APPEARANCE_THEMES[number];\nexport type AppearanceMode = typeof APPEARANCE_MODES[number];\nexport type AppearanceFont = typeof APPEARANCE_FONTS[number];\nexport type AppearanceDensity = typeof APPEARANCE_DENSITIES[number];\n\nexport interface AppearanceValues {\n  theme: AppearanceTheme;\n  mode: AppearanceMode;\n  font: AppearanceFont;\n  density: AppearanceDensity;\n}\n","import { z } from 'zod';\nimport { SCHEDULABLE_POWER_STATES } from '@myco/constants.js';\nimport { ReasoningLevelSchema, RuntimeIdSchema } from '@myco/agent/schemas.js';\n\nconst EmbeddingProviderSchema = z.object({\n  provider: z.enum(['ollama', 'openai-compatible', 'openrouter', 'openai']).default('ollama'),\n  model: z.string().default('bge-m3'),\n  base_url: z.string().url().optional(),\n});\n\nconst DaemonSchema = z.object({\n  port: z.number().int().min(1024).max(65535).nullable().default(null),\n  log_level: z.enum(['debug', 'info', 'warn', 'error']).default('info'),\n  log_retention_days: z.number().int().min(1).max(365).default(30),\n  /**\n   * Time without new prompts before an active session is auto-completed (ms).\n   * Intelligence tasks (vault-evolve, skill-survey, etc.) only process\n   * settled sessions, so this threshold directly controls how fresh their\n   * inputs are. Defaults to 1 hour.\n   */\n  stale_session_threshold_ms: z.number().int().min(60_000).default(60 * 60 * 1000),\n});\n\nconst CaptureSchema = z.object({\n  transcript_paths: z.array(z.string()).default([]),\n  plan_dirs: z.array(z.string()).default([]),\n  ignore_plan_dirs_in_git: z.boolean().default(false),\n  artifact_extensions: z.array(z.string()).default(['.md']),\n  buffer_max_events: z.number().int().positive().default(500),\n});\n\n/** Provider config shape used in both task-level and phase-level overrides. */\nconst ProviderOverrideSchema = z.object({\n  runtime: RuntimeIdSchema.optional(),\n  type: z.enum(['anthropic', 'ollama', 'lmstudio', 'openai', 'openrouter', 'openai-compatible']),\n  local_backend: z.enum(['ollama', 'lmstudio']).optional(),\n  base_url: z.string().optional(),\n  model: z.string().optional(),\n  reasoning_map: z.object({\n    low: z.string().optional(),\n    default: z.string().optional(),\n    high: z.string().optional(),\n  }).optional(),\n  /** Context window size for local models (Ollama num_ctx, LM Studio context_length). */\n  context_length: z.number().int().positive().optional(),\n});\n\n/** Per-phase overrides within a task — keyed by phase name. */\nconst PhaseOverrideSchema = z.object({\n  provider: ProviderOverrideSchema.optional(),\n  model: z.string().optional(),\n  maxTurns: z.number().int().positive().optional(),\n});\n\n/** Per-task schedule override — partial, merges with YAML defaults. */\nconst ScheduleOverrideSchema = z.object({\n  enabled: z.boolean().optional(),\n  intervalSeconds: z.number().int().positive().optional(),\n  runIn: z.array(z.enum([...SCHEDULABLE_POWER_STATES])).optional(),\n  preCondition: z.enum(['has-unprocessed-batches', 'has-active-skills', 'has-approved-candidates', 'has-skill-survey-evidence']).optional(),\n}).optional();\n\n/** Per-task config override — stored in myco.yaml under agent.tasks. */\nconst TaskProviderOverrideSchema = z.object({\n  provider: ProviderOverrideSchema.optional(),\n  runtime: RuntimeIdSchema.optional(),\n  model: z.string().optional(),\n  maxTurns: z.number().int().positive().optional(),\n  timeoutSeconds: z.number().int().positive().optional(),\n  phases: z.record(z.string(), PhaseOverrideSchema).optional(),\n  schedule: ScheduleOverrideSchema,\n  /** Task-specific params — keys and types vary per task. */\n  params: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),\n});\n\n/**\n * Raw context shape inside zod preprocess — accepts the legacy\n * `operating_brief_enabled` key and rewrites it to `cortex_enabled`.\n * Loader emits a deprecation warning once per load (see `loader.ts`).\n */\nconst ContextSchema = z.preprocess((raw) => {\n  if (raw && typeof raw === 'object' && !Array.isArray(raw)) {\n    const input = raw as Record<string, unknown>;\n    if ('operating_brief_enabled' in input && !('cortex_enabled' in input)) {\n      const { operating_brief_enabled, ...rest } = input;\n      return { ...rest, cortex_enabled: operating_brief_enabled };\n    }\n  }\n  return raw;\n}, z.object({\n  /** Preferred digest tier when a user or agent explicitly requests Myco context. */\n  digest_tier: z.number().int().default(5000),\n  /** Append the preferred digest extract at session start after Cortex instructions. */\n  session_start_digest_enabled: z.boolean().default(false),\n  /** Master switch for Cortex session-start instruction injection. */\n  cortex_enabled: z.boolean().default(true),\n  /** Enable semantic spore search on each user prompt. */\n  prompt_search: z.boolean().default(true),\n  /** Max spores to inject per prompt (0-10). */\n  prompt_max_spores: z.number().int().min(0).max(10).default(3),\n}));\n\nconst AgentSchema = z.object({\n  /** Number of batches between event-driven summary triggers (0 to disable). */\n  summary_batch_interval: z.number().int().min(0).default(5),\n  /** Global toggle for PowerManager-scheduled agent tasks. */\n  scheduled_tasks_enabled: z.boolean().default(true),\n  /** Global toggle for event-driven agent tasks (title-summary, Cortex refresh). */\n  event_tasks_enabled: z.boolean().default(true),\n  /** Global default provider — applies to all tasks unless overridden per-task. */\n  provider: ProviderOverrideSchema.optional(),\n  /** Global default runtime — applies to all tasks unless overridden per-task. */\n  runtime: RuntimeIdSchema.optional(),\n  /** Global default model — applies to all tasks unless overridden per-task. */\n  model: z.string().optional(),\n  /** Per-task overrides keyed by task name. */\n  tasks: z.record(z.string(), TaskProviderOverrideSchema).optional(),\n});\n\nconst BackupSchema = z.object({\n  /** Override directory for backup files. Supports ~ for home directory. When unset, defaults to .myco/backups. */\n  dir: z.string().optional(),\n});\n\nconst MaintenanceSchema = z.object({\n  /** Automatically run PRAGMA optimize on a schedule. */\n  auto_optimize: z.boolean().default(true),\n  /** How often to run auto-optimize, in hours (1–720). */\n  auto_optimize_interval_hours: z.number().int().min(1).max(720).default(24),\n});\n\nconst TeamSchema = z.object({\n  /** Whether team sync is enabled. */\n  enabled: z.boolean().default(false),\n  /** Cloudflare Worker URL for team sync. */\n  worker_url: z.string().url().optional(),\n  /** Team identifier for sync grouping. */\n  team_id: z.string().optional(),\n  /** Sync interval in minutes. */\n  interval_minutes: z.number().int().min(1).max(1440).default(15),\n});\n\nconst SkillsSchema = z.object({\n  /** Auto-generate candidates above this confidence score. */\n  confidence_threshold: z.number().min(0).max(1).default(0.7),\n  /** Flag unused skills after this many days. */\n  usage_stale_days: z.number().int().positive().default(30),\n});\n\nconst NotificationsSchema = z.object({\n  /** Master switch — disables all notifications when false. */\n  enabled: z.boolean().default(true),\n  /** Allow browser system notifications (Notification API). */\n  system_notifications: z.boolean().default(false),\n  /** Default display mode for new notification types. */\n  default_mode: z.enum(['banner', 'summary']).default('summary'),\n  /** Per-domain settings. Keys are domain names from the registry. */\n  domains: z.record(z.string(), z.object({\n    enabled: z.boolean().default(true),\n    /** Override display mode for this domain. Omit to use global default_mode. */\n    mode: z.enum(['banner', 'summary']).optional(),\n  })).default({}),\n});\n\nconst SymbiontEntrySchema = z.object({\n  enabled: z.boolean().default(true),\n});\n\nexport {\n  APPEARANCE_THEMES,\n  APPEARANCE_MODES,\n  APPEARANCE_FONTS,\n  APPEARANCE_DENSITIES,\n  type AppearanceValues,\n} from './appearance-values.js';\n\nimport {\n  APPEARANCE_THEMES,\n  APPEARANCE_MODES,\n  APPEARANCE_FONTS,\n  APPEARANCE_DENSITIES,\n} from './appearance-values.js';\n\nexport const AppearanceConfigSchema = z.object({\n  theme: z.enum(APPEARANCE_THEMES).default('sage'),\n  mode: z.enum(APPEARANCE_MODES).default('dark'),\n  font: z.enum(APPEARANCE_FONTS).default('default'),\n  density: z.enum(APPEARANCE_DENSITIES).default('normal'),\n}).default({ theme: 'sage', mode: 'dark', font: 'default', density: 'normal' });\n\nexport type AppearanceConfig = z.infer<typeof AppearanceConfigSchema>;\n\nexport const MycoConfigSchema = z.preprocess(\n  (raw: unknown) => {\n    if (raw && typeof raw === 'object' && 'curation' in raw && !('agent' in raw)) {\n      const { curation, ...rest } = raw as Record<string, unknown>;\n      return { ...rest, agent: curation };\n    }\n    return raw;\n  },\n  z.object({\n    version: z.literal(3),\n    config_version: z.number().int().nonnegative().default(0),\n    embedding: EmbeddingProviderSchema.default(() => EmbeddingProviderSchema.parse({})),\n    daemon: DaemonSchema.default(() => DaemonSchema.parse({})),\n    capture: CaptureSchema.default(() => CaptureSchema.parse({})),\n    agent: AgentSchema.default(() => AgentSchema.parse({})),\n    context: ContextSchema.default(() => ContextSchema.parse({})),\n    backup: BackupSchema.default(() => BackupSchema.parse({})),\n    maintenance: MaintenanceSchema.default(() => MaintenanceSchema.parse({})),\n    team: TeamSchema.default(() => TeamSchema.parse({})),\n    skills: SkillsSchema.default(() => SkillsSchema.parse({})),\n    notifications: NotificationsSchema.default(() => NotificationsSchema.parse({})),\n    appearance: AppearanceConfigSchema,\n    symbionts: z.record(z.string(), SymbiontEntrySchema).optional(),\n  }),\n);\n\nexport type MycoConfig = z.output<typeof MycoConfigSchema>;\nexport type EmbeddingProviderConfig = z.infer<typeof EmbeddingProviderSchema>;\nexport type TaskProviderOverride = z.infer<typeof TaskProviderOverrideSchema>;\nexport type PhaseOverride = z.infer<typeof PhaseOverrideSchema>;\nexport type ScheduleOverride = z.infer<typeof ScheduleOverrideSchema>;\nexport type ContextConfig = z.infer<typeof ContextSchema>;\nexport type BackupConfig = z.infer<typeof BackupSchema>;\nexport type TeamConfig = z.infer<typeof TeamSchema>;\nexport type SkillsConfig = z.infer<typeof SkillsSchema>;\nexport type NotificationsConfig = z.infer<typeof NotificationsSchema>;\nexport type SymbiontEntry = z.infer<typeof SymbiontEntrySchema>;\n","/**\n * Config and vault migrations — run once per version, tracked by config_version.\n *\n * Each migration has a version number, a name, and a function that receives\n * the raw parsed YAML doc and the vault directory. Migrations run in order\n * and are skipped if config_version is already past them.\n *\n * To add a new migration:\n * 1. Add an entry to MIGRATIONS with the next version number\n * 2. Write the migrate function — it receives the mutable doc and vaultDir\n * 3. The framework handles version tracking and writing the config back\n */\n\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nexport interface Migration {\n  version: number;\n  name: string;\n  migrate: (doc: Record<string, unknown>, vaultDir: string) => void;\n}\n\n/** Regex matching both quoted and unquoted YAML: type: memory, type: \"memory\", type: 'memory' */\nconst MEMORY_TYPE_PATTERN = /type:\\s*[\"']?memory[\"']?/g;\n\nexport const MIGRATIONS: Migration[] = [\n  {\n    version: 1,\n    name: 'rename-memories-to-spores',\n    migrate: (doc, vaultDir) => {\n      // Config: rename context.layers.memories → context.layers.spores\n      const context = doc.context as Record<string, unknown> | undefined;\n      const layers = context?.layers as Record<string, unknown> | undefined;\n      if (layers && 'memories' in layers && !('spores' in layers)) {\n        layers.spores = layers.memories;\n        delete layers.memories;\n      }\n\n      // Vault: rename memories/ directory → spores/\n      const memoriesDir = path.join(vaultDir, 'memories');\n      const sporesDir = path.join(vaultDir, 'spores');\n\n      if (!fs.existsSync(memoriesDir)) return;\n\n      if (fs.existsSync(sporesDir)) {\n        // Both exist (interrupted migration) — merge remaining files\n        const moveRemaining = (srcDir: string, destDir: string): void => {\n          for (const entry of fs.readdirSync(srcDir, { withFileTypes: true })) {\n            const srcPath = path.join(srcDir, entry.name);\n            const destPath = path.join(destDir, entry.name);\n            if (entry.isDirectory()) {\n              if (!fs.existsSync(destPath)) fs.mkdirSync(destPath, { recursive: true });\n              moveRemaining(srcPath, destPath);\n            } else if (!fs.existsSync(destPath)) {\n              fs.renameSync(srcPath, destPath);\n            }\n          }\n        };\n        moveRemaining(memoriesDir, sporesDir);\n        fs.rmSync(memoriesDir, { recursive: true, force: true });\n      } else {\n        fs.renameSync(memoriesDir, sporesDir);\n      }\n\n      // Update frontmatter type: memory → type: spore (handles quoted and unquoted)\n      const walkUpdate = (dir: string): void => {\n        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n          const fullPath = path.join(dir, entry.name);\n          if (entry.isDirectory()) { walkUpdate(fullPath); continue; }\n          if (!entry.name.endsWith('.md')) continue;\n          const content = fs.readFileSync(fullPath, 'utf-8');\n          MEMORY_TYPE_PATTERN.lastIndex = 0;\n          if (MEMORY_TYPE_PATTERN.test(content)) {\n            MEMORY_TYPE_PATTERN.lastIndex = 0;\n            fs.writeFileSync(fullPath, content.replace(MEMORY_TYPE_PATTERN, 'type: spore'));\n          }\n        }\n      };\n      walkUpdate(sporesDir);\n\n      // Legacy: update wikilink references in Markdown files (pre-SQLite migration): [[memories/...]] → [[spores/...]]\n      const walkLinks = (dir: string): void => {\n        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n          const fullPath = path.join(dir, entry.name);\n          if (entry.isDirectory()) { walkLinks(fullPath); continue; }\n          if (!entry.name.endsWith('.md')) continue;\n          const content = fs.readFileSync(fullPath, 'utf-8');\n          if (content.includes('memories/')) {\n            fs.writeFileSync(fullPath, content.replace(/memories\\//g, 'spores/'));\n          }\n        }\n      };\n      walkLinks(vaultDir);\n    },\n  },\n  {\n    version: 2,\n    name: 'consolidation-boolean-to-object',\n    migrate: (doc) => {\n      const digest = doc.digest as Record<string, unknown> | undefined;\n      if (!digest) return;\n\n      const consolidation = digest.consolidation;\n      if (typeof consolidation === 'boolean') {\n        digest.consolidation = { enabled: consolidation, max_tokens: 2048 };\n      }\n    },\n  },\n  {\n    version: 3,\n    name: 'schedule-to-task-level',\n    migrate(doc: Record<string, unknown>, _vaultDir: string): void {\n      const agent = (doc.agent ?? {}) as Record<string, unknown>;\n      const skills = (doc.skills ?? {}) as Record<string, unknown>;\n      const tasks = ((agent.tasks ?? {}) as Record<string, Record<string, unknown>>);\n\n      /** Default interval for full-intelligence task (5 minutes). */\n      const DEFAULT_INTELLIGENCE_INTERVAL_SECONDS = 300;\n\n      const VALID_SCHEDULE_STATES = ['active', 'idle', 'sleep'] as const;\n\n      // Migrate agent.auto_run + interval_seconds → full-intelligence schedule\n      if ('auto_run' in agent || 'interval_seconds' in agent) {\n        const fiTask = tasks['full-intelligence'] ?? {};\n        fiTask.schedule = {\n          enabled: agent.auto_run ?? true,\n          intervalSeconds: agent.interval_seconds ?? DEFAULT_INTELLIGENCE_INTERVAL_SECONDS,\n        };\n        tasks['full-intelligence'] = fiTask;\n        delete agent.auto_run;\n        delete agent.interval_seconds;\n      }\n\n      // Migrate skills.auto_survey → skill-survey schedule\n      if ('auto_survey' in skills) {\n        const ssTask = tasks['skill-survey'] ?? {};\n        ssTask.schedule = {\n          enabled: skills.auto_survey ?? false,\n        };\n        tasks['skill-survey'] = ssTask;\n        delete skills.auto_survey;\n      }\n\n      // Migrate skills.auto_evolve + evolve_cadence → skill-evolve schedule\n      if ('auto_evolve' in skills || 'evolve_cadence' in skills) {\n        const seTask = tasks['skill-evolve'] ?? {};\n        const schedule: Record<string, unknown> = {\n          enabled: skills.auto_evolve ?? false,\n        };\n        if ('evolve_cadence' in skills) {\n          const cadence = String(skills.evolve_cadence);\n          schedule.runIn = VALID_SCHEDULE_STATES.includes(cadence as typeof VALID_SCHEDULE_STATES[number])\n            ? [cadence]\n            : ['idle']; // fallback to safe default\n        }\n        seTask.schedule = schedule;\n        tasks['skill-evolve'] = seTask;\n        delete skills.auto_evolve;\n        delete skills.evolve_cadence;\n      }\n\n      // Write back tasks if any were created\n      if (Object.keys(tasks).length > 0) {\n        agent.tasks = tasks;\n      }\n      doc.agent = agent;\n      doc.skills = skills;\n    },\n  },\n  {\n    version: 4,\n    name: 'rename-cloud-provider-to-anthropic',\n    migrate(doc: Record<string, unknown>, _vaultDir: string): void {\n      // Rename `provider.type: cloud` -> `provider.type: anthropic` everywhere\n      // it appears in the agent config: global default, per-task, per-phase.\n      const renameProvider = (provider: unknown): void => {\n        if (\n          provider &&\n          typeof provider === 'object' &&\n          (provider as Record<string, unknown>).type === 'cloud'\n        ) {\n          (provider as Record<string, unknown>).type = 'anthropic';\n        }\n      };\n\n      const agent = doc.agent as Record<string, unknown> | undefined;\n      if (!agent) return;\n\n      // Global default provider\n      renameProvider(agent.provider);\n\n      // Per-task overrides\n      const tasks = agent.tasks as Record<string, Record<string, unknown>> | undefined;\n      if (tasks) {\n        for (const taskConfig of Object.values(tasks)) {\n          renameProvider(taskConfig.provider);\n\n          // Per-phase overrides within a task\n          const phases = taskConfig.phases as Record<string, Record<string, unknown>> | undefined;\n          if (phases) {\n            for (const phaseConfig of Object.values(phases)) {\n              renameProvider(phaseConfig.provider);\n            }\n          }\n        }\n      }\n    },\n  },\n  {\n    version: 5,\n    name: 'seed-settings-notification-domain-default',\n    migrate(doc: Record<string, unknown>, _vaultDir: string): void {\n      const notifications = (doc.notifications ??= {}) as Record<string, unknown>;\n      const domains = (notifications.domains ??= {}) as Record<string, unknown>;\n      const settings = (domains.settings ??= {}) as Record<string, unknown>;\n\n      if (!('enabled' in settings)) settings.enabled = true;\n      if (!('mode' in settings)) settings.mode = 'banner';\n    },\n  },\n  {\n    version: 6,\n    name: 'rename-full-intelligence-to-vault-evolve',\n    migrate(doc: Record<string, unknown>, _vaultDir: string): void {\n      // The built-in task `full-intelligence` was renamed to `vault-evolve`.\n      // Move any user overrides stored under the old task key so their\n      // schedule, model, and phase settings keep applying.\n      const agent = doc.agent as Record<string, unknown> | undefined;\n      if (!agent) return;\n      const tasks = agent.tasks as Record<string, unknown> | undefined;\n      if (!tasks || !('full-intelligence' in tasks)) return;\n\n      const legacy = tasks['full-intelligence'];\n      const existing = tasks['vault-evolve'];\n\n      // If a user somehow has both (e.g., hand-edited config), keep the\n      // newer key and drop the legacy one rather than clobbering.\n      if (!existing) {\n        tasks['vault-evolve'] = legacy;\n      }\n      delete tasks['full-intelligence'];\n    },\n  },\n];\n\n/** Current migration version — the highest version in MIGRATIONS. */\nexport const CURRENT_MIGRATION_VERSION = MIGRATIONS[MIGRATIONS.length - 1]?.version ?? 0;\n\n/**\n * Run all pending migrations on the raw config doc.\n * Returns true if any migrations ran (caller should reindex).\n */\nexport function runMigrations(\n  doc: Record<string, unknown>,\n  vaultDir: string,\n  log?: (message: string) => void,\n): boolean {\n  const currentVersion = (doc.config_version as number) ?? 0;\n  let ran = false;\n\n  for (const migration of MIGRATIONS) {\n    if (migration.version <= currentVersion) continue;\n\n    migration.migrate(doc, vaultDir);\n    doc.config_version = migration.version;\n    ran = true;\n  }\n\n  if (ran) {\n    const from = currentVersion;\n    const to = (doc.config_version as number) ?? 0;\n    log?.(`Migrated config from v${from} to v${to}`);\n  }\n\n  return ran;\n}\n","export interface DeepMergeOptions {\n  /** How to reconcile arrays found at the same key in both target and source. */\n  arrayStrategy: 'replace' | 'union';\n}\n\nexport function isPlainObject(val: unknown): val is Record<string, unknown> {\n  return typeof val === 'object' && val !== null && !Array.isArray(val);\n}\n\n/**\n * Deep-merge source into target at the leaf.\n *\n * - `arrayStrategy: 'replace'` — arrays in source overwrite arrays in target (config overlay semantics).\n * - `arrayStrategy: 'union'` — arrays are concatenated and deduplicated (symbiont settings merge semantics).\n *\n * Non-object, non-array leaves: source overwrites target.\n * `undefined` values in source are skipped (target value preserved).\n */\nexport function deepMerge<T extends Record<string, unknown>>(\n  target: T,\n  source: Partial<T>,\n  options: DeepMergeOptions,\n): T {\n  const result: Record<string, unknown> = { ...target };\n  for (const [key, value] of Object.entries(source)) {\n    if (value === undefined) continue;\n    const existing = result[key];\n    if (Array.isArray(value) && Array.isArray(existing)) {\n      result[key] = options.arrayStrategy === 'union'\n        ? [...new Set([...existing, ...value])]\n        : value;\n    } else if (isPlainObject(value) && isPlainObject(existing)) {\n      result[key] = deepMerge(\n        existing,\n        value,\n        options,\n      );\n    } else {\n      result[key] = value;\n    }\n  }\n  return result as T;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAEA,kBAAiB;AAFjB,OAAOA,SAAQ;AACf,OAAOC,WAAU;;;ACOV,IAAM,oBAAoB,CAAC,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,OAAO;AAChF,IAAM,mBAAmB,CAAC,SAAS,QAAQ,QAAQ;AACnD,IAAM,mBAAmB,CAAC,WAAW,cAAc,UAAU,WAAW,aAAa,gBAAgB;AACrG,IAAM,uBAAuB,CAAC,WAAW,UAAU,OAAO;;;ACPjE,IAAM,0BAA0B,iBAAE,OAAO;AAAA,EACvC,UAAU,iBAAE,KAAK,CAAC,UAAU,qBAAqB,cAAc,QAAQ,CAAC,EAAE,QAAQ,QAAQ;AAAA,EAC1F,OAAO,iBAAE,OAAO,EAAE,QAAQ,QAAQ;AAAA,EAClC,UAAU,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACtC,CAAC;AAED,IAAM,eAAe,iBAAE,OAAO;AAAA,EAC5B,MAAM,iBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnE,WAAW,iBAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,CAAC,EAAE,QAAQ,MAAM;AAAA,EACpE,oBAAoB,iBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO/D,4BAA4B,iBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAM,EAAE,QAAQ,KAAK,KAAK,GAAI;AACjF,CAAC;AAED,IAAM,gBAAgB,iBAAE,OAAO;AAAA,EAC7B,kBAAkB,iBAAE,MAAM,iBAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,WAAW,iBAAE,MAAM,iBAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EACzC,yBAAyB,iBAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClD,qBAAqB,iBAAE,MAAM,iBAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;AAAA,EACxD,mBAAmB,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAG;AAC5D,CAAC;AAGD,IAAM,yBAAyB,iBAAE,OAAO;AAAA,EACtC,SAAS,gBAAgB,SAAS;AAAA,EAClC,MAAM,iBAAE,KAAK,CAAC,aAAa,UAAU,YAAY,UAAU,cAAc,mBAAmB,CAAC;AAAA,EAC7F,eAAe,iBAAE,KAAK,CAAC,UAAU,UAAU,CAAC,EAAE,SAAS;AAAA,EACvD,UAAU,iBAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,iBAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,eAAe,iBAAE,OAAO;AAAA,IACtB,KAAK,iBAAE,OAAO,EAAE,SAAS;AAAA,IACzB,SAAS,iBAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,MAAM,iBAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,EAAE,SAAS;AAAA;AAAA,EAEZ,gBAAgB,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AACvD,CAAC;AAGD,IAAM,sBAAsB,iBAAE,OAAO;AAAA,EACnC,UAAU,uBAAuB,SAAS;AAAA,EAC1C,OAAO,iBAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AACjD,CAAC;AAGD,IAAM,yBAAyB,iBAAE,OAAO;AAAA,EACtC,SAAS,iBAAE,QAAQ,EAAE,SAAS;AAAA,EAC9B,iBAAiB,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,OAAO,iBAAE,MAAM,iBAAE,KAAK,CAAC,GAAG,wBAAwB,CAAC,CAAC,EAAE,SAAS;AAAA,EAC/D,cAAc,iBAAE,KAAK,CAAC,2BAA2B,qBAAqB,2BAA2B,2BAA2B,CAAC,EAAE,SAAS;AAC1I,CAAC,EAAE,SAAS;AAGZ,IAAM,6BAA6B,iBAAE,OAAO;AAAA,EAC1C,UAAU,uBAAuB,SAAS;AAAA,EAC1C,SAAS,gBAAgB,SAAS;AAAA,EAClC,OAAO,iBAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,gBAAgB,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,QAAQ,iBAAE,OAAO,iBAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,EAC3D,UAAU;AAAA;AAAA,EAEV,QAAQ,iBAAE,OAAO,iBAAE,OAAO,GAAG,iBAAE,MAAM,CAAC,iBAAE,OAAO,GAAG,iBAAE,OAAO,GAAG,iBAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS;AACxF,CAAC;AAOD,IAAM,gBAAgB,iBAAE,WAAW,CAAC,QAAQ;AAC1C,MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,GAAG;AACzD,UAAM,QAAQ;AACd,QAAI,6BAA6B,SAAS,EAAE,oBAAoB,QAAQ;AACtE,YAAM,EAAE,yBAAyB,GAAG,KAAK,IAAI;AAC7C,aAAO,EAAE,GAAG,MAAM,gBAAgB,wBAAwB;AAAA,IAC5D;AAAA,EACF;AACA,SAAO;AACT,GAAG,iBAAE,OAAO;AAAA;AAAA,EAEV,aAAa,iBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAI;AAAA;AAAA,EAE1C,8BAA8B,iBAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAEvD,gBAAgB,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAExC,eAAe,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEvC,mBAAmB,iBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;AAC9D,CAAC,CAAC;AAEF,IAAM,cAAc,iBAAE,OAAO;AAAA;AAAA,EAE3B,wBAAwB,iBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA;AAAA,EAEzD,yBAAyB,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjD,qBAAqB,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAE7C,UAAU,uBAAuB,SAAS;AAAA;AAAA,EAE1C,SAAS,gBAAgB,SAAS;AAAA;AAAA,EAElC,OAAO,iBAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE3B,OAAO,iBAAE,OAAO,iBAAE,OAAO,GAAG,0BAA0B,EAAE,SAAS;AACnE,CAAC;AAED,IAAM,eAAe,iBAAE,OAAO;AAAA;AAAA,EAE5B,KAAK,iBAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAED,IAAM,oBAAoB,iBAAE,OAAO;AAAA;AAAA,EAEjC,eAAe,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEvC,8BAA8B,iBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3E,CAAC;AAED,IAAM,aAAa,iBAAE,OAAO;AAAA;AAAA,EAE1B,SAAS,iBAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAElC,YAAY,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA;AAAA,EAEtC,SAAS,iBAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE7B,kBAAkB,iBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE;AAChE,CAAC;AAED,IAAM,eAAe,iBAAE,OAAO;AAAA;AAAA,EAE5B,sBAAsB,iBAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,GAAG;AAAA;AAAA,EAE1D,kBAAkB,iBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE;AAC1D,CAAC;AAED,IAAM,sBAAsB,iBAAE,OAAO;AAAA;AAAA,EAEnC,SAAS,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEjC,sBAAsB,iBAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,EAE/C,cAAc,iBAAE,KAAK,CAAC,UAAU,SAAS,CAAC,EAAE,QAAQ,SAAS;AAAA;AAAA,EAE7D,SAAS,iBAAE,OAAO,iBAAE,OAAO,GAAG,iBAAE,OAAO;AAAA,IACrC,SAAS,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,IAEjC,MAAM,iBAAE,KAAK,CAAC,UAAU,SAAS,CAAC,EAAE,SAAS;AAAA,EAC/C,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAChB,CAAC;AAED,IAAM,sBAAsB,iBAAE,OAAO;AAAA,EACnC,SAAS,iBAAE,QAAQ,EAAE,QAAQ,IAAI;AACnC,CAAC;AAiBM,IAAM,yBAAyB,iBAAE,OAAO;AAAA,EAC7C,OAAO,iBAAE,KAAK,iBAAiB,EAAE,QAAQ,MAAM;AAAA,EAC/C,MAAM,iBAAE,KAAK,gBAAgB,EAAE,QAAQ,MAAM;AAAA,EAC7C,MAAM,iBAAE,KAAK,gBAAgB,EAAE,QAAQ,SAAS;AAAA,EAChD,SAAS,iBAAE,KAAK,oBAAoB,EAAE,QAAQ,QAAQ;AACxD,CAAC,EAAE,QAAQ,EAAE,OAAO,QAAQ,MAAM,QAAQ,MAAM,WAAW,SAAS,SAAS,CAAC;AAIvE,IAAM,mBAAmB,iBAAE;AAAA,EAChC,CAAC,QAAiB;AAChB,QAAI,OAAO,OAAO,QAAQ,YAAY,cAAc,OAAO,EAAE,WAAW,MAAM;AAC5E,YAAM,EAAE,UAAU,GAAG,KAAK,IAAI;AAC9B,aAAO,EAAE,GAAG,MAAM,OAAO,SAAS;AAAA,IACpC;AACA,WAAO;AAAA,EACT;AAAA,EACA,iBAAE,OAAO;AAAA,IACP,SAAS,iBAAE,QAAQ,CAAC;AAAA,IACpB,gBAAgB,iBAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA,IACxD,WAAW,wBAAwB,QAAQ,MAAM,wBAAwB,MAAM,CAAC,CAAC,CAAC;AAAA,IAClF,QAAQ,aAAa,QAAQ,MAAM,aAAa,MAAM,CAAC,CAAC,CAAC;AAAA,IACzD,SAAS,cAAc,QAAQ,MAAM,cAAc,MAAM,CAAC,CAAC,CAAC;AAAA,IAC5D,OAAO,YAAY,QAAQ,MAAM,YAAY,MAAM,CAAC,CAAC,CAAC;AAAA,IACtD,SAAS,cAAc,QAAQ,MAAM,cAAc,MAAM,CAAC,CAAC,CAAC;AAAA,IAC5D,QAAQ,aAAa,QAAQ,MAAM,aAAa,MAAM,CAAC,CAAC,CAAC;AAAA,IACzD,aAAa,kBAAkB,QAAQ,MAAM,kBAAkB,MAAM,CAAC,CAAC,CAAC;AAAA,IACxE,MAAM,WAAW,QAAQ,MAAM,WAAW,MAAM,CAAC,CAAC,CAAC;AAAA,IACnD,QAAQ,aAAa,QAAQ,MAAM,aAAa,MAAM,CAAC,CAAC,CAAC;AAAA,IACzD,eAAe,oBAAoB,QAAQ,MAAM,oBAAoB,MAAM,CAAC,CAAC,CAAC;AAAA,IAC9E,YAAY;AAAA,IACZ,WAAW,iBAAE,OAAO,iBAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,EAChE,CAAC;AACH;;;AC3MA,OAAO,QAAQ;AACf,OAAO,UAAU;AASjB,IAAM,sBAAsB;AAErB,IAAM,aAA0B;AAAA,EACrC;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS,CAAC,KAAK,aAAa;AAE1B,YAAM,UAAU,IAAI;AACpB,YAAM,SAAS,SAAS;AACxB,UAAI,UAAU,cAAc,UAAU,EAAE,YAAY,SAAS;AAC3D,eAAO,SAAS,OAAO;AACvB,eAAO,OAAO;AAAA,MAChB;AAGA,YAAM,cAAc,KAAK,KAAK,UAAU,UAAU;AAClD,YAAM,YAAY,KAAK,KAAK,UAAU,QAAQ;AAE9C,UAAI,CAAC,GAAG,WAAW,WAAW,EAAG;AAEjC,UAAI,GAAG,WAAW,SAAS,GAAG;AAE5B,cAAM,gBAAgB,CAAC,QAAgB,YAA0B;AAC/D,qBAAW,SAAS,GAAG,YAAY,QAAQ,EAAE,eAAe,KAAK,CAAC,GAAG;AACnE,kBAAM,UAAU,KAAK,KAAK,QAAQ,MAAM,IAAI;AAC5C,kBAAM,WAAW,KAAK,KAAK,SAAS,MAAM,IAAI;AAC9C,gBAAI,MAAM,YAAY,GAAG;AACvB,kBAAI,CAAC,GAAG,WAAW,QAAQ,EAAG,IAAG,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AACxE,4BAAc,SAAS,QAAQ;AAAA,YACjC,WAAW,CAAC,GAAG,WAAW,QAAQ,GAAG;AACnC,iBAAG,WAAW,SAAS,QAAQ;AAAA,YACjC;AAAA,UACF;AAAA,QACF;AACA,sBAAc,aAAa,SAAS;AACpC,WAAG,OAAO,aAAa,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACzD,OAAO;AACL,WAAG,WAAW,aAAa,SAAS;AAAA,MACtC;AAGA,YAAM,aAAa,CAAC,QAAsB;AACxC,mBAAW,SAAS,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;AAChE,gBAAM,WAAW,KAAK,KAAK,KAAK,MAAM,IAAI;AAC1C,cAAI,MAAM,YAAY,GAAG;AAAE,uBAAW,QAAQ;AAAG;AAAA,UAAU;AAC3D,cAAI,CAAC,MAAM,KAAK,SAAS,KAAK,EAAG;AACjC,gBAAM,UAAU,GAAG,aAAa,UAAU,OAAO;AACjD,8BAAoB,YAAY;AAChC,cAAI,oBAAoB,KAAK,OAAO,GAAG;AACrC,gCAAoB,YAAY;AAChC,eAAG,cAAc,UAAU,QAAQ,QAAQ,qBAAqB,aAAa,CAAC;AAAA,UAChF;AAAA,QACF;AAAA,MACF;AACA,iBAAW,SAAS;AAGpB,YAAM,YAAY,CAAC,QAAsB;AACvC,mBAAW,SAAS,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;AAChE,gBAAM,WAAW,KAAK,KAAK,KAAK,MAAM,IAAI;AAC1C,cAAI,MAAM,YAAY,GAAG;AAAE,sBAAU,QAAQ;AAAG;AAAA,UAAU;AAC1D,cAAI,CAAC,MAAM,KAAK,SAAS,KAAK,EAAG;AACjC,gBAAM,UAAU,GAAG,aAAa,UAAU,OAAO;AACjD,cAAI,QAAQ,SAAS,WAAW,GAAG;AACjC,eAAG,cAAc,UAAU,QAAQ,QAAQ,eAAe,SAAS,CAAC;AAAA,UACtE;AAAA,QACF;AAAA,MACF;AACA,gBAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,SAAS,CAAC,QAAQ;AAChB,YAAM,SAAS,IAAI;AACnB,UAAI,CAAC,OAAQ;AAEb,YAAM,gBAAgB,OAAO;AAC7B,UAAI,OAAO,kBAAkB,WAAW;AACtC,eAAO,gBAAgB,EAAE,SAAS,eAAe,YAAY,KAAK;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,QAAQ,KAA8B,WAAyB;AAC7D,YAAM,QAAS,IAAI,SAAS,CAAC;AAC7B,YAAM,SAAU,IAAI,UAAU,CAAC;AAC/B,YAAM,QAAU,MAAM,SAAS,CAAC;AAGhC,YAAM,wCAAwC;AAE9C,YAAM,wBAAwB,CAAC,UAAU,QAAQ,OAAO;AAGxD,UAAI,cAAc,SAAS,sBAAsB,OAAO;AACtD,cAAM,SAAS,MAAM,mBAAmB,KAAK,CAAC;AAC9C,eAAO,WAAW;AAAA,UAChB,SAAS,MAAM,YAAY;AAAA,UAC3B,iBAAiB,MAAM,oBAAoB;AAAA,QAC7C;AACA,cAAM,mBAAmB,IAAI;AAC7B,eAAO,MAAM;AACb,eAAO,MAAM;AAAA,MACf;AAGA,UAAI,iBAAiB,QAAQ;AAC3B,cAAM,SAAS,MAAM,cAAc,KAAK,CAAC;AACzC,eAAO,WAAW;AAAA,UAChB,SAAS,OAAO,eAAe;AAAA,QACjC;AACA,cAAM,cAAc,IAAI;AACxB,eAAO,OAAO;AAAA,MAChB;AAGA,UAAI,iBAAiB,UAAU,oBAAoB,QAAQ;AACzD,cAAM,SAAS,MAAM,cAAc,KAAK,CAAC;AACzC,cAAM,WAAoC;AAAA,UACxC,SAAS,OAAO,eAAe;AAAA,QACjC;AACA,YAAI,oBAAoB,QAAQ;AAC9B,gBAAM,UAAU,OAAO,OAAO,cAAc;AAC5C,mBAAS,QAAQ,sBAAsB,SAAS,OAA+C,IAC3F,CAAC,OAAO,IACR,CAAC,MAAM;AAAA,QACb;AACA,eAAO,WAAW;AAClB,cAAM,cAAc,IAAI;AACxB,eAAO,OAAO;AACd,eAAO,OAAO;AAAA,MAChB;AAGA,UAAI,OAAO,KAAK,KAAK,EAAE,SAAS,GAAG;AACjC,cAAM,QAAQ;AAAA,MAChB;AACA,UAAI,QAAQ;AACZ,UAAI,SAAS;AAAA,IACf;AAAA,EACF;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,QAAQ,KAA8B,WAAyB;AAG7D,YAAM,iBAAiB,CAAC,aAA4B;AAClD,YACE,YACA,OAAO,aAAa,YACnB,SAAqC,SAAS,SAC/C;AACA,UAAC,SAAqC,OAAO;AAAA,QAC/C;AAAA,MACF;AAEA,YAAM,QAAQ,IAAI;AAClB,UAAI,CAAC,MAAO;AAGZ,qBAAe,MAAM,QAAQ;AAG7B,YAAM,QAAQ,MAAM;AACpB,UAAI,OAAO;AACT,mBAAW,cAAc,OAAO,OAAO,KAAK,GAAG;AAC7C,yBAAe,WAAW,QAAQ;AAGlC,gBAAM,SAAS,WAAW;AAC1B,cAAI,QAAQ;AACV,uBAAW,eAAe,OAAO,OAAO,MAAM,GAAG;AAC/C,6BAAe,YAAY,QAAQ;AAAA,YACrC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,QAAQ,KAA8B,WAAyB;AAC7D,YAAM,gBAAiB,IAAI,kBAAkB,CAAC;AAC9C,YAAM,UAAW,cAAc,YAAY,CAAC;AAC5C,YAAM,WAAY,QAAQ,aAAa,CAAC;AAExC,UAAI,EAAE,aAAa,UAAW,UAAS,UAAU;AACjD,UAAI,EAAE,UAAU,UAAW,UAAS,OAAO;AAAA,IAC7C;AAAA,EACF;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,MAAM;AAAA,IACN,QAAQ,KAA8B,WAAyB;AAI7D,YAAM,QAAQ,IAAI;AAClB,UAAI,CAAC,MAAO;AACZ,YAAM,QAAQ,MAAM;AACpB,UAAI,CAAC,SAAS,EAAE,uBAAuB,OAAQ;AAE/C,YAAM,SAAS,MAAM,mBAAmB;AACxC,YAAM,WAAW,MAAM,cAAc;AAIrC,UAAI,CAAC,UAAU;AACb,cAAM,cAAc,IAAI;AAAA,MAC1B;AACA,aAAO,MAAM,mBAAmB;AAAA,IAClC;AAAA,EACF;AACF;AAGO,IAAM,4BAA4B,WAAW,WAAW,SAAS,CAAC,GAAG,WAAW;AAMhF,SAAS,cACd,KACA,UACA,KACS;AACT,QAAM,iBAAkB,IAAI,kBAA6B;AACzD,MAAI,MAAM;AAEV,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,WAAW,eAAgB;AAEzC,cAAU,QAAQ,KAAK,QAAQ;AAC/B,QAAI,iBAAiB,UAAU;AAC/B,UAAM;AAAA,EACR;AAEA,MAAI,KAAK;AACP,UAAM,OAAO;AACb,UAAM,KAAM,IAAI,kBAA6B;AAC7C,UAAM,yBAAyB,IAAI,QAAQ,EAAE,EAAE;AAAA,EACjD;AAEA,SAAO;AACT;;;AC9QO,SAAS,cAAc,KAA8C;AAC1E,SAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,CAAC,MAAM,QAAQ,GAAG;AACtE;AAWO,SAAS,UACd,QACA,QACA,SACG;AACH,QAAM,SAAkC,EAAE,GAAG,OAAO;AACpD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,UAAU,OAAW;AACzB,UAAM,WAAW,OAAO,GAAG;AAC3B,QAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,QAAQ,QAAQ,GAAG;AACnD,aAAO,GAAG,IAAI,QAAQ,kBAAkB,UACpC,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,IACpC;AAAA,IACN,WAAW,cAAc,KAAK,KAAK,cAAc,QAAQ,GAAG;AAC1D,aAAO,GAAG,IAAI;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;;;AJnCO,IAAM,kBAAkB;AACxB,IAAM,wBAAwB;AAErC,SAAS,gBAAgB,UAA0B;AAGjD,SAAOC,MAAK,KAAK,UAAU,qBAAqB;AAClD;AAGO,SAAS,gBAAmD,QAAW,QAAuB;AACnG,SAAO,UAAU,QAAQ,QAAQ,EAAE,eAAe,UAAU,CAAC;AAC/D;AAEO,SAAS,WAAW,UAA8B;AACvD,QAAM,aAAaA,MAAK,KAAK,UAAU,eAAe;AAEtD,MAAI,CAACC,IAAG,WAAW,UAAU,GAAG;AAC9B,UAAM,IAAI,MAAM,0BAA0B,QAAQ,EAAE;AAAA,EACtD;AAEA,QAAM,MAAMA,IAAG,aAAa,YAAY,OAAO;AAC/C,QAAM,SAAS,YAAAC,QAAK,MAAM,GAAG;AAG7B,MAAI,OAAO,YAAY,KAAM,OAAO,cAA0C,SAAS;AACrF,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,aAAa;AACjB,MAAI,OAAO,YAAY,GAAG;AAExB,UAAM,QAAQ,OAAO;AACrB,UAAM,kBAAkB,OAAO;AAC/B,QAAI,mBAAmB,CAAC,OAAO,WAAW;AAExC,UAAI,gBAAgB,aAAa,aAAa;AAC5C,wBAAgB,WAAW;AAAA,MAC7B;AACA,aAAO,YAAY;AAAA,IACrB;AAGA,UAAM,SAAS,OAAO;AACtB,QAAI,QAAQ;AACV,YAAM,EAAE,MAAM,UAAU,IAAI;AAC5B,aAAO,SAAS,EAAE,MAAM,QAAQ,MAAM,WAAW,aAAa,OAAO;AAAA,IACvE;AAGA,UAAM,UAAU,OAAO;AACvB,QAAI,SAAS;AACX,YAAM,EAAE,kBAAkB,gBAAgB,WAAW,qBAAqB,kBAAkB,IAAI;AAChG,aAAO,UAAU;AAAA,QACf;AAAA,QACA,WAAW,aAAa;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,WAAO,OAAO;AACd,WAAO,OAAO;AACd,WAAO,OAAO;AACd,WAAO,OAAO;AACd,WAAO,OAAO;AAGd,WAAO,UAAU;AACjB,iBAAa;AAEb,YAAQ,OAAO,MAAM,kDAAkD;AAAA,EACzE;AAGA,QAAM,gBAAgB,cAAc,QAAQ,UAAU,CAAC,QAAQ;AAC7D,YAAQ,OAAO,MAAM,oBAAoB,GAAG;AAAA,CAAI;AAAA,EAClD,CAAC;AAID,QAAM,MAAM,OAAO;AACnB,MAAI,OAAO,6BAA6B,OAAO,EAAE,oBAAoB,MAAM;AACzE,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,iBAAiB,MAAM,MAAM;AAG5C,QAAM,aAAa,cACd,kBACC,OAAO,kBAA4B,KAAK,6BACzC,OAAO,YAAY,OAAO;AAE/B,MAAI,YAAY;AACd,UAAM,aAAa,KAAK,MAAM,KAAK,UAAU,MAAM,CAAC;AACpD,IAAAD,IAAG,cAAc,YAAY,YAAAC,QAAK,UAAU,UAAU,GAAG,OAAO;AAAA,EAClE;AAEA,SAAO;AACT;AAEO,SAAS,WAAW,UAAkB,QAA0B;AAGrE,QAAM,YAAY,iBAAiB,MAAM,MAAM;AAE/C,QAAM,aAAaF,MAAK,KAAK,UAAU,eAAe;AACtD,EAAAC,IAAG,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AAC1C,EAAAA,IAAG,cAAc,YAAY,YAAAC,QAAK,UAAU,SAAS,GAAG,OAAO;AACjE;AAEO,SAAS,aACd,UACA,IACY;AACZ,QAAM,UAAU,WAAW,QAAQ;AACnC,QAAM,UAAU,GAAG,OAAO;AAC1B,aAAW,UAAU,OAAO;AAC5B,SAAO;AACT;AAEO,SAAS,mBACd,UACA,QACY;AACZ,SAAO,aAAa,UAAU,CAAC,YAAY;AAAA,IACzC,GAAG;AAAA,IACH,QAAQ,EAAE,GAAG,OAAO,QAAQ,GAAG,OAAO;AAAA,EACxC,EAAE;AACJ;AAOO,SAAS,wBAAwB,QAAwC;AAC9E,MAAI,CAAC,OAAO,UAAW,QAAO;AAC9B,SAAO,IAAI;AAAA,IACT,OAAO,QAAQ,OAAO,SAAS,EAC5B,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,MAAM,OAAO,EACnC,IAAI,CAAC,CAAC,IAAI,MAAM,IAAI;AAAA,EACzB;AACF;AAEO,SAAS,iBACd,UACA,MACY;AACZ,SAAO,aAAa,UAAU,CAAC,YAAY;AAAA,IACzC,GAAG;AAAA,IACH,MAAM,EAAE,GAAG,OAAO,MAAM,GAAG,KAAK;AAAA,EAClC,EAAE;AACJ;AAGO,SAAS,gBAAgB,UAAuC;AACrE,QAAM,WAAW,gBAAgB,QAAQ;AACzC,MAAI,CAACD,IAAG,WAAW,QAAQ,EAAG,QAAO,CAAC;AACtC,QAAM,MAAMA,IAAG,aAAa,UAAU,OAAO,EAAE,KAAK;AACpD,MAAI,CAAC,IAAK,QAAO,CAAC;AAElB,MAAI;AACJ,MAAI;AACF,aAAS,YAAAC,QAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,iCAAiC,QAAQ,+BAAgC,IAAc,OAAO;AAAA,CAAI;AACvH,WAAO,CAAC;AAAA,EACV;AAEA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,YAAQ,OAAO,MAAM,iBAAiB,QAAQ;AAAA,CAA2D;AACzG,WAAO,CAAC;AAAA,EACV;AAEA,SAAO;AACT;AAGO,SAAS,iBAAiB,UAA8B;AAC7D,QAAM,UAAU,WAAW,QAAQ;AACnC,QAAM,QAAQ,gBAAgB,QAAQ;AACtC,QAAM,SAAS,gBAAgB,SAAoC,KAAgC;AACnG,SAAO,iBAAiB,MAAM,MAAM;AACtC;AAMA,SAAS,wBAA2B,UAAkB,SAAY,MAAY;AAC5E,QAAM,eAAe,YAAAA,QAAK,UAAU,OAAO;AAC3C,QAAM,WAAW,YAAAA,QAAK,UAAU,IAAI;AACpC,MAAI,iBAAiB,SAAU,QAAO;AAEtC,EAAAD,IAAG,UAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AAC1C,EAAAA,IAAG,cAAc,gBAAgB,QAAQ,GAAG,UAAU,OAAO;AAC7D,SAAO;AACT;AAGO,SAAS,gBAAgB,UAAkB,OAAiD;AACjG,QAAM,WAAW,gBAAgB,QAAQ;AACzC,QAAM,OAAO,gBAAgB,UAAqC,KAAgC;AAClG,SAAO,wBAAwB,UAAU,UAAU,IAAI;AACzD;AAQO,SAAS,kBACd,UACA,IACqB;AACrB,QAAM,UAAU,gBAAgB,QAAQ;AACxC,SAAO,wBAAwB,UAAU,SAAS,GAAG,OAAO,CAAC;AAC/D;","names":["fs","path","path","fs","YAML"]}

package/dist/chunk-54SXG5HF.js

@@ -0,0 +1,26 @@
+import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+
+// src/agent/evaluation-matrix.ts
+function enumerateMatrixCells(matrix) {
+  const runtimes = matrix.runtimes && matrix.runtimes.length > 0 ? matrix.runtimes : [void 0];
+  const reasoningLevels = matrix.reasoningLevels && matrix.reasoningLevels.length > 0 ? matrix.reasoningLevels : [void 0];
+  const models = matrix.models && matrix.models.length > 0 ? matrix.models : [void 0];
+  const cells = [];
+  for (const runtime of runtimes) {
+    for (const reasoningLevel of reasoningLevels) {
+      for (const model of models) {
+        cells.push({
+          ...runtime !== void 0 ? { runtime } : {},
+          ...reasoningLevel !== void 0 ? { reasoningLevel } : {},
+          ...model !== void 0 ? { model } : {}
+        });
+      }
+    }
+  }
+  return cells;
+}
+
+export {
+  enumerateMatrixCells
+};
+//# sourceMappingURL=chunk-54SXG5HF.js.map

package/dist/chunk-54SXG5HF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agent/evaluation-matrix.ts"],"sourcesContent":["/**\n * Shared matrix cell enumeration for agent evaluations.\n *\n * An evaluation fans a single task out across a cartesian product of\n * (runtime × reasoningLevel × model) cells. The daemon creates runs in\n * deterministic iteration order so downstream consumers can zip cells\n * against run rows reliably — which means the one canonical iteration\n * order must live in one place.\n *\n * NOTE: This module is currently only imported from backend (daemon API +\n * CLI). The frontend (evaluation-helpers.ts) will switch to reading the\n * per-run `reasoning_level` / `execution_overrides` columns directly and\n * can drop its local copy in a separate commit.\n */\n\nimport type { ReasoningLevel, RuntimeId } from './types.js';\n\nexport interface EvaluationMatrixCell {\n  runtime?: RuntimeId;\n  reasoningLevel?: ReasoningLevel;\n  model?: string;\n}\n\nexport interface EvaluationMatrixDimensions {\n  runtimes?: RuntimeId[];\n  reasoningLevels?: ReasoningLevel[];\n  models?: string[];\n}\n\n/**\n * Enumerate the cartesian product of the matrix dimensions. Any missing\n * dimension is treated as a single-cell axis holding `undefined` (so the\n * run falls back to the task's default for that field). Iteration order is\n * runtimes × reasoningLevels × models — this is load-bearing: the daemon\n * creates runs in this order and the CLI / UI zip cells by started_at ASC.\n *\n * Undefined fields are omitted from the cell object (not set to\n * `undefined`) so `'field' in cell` works as an existence check.\n */\nexport function enumerateMatrixCells(\n  matrix: EvaluationMatrixDimensions,\n): EvaluationMatrixCell[] {\n  const runtimes: Array<RuntimeId | undefined> =\n    matrix.runtimes && matrix.runtimes.length > 0 ? matrix.runtimes : [undefined];\n  const reasoningLevels: Array<ReasoningLevel | undefined> =\n    matrix.reasoningLevels && matrix.reasoningLevels.length > 0\n      ? matrix.reasoningLevels\n      : [undefined];\n  const models: Array<string | undefined> =\n    matrix.models && matrix.models.length > 0 ? matrix.models : [undefined];\n\n  const cells: EvaluationMatrixCell[] = [];\n  for (const runtime of runtimes) {\n    for (const reasoningLevel of reasoningLevels) {\n      for (const model of models) {\n        cells.push({\n          ...(runtime !== undefined ? { runtime } : {}),\n          ...(reasoningLevel !== undefined ? { reasoningLevel } : {}),\n          ...(model !== undefined ? { model } : {}),\n        });\n      }\n    }\n  }\n  return cells;\n}\n"],"mappings":";;;AAuCO,SAAS,qBACd,QACwB;AACxB,QAAM,WACJ,OAAO,YAAY,OAAO,SAAS,SAAS,IAAI,OAAO,WAAW,CAAC,MAAS;AAC9E,QAAM,kBACJ,OAAO,mBAAmB,OAAO,gBAAgB,SAAS,IACtD,OAAO,kBACP,CAAC,MAAS;AAChB,QAAM,SACJ,OAAO,UAAU,OAAO,OAAO,SAAS,IAAI,OAAO,SAAS,CAAC,MAAS;AAExE,QAAM,QAAgC,CAAC;AACvC,aAAW,WAAW,UAAU;AAC9B,eAAW,kBAAkB,iBAAiB;AAC5C,iBAAW,SAAS,QAAQ;AAC1B,cAAM,KAAK;AAAA,UACT,GAAI,YAAY,SAAY,EAAE,QAAQ,IAAI,CAAC;AAAA,UAC3C,GAAI,mBAAmB,SAAY,EAAE,eAAe,IAAI,CAAC;AAAA,UACzD,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC;AAAA,QACzC,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-XATDZX7U.js → chunk-6ALVMIB4.js}

@@ -1,16 +1,16 @@
 import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
 import {
   SCHEMA_VERSION
-} from "./chunk-MYOZLMB2.js";
+} from "./chunk-DTWUHHFI.js";
 import {
   loadConfig,
   updateTeamConfig
-} from "./chunk-OD4AA7PV.js";
+} from "./chunk-53RPGOEN.js";
 import {
   TEAM_API_KEY_SECRET,
   TEAM_MCP_TOKEN_SECRET,
   WRANGLER_COMMAND_TIMEOUT_MS
-} from "./chunk-FLLBJLHM.js";
+} from "./chunk-6C6QZ4PM.js";
 
 // ../myco-team/src/cli.ts
 import crypto2 from "crypto";
@@ -41,6 +41,19 @@ function writeSecret(vaultDir, key, value) {
   const content = Object.entries(existing).map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
   fs.writeFileSync(secretsPath, content, "utf-8");
 }
+function deleteSecrets(vaultDir, keys) {
+  const secretsPath = path.join(vaultDir, SECRETS_FILE);
+  if (!fs.existsSync(secretsPath)) return;
+  const existing = readSecrets(vaultDir);
+  for (const key of keys) delete existing[key];
+  const entries = Object.entries(existing);
+  if (entries.length === 0) {
+    fs.rmSync(secretsPath, { force: true });
+    return;
+  }
+  const content = entries.map(([k, v]) => `${k}=${v}`).join("\n") + "\n";
+  fs.writeFileSync(secretsPath, content, "utf-8");
+}
 function loadSecrets(vaultDir) {
   const secrets = readSecrets(vaultDir);
   for (const [key, value] of Object.entries(secrets)) {
@@ -210,7 +223,7 @@ function resolvePackageRoot() {
 }
 function getTeamPackageVersion() {
   if (true) {
-    return "0.1.2";
+    return "0.1.3";
   }
   const packageRoot = resolvePackageRoot();
   const candidatePaths = [
@@ -587,6 +600,7 @@ async function teamUpgrade(vaultDir) {
 export {
   readSecrets,
   writeSecret,
+  deleteSecrets,
   loadSecrets,
   resolveVaultConfigPath,
   readJsonConfig,
@@ -595,4 +609,4 @@ export {
   upgradeWorker,
   teamUpgrade
 };
-//# sourceMappingURL=chunk-XATDZX7U.js.map
+//# sourceMappingURL=chunk-6ALVMIB4.js.map

package/dist/{chunk-XATDZX7U.js.map → chunk-6ALVMIB4.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../../myco-team/src/cli.ts","../src/config/secrets.ts","../../myco-deploy/src/cloudflare.ts","../../myco-deploy/src/local-config.ts"],"sourcesContent":["/**\n * CLI team commands — provision and manage Cloudflare team sync infrastructure.\n *\n * `myco team init`    — Provision D1 database, Vectorize index, deploy worker.\n * `myco team upgrade` — Redeploy worker with updated source.\n */\n\nimport crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { CONFIG_FILENAME, loadConfig, updateTeamConfig } from '@myco/config/loader.js';\nimport { writeSecret, readSecrets } from '@myco/config/secrets.js';\nimport { WRANGLER_COMMAND_TIMEOUT_MS, TEAM_API_KEY_SECRET, TEAM_MCP_TOKEN_SECRET } from '@myco/constants.js';\nimport { SCHEMA_VERSION } from '@myco/db/schema.js';\nimport {\n  extractJsonArray,\n  installDeploymentDeps,\n  maskSecret,\n  parseD1Id,\n  parseKvNamespaceId,\n  parseWorkerUrl,\n  readJsonConfig,\n  resolveHomeConfigPath,\n  resolveVaultConfigPath,\n  runWrangler,\n  stageDeploymentDir,\n  writeJsonConfig,\n} from '@myco-deploy/index.js';\n\ndeclare const __MYCO_TEAM_VERSION__: string;\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Number of random bytes for API key generation. */\nconst API_KEY_BYTES = 32;\n\n/** Vectorize index dimensions (must match the embedding model). */\nconst VECTORIZE_DIMENSIONS = '1024';\n\n/** Vectorize distance metric. */\nconst VECTORIZE_METRIC = 'cosine';\n\n/** Prefix for team resource names. */\nconst TEAM_RESOURCE_PREFIX = 'myco-team';\n\n/** Length of the project hash suffix for unique resource naming. */\nconst PROJECT_HASH_LENGTH = 8;\n\n\n/** Source directory for worker files (relative to package root). */\nconst WORKER_SOURCE_DIR = 'worker';\n\n/** Team sync state directory within the vault. */\nconst TEAM_STATE_DIR = 'team';\nconst TEAM_DEPLOY_DIR = 'worker';\nconst TEAM_CONFIG_FILE = 'config.json';\nconst LEGACY_TEAM_CONFIG_DIR = '.myco-team';\nconst LEGACY_TEAM_DEPLOY_DIR = '.team-worker';\nconst TEAM_CONFIG_VERSION = 1;\nconst TEAM_MCP_ROTATION_RETRY_ATTEMPTS = 10;\nconst TEAM_MCP_ROTATION_RETRY_DELAY_MS = 1500;\n\n/** Regex to match wrangler.toml name field. */\nconst TOML_NAME_REGEX = /^name\\s*=\\s*\"[^\"]*\"/m;\n\n/** Regex to match wrangler.toml D1 placeholder. */\nconst TOML_D1_PLACEHOLDER_REGEX = /<YOUR_D1_DATABASE_ID>/g;\n\n/** Regex to match wrangler.toml database_name field. */\nconst TOML_DB_NAME_REGEX = /database_name\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match wrangler.toml index_name field. */\nconst TOML_INDEX_NAME_REGEX = /index_name\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match wrangler.toml team package version placeholder. */\nconst TOML_TEAM_PACKAGE_VERSION_REGEX = /MYCO_TEAM_PACKAGE_VERSION\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match wrangler.toml Myco schema version placeholder. */\nconst TOML_MYCO_SCHEMA_VERSION_REGEX = /MYCO_SCHEMA_VERSION\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match database_id in existing wrangler.toml. */\nconst TOML_DB_ID_REGEX = /database_id\\s*=\\s*\"([^\"]+)\"/;\n\n/** Regex to match wrangler.toml KV namespace placeholder. */\nconst TOML_KV_PLACEHOLDER_REGEX = /<YOUR_KV_NAMESPACE_ID>/g;\n\n/** Regex to extract the KV namespace ID from an existing wrangler.toml. */\nconst TOML_KV_ID_REGEX = /\\[\\[kv_namespaces\\]\\][\\s\\S]*?id\\s*=\\s*\"([0-9a-f]+)\"/;\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Generate a project hash from vault dir for unique resource naming. */\nfunction projectHash(vaultDir: string): string {\n  const hash = crypto.createHash('sha256').update(vaultDir).digest('hex');\n  return hash.slice(0, PROJECT_HASH_LENGTH);\n}\n\n/** Build the unique resource name for this project's team infrastructure. */\nfunction resourceName(vaultDir: string): string {\n  return `${TEAM_RESOURCE_PREFIX}-${projectHash(vaultDir)}`;\n}\n\nfunction resolvePackageRoot(): string {\n  const override = process.env.MYCO_TEAM_PACKAGE_ROOT?.trim();\n  if (override) return override;\n  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');\n}\n\nexport function getTeamPackageVersion(): string {\n  if (typeof __MYCO_TEAM_VERSION__ !== 'undefined') {\n    return __MYCO_TEAM_VERSION__;\n  }\n\n  const packageRoot = resolvePackageRoot();\n  const candidatePaths = [\n    path.join(packageRoot, 'package.json'),\n    path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'package.json'),\n  ];\n\n  for (const candidatePath of candidatePaths) {\n    if (!fs.existsSync(candidatePath)) continue;\n    const packageJson = JSON.parse(fs.readFileSync(candidatePath, 'utf-8')) as { version?: string };\n    if (packageJson.version) return packageJson.version;\n  }\n\n  return '0.1.0';\n}\n\nfunction getMycoSchemaVersion(): string {\n  return String(SCHEMA_VERSION);\n}\n\nexport interface TeamLocalConfig {\n  worker_name: string;\n  worker_url: string;\n  package_version: string;\n  created_at: string;\n  last_upgraded: string;\n  config_version: number;\n}\n\ninterface LegacyTeamLocalConfig extends TeamLocalConfig {\n  api_key?: string;\n  mcp_token?: string | null;\n  vault_dir?: string;\n}\n\nfunction resolveLocalConfigPath(vaultDir: string): string {\n  return resolveVaultConfigPath(vaultDir, TEAM_STATE_DIR, TEAM_CONFIG_FILE);\n}\n\nfunction resolveLegacyLocalConfigPath(): string {\n  return resolveHomeConfigPath(LEGACY_TEAM_CONFIG_DIR, TEAM_CONFIG_FILE);\n}\n\nfunction resolveDeployDir(vaultDir: string): string {\n  return path.join(vaultDir, TEAM_STATE_DIR, TEAM_DEPLOY_DIR);\n}\n\nfunction resolveLegacyDeployDir(vaultDir: string): string {\n  return path.join(vaultDir, LEGACY_TEAM_DEPLOY_DIR);\n}\n\nfunction writeLocalConfig(vaultDir: string, config: TeamLocalConfig): void {\n  writeJsonConfig(resolveLocalConfigPath(vaultDir), config);\n}\n\nfunction migrateLegacyDeployDir(vaultDir: string): void {\n  const legacyDeployDir = resolveLegacyDeployDir(vaultDir);\n  const nextDeployDir = resolveDeployDir(vaultDir);\n  if (!fs.existsSync(legacyDeployDir) || fs.existsSync(nextDeployDir)) return;\n\n  fs.mkdirSync(path.dirname(nextDeployDir), { recursive: true });\n  fs.renameSync(legacyDeployDir, nextDeployDir);\n}\n\nfunction readLocalConfig(vaultDir: string): TeamLocalConfig | null {\n  const config = readJsonConfig<TeamLocalConfig>(resolveLocalConfigPath(vaultDir));\n  if (config) {\n    migrateLegacyDeployDir(vaultDir);\n    return config;\n  }\n\n  const legacyConfig = readJsonConfig<LegacyTeamLocalConfig>(resolveLegacyLocalConfigPath());\n  if (!legacyConfig) return null;\n  if (legacyConfig.vault_dir && legacyConfig.vault_dir !== vaultDir) return null;\n\n  const migrated: TeamLocalConfig = {\n    worker_name: legacyConfig.worker_name,\n    worker_url: legacyConfig.worker_url,\n    package_version: legacyConfig.package_version,\n    created_at: legacyConfig.created_at,\n    last_upgraded: legacyConfig.last_upgraded,\n    config_version: legacyConfig.config_version ?? TEAM_CONFIG_VERSION,\n  };\n  writeLocalConfig(vaultDir, migrated);\n  if (legacyConfig.api_key) writeSecret(vaultDir, TEAM_API_KEY_SECRET, legacyConfig.api_key);\n  if (legacyConfig.mcp_token) writeSecret(vaultDir, TEAM_MCP_TOKEN_SECRET, legacyConfig.mcp_token);\n  migrateLegacyDeployDir(vaultDir);\n  return migrated;\n}\n\nfunction requireLocalConfig(vaultDir: string): TeamLocalConfig {\n  const config = readLocalConfig(vaultDir);\n  if (config) return config;\n\n  console.error(`No local myco-team config found at ${resolveLocalConfigPath(vaultDir)}`);\n  process.exit(1);\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nasync function rotateMcpTokenWithRetry(workerUrl: string, apiKey: string): Promise<string> {\n  let lastError: Error | null = null;\n\n  for (let attempt = 1; attempt <= TEAM_MCP_ROTATION_RETRY_ATTEMPTS; attempt += 1) {\n    try {\n      return await rotateMcpTokenForWorker(workerUrl, apiKey);\n    } catch (error) {\n      lastError = error as Error;\n      const isRetryable =\n        lastError.message.includes('401') &&\n        lastError.message.includes('Invalid API key') &&\n        attempt < TEAM_MCP_ROTATION_RETRY_ATTEMPTS;\n      if (!isRetryable) {\n        throw lastError;\n      }\n      await delay(TEAM_MCP_ROTATION_RETRY_DELAY_MS);\n    }\n  }\n\n  throw lastError ?? new Error('MCP token rotation failed');\n}\n\n/** Run a wrangler command and return stdout. Throws on failure, surfacing stderr. */\nfunction wrangler(args: string[], options?: { cwd?: string }): string {\n  return runWrangler(args, { cwd: options?.cwd, timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS });\n}\n\n/** Find the worker source directory. Checks dist layout first (installed), then source layout (dev). */\nfunction locateWorkerSource(): string {\n  const root = resolvePackageRoot();\n  const distPath = path.join(root, 'dist', WORKER_SOURCE_DIR);\n  if (fs.existsSync(distPath)) return distPath;\n  const srcPath = path.join(root, WORKER_SOURCE_DIR);\n  if (fs.existsSync(srcPath)) return srcPath;\n  throw new Error(`Cannot find ${WORKER_SOURCE_DIR} — are you running from the myco-team package?`);\n}\n\n/**\n * Copy worker source to the vault deployment directory and patch wrangler.toml\n * with actual D1 database ID and resource names.\n */\nfunction prepareDeployDir(vaultDir: string, d1Id: string, kvId: string): string {\n  const srcDir = locateWorkerSource();\n  const deployDir = resolveDeployDir(vaultDir);\n  const name = resourceName(vaultDir);\n  return stageDeploymentDir({\n    sourceDir: srcDir,\n    deployDir,\n    reset: true,\n    textPatches: [{\n      filePath: 'wrangler.toml',\n      transforms: [\n        (toml) => toml.replace(TOML_NAME_REGEX, `name = \"${name}\"`),\n        (toml) => toml.replace(TOML_D1_PLACEHOLDER_REGEX, d1Id),\n        (toml) => toml.replace(TOML_DB_NAME_REGEX, `database_name = \"${name}\"`),\n        (toml) => toml.replace(TOML_INDEX_NAME_REGEX, `index_name = \"${name}-vectors\"`),\n        (toml) => toml.replace(TOML_KV_PLACEHOLDER_REGEX, kvId),\n        (toml) => toml.replace(TOML_TEAM_PACKAGE_VERSION_REGEX, `MYCO_TEAM_PACKAGE_VERSION = \"${getTeamPackageVersion()}\"`),\n        (toml) => toml.replace(TOML_MYCO_SCHEMA_VERSION_REGEX, `MYCO_SCHEMA_VERSION = \"${getMycoSchemaVersion()}\"`),\n      ],\n    }],\n    installDepsTimeoutMs: WRANGLER_COMMAND_TIMEOUT_MS * 3,\n  });\n}\n\n/** Ensure a KV namespace exists for this project. Returns the namespace ID. */\nfunction ensureKvNamespace(name: string): string {\n  const kvName = `${name}-secrets`;\n  const lookupExisting = (): string => {\n    const listOutput = wrangler(['kv', 'namespace', 'list']);\n    const namespaces = extractJsonArray(listOutput) as Array<{ id: string; title: string }>;\n    // Wrangler sometimes rewrites hyphens to underscores in titles\n    const normalize = (s: string) => s.replace(/[-_]/g, '');\n    const target = normalize(kvName);\n    const existing = namespaces.find((ns) => normalize(ns.title) === target || normalize(ns.title).endsWith(target));\n    if (!existing) throw new Error(`KV namespace \"${kvName}\" not found in list of ${namespaces.length} namespaces`);\n    return existing.id;\n  };\n\n  try {\n    const output = wrangler(['kv', 'namespace', 'create', kvName]);\n    return parseKvNamespaceId(output);\n    // Created successfully but we couldn't parse — fall back to list lookup\n  } catch (err) {\n    const errMsg = (err as Error).message;\n    if (errMsg.includes('already exists') || errMsg.includes('duplicate') || errMsg.includes('same title')) {\n      return lookupExisting();\n    }\n    throw err;\n  }\n}\n\nasync function rotateMcpTokenForWorker(workerUrl: string, apiKey: string): Promise<string> {\n  const response = await fetch(`${workerUrl}/mcp/rotate`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      'Content-Type': 'application/json',\n    },\n  });\n  if (!response.ok) {\n    throw new Error(`MCP token rotation failed: ${response.status} ${await response.text()}`);\n  }\n  const body = await response.json() as { token?: string };\n  if (!body.token) {\n    throw new Error('MCP token rotation response did not include a token');\n  }\n  return body.token;\n}\n\n// ---------------------------------------------------------------------------\n// Commands\n// ---------------------------------------------------------------------------\n\nexport async function teamInit(vaultDir: string): Promise<void> {\n  console.log('Provisioning team sync infrastructure...\\n');\n\n  // 1. Check for wrangler\n  try {\n    const version = wrangler(['--version']).trim();\n    console.log(`wrangler: ${version}`);\n  } catch {\n    console.error('Error: wrangler CLI not found. Install it with: npm install -g wrangler');\n    process.exit(1);\n  }\n\n  // 2. Check auth\n  try {\n    wrangler(['whoami']);\n    console.log('Cloudflare auth: OK\\n');\n  } catch {\n    console.error('Error: Not authenticated with Cloudflare. Run: wrangler login');\n    process.exit(1);\n  }\n\n  const name = resourceName(vaultDir);\n  console.log(`Resource name: ${name}\\n`);\n\n  // 3. Create D1 database (or reuse existing)\n  console.log('Creating D1 database...');\n  let d1Id: string;\n  try {\n    const d1Output = wrangler(['d1', 'create', name]);\n    d1Id = parseD1Id(d1Output);\n    console.log(`D1 database created: ${d1Id}\\n`);\n  } catch (err) {\n    const errMsg = (err as Error).message;\n    if (errMsg.includes('already exists')) {\n      console.log('D1 database already exists, looking up ID...');\n      const listOutput = wrangler(['d1', 'list', '--json']);\n      const databases = JSON.parse(listOutput) as Array<{ name: string; uuid: string }>;\n      const existing = databases.find((db) => db.name === name);\n      if (!existing) {\n        console.error(`D1 database \"${name}\" reported as existing but not found in list`);\n        process.exit(1);\n      }\n      d1Id = existing.uuid;\n      console.log(`Reusing D1 database: ${d1Id}\\n`);\n    } else {\n      console.error(`Failed to create D1 database: ${errMsg}`);\n      process.exit(1);\n    }\n  }\n\n  // 4. Create Vectorize index (or reuse existing)\n  console.log('Creating Vectorize index...');\n  try {\n    wrangler(['vectorize', 'create', `${name}-vectors`, '--dimensions', VECTORIZE_DIMENSIONS, '--metric', VECTORIZE_METRIC]);\n    console.log('Vectorize index created\\n');\n  } catch (err) {\n    const errMsg = (err as Error).message;\n    if (errMsg.includes('already exists') || errMsg.includes('duplicate_name')) {\n      console.log('Vectorize index already exists, reusing\\n');\n    } else {\n      console.error(`Failed to create Vectorize index: ${errMsg}`);\n      process.exit(1);\n    }\n  }\n\n  // 5. Create KV namespace for runtime secrets (MCP tokens)\n  console.log('Creating KV namespace for secrets...');\n  let kvId: string;\n  try {\n    kvId = ensureKvNamespace(name);\n    console.log(`KV namespace ready: ${kvId}\\n`);\n  } catch (err) {\n    console.error(`Failed to create KV namespace: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  // 6. Generate API key\n  const apiKey = crypto.randomBytes(API_KEY_BYTES).toString('hex');\n\n  // 7. Prepare deployment directory\n  console.log('Preparing worker deployment...');\n  const deployDir = prepareDeployDir(vaultDir, d1Id, kvId);\n\n  // 7. Set API key secret via wrangler\n  console.log('Setting API key secret...');\n  try {\n    runWrangler(['secret', 'put', TEAM_API_KEY_SECRET, '--name', name], {\n      cwd: deployDir,\n      input: apiKey,\n      timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS,\n    });\n    console.log('Secret set\\n');\n  } catch (err) {\n    console.error(`Failed to set API key secret: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  // 8. Deploy worker\n  console.log('Deploying worker...');\n  let workerUrl: string;\n  try {\n    const deployOutput = wrangler(['deploy'], { cwd: deployDir });\n    workerUrl = parseWorkerUrl(deployOutput);\n    console.log(`Worker deployed: ${workerUrl}\\n`);\n  } catch (err) {\n    console.error(`Failed to deploy worker: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  // 9. Seed team config in the Worker\n  console.log('Setting team configuration...');\n  try {\n    const { getMachineId } = await import('@myco/daemon/machine-id.js');\n    const creatorMachineId = await getMachineId(vaultDir);\n    await fetch(`${workerUrl}/config`, {\n      method: 'PUT',\n      headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        team_name: name,\n        embedding_model: '@cf/baai/bge-m3',\n        embedding_dimensions: '1024',\n        created_at: String(Math.floor(Date.now() / 1000)),\n        created_by: creatorMachineId,\n      }),\n    });\n    console.log('Team config saved\\n');\n  } catch {\n    console.log('Warning: could not seed team config (non-fatal)\\n');\n  }\n\n  let mcpToken: string | null = null;\n  try {\n    mcpToken = await rotateMcpTokenForWorker(workerUrl, apiKey);\n  } catch {\n    // Non-fatal. The daemon can also fetch the token later through /connect.\n  }\n\n  // 10. Save config and API key locally\n  updateTeamConfig(vaultDir, {\n    enabled: true,\n    worker_url: workerUrl,\n  });\n  writeSecret(vaultDir, TEAM_API_KEY_SECRET, apiKey);\n  if (mcpToken) writeSecret(vaultDir, TEAM_MCP_TOKEN_SECRET, mcpToken);\n  writeLocalConfig(vaultDir, {\n    worker_name: name,\n    worker_url: workerUrl,\n    package_version: getTeamPackageVersion(),\n    created_at: new Date().toISOString(),\n    last_upgraded: new Date().toISOString(),\n    config_version: TEAM_CONFIG_VERSION,\n  });\n\n  console.log('Team sync configured!\\n');\n  console.log(`  URL:     ${workerUrl}`);\n  console.log(`  API Key: ${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`);\n  if (mcpToken) {\n    console.log(`  MCP:     ${mcpToken.slice(0, 8)}...${mcpToken.slice(-4)}`);\n  }\n  console.log('\\nShare the URL and API key with teammates so they can connect.');\n}\n\n// ---------------------------------------------------------------------------\n// Shared upgrade logic (used by CLI and daemon API)\n// ---------------------------------------------------------------------------\n\nexport interface UpgradeResult {\n  success: boolean;\n  worker_url?: string;\n  version?: string;\n  error?: string;\n}\n\n/**\n * Upgrade the team sync worker: re-copy source, patch config, redeploy.\n * Returns a result instead of calling process.exit — safe for both CLI and daemon.\n */\nexport function upgradeWorker(vaultDir: string): UpgradeResult {\n  const config = loadConfig(vaultDir);\n  if (!config.team.worker_url) {\n    return { success: false, error: 'No team sync configured. Run: myco team init' };\n  }\n\n  migrateLegacyDeployDir(vaultDir);\n  const deployDir = resolveDeployDir(vaultDir);\n  const tomlPath = path.join(deployDir, 'wrangler.toml');\n\n  if (!fs.existsSync(tomlPath)) {\n    return { success: false, error: 'No deployment directory found. Run: myco team init' };\n  }\n\n  // Read ALL existing resource identifiers from current wrangler.toml.\n  const existingToml = fs.readFileSync(tomlPath, 'utf-8');\n  const d1Match = existingToml.match(TOML_DB_ID_REGEX);\n  if (!d1Match || d1Match[1] === '<YOUR_D1_DATABASE_ID>') {\n    return { success: false, error: 'Cannot determine D1 database ID from existing deployment. Run: myco team init' };\n  }\n  const d1Id = d1Match[1];\n\n  const nameMatch = existingToml.match(/^name\\s*=\\s*\"([^\"]*)\"/m);\n  const dbNameMatch = existingToml.match(/database_name\\s*=\\s*\"([^\"]*)\"/);\n  const indexNameMatch = existingToml.match(/index_name\\s*=\\s*\"([^\"]*)\"/);\n  const workerName = nameMatch?.[1] ?? resourceName(vaultDir);\n\n  // KV namespace may not exist on older deployments — create or reuse.\n  const kvMatch = existingToml.match(TOML_KV_ID_REGEX);\n  let kvId: string;\n  if (kvMatch) {\n    kvId = kvMatch[1];\n  } else {\n    try {\n      kvId = ensureKvNamespace(workerName);\n    } catch (err) {\n      return { success: false, error: `Failed to provision KV namespace: ${(err as Error).message}` };\n    }\n  }\n\n  try {\n    stageDeploymentDir({\n      sourceDir: locateWorkerSource(),\n      deployDir,\n      textPatches: [{\n        filePath: 'wrangler.toml',\n        transforms: [\n          (toml) => toml.replace(TOML_NAME_REGEX, `name = \"${workerName}\"`),\n          (toml) => toml.replace(TOML_D1_PLACEHOLDER_REGEX, d1Id),\n          (toml) => toml.replace(TOML_DB_NAME_REGEX, `database_name = \"${dbNameMatch?.[1] ?? workerName}\"`),\n          (toml) => toml.replace(TOML_INDEX_NAME_REGEX, `index_name = \"${indexNameMatch?.[1] ?? `${workerName}-vectors`}\"`),\n          (toml) => toml.replace(TOML_KV_PLACEHOLDER_REGEX, kvId),\n          (toml) => toml.replace(TOML_TEAM_PACKAGE_VERSION_REGEX, `MYCO_TEAM_PACKAGE_VERSION = \"${getTeamPackageVersion()}\"`),\n          (toml) => toml.replace(TOML_MYCO_SCHEMA_VERSION_REGEX, `MYCO_SCHEMA_VERSION = \"${getMycoSchemaVersion()}\"`),\n        ],\n      }],\n      installDepsTimeoutMs: WRANGLER_COMMAND_TIMEOUT_MS * 3,\n    });\n  } catch (err) {\n    return { success: false, error: `Failed to install worker dependencies: ${(err as Error).message}` };\n  }\n\n  // Re-set API key secret before deploy (deploy can wipe secrets)\n  const secrets = readSecrets(vaultDir);\n  const apiKey = secrets[TEAM_API_KEY_SECRET];\n  if (apiKey) {\n    try {\n      runWrangler(['secret', 'put', TEAM_API_KEY_SECRET, '--name', workerName], {\n        cwd: deployDir,\n        input: apiKey,\n        timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS,\n      });\n    } catch {\n      // Non-fatal — secret may already be set\n    }\n  }\n\n  // Redeploy\n  try {\n    const deployOutput = wrangler(['deploy'], { cwd: deployDir });\n    const workerUrl = parseWorkerUrl(deployOutput);\n    const version = getTeamPackageVersion();\n\n    updateTeamConfig(vaultDir, {\n      worker_url: workerUrl,\n    });\n    const localConfig = readLocalConfig(vaultDir);\n    if (localConfig) {\n      writeLocalConfig(vaultDir, {\n        ...localConfig,\n        worker_name: workerName,\n        worker_url: workerUrl,\n        package_version: version,\n        last_upgraded: new Date().toISOString(),\n      });\n    }\n\n    return { success: true, worker_url: workerUrl, version };\n  } catch (err) {\n    return { success: false, error: `Failed to deploy worker: ${(err as Error).message}` };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// CLI wrapper\n// ---------------------------------------------------------------------------\n\nexport async function teamUpgrade(vaultDir: string): Promise<void> {\n  console.log('Upgrading team sync worker...\\n');\n  const result = upgradeWorker(vaultDir);\n  if (!result.success) {\n    console.error(result.error);\n    process.exit(1);\n  }\n  console.log(`Worker deployed: ${result.worker_url}`);\n  console.log(`Version: ${result.version}`);\n  console.log('\\nUpgrade complete.');\n}\n\nexport async function teamStatus(vaultDir: string): Promise<void> {\n  const config = requireLocalConfig(vaultDir);\n  const secrets = readSecrets(vaultDir);\n\n  console.log(`Worker:      ${config.worker_name}`);\n  console.log(`URL:         ${config.worker_url}`);\n  console.log(`API Key:     ${maskSecret(secrets[TEAM_API_KEY_SECRET] ?? null)}`);\n  console.log(`MCP Token:   ${maskSecret(secrets[TEAM_MCP_TOKEN_SECRET] ?? null)}`);\n  console.log(`Package v:   ${config.package_version}`);\n  console.log(`Created:     ${config.created_at}`);\n  console.log(`Upgraded:    ${config.last_upgraded}`);\n  console.log(`Config v:    ${config.config_version}`);\n}\n\nexport async function teamRotateTokens(vaultDir: string, which: 'api' | 'mcp' | 'all' = 'all'): Promise<void> {\n  const config = requireLocalConfig(vaultDir);\n  const secrets = readSecrets(vaultDir);\n  let currentApiKey = secrets[TEAM_API_KEY_SECRET] ?? '';\n  let currentMcpToken = secrets[TEAM_MCP_TOKEN_SECRET] ?? null;\n\n  let nextConfig = { ...config };\n\n  if (which === 'api' || which === 'all') {\n    const apiKey = crypto.randomBytes(API_KEY_BYTES).toString('hex');\n    runWrangler(['secret', 'put', TEAM_API_KEY_SECRET, '--name', config.worker_name], {\n      cwd: resolveDeployDir(vaultDir),\n      input: apiKey,\n      timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS,\n    });\n    writeSecret(vaultDir, TEAM_API_KEY_SECRET, apiKey);\n    currentApiKey = apiKey;\n    nextConfig = {\n      ...nextConfig,\n      package_version: getTeamPackageVersion(),\n      last_upgraded: new Date().toISOString(),\n    };\n    writeLocalConfig(vaultDir, nextConfig);\n  }\n\n  if (which === 'mcp' || which === 'all') {\n    try {\n      currentMcpToken = await rotateMcpTokenWithRetry(config.worker_url, currentApiKey);\n      if (currentMcpToken) writeSecret(vaultDir, TEAM_MCP_TOKEN_SECRET, currentMcpToken);\n    } catch (error) {\n      writeLocalConfig(vaultDir, {\n        ...nextConfig,\n        last_upgraded: new Date().toISOString(),\n      });\n      throw new Error(\n        `API key rotation completed, but MCP token rotation failed. Local config was updated to the new API key.\\n${(error as Error).message}`,\n      );\n    }\n  }\n\n  nextConfig.last_upgraded = new Date().toISOString();\n  writeLocalConfig(vaultDir, nextConfig);\n\n  console.log(`API Key:   ${maskSecret(currentApiKey)}`);\n  console.log(`MCP Token: ${maskSecret(currentMcpToken)}`);\n}\n\nexport async function teamDestroy(vaultDir: string): Promise<void> {\n  const config = requireLocalConfig(vaultDir);\n  const errors: string[] = [];\n  const deployDir = resolveDeployDir(vaultDir);\n\n  try {\n    wrangler(['delete', config.worker_name], { cwd: deployDir });\n  } catch (error) {\n    errors.push(`worker delete failed: ${(error as Error).message}`);\n  }\n\n  try {\n    wrangler(['vectorize', 'delete', `${config.worker_name}-vectors`]);\n  } catch (error) {\n    errors.push(`vectorize delete failed: ${(error as Error).message}`);\n  }\n\n  try {\n    const databases = JSON.parse(wrangler(['d1', 'list', '--json'])) as Array<{ name: string; uuid: string }>;\n    const database = databases.find((entry) => entry.name === config.worker_name);\n    if (database) {\n      wrangler(['d1', 'delete', database.name, '--skip-confirmation']);\n    }\n  } catch (error) {\n    errors.push(`d1 delete failed: ${(error as Error).message}`);\n  }\n\n  try {\n    const namespaces = extractJsonArray(wrangler(['kv', 'namespace', 'list'])) as Array<{ id: string; title: string }>;\n    const namespace = namespaces.find((entry) => entry.title === `${config.worker_name}-secrets`);\n    if (namespace) {\n      wrangler(['kv', 'namespace', 'delete', '--namespace-id', namespace.id, '--skip-confirmation']);\n    }\n  } catch (error) {\n    errors.push(`kv delete failed: ${(error as Error).message}`);\n  }\n\n  if (errors.length > 0) {\n    throw new Error(`Team destroy incomplete. Local state preserved for retry.\\n${errors.join('\\n')}`);\n  }\n\n  fs.rmSync(path.join(vaultDir, TEAM_STATE_DIR), { recursive: true, force: true });\n  console.log(`Destroyed local myco-team state for ${config.worker_name}.`);\n}\n","/**\n * Secrets file utilities for API key storage outside git.\n *\n * Secrets are stored in `secrets.env` inside the vault directory.\n * This file is gitignored (see VAULT_GITIGNORE) and never committed.\n * Format: KEY=value, one per line (same as .env).\n */\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nconst SECRETS_FILE = 'secrets.env';\n\n/** Read all secrets from <vault>/secrets.env as key-value pairs. */\nexport function readSecrets(vaultDir: string): Record<string, string> {\n  const secretsPath = path.join(vaultDir, SECRETS_FILE);\n  if (!fs.existsSync(secretsPath)) return {};\n\n  const secrets: Record<string, string> = {};\n  for (const line of fs.readFileSync(secretsPath, 'utf-8').split('\\n')) {\n    const match = line.match(/^\\s*([^#=]+?)\\s*=\\s*(.*?)\\s*$/);\n    if (match) {\n      secrets[match[1]] = match[2];\n    }\n  }\n  return secrets;\n}\n\n/** Write a secret to <vault>/secrets.env, preserving existing entries. */\nexport function writeSecret(vaultDir: string, key: string, value: string): void {\n  const secretsPath = path.join(vaultDir, SECRETS_FILE);\n  const existing = readSecrets(vaultDir);\n  existing[key] = value;\n\n  const content = Object.entries(existing)\n    .map(([k, v]) => `${k}=${v}`)\n    .join('\\n') + '\\n';\n\n  fs.writeFileSync(secretsPath, content, 'utf-8');\n}\n\n/** Remove one or more secrets from <vault>/secrets.env, preserving remaining entries. */\nexport function deleteSecrets(vaultDir: string, keys: string[]): void {\n  const secretsPath = path.join(vaultDir, SECRETS_FILE);\n  if (!fs.existsSync(secretsPath)) return;\n\n  const existing = readSecrets(vaultDir);\n  for (const key of keys) delete existing[key];\n\n  const entries = Object.entries(existing);\n  if (entries.length === 0) {\n    fs.rmSync(secretsPath, { force: true });\n    return;\n  }\n\n  const content = entries\n    .map(([k, v]) => `${k}=${v}`)\n    .join('\\n') + '\\n';\n\n  fs.writeFileSync(secretsPath, content, 'utf-8');\n}\n\n/** Load secrets from <vault>/secrets.env into process.env (without overwriting existing vars). */\nexport function loadSecrets(vaultDir: string): void {\n  const secrets = readSecrets(vaultDir);\n  for (const [key, value] of Object.entries(secrets)) {\n    if (!process.env[key]) {\n      process.env[key] = value;\n    }\n  }\n}\n","import { execFileSync } from 'node:child_process';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nconst WORKER_URL_REGEX = /(https:\\/\\/[^\\s]+\\.workers\\.dev)/;\nconst D1_ID_JSON_REGEX = /\"database_id\"\\s*:\\s*\"([0-9a-f-]{36})\"/i;\nconst D1_ID_TEXT_REGEX = /id:\\s*([0-9a-f-]{36})/i;\nconst KV_ID_REGEX = /\"id\":\\s*\"([0-9a-f]+)\"/i;\n\nexport interface WranglerOptions {\n  cwd?: string;\n  input?: string;\n  timeoutMs: number;\n}\n\nexport interface TextPatch {\n  filePath: string;\n  transforms: Array<(text: string) => string>;\n}\n\nexport interface StageDeploymentDirOptions {\n  sourceDir: string;\n  deployDir: string;\n  reset?: boolean;\n  extraCopies?: Array<{ sourceDir: string; destinationSubdir: string }>;\n  textPatches?: TextPatch[];\n  installDepsTimeoutMs?: number | null;\n}\n\nexport function buildCommandEnv(): NodeJS.ProcessEnv {\n  const nodeBinDir = path.dirname(process.execPath);\n  const pathValue = process.env.PATH\n    ? `${nodeBinDir}${path.delimiter}${process.env.PATH}`\n    : nodeBinDir;\n  return { ...process.env, PATH: pathValue };\n}\n\nexport function runWrangler(args: string[], options: WranglerOptions): string {\n  try {\n    return execFileSync('wrangler', args, {\n      cwd: options.cwd,\n      env: buildCommandEnv(),\n      input: options.input,\n      encoding: 'utf-8',\n      timeout: options.timeoutMs,\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n  } catch (error) {\n    const execError = error as Error & { stderr?: Buffer | string; stdout?: Buffer | string };\n    const stderr = execError.stderr?.toString() ?? '';\n    const stdout = execError.stdout?.toString() ?? '';\n    const detail = [stderr, stdout].filter(Boolean).join('\\n').trim();\n    throw new Error(detail || execError.message);\n  }\n}\n\nexport function installDeploymentDeps(deployDir: string, timeoutMs: number): void {\n  const packageJsonPath = path.join(deployDir, 'package.json');\n  if (!fs.existsSync(packageJsonPath)) return;\n\n  execFileSync('npm', ['install', '--silent', '--no-audit', '--no-fund'], {\n    cwd: deployDir,\n    env: buildCommandEnv(),\n    encoding: 'utf-8',\n    timeout: timeoutMs,\n    stdio: ['pipe', 'pipe', 'pipe'],\n  });\n}\n\nexport function parseWorkerUrl(output: string): string {\n  const workerUrl = output.match(WORKER_URL_REGEX)?.[1];\n  if (!workerUrl) {\n    throw new Error(`Could not parse worker URL from deploy output:\\n${output}`);\n  }\n  return workerUrl;\n}\n\nexport function parseD1Id(output: string): string {\n  const jsonMatch = output.match(D1_ID_JSON_REGEX);\n  if (jsonMatch) return jsonMatch[1];\n\n  const textMatch = output.match(D1_ID_TEXT_REGEX);\n  if (textMatch) return textMatch[1];\n\n  throw new Error(`Could not parse D1 database ID from wrangler output:\\n${output}`);\n}\n\nexport function parseKvNamespaceId(output: string): string {\n  const kvId = output.match(KV_ID_REGEX)?.[1];\n  if (!kvId) {\n    throw new Error(`Could not parse KV namespace ID from wrangler output:\\n${output}`);\n  }\n  return kvId;\n}\n\nexport function extractJsonArray(output: string): unknown[] {\n  const start = output.indexOf('[');\n  const end = output.lastIndexOf(']');\n  if (start === -1 || end === -1 || end < start) {\n    throw new Error(`No JSON array found in output:\\n${output}`);\n  }\n  return JSON.parse(output.slice(start, end + 1)) as unknown[];\n}\n\nexport function stageDeploymentDir(options: StageDeploymentDirOptions): string {\n  if (options.reset) {\n    fs.rmSync(options.deployDir, { recursive: true, force: true });\n  }\n  fs.mkdirSync(options.deployDir, { recursive: true });\n  fs.cpSync(options.sourceDir, options.deployDir, { recursive: true });\n\n  for (const copy of options.extraCopies ?? []) {\n    fs.cpSync(copy.sourceDir, path.join(options.deployDir, copy.destinationSubdir), { recursive: true });\n  }\n\n  for (const patch of options.textPatches ?? []) {\n    const absolutePath = path.join(options.deployDir, patch.filePath);\n    let nextText = fs.readFileSync(absolutePath, 'utf-8');\n    for (const transform of patch.transforms) {\n      nextText = transform(nextText);\n    }\n    fs.writeFileSync(absolutePath, nextText, 'utf-8');\n  }\n\n  if (options.installDepsTimeoutMs) {\n    installDeploymentDeps(options.deployDir, options.installDepsTimeoutMs);\n  }\n\n  return options.deployDir;\n}\n","import crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nconst MYCO_HOME_OVERRIDE_ENV = 'MYCO_HOME_OVERRIDE';\n\nexport function resolveHomeDir(): string {\n  return process.env[MYCO_HOME_OVERRIDE_ENV]?.trim() || os.homedir();\n}\n\nexport function resolveHomeConfigPath(configDir: string, fileName: string): string {\n  return path.join(resolveHomeDir(), configDir, fileName);\n}\n\nexport function resolveNamedHomeConfigPath(configDir: string, name: string, fileName: string): string {\n  return path.join(resolveHomeDir(), configDir, name, fileName);\n}\n\nexport function resolveVaultConfigPath(vaultDir: string, configDir: string, fileName: string): string {\n  return path.join(vaultDir, configDir, fileName);\n}\n\nexport function readJsonConfig<T>(configPath: string): T | null {\n  if (!fs.existsSync(configPath)) return null;\n  return JSON.parse(fs.readFileSync(configPath, 'utf-8')) as T;\n}\n\nexport function writeJsonConfig(configPath: string, value: unknown): void {\n  fs.mkdirSync(path.dirname(configPath), { recursive: true });\n  fs.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}\\n`, { encoding: 'utf-8', mode: 0o600 });\n  fs.chmodSync(configPath, 0o600);\n}\n\nexport function maskSecret(secret: string | null): string | null {\n  if (!secret) return null;\n  if (secret.length <= 8) return secret;\n  return `${secret.slice(0, 4)}...${secret.slice(-4)}`;\n}\n\nexport function createHexToken(byteLength: number): string {\n  return crypto.randomBytes(byteLength).toString('hex');\n}\n"],"mappings":";;;;;;;;;;;;;;;AAOA,OAAOA,aAAY;AACnB,OAAOC,SAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,qBAAqB;;;ACH9B,OAAO,QAAQ;AACf,OAAO,UAAU;AAEjB,IAAM,eAAe;AAGd,SAAS,YAAY,UAA0C;AACpE,QAAM,cAAc,KAAK,KAAK,UAAU,YAAY;AACpD,MAAI,CAAC,GAAG,WAAW,WAAW,EAAG,QAAO,CAAC;AAEzC,QAAM,UAAkC,CAAC;AACzC,aAAW,QAAQ,GAAG,aAAa,aAAa,OAAO,EAAE,MAAM,IAAI,GAAG;AACpE,UAAM,QAAQ,KAAK,MAAM,+BAA+B;AACxD,QAAI,OAAO;AACT,cAAQ,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,YAAY,UAAkB,KAAa,OAAqB;AAC9E,QAAM,cAAc,KAAK,KAAK,UAAU,YAAY;AACpD,QAAM,WAAW,YAAY,QAAQ;AACrC,WAAS,GAAG,IAAI;AAEhB,QAAM,UAAU,OAAO,QAAQ,QAAQ,EACpC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,IAAI,IAAI;AAEhB,KAAG,cAAc,aAAa,SAAS,OAAO;AAChD;AAwBO,SAAS,YAAY,UAAwB;AAClD,QAAM,UAAU,YAAY,QAAQ;AACpC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,cAAQ,IAAI,GAAG,IAAI;AAAA,IACrB;AAAA,EACF;AACF;;;ACrEA,SAAS,oBAAoB;AAC7B,OAAOC,SAAQ;AACf,OAAOC,WAAU;AAEjB,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,cAAc;AAsBb,SAAS,kBAAqC;AACnD,QAAM,aAAaA,MAAK,QAAQ,QAAQ,QAAQ;AAChD,QAAM,YAAY,QAAQ,IAAI,OAC1B,GAAG,UAAU,GAAGA,MAAK,SAAS,GAAG,QAAQ,IAAI,IAAI,KACjD;AACJ,SAAO,EAAE,GAAG,QAAQ,KAAK,MAAM,UAAU;AAC3C;AAEO,SAAS,YAAY,MAAgB,SAAkC;AAC5E,MAAI;AACF,WAAO,aAAa,YAAY,MAAM;AAAA,MACpC,KAAK,QAAQ;AAAA,MACb,KAAK,gBAAgB;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,SAAS,QAAQ;AAAA,MACjB,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,YAAY;AAClB,UAAM,SAAS,UAAU,QAAQ,SAAS,KAAK;AAC/C,UAAM,SAAS,UAAU,QAAQ,SAAS,KAAK;AAC/C,UAAM,SAAS,CAAC,QAAQ,MAAM,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK;AAChE,UAAM,IAAI,MAAM,UAAU,UAAU,OAAO;AAAA,EAC7C;AACF;AAEO,SAAS,sBAAsB,WAAmB,WAAyB;AAChF,QAAM,kBAAkBA,MAAK,KAAK,WAAW,cAAc;AAC3D,MAAI,CAACD,IAAG,WAAW,eAAe,EAAG;AAErC,eAAa,OAAO,CAAC,WAAW,YAAY,cAAc,WAAW,GAAG;AAAA,IACtE,KAAK;AAAA,IACL,KAAK,gBAAgB;AAAA,IACrB,UAAU;AAAA,IACV,SAAS;AAAA,IACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,EAChC,CAAC;AACH;AAEO,SAAS,eAAe,QAAwB;AACrD,QAAM,YAAY,OAAO,MAAM,gBAAgB,IAAI,CAAC;AACpD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM;AAAA,EAAmD,MAAM,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,UAAU,QAAwB;AAChD,QAAM,YAAY,OAAO,MAAM,gBAAgB;AAC/C,MAAI,UAAW,QAAO,UAAU,CAAC;AAEjC,QAAM,YAAY,OAAO,MAAM,gBAAgB;AAC/C,MAAI,UAAW,QAAO,UAAU,CAAC;AAEjC,QAAM,IAAI,MAAM;AAAA,EAAyD,MAAM,EAAE;AACnF;AAEO,SAAS,mBAAmB,QAAwB;AACzD,QAAM,OAAO,OAAO,MAAM,WAAW,IAAI,CAAC;AAC1C,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM;AAAA,EAA0D,MAAM,EAAE;AAAA,EACpF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,QAA2B;AAC1D,QAAM,QAAQ,OAAO,QAAQ,GAAG;AAChC,QAAM,MAAM,OAAO,YAAY,GAAG;AAClC,MAAI,UAAU,MAAM,QAAQ,MAAM,MAAM,OAAO;AAC7C,UAAM,IAAI,MAAM;AAAA,EAAmC,MAAM,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,MAAM,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC;AAChD;AAEO,SAAS,mBAAmB,SAA4C;AAC7E,MAAI,QAAQ,OAAO;AACjB,IAAAA,IAAG,OAAO,QAAQ,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC/D;AACA,EAAAA,IAAG,UAAU,QAAQ,WAAW,EAAE,WAAW,KAAK,CAAC;AACnD,EAAAA,IAAG,OAAO,QAAQ,WAAW,QAAQ,WAAW,EAAE,WAAW,KAAK,CAAC;AAEnE,aAAW,QAAQ,QAAQ,eAAe,CAAC,GAAG;AAC5C,IAAAA,IAAG,OAAO,KAAK,WAAWC,MAAK,KAAK,QAAQ,WAAW,KAAK,iBAAiB,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EACrG;AAEA,aAAW,SAAS,QAAQ,eAAe,CAAC,GAAG;AAC7C,UAAM,eAAeA,MAAK,KAAK,QAAQ,WAAW,MAAM,QAAQ;AAChE,QAAI,WAAWD,IAAG,aAAa,cAAc,OAAO;AACpD,eAAW,aAAa,MAAM,YAAY;AACxC,iBAAW,UAAU,QAAQ;AAAA,IAC/B;AACA,IAAAA,IAAG,cAAc,cAAc,UAAU,OAAO;AAAA,EAClD;AAEA,MAAI,QAAQ,sBAAsB;AAChC,0BAAsB,QAAQ,WAAW,QAAQ,oBAAoB;AAAA,EACvE;AAEA,SAAO,QAAQ;AACjB;;;ACjIA,OAAO,YAAY;AACnB,OAAOE,SAAQ;AACf,OAAO,QAAQ;AACf,OAAOC,WAAU;AAEjB,IAAM,yBAAyB;AAExB,SAAS,iBAAyB;AACvC,SAAO,QAAQ,IAAI,sBAAsB,GAAG,KAAK,KAAK,GAAG,QAAQ;AACnE;AAEO,SAAS,sBAAsB,WAAmB,UAA0B;AACjF,SAAOA,MAAK,KAAK,eAAe,GAAG,WAAW,QAAQ;AACxD;AAMO,SAAS,uBAAuB,UAAkB,WAAmB,UAA0B;AACpG,SAAOC,MAAK,KAAK,UAAU,WAAW,QAAQ;AAChD;AAEO,SAAS,eAAkB,YAA8B;AAC9D,MAAI,CAACC,IAAG,WAAW,UAAU,EAAG,QAAO;AACvC,SAAO,KAAK,MAAMA,IAAG,aAAa,YAAY,OAAO,CAAC;AACxD;AAEO,SAAS,gBAAgB,YAAoB,OAAsB;AACxE,EAAAA,IAAG,UAAUD,MAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1D,EAAAC,IAAG,cAAc,YAAY,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AACtG,EAAAA,IAAG,UAAU,YAAY,GAAK;AAChC;;;AHKA,IAAM,gBAAgB;AAGtB,IAAM,uBAAuB;AAG7B,IAAM,mBAAmB;AAGzB,IAAM,uBAAuB;AAG7B,IAAM,sBAAsB;AAI5B,IAAM,oBAAoB;AAG1B,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,sBAAsB;AAK5B,IAAM,kBAAkB;AAGxB,IAAM,4BAA4B;AAGlC,IAAM,qBAAqB;AAG3B,IAAM,wBAAwB;AAG9B,IAAM,kCAAkC;AAGxC,IAAM,iCAAiC;AAGvC,IAAM,mBAAmB;AAGzB,IAAM,4BAA4B;AAGlC,IAAM,mBAAmB;AAOzB,SAAS,YAAY,UAA0B;AAC7C,QAAM,OAAOC,QAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AACtE,SAAO,KAAK,MAAM,GAAG,mBAAmB;AAC1C;AAGA,SAAS,aAAa,UAA0B;AAC9C,SAAO,GAAG,oBAAoB,IAAI,YAAY,QAAQ,CAAC;AACzD;AAEA,SAAS,qBAA6B;AACpC,QAAM,WAAW,QAAQ,IAAI,wBAAwB,KAAK;AAC1D,MAAI,SAAU,QAAO;AACrB,SAAOC,MAAK,QAAQA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,IAAI;AACxE;AAEO,SAAS,wBAAgC;AAC9C,MAAI,MAA8C;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,mBAAmB;AACvC,QAAM,iBAAiB;AAAA,IACrBA,MAAK,KAAK,aAAa,cAAc;AAAA,IACrCA,MAAK,KAAKA,MAAK,QAAQA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,cAAc;AAAA,EAC5F;AAEA,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAACC,IAAG,WAAW,aAAa,EAAG;AACnC,UAAM,cAAc,KAAK,MAAMA,IAAG,aAAa,eAAe,OAAO,CAAC;AACtE,QAAI,YAAY,QAAS,QAAO,YAAY;AAAA,EAC9C;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,SAAO,OAAO,cAAc;AAC9B;AAiBA,SAAS,uBAAuB,UAA0B;AACxD,SAAO,uBAAuB,UAAU,gBAAgB,gBAAgB;AAC1E;AAEA,SAAS,+BAAuC;AAC9C,SAAO,sBAAsB,wBAAwB,gBAAgB;AACvE;AAEA,SAAS,iBAAiB,UAA0B;AAClD,SAAOD,MAAK,KAAK,UAAU,gBAAgB,eAAe;AAC5D;AAEA,SAAS,uBAAuB,UAA0B;AACxD,SAAOA,MAAK,KAAK,UAAU,sBAAsB;AACnD;AAEA,SAAS,iBAAiB,UAAkB,QAA+B;AACzE,kBAAgB,uBAAuB,QAAQ,GAAG,MAAM;AAC1D;AAEA,SAAS,uBAAuB,UAAwB;AACtD,QAAM,kBAAkB,uBAAuB,QAAQ;AACvD,QAAM,gBAAgB,iBAAiB,QAAQ;AAC/C,MAAI,CAACC,IAAG,WAAW,eAAe,KAAKA,IAAG,WAAW,aAAa,EAAG;AAErE,EAAAA,IAAG,UAAUD,MAAK,QAAQ,aAAa,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,EAAAC,IAAG,WAAW,iBAAiB,aAAa;AAC9C;AAEA,SAAS,gBAAgB,UAA0C;AACjE,QAAM,SAAS,eAAgC,uBAAuB,QAAQ,CAAC;AAC/E,MAAI,QAAQ;AACV,2BAAuB,QAAQ;AAC/B,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,eAAsC,6BAA6B,CAAC;AACzF,MAAI,CAAC,aAAc,QAAO;AAC1B,MAAI,aAAa,aAAa,aAAa,cAAc,SAAU,QAAO;AAE1E,QAAM,WAA4B;AAAA,IAChC,aAAa,aAAa;AAAA,IAC1B,YAAY,aAAa;AAAA,IACzB,iBAAiB,aAAa;AAAA,IAC9B,YAAY,aAAa;AAAA,IACzB,eAAe,aAAa;AAAA,IAC5B,gBAAgB,aAAa,kBAAkB;AAAA,EACjD;AACA,mBAAiB,UAAU,QAAQ;AACnC,MAAI,aAAa,QAAS,aAAY,UAAU,qBAAqB,aAAa,OAAO;AACzF,MAAI,aAAa,UAAW,aAAY,UAAU,uBAAuB,aAAa,SAAS;AAC/F,yBAAuB,QAAQ;AAC/B,SAAO;AACT;AAqCA,SAAS,SAAS,MAAgB,SAAoC;AACpE,SAAO,YAAY,MAAM,EAAE,KAAK,SAAS,KAAK,WAAW,4BAA4B,CAAC;AACxF;AAGA,SAAS,qBAA6B;AACpC,QAAM,OAAO,mBAAmB;AAChC,QAAM,WAAWC,MAAK,KAAK,MAAM,QAAQ,iBAAiB;AAC1D,MAAIC,IAAG,WAAW,QAAQ,EAAG,QAAO;AACpC,QAAM,UAAUD,MAAK,KAAK,MAAM,iBAAiB;AACjD,MAAIC,IAAG,WAAW,OAAO,EAAG,QAAO;AACnC,QAAM,IAAI,MAAM,eAAe,iBAAiB,qDAAgD;AAClG;AAMA,SAAS,iBAAiB,UAAkB,MAAc,MAAsB;AAC9E,QAAM,SAAS,mBAAmB;AAClC,QAAM,YAAY,iBAAiB,QAAQ;AAC3C,QAAM,OAAO,aAAa,QAAQ;AAClC,SAAO,mBAAmB;AAAA,IACxB,WAAW;AAAA,IACX;AAAA,IACA,OAAO;AAAA,IACP,aAAa,CAAC;AAAA,MACZ,UAAU;AAAA,MACV,YAAY;AAAA,QACV,CAAC,SAAS,KAAK,QAAQ,iBAAiB,WAAW,IAAI,GAAG;AAAA,QAC1D,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,QACtD,CAAC,SAAS,KAAK,QAAQ,oBAAoB,oBAAoB,IAAI,GAAG;AAAA,QACtE,CAAC,SAAS,KAAK,QAAQ,uBAAuB,iBAAiB,IAAI,WAAW;AAAA,QAC9E,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,QACtD,CAAC,SAAS,KAAK,QAAQ,iCAAiC,gCAAgC,sBAAsB,CAAC,GAAG;AAAA,QAClH,CAAC,SAAS,KAAK,QAAQ,gCAAgC,0BAA0B,qBAAqB,CAAC,GAAG;AAAA,MAC5G;AAAA,IACF,CAAC;AAAA,IACD,sBAAsB,8BAA8B;AAAA,EACtD,CAAC;AACH;AAGA,SAAS,kBAAkB,MAAsB;AAC/C,QAAM,SAAS,GAAG,IAAI;AACtB,QAAM,iBAAiB,MAAc;AACnC,UAAM,aAAa,SAAS,CAAC,MAAM,aAAa,MAAM,CAAC;AACvD,UAAM,aAAa,iBAAiB,UAAU;AAE9C,UAAM,YAAY,CAAC,MAAc,EAAE,QAAQ,SAAS,EAAE;AACtD,UAAM,SAAS,UAAU,MAAM;AAC/B,UAAM,WAAW,WAAW,KAAK,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,UAAU,UAAU,GAAG,KAAK,EAAE,SAAS,MAAM,CAAC;AAC/G,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,iBAAiB,MAAM,0BAA0B,WAAW,MAAM,aAAa;AAC9G,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,SAAS,SAAS,CAAC,MAAM,aAAa,UAAU,MAAM,CAAC;AAC7D,WAAO,mBAAmB,MAAM;AAAA,EAElC,SAAS,KAAK;AACZ,UAAM,SAAU,IAAc;AAC9B,QAAI,OAAO,SAAS,gBAAgB,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,YAAY,GAAG;AACtG,aAAO,eAAe;AAAA,IACxB;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,wBAAwB,WAAmB,QAAiC;AACzF,QAAM,WAAW,MAAM,MAAM,GAAG,SAAS,eAAe;AAAA,IACtD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,MAAM;AAAA,MAC/B,gBAAgB;AAAA,IAClB;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,8BAA8B,SAAS,MAAM,IAAI,MAAM,SAAS,KAAK,CAAC,EAAE;AAAA,EAC1F;AACA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,KAAK,OAAO;AACf,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO,KAAK;AACd;AAMA,eAAsB,SAAS,UAAiC;AAC9D,UAAQ,IAAI,4CAA4C;AAGxD,MAAI;AACF,UAAM,UAAU,SAAS,CAAC,WAAW,CAAC,EAAE,KAAK;AAC7C,YAAQ,IAAI,aAAa,OAAO,EAAE;AAAA,EACpC,QAAQ;AACN,YAAQ,MAAM,yEAAyE;AACvF,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,MAAI;AACF,aAAS,CAAC,QAAQ,CAAC;AACnB,YAAQ,IAAI,uBAAuB;AAAA,EACrC,QAAQ;AACN,YAAQ,MAAM,+DAA+D;AAC7E,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,OAAO,aAAa,QAAQ;AAClC,UAAQ,IAAI,kBAAkB,IAAI;AAAA,CAAI;AAGtC,UAAQ,IAAI,yBAAyB;AACrC,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,SAAS,CAAC,MAAM,UAAU,IAAI,CAAC;AAChD,WAAO,UAAU,QAAQ;AACzB,YAAQ,IAAI,wBAAwB,IAAI;AAAA,CAAI;AAAA,EAC9C,SAAS,KAAK;AACZ,UAAM,SAAU,IAAc;AAC9B,QAAI,OAAO,SAAS,gBAAgB,GAAG;AACrC,cAAQ,IAAI,8CAA8C;AAC1D,YAAM,aAAa,SAAS,CAAC,MAAM,QAAQ,QAAQ,CAAC;AACpD,YAAM,YAAY,KAAK,MAAM,UAAU;AACvC,YAAM,WAAW,UAAU,KAAK,CAAC,OAAO,GAAG,SAAS,IAAI;AACxD,UAAI,CAAC,UAAU;AACb,gBAAQ,MAAM,gBAAgB,IAAI,8CAA8C;AAChF,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO,SAAS;AAChB,cAAQ,IAAI,wBAAwB,IAAI;AAAA,CAAI;AAAA,IAC9C,OAAO;AACL,cAAQ,MAAM,iCAAiC,MAAM,EAAE;AACvD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,UAAQ,IAAI,6BAA6B;AACzC,MAAI;AACF,aAAS,CAAC,aAAa,UAAU,GAAG,IAAI,YAAY,gBAAgB,sBAAsB,YAAY,gBAAgB,CAAC;AACvH,YAAQ,IAAI,2BAA2B;AAAA,EACzC,SAAS,KAAK;AACZ,UAAM,SAAU,IAAc;AAC9B,QAAI,OAAO,SAAS,gBAAgB,KAAK,OAAO,SAAS,gBAAgB,GAAG;AAC1E,cAAQ,IAAI,2CAA2C;AAAA,IACzD,OAAO;AACL,cAAQ,MAAM,qCAAqC,MAAM,EAAE;AAC3D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,UAAQ,IAAI,sCAAsC;AAClD,MAAI;AACJ,MAAI;AACF,WAAO,kBAAkB,IAAI;AAC7B,YAAQ,IAAI,uBAAuB,IAAI;AAAA,CAAI;AAAA,EAC7C,SAAS,KAAK;AACZ,YAAQ,MAAM,kCAAmC,IAAc,OAAO,EAAE;AACxE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,SAASC,QAAO,YAAY,aAAa,EAAE,SAAS,KAAK;AAG/D,UAAQ,IAAI,gCAAgC;AAC5C,QAAM,YAAY,iBAAiB,UAAU,MAAM,IAAI;AAGvD,UAAQ,IAAI,2BAA2B;AACvC,MAAI;AACF,gBAAY,CAAC,UAAU,OAAO,qBAAqB,UAAU,IAAI,GAAG;AAAA,MAClE,KAAK;AAAA,MACL,OAAO;AAAA,MACP,WAAW;AAAA,IACb,CAAC;AACD,YAAQ,IAAI,cAAc;AAAA,EAC5B,SAAS,KAAK;AACZ,YAAQ,MAAM,iCAAkC,IAAc,OAAO,EAAE;AACvE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,UAAQ,IAAI,qBAAqB;AACjC,MAAI;AACJ,MAAI;AACF,UAAM,eAAe,SAAS,CAAC,QAAQ,GAAG,EAAE,KAAK,UAAU,CAAC;AAC5D,gBAAY,eAAe,YAAY;AACvC,YAAQ,IAAI,oBAAoB,SAAS;AAAA,CAAI;AAAA,EAC/C,SAAS,KAAK;AACZ,YAAQ,MAAM,4BAA6B,IAAc,OAAO,EAAE;AAClE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,UAAQ,IAAI,+BAA+B;AAC3C,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,0BAA4B;AAClE,UAAM,mBAAmB,MAAM,aAAa,QAAQ;AACpD,UAAM,MAAM,GAAG,SAAS,WAAW;AAAA,MACjC,QAAQ;AAAA,MACR,SAAS,EAAE,iBAAiB,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,MACnF,MAAM,KAAK,UAAU;AAAA,QACnB,WAAW;AAAA,QACX,iBAAiB;AAAA,QACjB,sBAAsB;AAAA,QACtB,YAAY,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAAA,QAChD,YAAY;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD,YAAQ,IAAI,qBAAqB;AAAA,EACnC,QAAQ;AACN,YAAQ,IAAI,mDAAmD;AAAA,EACjE;AAEA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,wBAAwB,WAAW,MAAM;AAAA,EAC5D,QAAQ;AAAA,EAER;AAGA,mBAAiB,UAAU;AAAA,IACzB,SAAS;AAAA,IACT,YAAY;AAAA,EACd,CAAC;AACD,cAAY,UAAU,qBAAqB,MAAM;AACjD,MAAI,SAAU,aAAY,UAAU,uBAAuB,QAAQ;AACnE,mBAAiB,UAAU;AAAA,IACzB,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,iBAAiB,sBAAsB;AAAA,IACvC,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC,gBAAgB;AAAA,EAClB,CAAC;AAED,UAAQ,IAAI,yBAAyB;AACrC,UAAQ,IAAI,cAAc,SAAS,EAAE;AACrC,UAAQ,IAAI,cAAc,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,OAAO,MAAM,EAAE,CAAC,EAAE;AACpE,MAAI,UAAU;AACZ,YAAQ,IAAI,cAAc,SAAS,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,EAAE;AAAA,EAC1E;AACA,UAAQ,IAAI,iEAAiE;AAC/E;AAiBO,SAAS,cAAc,UAAiC;AAC7D,QAAM,SAAS,WAAW,QAAQ;AAClC,MAAI,CAAC,OAAO,KAAK,YAAY;AAC3B,WAAO,EAAE,SAAS,OAAO,OAAO,+CAA+C;AAAA,EACjF;AAEA,yBAAuB,QAAQ;AAC/B,QAAM,YAAY,iBAAiB,QAAQ;AAC3C,QAAM,WAAWF,MAAK,KAAK,WAAW,eAAe;AAErD,MAAI,CAACC,IAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO,EAAE,SAAS,OAAO,OAAO,qDAAqD;AAAA,EACvF;AAGA,QAAM,eAAeA,IAAG,aAAa,UAAU,OAAO;AACtD,QAAM,UAAU,aAAa,MAAM,gBAAgB;AACnD,MAAI,CAAC,WAAW,QAAQ,CAAC,MAAM,yBAAyB;AACtD,WAAO,EAAE,SAAS,OAAO,OAAO,gFAAgF;AAAA,EAClH;AACA,QAAM,OAAO,QAAQ,CAAC;AAEtB,QAAM,YAAY,aAAa,MAAM,wBAAwB;AAC7D,QAAM,cAAc,aAAa,MAAM,+BAA+B;AACtE,QAAM,iBAAiB,aAAa,MAAM,4BAA4B;AACtE,QAAM,aAAa,YAAY,CAAC,KAAK,aAAa,QAAQ;AAG1D,QAAM,UAAU,aAAa,MAAM,gBAAgB;AACnD,MAAI;AACJ,MAAI,SAAS;AACX,WAAO,QAAQ,CAAC;AAAA,EAClB,OAAO;AACL,QAAI;AACF,aAAO,kBAAkB,UAAU;AAAA,IACrC,SAAS,KAAK;AACZ,aAAO,EAAE,SAAS,OAAO,OAAO,qCAAsC,IAAc,OAAO,GAAG;AAAA,IAChG;AAAA,EACF;AAEA,MAAI;AACF,uBAAmB;AAAA,MACjB,WAAW,mBAAmB;AAAA,MAC9B;AAAA,MACA,aAAa,CAAC;AAAA,QACZ,UAAU;AAAA,QACV,YAAY;AAAA,UACV,CAAC,SAAS,KAAK,QAAQ,iBAAiB,WAAW,UAAU,GAAG;AAAA,UAChE,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,UACtD,CAAC,SAAS,KAAK,QAAQ,oBAAoB,oBAAoB,cAAc,CAAC,KAAK,UAAU,GAAG;AAAA,UAChG,CAAC,SAAS,KAAK,QAAQ,uBAAuB,iBAAiB,iBAAiB,CAAC,KAAK,GAAG,UAAU,UAAU,GAAG;AAAA,UAChH,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,UACtD,CAAC,SAAS,KAAK,QAAQ,iCAAiC,gCAAgC,sBAAsB,CAAC,GAAG;AAAA,UAClH,CAAC,SAAS,KAAK,QAAQ,gCAAgC,0BAA0B,qBAAqB,CAAC,GAAG;AAAA,QAC5G;AAAA,MACF,CAAC;AAAA,MACD,sBAAsB,8BAA8B;AAAA,IACtD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,0CAA2C,IAAc,OAAO,GAAG;AAAA,EACrG;AAGA,QAAM,UAAU,YAAY,QAAQ;AACpC,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,MAAI,QAAQ;AACV,QAAI;AACF,kBAAY,CAAC,UAAU,OAAO,qBAAqB,UAAU,UAAU,GAAG;AAAA,QACxE,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,MACb,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,MAAI;AACF,UAAM,eAAe,SAAS,CAAC,QAAQ,GAAG,EAAE,KAAK,UAAU,CAAC;AAC5D,UAAM,YAAY,eAAe,YAAY;AAC7C,UAAM,UAAU,sBAAsB;AAEtC,qBAAiB,UAAU;AAAA,MACzB,YAAY;AAAA,IACd,CAAC;AACD,UAAM,cAAc,gBAAgB,QAAQ;AAC5C,QAAI,aAAa;AACf,uBAAiB,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,iBAAiB;AAAA,QACjB,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,MACxC,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,SAAS,MAAM,YAAY,WAAW,QAAQ;AAAA,EACzD,SAAS,KAAK;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,4BAA6B,IAAc,OAAO,GAAG;AAAA,EACvF;AACF;AAMA,eAAsB,YAAY,UAAiC;AACjE,UAAQ,IAAI,iCAAiC;AAC7C,QAAM,SAAS,cAAc,QAAQ;AACrC,MAAI,CAAC,OAAO,SAAS;AACnB,YAAQ,MAAM,OAAO,KAAK;AAC1B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,UAAQ,IAAI,oBAAoB,OAAO,UAAU,EAAE;AACnD,UAAQ,IAAI,YAAY,OAAO,OAAO,EAAE;AACxC,UAAQ,IAAI,qBAAqB;AACnC;","names":["crypto","fs","path","fs","path","fs","path","path","fs","crypto","path","fs","path","fs","crypto"]}
+{"version":3,"sources":["../../myco-team/src/cli.ts","../src/config/secrets.ts","../../myco-deploy/src/cloudflare.ts","../../myco-deploy/src/local-config.ts"],"sourcesContent":["/**\n * CLI team commands — provision and manage Cloudflare team sync infrastructure.\n *\n * `myco team init`    — Provision D1 database, Vectorize index, deploy worker.\n * `myco team upgrade` — Redeploy worker with updated source.\n */\n\nimport crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { CONFIG_FILENAME, loadConfig, updateTeamConfig } from '@myco/config/loader.js';\nimport { writeSecret, readSecrets } from '@myco/config/secrets.js';\nimport { WRANGLER_COMMAND_TIMEOUT_MS, TEAM_API_KEY_SECRET, TEAM_MCP_TOKEN_SECRET } from '@myco/constants.js';\nimport { SCHEMA_VERSION } from '@myco/db/schema.js';\nimport {\n  extractJsonArray,\n  installDeploymentDeps,\n  maskSecret,\n  parseD1Id,\n  parseKvNamespaceId,\n  parseWorkerUrl,\n  readJsonConfig,\n  resolveHomeConfigPath,\n  resolveVaultConfigPath,\n  runWrangler,\n  stageDeploymentDir,\n  writeJsonConfig,\n} from '@myco-deploy/index.js';\n\ndeclare const __MYCO_TEAM_VERSION__: string;\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Number of random bytes for API key generation. */\nconst API_KEY_BYTES = 32;\n\n/** Vectorize index dimensions (must match the embedding model). */\nconst VECTORIZE_DIMENSIONS = '1024';\n\n/** Vectorize distance metric. */\nconst VECTORIZE_METRIC = 'cosine';\n\n/** Prefix for team resource names. */\nconst TEAM_RESOURCE_PREFIX = 'myco-team';\n\n/** Length of the project hash suffix for unique resource naming. */\nconst PROJECT_HASH_LENGTH = 8;\n\n\n/** Source directory for worker files (relative to package root). */\nconst WORKER_SOURCE_DIR = 'worker';\n\n/** Team sync state directory within the vault. */\nconst TEAM_STATE_DIR = 'team';\nconst TEAM_DEPLOY_DIR = 'worker';\nconst TEAM_CONFIG_FILE = 'config.json';\nconst LEGACY_TEAM_CONFIG_DIR = '.myco-team';\nconst LEGACY_TEAM_DEPLOY_DIR = '.team-worker';\nconst TEAM_CONFIG_VERSION = 1;\nconst TEAM_MCP_ROTATION_RETRY_ATTEMPTS = 10;\nconst TEAM_MCP_ROTATION_RETRY_DELAY_MS = 1500;\n\n/** Regex to match wrangler.toml name field. */\nconst TOML_NAME_REGEX = /^name\\s*=\\s*\"[^\"]*\"/m;\n\n/** Regex to match wrangler.toml D1 placeholder. */\nconst TOML_D1_PLACEHOLDER_REGEX = /<YOUR_D1_DATABASE_ID>/g;\n\n/** Regex to match wrangler.toml database_name field. */\nconst TOML_DB_NAME_REGEX = /database_name\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match wrangler.toml index_name field. */\nconst TOML_INDEX_NAME_REGEX = /index_name\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match wrangler.toml team package version placeholder. */\nconst TOML_TEAM_PACKAGE_VERSION_REGEX = /MYCO_TEAM_PACKAGE_VERSION\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match wrangler.toml Myco schema version placeholder. */\nconst TOML_MYCO_SCHEMA_VERSION_REGEX = /MYCO_SCHEMA_VERSION\\s*=\\s*\"[^\"]*\"/g;\n\n/** Regex to match database_id in existing wrangler.toml. */\nconst TOML_DB_ID_REGEX = /database_id\\s*=\\s*\"([^\"]+)\"/;\n\n/** Regex to match wrangler.toml KV namespace placeholder. */\nconst TOML_KV_PLACEHOLDER_REGEX = /<YOUR_KV_NAMESPACE_ID>/g;\n\n/** Regex to extract the KV namespace ID from an existing wrangler.toml. */\nconst TOML_KV_ID_REGEX = /\\[\\[kv_namespaces\\]\\][\\s\\S]*?id\\s*=\\s*\"([0-9a-f]+)\"/;\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Generate a project hash from vault dir for unique resource naming. */\nfunction projectHash(vaultDir: string): string {\n  const hash = crypto.createHash('sha256').update(vaultDir).digest('hex');\n  return hash.slice(0, PROJECT_HASH_LENGTH);\n}\n\n/** Build the unique resource name for this project's team infrastructure. */\nfunction resourceName(vaultDir: string): string {\n  return `${TEAM_RESOURCE_PREFIX}-${projectHash(vaultDir)}`;\n}\n\nfunction resolvePackageRoot(): string {\n  const override = process.env.MYCO_TEAM_PACKAGE_ROOT?.trim();\n  if (override) return override;\n  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');\n}\n\nexport function getTeamPackageVersion(): string {\n  if (typeof __MYCO_TEAM_VERSION__ !== 'undefined') {\n    return __MYCO_TEAM_VERSION__;\n  }\n\n  const packageRoot = resolvePackageRoot();\n  const candidatePaths = [\n    path.join(packageRoot, 'package.json'),\n    path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'package.json'),\n  ];\n\n  for (const candidatePath of candidatePaths) {\n    if (!fs.existsSync(candidatePath)) continue;\n    const packageJson = JSON.parse(fs.readFileSync(candidatePath, 'utf-8')) as { version?: string };\n    if (packageJson.version) return packageJson.version;\n  }\n\n  return '0.1.0';\n}\n\nfunction getMycoSchemaVersion(): string {\n  return String(SCHEMA_VERSION);\n}\n\nexport interface TeamLocalConfig {\n  worker_name: string;\n  worker_url: string;\n  package_version: string;\n  created_at: string;\n  last_upgraded: string;\n  config_version: number;\n}\n\ninterface LegacyTeamLocalConfig extends TeamLocalConfig {\n  api_key?: string;\n  mcp_token?: string | null;\n  vault_dir?: string;\n}\n\nfunction resolveLocalConfigPath(vaultDir: string): string {\n  return resolveVaultConfigPath(vaultDir, TEAM_STATE_DIR, TEAM_CONFIG_FILE);\n}\n\nfunction resolveLegacyLocalConfigPath(): string {\n  return resolveHomeConfigPath(LEGACY_TEAM_CONFIG_DIR, TEAM_CONFIG_FILE);\n}\n\nfunction resolveDeployDir(vaultDir: string): string {\n  return path.join(vaultDir, TEAM_STATE_DIR, TEAM_DEPLOY_DIR);\n}\n\nfunction resolveLegacyDeployDir(vaultDir: string): string {\n  return path.join(vaultDir, LEGACY_TEAM_DEPLOY_DIR);\n}\n\nfunction writeLocalConfig(vaultDir: string, config: TeamLocalConfig): void {\n  writeJsonConfig(resolveLocalConfigPath(vaultDir), config);\n}\n\nfunction migrateLegacyDeployDir(vaultDir: string): void {\n  const legacyDeployDir = resolveLegacyDeployDir(vaultDir);\n  const nextDeployDir = resolveDeployDir(vaultDir);\n  if (!fs.existsSync(legacyDeployDir) || fs.existsSync(nextDeployDir)) return;\n\n  fs.mkdirSync(path.dirname(nextDeployDir), { recursive: true });\n  fs.renameSync(legacyDeployDir, nextDeployDir);\n}\n\nfunction readLocalConfig(vaultDir: string): TeamLocalConfig | null {\n  const config = readJsonConfig<TeamLocalConfig>(resolveLocalConfigPath(vaultDir));\n  if (config) {\n    migrateLegacyDeployDir(vaultDir);\n    return config;\n  }\n\n  const legacyConfig = readJsonConfig<LegacyTeamLocalConfig>(resolveLegacyLocalConfigPath());\n  if (!legacyConfig) return null;\n  if (legacyConfig.vault_dir && legacyConfig.vault_dir !== vaultDir) return null;\n\n  const migrated: TeamLocalConfig = {\n    worker_name: legacyConfig.worker_name,\n    worker_url: legacyConfig.worker_url,\n    package_version: legacyConfig.package_version,\n    created_at: legacyConfig.created_at,\n    last_upgraded: legacyConfig.last_upgraded,\n    config_version: legacyConfig.config_version ?? TEAM_CONFIG_VERSION,\n  };\n  writeLocalConfig(vaultDir, migrated);\n  if (legacyConfig.api_key) writeSecret(vaultDir, TEAM_API_KEY_SECRET, legacyConfig.api_key);\n  if (legacyConfig.mcp_token) writeSecret(vaultDir, TEAM_MCP_TOKEN_SECRET, legacyConfig.mcp_token);\n  migrateLegacyDeployDir(vaultDir);\n  return migrated;\n}\n\nfunction requireLocalConfig(vaultDir: string): TeamLocalConfig {\n  const config = readLocalConfig(vaultDir);\n  if (config) return config;\n\n  console.error(`No local myco-team config found at ${resolveLocalConfigPath(vaultDir)}`);\n  process.exit(1);\n}\n\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nasync function rotateMcpTokenWithRetry(workerUrl: string, apiKey: string): Promise<string> {\n  let lastError: Error | null = null;\n\n  for (let attempt = 1; attempt <= TEAM_MCP_ROTATION_RETRY_ATTEMPTS; attempt += 1) {\n    try {\n      return await rotateMcpTokenForWorker(workerUrl, apiKey);\n    } catch (error) {\n      lastError = error as Error;\n      const isRetryable =\n        lastError.message.includes('401') &&\n        lastError.message.includes('Invalid API key') &&\n        attempt < TEAM_MCP_ROTATION_RETRY_ATTEMPTS;\n      if (!isRetryable) {\n        throw lastError;\n      }\n      await delay(TEAM_MCP_ROTATION_RETRY_DELAY_MS);\n    }\n  }\n\n  throw lastError ?? new Error('MCP token rotation failed');\n}\n\n/** Run a wrangler command and return stdout. Throws on failure, surfacing stderr. */\nfunction wrangler(args: string[], options?: { cwd?: string }): string {\n  return runWrangler(args, { cwd: options?.cwd, timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS });\n}\n\n/** Find the worker source directory. Checks dist layout first (installed), then source layout (dev). */\nfunction locateWorkerSource(): string {\n  const root = resolvePackageRoot();\n  const distPath = path.join(root, 'dist', WORKER_SOURCE_DIR);\n  if (fs.existsSync(distPath)) return distPath;\n  const srcPath = path.join(root, WORKER_SOURCE_DIR);\n  if (fs.existsSync(srcPath)) return srcPath;\n  throw new Error(`Cannot find ${WORKER_SOURCE_DIR} — are you running from the myco-team package?`);\n}\n\n/**\n * Copy worker source to the vault deployment directory and patch wrangler.toml\n * with actual D1 database ID and resource names.\n */\nfunction prepareDeployDir(vaultDir: string, d1Id: string, kvId: string): string {\n  const srcDir = locateWorkerSource();\n  const deployDir = resolveDeployDir(vaultDir);\n  const name = resourceName(vaultDir);\n  return stageDeploymentDir({\n    sourceDir: srcDir,\n    deployDir,\n    reset: true,\n    textPatches: [{\n      filePath: 'wrangler.toml',\n      transforms: [\n        (toml) => toml.replace(TOML_NAME_REGEX, `name = \"${name}\"`),\n        (toml) => toml.replace(TOML_D1_PLACEHOLDER_REGEX, d1Id),\n        (toml) => toml.replace(TOML_DB_NAME_REGEX, `database_name = \"${name}\"`),\n        (toml) => toml.replace(TOML_INDEX_NAME_REGEX, `index_name = \"${name}-vectors\"`),\n        (toml) => toml.replace(TOML_KV_PLACEHOLDER_REGEX, kvId),\n        (toml) => toml.replace(TOML_TEAM_PACKAGE_VERSION_REGEX, `MYCO_TEAM_PACKAGE_VERSION = \"${getTeamPackageVersion()}\"`),\n        (toml) => toml.replace(TOML_MYCO_SCHEMA_VERSION_REGEX, `MYCO_SCHEMA_VERSION = \"${getMycoSchemaVersion()}\"`),\n      ],\n    }],\n    installDepsTimeoutMs: WRANGLER_COMMAND_TIMEOUT_MS * 3,\n  });\n}\n\n/** Ensure a KV namespace exists for this project. Returns the namespace ID. */\nfunction ensureKvNamespace(name: string): string {\n  const kvName = `${name}-secrets`;\n  const lookupExisting = (): string => {\n    const listOutput = wrangler(['kv', 'namespace', 'list']);\n    const namespaces = extractJsonArray(listOutput) as Array<{ id: string; title: string }>;\n    // Wrangler sometimes rewrites hyphens to underscores in titles\n    const normalize = (s: string) => s.replace(/[-_]/g, '');\n    const target = normalize(kvName);\n    const existing = namespaces.find((ns) => normalize(ns.title) === target || normalize(ns.title).endsWith(target));\n    if (!existing) throw new Error(`KV namespace \"${kvName}\" not found in list of ${namespaces.length} namespaces`);\n    return existing.id;\n  };\n\n  try {\n    const output = wrangler(['kv', 'namespace', 'create', kvName]);\n    return parseKvNamespaceId(output);\n    // Created successfully but we couldn't parse — fall back to list lookup\n  } catch (err) {\n    const errMsg = (err as Error).message;\n    if (errMsg.includes('already exists') || errMsg.includes('duplicate') || errMsg.includes('same title')) {\n      return lookupExisting();\n    }\n    throw err;\n  }\n}\n\nasync function rotateMcpTokenForWorker(workerUrl: string, apiKey: string): Promise<string> {\n  const response = await fetch(`${workerUrl}/mcp/rotate`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      'Content-Type': 'application/json',\n    },\n  });\n  if (!response.ok) {\n    throw new Error(`MCP token rotation failed: ${response.status} ${await response.text()}`);\n  }\n  const body = await response.json() as { token?: string };\n  if (!body.token) {\n    throw new Error('MCP token rotation response did not include a token');\n  }\n  return body.token;\n}\n\n// ---------------------------------------------------------------------------\n// Commands\n// ---------------------------------------------------------------------------\n\nexport async function teamInit(vaultDir: string): Promise<void> {\n  console.log('Provisioning team sync infrastructure...\\n');\n\n  // 1. Check for wrangler\n  try {\n    const version = wrangler(['--version']).trim();\n    console.log(`wrangler: ${version}`);\n  } catch {\n    console.error('Error: wrangler CLI not found. Install it with: npm install -g wrangler');\n    process.exit(1);\n  }\n\n  // 2. Check auth\n  try {\n    wrangler(['whoami']);\n    console.log('Cloudflare auth: OK\\n');\n  } catch {\n    console.error('Error: Not authenticated with Cloudflare. Run: wrangler login');\n    process.exit(1);\n  }\n\n  const name = resourceName(vaultDir);\n  console.log(`Resource name: ${name}\\n`);\n\n  // 3. Create D1 database (or reuse existing)\n  console.log('Creating D1 database...');\n  let d1Id: string;\n  try {\n    const d1Output = wrangler(['d1', 'create', name]);\n    d1Id = parseD1Id(d1Output);\n    console.log(`D1 database created: ${d1Id}\\n`);\n  } catch (err) {\n    const errMsg = (err as Error).message;\n    if (errMsg.includes('already exists')) {\n      console.log('D1 database already exists, looking up ID...');\n      const listOutput = wrangler(['d1', 'list', '--json']);\n      const databases = JSON.parse(listOutput) as Array<{ name: string; uuid: string }>;\n      const existing = databases.find((db) => db.name === name);\n      if (!existing) {\n        console.error(`D1 database \"${name}\" reported as existing but not found in list`);\n        process.exit(1);\n      }\n      d1Id = existing.uuid;\n      console.log(`Reusing D1 database: ${d1Id}\\n`);\n    } else {\n      console.error(`Failed to create D1 database: ${errMsg}`);\n      process.exit(1);\n    }\n  }\n\n  // 4. Create Vectorize index (or reuse existing)\n  console.log('Creating Vectorize index...');\n  try {\n    wrangler(['vectorize', 'create', `${name}-vectors`, '--dimensions', VECTORIZE_DIMENSIONS, '--metric', VECTORIZE_METRIC]);\n    console.log('Vectorize index created\\n');\n  } catch (err) {\n    const errMsg = (err as Error).message;\n    if (errMsg.includes('already exists') || errMsg.includes('duplicate_name')) {\n      console.log('Vectorize index already exists, reusing\\n');\n    } else {\n      console.error(`Failed to create Vectorize index: ${errMsg}`);\n      process.exit(1);\n    }\n  }\n\n  // 5. Create KV namespace for runtime secrets (MCP tokens)\n  console.log('Creating KV namespace for secrets...');\n  let kvId: string;\n  try {\n    kvId = ensureKvNamespace(name);\n    console.log(`KV namespace ready: ${kvId}\\n`);\n  } catch (err) {\n    console.error(`Failed to create KV namespace: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  // 6. Generate API key\n  const apiKey = crypto.randomBytes(API_KEY_BYTES).toString('hex');\n\n  // 7. Prepare deployment directory\n  console.log('Preparing worker deployment...');\n  const deployDir = prepareDeployDir(vaultDir, d1Id, kvId);\n\n  // 7. Set API key secret via wrangler\n  console.log('Setting API key secret...');\n  try {\n    runWrangler(['secret', 'put', TEAM_API_KEY_SECRET, '--name', name], {\n      cwd: deployDir,\n      input: apiKey,\n      timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS,\n    });\n    console.log('Secret set\\n');\n  } catch (err) {\n    console.error(`Failed to set API key secret: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  // 8. Deploy worker\n  console.log('Deploying worker...');\n  let workerUrl: string;\n  try {\n    const deployOutput = wrangler(['deploy'], { cwd: deployDir });\n    workerUrl = parseWorkerUrl(deployOutput);\n    console.log(`Worker deployed: ${workerUrl}\\n`);\n  } catch (err) {\n    console.error(`Failed to deploy worker: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  // 9. Seed team config in the Worker\n  console.log('Setting team configuration...');\n  try {\n    const { getMachineId } = await import('@myco/daemon/machine-id.js');\n    const creatorMachineId = await getMachineId(vaultDir);\n    await fetch(`${workerUrl}/config`, {\n      method: 'PUT',\n      headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' },\n      body: JSON.stringify({\n        team_name: name,\n        embedding_model: '@cf/baai/bge-m3',\n        embedding_dimensions: '1024',\n        created_at: String(Math.floor(Date.now() / 1000)),\n        created_by: creatorMachineId,\n      }),\n    });\n    console.log('Team config saved\\n');\n  } catch {\n    console.log('Warning: could not seed team config (non-fatal)\\n');\n  }\n\n  let mcpToken: string | null = null;\n  try {\n    mcpToken = await rotateMcpTokenForWorker(workerUrl, apiKey);\n  } catch {\n    // Non-fatal. The daemon can also fetch the token later through /connect.\n  }\n\n  // 10. Save config and API key locally\n  updateTeamConfig(vaultDir, {\n    enabled: true,\n    worker_url: workerUrl,\n  });\n  writeSecret(vaultDir, TEAM_API_KEY_SECRET, apiKey);\n  if (mcpToken) writeSecret(vaultDir, TEAM_MCP_TOKEN_SECRET, mcpToken);\n  writeLocalConfig(vaultDir, {\n    worker_name: name,\n    worker_url: workerUrl,\n    package_version: getTeamPackageVersion(),\n    created_at: new Date().toISOString(),\n    last_upgraded: new Date().toISOString(),\n    config_version: TEAM_CONFIG_VERSION,\n  });\n\n  console.log('Team sync configured!\\n');\n  console.log(`  URL:     ${workerUrl}`);\n  console.log(`  API Key: ${apiKey.slice(0, 8)}...${apiKey.slice(-4)}`);\n  if (mcpToken) {\n    console.log(`  MCP:     ${mcpToken.slice(0, 8)}...${mcpToken.slice(-4)}`);\n  }\n  console.log('\\nShare the URL and API key with teammates so they can connect.');\n}\n\n// ---------------------------------------------------------------------------\n// Shared upgrade logic (used by CLI and daemon API)\n// ---------------------------------------------------------------------------\n\nexport interface UpgradeResult {\n  success: boolean;\n  worker_url?: string;\n  version?: string;\n  error?: string;\n}\n\n/**\n * Upgrade the team sync worker: re-copy source, patch config, redeploy.\n * Returns a result instead of calling process.exit — safe for both CLI and daemon.\n */\nexport function upgradeWorker(vaultDir: string): UpgradeResult {\n  const config = loadConfig(vaultDir);\n  if (!config.team.worker_url) {\n    return { success: false, error: 'No team sync configured. Run: myco team init' };\n  }\n\n  migrateLegacyDeployDir(vaultDir);\n  const deployDir = resolveDeployDir(vaultDir);\n  const tomlPath = path.join(deployDir, 'wrangler.toml');\n\n  if (!fs.existsSync(tomlPath)) {\n    return { success: false, error: 'No deployment directory found. Run: myco team init' };\n  }\n\n  // Read ALL existing resource identifiers from current wrangler.toml.\n  const existingToml = fs.readFileSync(tomlPath, 'utf-8');\n  const d1Match = existingToml.match(TOML_DB_ID_REGEX);\n  if (!d1Match || d1Match[1] === '<YOUR_D1_DATABASE_ID>') {\n    return { success: false, error: 'Cannot determine D1 database ID from existing deployment. Run: myco team init' };\n  }\n  const d1Id = d1Match[1];\n\n  const nameMatch = existingToml.match(/^name\\s*=\\s*\"([^\"]*)\"/m);\n  const dbNameMatch = existingToml.match(/database_name\\s*=\\s*\"([^\"]*)\"/);\n  const indexNameMatch = existingToml.match(/index_name\\s*=\\s*\"([^\"]*)\"/);\n  const workerName = nameMatch?.[1] ?? resourceName(vaultDir);\n\n  // KV namespace may not exist on older deployments — create or reuse.\n  const kvMatch = existingToml.match(TOML_KV_ID_REGEX);\n  let kvId: string;\n  if (kvMatch) {\n    kvId = kvMatch[1];\n  } else {\n    try {\n      kvId = ensureKvNamespace(workerName);\n    } catch (err) {\n      return { success: false, error: `Failed to provision KV namespace: ${(err as Error).message}` };\n    }\n  }\n\n  try {\n    stageDeploymentDir({\n      sourceDir: locateWorkerSource(),\n      deployDir,\n      textPatches: [{\n        filePath: 'wrangler.toml',\n        transforms: [\n          (toml) => toml.replace(TOML_NAME_REGEX, `name = \"${workerName}\"`),\n          (toml) => toml.replace(TOML_D1_PLACEHOLDER_REGEX, d1Id),\n          (toml) => toml.replace(TOML_DB_NAME_REGEX, `database_name = \"${dbNameMatch?.[1] ?? workerName}\"`),\n          (toml) => toml.replace(TOML_INDEX_NAME_REGEX, `index_name = \"${indexNameMatch?.[1] ?? `${workerName}-vectors`}\"`),\n          (toml) => toml.replace(TOML_KV_PLACEHOLDER_REGEX, kvId),\n          (toml) => toml.replace(TOML_TEAM_PACKAGE_VERSION_REGEX, `MYCO_TEAM_PACKAGE_VERSION = \"${getTeamPackageVersion()}\"`),\n          (toml) => toml.replace(TOML_MYCO_SCHEMA_VERSION_REGEX, `MYCO_SCHEMA_VERSION = \"${getMycoSchemaVersion()}\"`),\n        ],\n      }],\n      installDepsTimeoutMs: WRANGLER_COMMAND_TIMEOUT_MS * 3,\n    });\n  } catch (err) {\n    return { success: false, error: `Failed to install worker dependencies: ${(err as Error).message}` };\n  }\n\n  // Re-set API key secret before deploy (deploy can wipe secrets)\n  const secrets = readSecrets(vaultDir);\n  const apiKey = secrets[TEAM_API_KEY_SECRET];\n  if (apiKey) {\n    try {\n      runWrangler(['secret', 'put', TEAM_API_KEY_SECRET, '--name', workerName], {\n        cwd: deployDir,\n        input: apiKey,\n        timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS,\n      });\n    } catch {\n      // Non-fatal — secret may already be set\n    }\n  }\n\n  // Redeploy\n  try {\n    const deployOutput = wrangler(['deploy'], { cwd: deployDir });\n    const workerUrl = parseWorkerUrl(deployOutput);\n    const version = getTeamPackageVersion();\n\n    updateTeamConfig(vaultDir, {\n      worker_url: workerUrl,\n    });\n    const localConfig = readLocalConfig(vaultDir);\n    if (localConfig) {\n      writeLocalConfig(vaultDir, {\n        ...localConfig,\n        worker_name: workerName,\n        worker_url: workerUrl,\n        package_version: version,\n        last_upgraded: new Date().toISOString(),\n      });\n    }\n\n    return { success: true, worker_url: workerUrl, version };\n  } catch (err) {\n    return { success: false, error: `Failed to deploy worker: ${(err as Error).message}` };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// CLI wrapper\n// ---------------------------------------------------------------------------\n\nexport async function teamUpgrade(vaultDir: string): Promise<void> {\n  console.log('Upgrading team sync worker...\\n');\n  const result = upgradeWorker(vaultDir);\n  if (!result.success) {\n    console.error(result.error);\n    process.exit(1);\n  }\n  console.log(`Worker deployed: ${result.worker_url}`);\n  console.log(`Version: ${result.version}`);\n  console.log('\\nUpgrade complete.');\n}\n\nexport async function teamStatus(vaultDir: string): Promise<void> {\n  const config = requireLocalConfig(vaultDir);\n  const secrets = readSecrets(vaultDir);\n\n  console.log(`Worker:      ${config.worker_name}`);\n  console.log(`URL:         ${config.worker_url}`);\n  console.log(`API Key:     ${maskSecret(secrets[TEAM_API_KEY_SECRET] ?? null)}`);\n  console.log(`MCP Token:   ${maskSecret(secrets[TEAM_MCP_TOKEN_SECRET] ?? null)}`);\n  console.log(`Package v:   ${config.package_version}`);\n  console.log(`Created:     ${config.created_at}`);\n  console.log(`Upgraded:    ${config.last_upgraded}`);\n  console.log(`Config v:    ${config.config_version}`);\n}\n\nexport async function teamRotateTokens(vaultDir: string, which: 'api' | 'mcp' | 'all' = 'all'): Promise<void> {\n  const config = requireLocalConfig(vaultDir);\n  const secrets = readSecrets(vaultDir);\n  let currentApiKey = secrets[TEAM_API_KEY_SECRET] ?? '';\n  let currentMcpToken = secrets[TEAM_MCP_TOKEN_SECRET] ?? null;\n\n  let nextConfig = { ...config };\n\n  if (which === 'api' || which === 'all') {\n    const apiKey = crypto.randomBytes(API_KEY_BYTES).toString('hex');\n    runWrangler(['secret', 'put', TEAM_API_KEY_SECRET, '--name', config.worker_name], {\n      cwd: resolveDeployDir(vaultDir),\n      input: apiKey,\n      timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS,\n    });\n    writeSecret(vaultDir, TEAM_API_KEY_SECRET, apiKey);\n    currentApiKey = apiKey;\n    nextConfig = {\n      ...nextConfig,\n      package_version: getTeamPackageVersion(),\n      last_upgraded: new Date().toISOString(),\n    };\n    writeLocalConfig(vaultDir, nextConfig);\n  }\n\n  if (which === 'mcp' || which === 'all') {\n    try {\n      currentMcpToken = await rotateMcpTokenWithRetry(config.worker_url, currentApiKey);\n      if (currentMcpToken) writeSecret(vaultDir, TEAM_MCP_TOKEN_SECRET, currentMcpToken);\n    } catch (error) {\n      writeLocalConfig(vaultDir, {\n        ...nextConfig,\n        last_upgraded: new Date().toISOString(),\n      });\n      throw new Error(\n        `API key rotation completed, but MCP token rotation failed. Local config was updated to the new API key.\\n${(error as Error).message}`,\n      );\n    }\n  }\n\n  nextConfig.last_upgraded = new Date().toISOString();\n  writeLocalConfig(vaultDir, nextConfig);\n\n  console.log(`API Key:   ${maskSecret(currentApiKey)}`);\n  console.log(`MCP Token: ${maskSecret(currentMcpToken)}`);\n}\n\nexport async function teamDestroy(vaultDir: string): Promise<void> {\n  const config = requireLocalConfig(vaultDir);\n  const errors: string[] = [];\n  const deployDir = resolveDeployDir(vaultDir);\n\n  try {\n    wrangler(['delete', config.worker_name], { cwd: deployDir });\n  } catch (error) {\n    errors.push(`worker delete failed: ${(error as Error).message}`);\n  }\n\n  try {\n    wrangler(['vectorize', 'delete', `${config.worker_name}-vectors`]);\n  } catch (error) {\n    errors.push(`vectorize delete failed: ${(error as Error).message}`);\n  }\n\n  try {\n    const databases = JSON.parse(wrangler(['d1', 'list', '--json'])) as Array<{ name: string; uuid: string }>;\n    const database = databases.find((entry) => entry.name === config.worker_name);\n    if (database) {\n      wrangler(['d1', 'delete', database.name, '--skip-confirmation']);\n    }\n  } catch (error) {\n    errors.push(`d1 delete failed: ${(error as Error).message}`);\n  }\n\n  try {\n    const namespaces = extractJsonArray(wrangler(['kv', 'namespace', 'list'])) as Array<{ id: string; title: string }>;\n    const namespace = namespaces.find((entry) => entry.title === `${config.worker_name}-secrets`);\n    if (namespace) {\n      wrangler(['kv', 'namespace', 'delete', '--namespace-id', namespace.id, '--skip-confirmation']);\n    }\n  } catch (error) {\n    errors.push(`kv delete failed: ${(error as Error).message}`);\n  }\n\n  if (errors.length > 0) {\n    throw new Error(`Team destroy incomplete. Local state preserved for retry.\\n${errors.join('\\n')}`);\n  }\n\n  fs.rmSync(path.join(vaultDir, TEAM_STATE_DIR), { recursive: true, force: true });\n  console.log(`Destroyed local myco-team state for ${config.worker_name}.`);\n}\n","/**\n * Secrets file utilities for API key storage outside git.\n *\n * Secrets are stored in `secrets.env` inside the vault directory.\n * This file is gitignored (see VAULT_GITIGNORE) and never committed.\n * Format: KEY=value, one per line (same as .env).\n */\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nconst SECRETS_FILE = 'secrets.env';\n\n/** Read all secrets from <vault>/secrets.env as key-value pairs. */\nexport function readSecrets(vaultDir: string): Record<string, string> {\n  const secretsPath = path.join(vaultDir, SECRETS_FILE);\n  if (!fs.existsSync(secretsPath)) return {};\n\n  const secrets: Record<string, string> = {};\n  for (const line of fs.readFileSync(secretsPath, 'utf-8').split('\\n')) {\n    const match = line.match(/^\\s*([^#=]+?)\\s*=\\s*(.*?)\\s*$/);\n    if (match) {\n      secrets[match[1]] = match[2];\n    }\n  }\n  return secrets;\n}\n\n/** Write a secret to <vault>/secrets.env, preserving existing entries. */\nexport function writeSecret(vaultDir: string, key: string, value: string): void {\n  const secretsPath = path.join(vaultDir, SECRETS_FILE);\n  const existing = readSecrets(vaultDir);\n  existing[key] = value;\n\n  const content = Object.entries(existing)\n    .map(([k, v]) => `${k}=${v}`)\n    .join('\\n') + '\\n';\n\n  fs.writeFileSync(secretsPath, content, 'utf-8');\n}\n\n/** Remove one or more secrets from <vault>/secrets.env, preserving remaining entries. */\nexport function deleteSecrets(vaultDir: string, keys: string[]): void {\n  const secretsPath = path.join(vaultDir, SECRETS_FILE);\n  if (!fs.existsSync(secretsPath)) return;\n\n  const existing = readSecrets(vaultDir);\n  for (const key of keys) delete existing[key];\n\n  const entries = Object.entries(existing);\n  if (entries.length === 0) {\n    fs.rmSync(secretsPath, { force: true });\n    return;\n  }\n\n  const content = entries\n    .map(([k, v]) => `${k}=${v}`)\n    .join('\\n') + '\\n';\n\n  fs.writeFileSync(secretsPath, content, 'utf-8');\n}\n\n/** Load secrets from <vault>/secrets.env into process.env (without overwriting existing vars). */\nexport function loadSecrets(vaultDir: string): void {\n  const secrets = readSecrets(vaultDir);\n  for (const [key, value] of Object.entries(secrets)) {\n    if (!process.env[key]) {\n      process.env[key] = value;\n    }\n  }\n}\n","import { execFileSync } from 'node:child_process';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nconst WORKER_URL_REGEX = /(https:\\/\\/[^\\s]+\\.workers\\.dev)/;\nconst D1_ID_JSON_REGEX = /\"database_id\"\\s*:\\s*\"([0-9a-f-]{36})\"/i;\nconst D1_ID_TEXT_REGEX = /id:\\s*([0-9a-f-]{36})/i;\nconst KV_ID_REGEX = /\"id\":\\s*\"([0-9a-f]+)\"/i;\n\nexport interface WranglerOptions {\n  cwd?: string;\n  input?: string;\n  timeoutMs: number;\n}\n\nexport interface TextPatch {\n  filePath: string;\n  transforms: Array<(text: string) => string>;\n}\n\nexport interface StageDeploymentDirOptions {\n  sourceDir: string;\n  deployDir: string;\n  reset?: boolean;\n  extraCopies?: Array<{ sourceDir: string; destinationSubdir: string }>;\n  textPatches?: TextPatch[];\n  installDepsTimeoutMs?: number | null;\n}\n\nexport function buildCommandEnv(): NodeJS.ProcessEnv {\n  const nodeBinDir = path.dirname(process.execPath);\n  const pathValue = process.env.PATH\n    ? `${nodeBinDir}${path.delimiter}${process.env.PATH}`\n    : nodeBinDir;\n  return { ...process.env, PATH: pathValue };\n}\n\nexport function runWrangler(args: string[], options: WranglerOptions): string {\n  try {\n    return execFileSync('wrangler', args, {\n      cwd: options.cwd,\n      env: buildCommandEnv(),\n      input: options.input,\n      encoding: 'utf-8',\n      timeout: options.timeoutMs,\n      stdio: ['pipe', 'pipe', 'pipe'],\n    });\n  } catch (error) {\n    const execError = error as Error & { stderr?: Buffer | string; stdout?: Buffer | string };\n    const stderr = execError.stderr?.toString() ?? '';\n    const stdout = execError.stdout?.toString() ?? '';\n    const detail = [stderr, stdout].filter(Boolean).join('\\n').trim();\n    throw new Error(detail || execError.message);\n  }\n}\n\nexport function installDeploymentDeps(deployDir: string, timeoutMs: number): void {\n  const packageJsonPath = path.join(deployDir, 'package.json');\n  if (!fs.existsSync(packageJsonPath)) return;\n\n  execFileSync('npm', ['install', '--silent', '--no-audit', '--no-fund'], {\n    cwd: deployDir,\n    env: buildCommandEnv(),\n    encoding: 'utf-8',\n    timeout: timeoutMs,\n    stdio: ['pipe', 'pipe', 'pipe'],\n  });\n}\n\nexport function parseWorkerUrl(output: string): string {\n  const workerUrl = output.match(WORKER_URL_REGEX)?.[1];\n  if (!workerUrl) {\n    throw new Error(`Could not parse worker URL from deploy output:\\n${output}`);\n  }\n  return workerUrl;\n}\n\nexport function parseD1Id(output: string): string {\n  const jsonMatch = output.match(D1_ID_JSON_REGEX);\n  if (jsonMatch) return jsonMatch[1];\n\n  const textMatch = output.match(D1_ID_TEXT_REGEX);\n  if (textMatch) return textMatch[1];\n\n  throw new Error(`Could not parse D1 database ID from wrangler output:\\n${output}`);\n}\n\nexport function parseKvNamespaceId(output: string): string {\n  const kvId = output.match(KV_ID_REGEX)?.[1];\n  if (!kvId) {\n    throw new Error(`Could not parse KV namespace ID from wrangler output:\\n${output}`);\n  }\n  return kvId;\n}\n\nexport function extractJsonArray(output: string): unknown[] {\n  const start = output.indexOf('[');\n  const end = output.lastIndexOf(']');\n  if (start === -1 || end === -1 || end < start) {\n    throw new Error(`No JSON array found in output:\\n${output}`);\n  }\n  return JSON.parse(output.slice(start, end + 1)) as unknown[];\n}\n\nexport function stageDeploymentDir(options: StageDeploymentDirOptions): string {\n  if (options.reset) {\n    fs.rmSync(options.deployDir, { recursive: true, force: true });\n  }\n  fs.mkdirSync(options.deployDir, { recursive: true });\n  fs.cpSync(options.sourceDir, options.deployDir, { recursive: true });\n\n  for (const copy of options.extraCopies ?? []) {\n    fs.cpSync(copy.sourceDir, path.join(options.deployDir, copy.destinationSubdir), { recursive: true });\n  }\n\n  for (const patch of options.textPatches ?? []) {\n    const absolutePath = path.join(options.deployDir, patch.filePath);\n    let nextText = fs.readFileSync(absolutePath, 'utf-8');\n    for (const transform of patch.transforms) {\n      nextText = transform(nextText);\n    }\n    fs.writeFileSync(absolutePath, nextText, 'utf-8');\n  }\n\n  if (options.installDepsTimeoutMs) {\n    installDeploymentDeps(options.deployDir, options.installDepsTimeoutMs);\n  }\n\n  return options.deployDir;\n}\n","import crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nconst MYCO_HOME_OVERRIDE_ENV = 'MYCO_HOME_OVERRIDE';\n\nexport function resolveHomeDir(): string {\n  return process.env[MYCO_HOME_OVERRIDE_ENV]?.trim() || os.homedir();\n}\n\nexport function resolveHomeConfigPath(configDir: string, fileName: string): string {\n  return path.join(resolveHomeDir(), configDir, fileName);\n}\n\nexport function resolveNamedHomeConfigPath(configDir: string, name: string, fileName: string): string {\n  return path.join(resolveHomeDir(), configDir, name, fileName);\n}\n\nexport function resolveVaultConfigPath(vaultDir: string, configDir: string, fileName: string): string {\n  return path.join(vaultDir, configDir, fileName);\n}\n\nexport function readJsonConfig<T>(configPath: string): T | null {\n  if (!fs.existsSync(configPath)) return null;\n  return JSON.parse(fs.readFileSync(configPath, 'utf-8')) as T;\n}\n\nexport function writeJsonConfig(configPath: string, value: unknown): void {\n  fs.mkdirSync(path.dirname(configPath), { recursive: true });\n  fs.writeFileSync(configPath, `${JSON.stringify(value, null, 2)}\\n`, { encoding: 'utf-8', mode: 0o600 });\n  fs.chmodSync(configPath, 0o600);\n}\n\nexport function maskSecret(secret: string | null): string | null {\n  if (!secret) return null;\n  if (secret.length <= 8) return secret;\n  return `${secret.slice(0, 4)}...${secret.slice(-4)}`;\n}\n\nexport function createHexToken(byteLength: number): string {\n  return crypto.randomBytes(byteLength).toString('hex');\n}\n"],"mappings":";;;;;;;;;;;;;;;AAOA,OAAOA,aAAY;AACnB,OAAOC,SAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,qBAAqB;;;ACH9B,OAAO,QAAQ;AACf,OAAO,UAAU;AAEjB,IAAM,eAAe;AAGd,SAAS,YAAY,UAA0C;AACpE,QAAM,cAAc,KAAK,KAAK,UAAU,YAAY;AACpD,MAAI,CAAC,GAAG,WAAW,WAAW,EAAG,QAAO,CAAC;AAEzC,QAAM,UAAkC,CAAC;AACzC,aAAW,QAAQ,GAAG,aAAa,aAAa,OAAO,EAAE,MAAM,IAAI,GAAG;AACpE,UAAM,QAAQ,KAAK,MAAM,+BAA+B;AACxD,QAAI,OAAO;AACT,cAAQ,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,YAAY,UAAkB,KAAa,OAAqB;AAC9E,QAAM,cAAc,KAAK,KAAK,UAAU,YAAY;AACpD,QAAM,WAAW,YAAY,QAAQ;AACrC,WAAS,GAAG,IAAI;AAEhB,QAAM,UAAU,OAAO,QAAQ,QAAQ,EACpC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,IAAI,IAAI;AAEhB,KAAG,cAAc,aAAa,SAAS,OAAO;AAChD;AAGO,SAAS,cAAc,UAAkB,MAAsB;AACpE,QAAM,cAAc,KAAK,KAAK,UAAU,YAAY;AACpD,MAAI,CAAC,GAAG,WAAW,WAAW,EAAG;AAEjC,QAAM,WAAW,YAAY,QAAQ;AACrC,aAAW,OAAO,KAAM,QAAO,SAAS,GAAG;AAE3C,QAAM,UAAU,OAAO,QAAQ,QAAQ;AACvC,MAAI,QAAQ,WAAW,GAAG;AACxB,OAAG,OAAO,aAAa,EAAE,OAAO,KAAK,CAAC;AACtC;AAAA,EACF;AAEA,QAAM,UAAU,QACb,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,IAAI,IAAI;AAEhB,KAAG,cAAc,aAAa,SAAS,OAAO;AAChD;AAGO,SAAS,YAAY,UAAwB;AAClD,QAAM,UAAU,YAAY,QAAQ;AACpC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AACrB,cAAQ,IAAI,GAAG,IAAI;AAAA,IACrB;AAAA,EACF;AACF;;;ACrEA,SAAS,oBAAoB;AAC7B,OAAOC,SAAQ;AACf,OAAOC,WAAU;AAEjB,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,cAAc;AAsBb,SAAS,kBAAqC;AACnD,QAAM,aAAaA,MAAK,QAAQ,QAAQ,QAAQ;AAChD,QAAM,YAAY,QAAQ,IAAI,OAC1B,GAAG,UAAU,GAAGA,MAAK,SAAS,GAAG,QAAQ,IAAI,IAAI,KACjD;AACJ,SAAO,EAAE,GAAG,QAAQ,KAAK,MAAM,UAAU;AAC3C;AAEO,SAAS,YAAY,MAAgB,SAAkC;AAC5E,MAAI;AACF,WAAO,aAAa,YAAY,MAAM;AAAA,MACpC,KAAK,QAAQ;AAAA,MACb,KAAK,gBAAgB;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,SAAS,QAAQ;AAAA,MACjB,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,YAAY;AAClB,UAAM,SAAS,UAAU,QAAQ,SAAS,KAAK;AAC/C,UAAM,SAAS,UAAU,QAAQ,SAAS,KAAK;AAC/C,UAAM,SAAS,CAAC,QAAQ,MAAM,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,EAAE,KAAK;AAChE,UAAM,IAAI,MAAM,UAAU,UAAU,OAAO;AAAA,EAC7C;AACF;AAEO,SAAS,sBAAsB,WAAmB,WAAyB;AAChF,QAAM,kBAAkBA,MAAK,KAAK,WAAW,cAAc;AAC3D,MAAI,CAACD,IAAG,WAAW,eAAe,EAAG;AAErC,eAAa,OAAO,CAAC,WAAW,YAAY,cAAc,WAAW,GAAG;AAAA,IACtE,KAAK;AAAA,IACL,KAAK,gBAAgB;AAAA,IACrB,UAAU;AAAA,IACV,SAAS;AAAA,IACT,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,EAChC,CAAC;AACH;AAEO,SAAS,eAAe,QAAwB;AACrD,QAAM,YAAY,OAAO,MAAM,gBAAgB,IAAI,CAAC;AACpD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM;AAAA,EAAmD,MAAM,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,UAAU,QAAwB;AAChD,QAAM,YAAY,OAAO,MAAM,gBAAgB;AAC/C,MAAI,UAAW,QAAO,UAAU,CAAC;AAEjC,QAAM,YAAY,OAAO,MAAM,gBAAgB;AAC/C,MAAI,UAAW,QAAO,UAAU,CAAC;AAEjC,QAAM,IAAI,MAAM;AAAA,EAAyD,MAAM,EAAE;AACnF;AAEO,SAAS,mBAAmB,QAAwB;AACzD,QAAM,OAAO,OAAO,MAAM,WAAW,IAAI,CAAC;AAC1C,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM;AAAA,EAA0D,MAAM,EAAE;AAAA,EACpF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,QAA2B;AAC1D,QAAM,QAAQ,OAAO,QAAQ,GAAG;AAChC,QAAM,MAAM,OAAO,YAAY,GAAG;AAClC,MAAI,UAAU,MAAM,QAAQ,MAAM,MAAM,OAAO;AAC7C,UAAM,IAAI,MAAM;AAAA,EAAmC,MAAM,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,MAAM,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC;AAChD;AAEO,SAAS,mBAAmB,SAA4C;AAC7E,MAAI,QAAQ,OAAO;AACjB,IAAAA,IAAG,OAAO,QAAQ,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC/D;AACA,EAAAA,IAAG,UAAU,QAAQ,WAAW,EAAE,WAAW,KAAK,CAAC;AACnD,EAAAA,IAAG,OAAO,QAAQ,WAAW,QAAQ,WAAW,EAAE,WAAW,KAAK,CAAC;AAEnE,aAAW,QAAQ,QAAQ,eAAe,CAAC,GAAG;AAC5C,IAAAA,IAAG,OAAO,KAAK,WAAWC,MAAK,KAAK,QAAQ,WAAW,KAAK,iBAAiB,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EACrG;AAEA,aAAW,SAAS,QAAQ,eAAe,CAAC,GAAG;AAC7C,UAAM,eAAeA,MAAK,KAAK,QAAQ,WAAW,MAAM,QAAQ;AAChE,QAAI,WAAWD,IAAG,aAAa,cAAc,OAAO;AACpD,eAAW,aAAa,MAAM,YAAY;AACxC,iBAAW,UAAU,QAAQ;AAAA,IAC/B;AACA,IAAAA,IAAG,cAAc,cAAc,UAAU,OAAO;AAAA,EAClD;AAEA,MAAI,QAAQ,sBAAsB;AAChC,0BAAsB,QAAQ,WAAW,QAAQ,oBAAoB;AAAA,EACvE;AAEA,SAAO,QAAQ;AACjB;;;ACjIA,OAAO,YAAY;AACnB,OAAOE,SAAQ;AACf,OAAO,QAAQ;AACf,OAAOC,WAAU;AAEjB,IAAM,yBAAyB;AAExB,SAAS,iBAAyB;AACvC,SAAO,QAAQ,IAAI,sBAAsB,GAAG,KAAK,KAAK,GAAG,QAAQ;AACnE;AAEO,SAAS,sBAAsB,WAAmB,UAA0B;AACjF,SAAOA,MAAK,KAAK,eAAe,GAAG,WAAW,QAAQ;AACxD;AAMO,SAAS,uBAAuB,UAAkB,WAAmB,UAA0B;AACpG,SAAOC,MAAK,KAAK,UAAU,WAAW,QAAQ;AAChD;AAEO,SAAS,eAAkB,YAA8B;AAC9D,MAAI,CAACC,IAAG,WAAW,UAAU,EAAG,QAAO;AACvC,SAAO,KAAK,MAAMA,IAAG,aAAa,YAAY,OAAO,CAAC;AACxD;AAEO,SAAS,gBAAgB,YAAoB,OAAsB;AACxE,EAAAA,IAAG,UAAUD,MAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1D,EAAAC,IAAG,cAAc,YAAY,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,GAAM,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AACtG,EAAAA,IAAG,UAAU,YAAY,GAAK;AAChC;;;AHKA,IAAM,gBAAgB;AAGtB,IAAM,uBAAuB;AAG7B,IAAM,mBAAmB;AAGzB,IAAM,uBAAuB;AAG7B,IAAM,sBAAsB;AAI5B,IAAM,oBAAoB;AAG1B,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,yBAAyB;AAC/B,IAAM,yBAAyB;AAC/B,IAAM,sBAAsB;AAK5B,IAAM,kBAAkB;AAGxB,IAAM,4BAA4B;AAGlC,IAAM,qBAAqB;AAG3B,IAAM,wBAAwB;AAG9B,IAAM,kCAAkC;AAGxC,IAAM,iCAAiC;AAGvC,IAAM,mBAAmB;AAGzB,IAAM,4BAA4B;AAGlC,IAAM,mBAAmB;AAOzB,SAAS,YAAY,UAA0B;AAC7C,QAAM,OAAOC,QAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AACtE,SAAO,KAAK,MAAM,GAAG,mBAAmB;AAC1C;AAGA,SAAS,aAAa,UAA0B;AAC9C,SAAO,GAAG,oBAAoB,IAAI,YAAY,QAAQ,CAAC;AACzD;AAEA,SAAS,qBAA6B;AACpC,QAAM,WAAW,QAAQ,IAAI,wBAAwB,KAAK;AAC1D,MAAI,SAAU,QAAO;AACrB,SAAOC,MAAK,QAAQA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,IAAI;AACxE;AAEO,SAAS,wBAAgC;AAC9C,MAAI,MAA8C;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,mBAAmB;AACvC,QAAM,iBAAiB;AAAA,IACrBA,MAAK,KAAK,aAAa,cAAc;AAAA,IACrCA,MAAK,KAAKA,MAAK,QAAQA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,cAAc;AAAA,EAC5F;AAEA,aAAW,iBAAiB,gBAAgB;AAC1C,QAAI,CAACC,IAAG,WAAW,aAAa,EAAG;AACnC,UAAM,cAAc,KAAK,MAAMA,IAAG,aAAa,eAAe,OAAO,CAAC;AACtE,QAAI,YAAY,QAAS,QAAO,YAAY;AAAA,EAC9C;AAEA,SAAO;AACT;AAEA,SAAS,uBAA+B;AACtC,SAAO,OAAO,cAAc;AAC9B;AAiBA,SAAS,uBAAuB,UAA0B;AACxD,SAAO,uBAAuB,UAAU,gBAAgB,gBAAgB;AAC1E;AAEA,SAAS,+BAAuC;AAC9C,SAAO,sBAAsB,wBAAwB,gBAAgB;AACvE;AAEA,SAAS,iBAAiB,UAA0B;AAClD,SAAOD,MAAK,KAAK,UAAU,gBAAgB,eAAe;AAC5D;AAEA,SAAS,uBAAuB,UAA0B;AACxD,SAAOA,MAAK,KAAK,UAAU,sBAAsB;AACnD;AAEA,SAAS,iBAAiB,UAAkB,QAA+B;AACzE,kBAAgB,uBAAuB,QAAQ,GAAG,MAAM;AAC1D;AAEA,SAAS,uBAAuB,UAAwB;AACtD,QAAM,kBAAkB,uBAAuB,QAAQ;AACvD,QAAM,gBAAgB,iBAAiB,QAAQ;AAC/C,MAAI,CAACC,IAAG,WAAW,eAAe,KAAKA,IAAG,WAAW,aAAa,EAAG;AAErE,EAAAA,IAAG,UAAUD,MAAK,QAAQ,aAAa,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,EAAAC,IAAG,WAAW,iBAAiB,aAAa;AAC9C;AAEA,SAAS,gBAAgB,UAA0C;AACjE,QAAM,SAAS,eAAgC,uBAAuB,QAAQ,CAAC;AAC/E,MAAI,QAAQ;AACV,2BAAuB,QAAQ;AAC/B,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,eAAsC,6BAA6B,CAAC;AACzF,MAAI,CAAC,aAAc,QAAO;AAC1B,MAAI,aAAa,aAAa,aAAa,cAAc,SAAU,QAAO;AAE1E,QAAM,WAA4B;AAAA,IAChC,aAAa,aAAa;AAAA,IAC1B,YAAY,aAAa;AAAA,IACzB,iBAAiB,aAAa;AAAA,IAC9B,YAAY,aAAa;AAAA,IACzB,eAAe,aAAa;AAAA,IAC5B,gBAAgB,aAAa,kBAAkB;AAAA,EACjD;AACA,mBAAiB,UAAU,QAAQ;AACnC,MAAI,aAAa,QAAS,aAAY,UAAU,qBAAqB,aAAa,OAAO;AACzF,MAAI,aAAa,UAAW,aAAY,UAAU,uBAAuB,aAAa,SAAS;AAC/F,yBAAuB,QAAQ;AAC/B,SAAO;AACT;AAqCA,SAAS,SAAS,MAAgB,SAAoC;AACpE,SAAO,YAAY,MAAM,EAAE,KAAK,SAAS,KAAK,WAAW,4BAA4B,CAAC;AACxF;AAGA,SAAS,qBAA6B;AACpC,QAAM,OAAO,mBAAmB;AAChC,QAAM,WAAWC,MAAK,KAAK,MAAM,QAAQ,iBAAiB;AAC1D,MAAIC,IAAG,WAAW,QAAQ,EAAG,QAAO;AACpC,QAAM,UAAUD,MAAK,KAAK,MAAM,iBAAiB;AACjD,MAAIC,IAAG,WAAW,OAAO,EAAG,QAAO;AACnC,QAAM,IAAI,MAAM,eAAe,iBAAiB,qDAAgD;AAClG;AAMA,SAAS,iBAAiB,UAAkB,MAAc,MAAsB;AAC9E,QAAM,SAAS,mBAAmB;AAClC,QAAM,YAAY,iBAAiB,QAAQ;AAC3C,QAAM,OAAO,aAAa,QAAQ;AAClC,SAAO,mBAAmB;AAAA,IACxB,WAAW;AAAA,IACX;AAAA,IACA,OAAO;AAAA,IACP,aAAa,CAAC;AAAA,MACZ,UAAU;AAAA,MACV,YAAY;AAAA,QACV,CAAC,SAAS,KAAK,QAAQ,iBAAiB,WAAW,IAAI,GAAG;AAAA,QAC1D,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,QACtD,CAAC,SAAS,KAAK,QAAQ,oBAAoB,oBAAoB,IAAI,GAAG;AAAA,QACtE,CAAC,SAAS,KAAK,QAAQ,uBAAuB,iBAAiB,IAAI,WAAW;AAAA,QAC9E,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,QACtD,CAAC,SAAS,KAAK,QAAQ,iCAAiC,gCAAgC,sBAAsB,CAAC,GAAG;AAAA,QAClH,CAAC,SAAS,KAAK,QAAQ,gCAAgC,0BAA0B,qBAAqB,CAAC,GAAG;AAAA,MAC5G;AAAA,IACF,CAAC;AAAA,IACD,sBAAsB,8BAA8B;AAAA,EACtD,CAAC;AACH;AAGA,SAAS,kBAAkB,MAAsB;AAC/C,QAAM,SAAS,GAAG,IAAI;AACtB,QAAM,iBAAiB,MAAc;AACnC,UAAM,aAAa,SAAS,CAAC,MAAM,aAAa,MAAM,CAAC;AACvD,UAAM,aAAa,iBAAiB,UAAU;AAE9C,UAAM,YAAY,CAAC,MAAc,EAAE,QAAQ,SAAS,EAAE;AACtD,UAAM,SAAS,UAAU,MAAM;AAC/B,UAAM,WAAW,WAAW,KAAK,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,UAAU,UAAU,GAAG,KAAK,EAAE,SAAS,MAAM,CAAC;AAC/G,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,iBAAiB,MAAM,0BAA0B,WAAW,MAAM,aAAa;AAC9G,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI;AACF,UAAM,SAAS,SAAS,CAAC,MAAM,aAAa,UAAU,MAAM,CAAC;AAC7D,WAAO,mBAAmB,MAAM;AAAA,EAElC,SAAS,KAAK;AACZ,UAAM,SAAU,IAAc;AAC9B,QAAI,OAAO,SAAS,gBAAgB,KAAK,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,YAAY,GAAG;AACtG,aAAO,eAAe;AAAA,IACxB;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,wBAAwB,WAAmB,QAAiC;AACzF,QAAM,WAAW,MAAM,MAAM,GAAG,SAAS,eAAe;AAAA,IACtD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,MAAM;AAAA,MAC/B,gBAAgB;AAAA,IAClB;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,8BAA8B,SAAS,MAAM,IAAI,MAAM,SAAS,KAAK,CAAC,EAAE;AAAA,EAC1F;AACA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,KAAK,OAAO;AACf,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AACA,SAAO,KAAK;AACd;AAMA,eAAsB,SAAS,UAAiC;AAC9D,UAAQ,IAAI,4CAA4C;AAGxD,MAAI;AACF,UAAM,UAAU,SAAS,CAAC,WAAW,CAAC,EAAE,KAAK;AAC7C,YAAQ,IAAI,aAAa,OAAO,EAAE;AAAA,EACpC,QAAQ;AACN,YAAQ,MAAM,yEAAyE;AACvF,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,MAAI;AACF,aAAS,CAAC,QAAQ,CAAC;AACnB,YAAQ,IAAI,uBAAuB;AAAA,EACrC,QAAQ;AACN,YAAQ,MAAM,+DAA+D;AAC7E,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,OAAO,aAAa,QAAQ;AAClC,UAAQ,IAAI,kBAAkB,IAAI;AAAA,CAAI;AAGtC,UAAQ,IAAI,yBAAyB;AACrC,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,SAAS,CAAC,MAAM,UAAU,IAAI,CAAC;AAChD,WAAO,UAAU,QAAQ;AACzB,YAAQ,IAAI,wBAAwB,IAAI;AAAA,CAAI;AAAA,EAC9C,SAAS,KAAK;AACZ,UAAM,SAAU,IAAc;AAC9B,QAAI,OAAO,SAAS,gBAAgB,GAAG;AACrC,cAAQ,IAAI,8CAA8C;AAC1D,YAAM,aAAa,SAAS,CAAC,MAAM,QAAQ,QAAQ,CAAC;AACpD,YAAM,YAAY,KAAK,MAAM,UAAU;AACvC,YAAM,WAAW,UAAU,KAAK,CAAC,OAAO,GAAG,SAAS,IAAI;AACxD,UAAI,CAAC,UAAU;AACb,gBAAQ,MAAM,gBAAgB,IAAI,8CAA8C;AAChF,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,aAAO,SAAS;AAChB,cAAQ,IAAI,wBAAwB,IAAI;AAAA,CAAI;AAAA,IAC9C,OAAO;AACL,cAAQ,MAAM,iCAAiC,MAAM,EAAE;AACvD,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,UAAQ,IAAI,6BAA6B;AACzC,MAAI;AACF,aAAS,CAAC,aAAa,UAAU,GAAG,IAAI,YAAY,gBAAgB,sBAAsB,YAAY,gBAAgB,CAAC;AACvH,YAAQ,IAAI,2BAA2B;AAAA,EACzC,SAAS,KAAK;AACZ,UAAM,SAAU,IAAc;AAC9B,QAAI,OAAO,SAAS,gBAAgB,KAAK,OAAO,SAAS,gBAAgB,GAAG;AAC1E,cAAQ,IAAI,2CAA2C;AAAA,IACzD,OAAO;AACL,cAAQ,MAAM,qCAAqC,MAAM,EAAE;AAC3D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAGA,UAAQ,IAAI,sCAAsC;AAClD,MAAI;AACJ,MAAI;AACF,WAAO,kBAAkB,IAAI;AAC7B,YAAQ,IAAI,uBAAuB,IAAI;AAAA,CAAI;AAAA,EAC7C,SAAS,KAAK;AACZ,YAAQ,MAAM,kCAAmC,IAAc,OAAO,EAAE;AACxE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,SAASC,QAAO,YAAY,aAAa,EAAE,SAAS,KAAK;AAG/D,UAAQ,IAAI,gCAAgC;AAC5C,QAAM,YAAY,iBAAiB,UAAU,MAAM,IAAI;AAGvD,UAAQ,IAAI,2BAA2B;AACvC,MAAI;AACF,gBAAY,CAAC,UAAU,OAAO,qBAAqB,UAAU,IAAI,GAAG;AAAA,MAClE,KAAK;AAAA,MACL,OAAO;AAAA,MACP,WAAW;AAAA,IACb,CAAC;AACD,YAAQ,IAAI,cAAc;AAAA,EAC5B,SAAS,KAAK;AACZ,YAAQ,MAAM,iCAAkC,IAAc,OAAO,EAAE;AACvE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,UAAQ,IAAI,qBAAqB;AACjC,MAAI;AACJ,MAAI;AACF,UAAM,eAAe,SAAS,CAAC,QAAQ,GAAG,EAAE,KAAK,UAAU,CAAC;AAC5D,gBAAY,eAAe,YAAY;AACvC,YAAQ,IAAI,oBAAoB,SAAS;AAAA,CAAI;AAAA,EAC/C,SAAS,KAAK;AACZ,YAAQ,MAAM,4BAA6B,IAAc,OAAO,EAAE;AAClE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,UAAQ,IAAI,+BAA+B;AAC3C,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,0BAA4B;AAClE,UAAM,mBAAmB,MAAM,aAAa,QAAQ;AACpD,UAAM,MAAM,GAAG,SAAS,WAAW;AAAA,MACjC,QAAQ;AAAA,MACR,SAAS,EAAE,iBAAiB,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,MACnF,MAAM,KAAK,UAAU;AAAA,QACnB,WAAW;AAAA,QACX,iBAAiB;AAAA,QACjB,sBAAsB;AAAA,QACtB,YAAY,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAAA,QAChD,YAAY;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD,YAAQ,IAAI,qBAAqB;AAAA,EACnC,QAAQ;AACN,YAAQ,IAAI,mDAAmD;AAAA,EACjE;AAEA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,wBAAwB,WAAW,MAAM;AAAA,EAC5D,QAAQ;AAAA,EAER;AAGA,mBAAiB,UAAU;AAAA,IACzB,SAAS;AAAA,IACT,YAAY;AAAA,EACd,CAAC;AACD,cAAY,UAAU,qBAAqB,MAAM;AACjD,MAAI,SAAU,aAAY,UAAU,uBAAuB,QAAQ;AACnE,mBAAiB,UAAU;AAAA,IACzB,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,iBAAiB,sBAAsB;AAAA,IACvC,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC,gBAAgB;AAAA,EAClB,CAAC;AAED,UAAQ,IAAI,yBAAyB;AACrC,UAAQ,IAAI,cAAc,SAAS,EAAE;AACrC,UAAQ,IAAI,cAAc,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,OAAO,MAAM,EAAE,CAAC,EAAE;AACpE,MAAI,UAAU;AACZ,YAAQ,IAAI,cAAc,SAAS,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,EAAE;AAAA,EAC1E;AACA,UAAQ,IAAI,iEAAiE;AAC/E;AAiBO,SAAS,cAAc,UAAiC;AAC7D,QAAM,SAAS,WAAW,QAAQ;AAClC,MAAI,CAAC,OAAO,KAAK,YAAY;AAC3B,WAAO,EAAE,SAAS,OAAO,OAAO,+CAA+C;AAAA,EACjF;AAEA,yBAAuB,QAAQ;AAC/B,QAAM,YAAY,iBAAiB,QAAQ;AAC3C,QAAM,WAAWF,MAAK,KAAK,WAAW,eAAe;AAErD,MAAI,CAACC,IAAG,WAAW,QAAQ,GAAG;AAC5B,WAAO,EAAE,SAAS,OAAO,OAAO,qDAAqD;AAAA,EACvF;AAGA,QAAM,eAAeA,IAAG,aAAa,UAAU,OAAO;AACtD,QAAM,UAAU,aAAa,MAAM,gBAAgB;AACnD,MAAI,CAAC,WAAW,QAAQ,CAAC,MAAM,yBAAyB;AACtD,WAAO,EAAE,SAAS,OAAO,OAAO,gFAAgF;AAAA,EAClH;AACA,QAAM,OAAO,QAAQ,CAAC;AAEtB,QAAM,YAAY,aAAa,MAAM,wBAAwB;AAC7D,QAAM,cAAc,aAAa,MAAM,+BAA+B;AACtE,QAAM,iBAAiB,aAAa,MAAM,4BAA4B;AACtE,QAAM,aAAa,YAAY,CAAC,KAAK,aAAa,QAAQ;AAG1D,QAAM,UAAU,aAAa,MAAM,gBAAgB;AACnD,MAAI;AACJ,MAAI,SAAS;AACX,WAAO,QAAQ,CAAC;AAAA,EAClB,OAAO;AACL,QAAI;AACF,aAAO,kBAAkB,UAAU;AAAA,IACrC,SAAS,KAAK;AACZ,aAAO,EAAE,SAAS,OAAO,OAAO,qCAAsC,IAAc,OAAO,GAAG;AAAA,IAChG;AAAA,EACF;AAEA,MAAI;AACF,uBAAmB;AAAA,MACjB,WAAW,mBAAmB;AAAA,MAC9B;AAAA,MACA,aAAa,CAAC;AAAA,QACZ,UAAU;AAAA,QACV,YAAY;AAAA,UACV,CAAC,SAAS,KAAK,QAAQ,iBAAiB,WAAW,UAAU,GAAG;AAAA,UAChE,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,UACtD,CAAC,SAAS,KAAK,QAAQ,oBAAoB,oBAAoB,cAAc,CAAC,KAAK,UAAU,GAAG;AAAA,UAChG,CAAC,SAAS,KAAK,QAAQ,uBAAuB,iBAAiB,iBAAiB,CAAC,KAAK,GAAG,UAAU,UAAU,GAAG;AAAA,UAChH,CAAC,SAAS,KAAK,QAAQ,2BAA2B,IAAI;AAAA,UACtD,CAAC,SAAS,KAAK,QAAQ,iCAAiC,gCAAgC,sBAAsB,CAAC,GAAG;AAAA,UAClH,CAAC,SAAS,KAAK,QAAQ,gCAAgC,0BAA0B,qBAAqB,CAAC,GAAG;AAAA,QAC5G;AAAA,MACF,CAAC;AAAA,MACD,sBAAsB,8BAA8B;AAAA,IACtD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,0CAA2C,IAAc,OAAO,GAAG;AAAA,EACrG;AAGA,QAAM,UAAU,YAAY,QAAQ;AACpC,QAAM,SAAS,QAAQ,mBAAmB;AAC1C,MAAI,QAAQ;AACV,QAAI;AACF,kBAAY,CAAC,UAAU,OAAO,qBAAqB,UAAU,UAAU,GAAG;AAAA,QACxE,KAAK;AAAA,QACL,OAAO;AAAA,QACP,WAAW;AAAA,MACb,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,MAAI;AACF,UAAM,eAAe,SAAS,CAAC,QAAQ,GAAG,EAAE,KAAK,UAAU,CAAC;AAC5D,UAAM,YAAY,eAAe,YAAY;AAC7C,UAAM,UAAU,sBAAsB;AAEtC,qBAAiB,UAAU;AAAA,MACzB,YAAY;AAAA,IACd,CAAC;AACD,UAAM,cAAc,gBAAgB,QAAQ;AAC5C,QAAI,aAAa;AACf,uBAAiB,UAAU;AAAA,QACzB,GAAG;AAAA,QACH,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,iBAAiB;AAAA,QACjB,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAAA,MACxC,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,SAAS,MAAM,YAAY,WAAW,QAAQ;AAAA,EACzD,SAAS,KAAK;AACZ,WAAO,EAAE,SAAS,OAAO,OAAO,4BAA6B,IAAc,OAAO,GAAG;AAAA,EACvF;AACF;AAMA,eAAsB,YAAY,UAAiC;AACjE,UAAQ,IAAI,iCAAiC;AAC7C,QAAM,SAAS,cAAc,QAAQ;AACrC,MAAI,CAAC,OAAO,SAAS;AACnB,YAAQ,MAAM,OAAO,KAAK;AAC1B,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,UAAQ,IAAI,oBAAoB,OAAO,UAAU,EAAE;AACnD,UAAQ,IAAI,YAAY,OAAO,OAAO,EAAE;AACxC,UAAQ,IAAI,qBAAqB;AACnC;","names":["crypto","fs","path","fs","path","fs","path","path","fs","crypto","path","fs","path","fs","crypto"]}