@lazehq/cli 0.1.0 → 0.1.2

package/dist/laze.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
 };
 
 // src/main.ts
@@ -18,7 +18,7 @@ var expectedFinite = (entityName, num) => `Non-finite ${entityName}: ${num}`;
 var forbiddenBigIntToNumber = (entityName) => `Cannot convert bigint to ${entityName}`;
 var invalidObject = "Invalid object";
 var numberOutOfRange = (entityName, val, min, max) => invalidEntity(entityName, val) + `; must be between ${min}-${max}`;
-var invalidEntity = (fieldName, val) => `Invalid ${fieldName}: ${val}`;
+var invalidEntity = (fieldName2, val) => `Invalid ${fieldName2}: ${val}`;
 
 // ../../node_modules/.pnpm/temporal-utils@1.0.2/node_modules/temporal-utils/dist/utils.js
 var nanoInMicro = 1e3;
@@ -69,10 +69,10 @@ function requireObjectLike(arg) {
 
 // ../../node_modules/.pnpm/temporal-polyfill@1.0.4/node_modules/temporal-polyfill/chunks/internal.js
 var invalidEntity2 = invalidEntity;
-var missingField = (fieldName) => `Missing ${fieldName}`;
+var missingField = (fieldName2) => `Missing ${fieldName2}`;
 var noValidFields = (validFields) => "No valid fields: " + validFields.join();
 var invalidBag = "Invalid bag";
-var invalidChoice = (fieldName, val, choiceMap) => invalidEntity(fieldName, val) + "; must be " + Object.keys(choiceMap).join();
+var invalidChoice = (fieldName2, val, choiceMap) => invalidEntity(fieldName2, val) + "; must be " + Object.keys(choiceMap).join();
 var forbiddenValueOf = "Cannot use valueOf";
 var invalidCallingContext = "Invalid calling context";
 var missingYear = (allowEra) => "Missing year" + (allowEra ? "/era/eraYear" : "");
@@ -111,8 +111,8 @@ function memoize(generator, MapClass = Map) {
     return map2.set(key, val), val;
   };
 }
-var createNameDescriptors = (name) => createPropDescriptors({
-  name
+var createNameDescriptors = (name2) => createPropDescriptors({
+  name: name2
 }, 1);
 var createPropDescriptors = (propVals, readonly2) => mapProps((value) => ({
   value,
@@ -324,8 +324,8 @@ var maxValues = {
 };
 function constrainTimeFields(timeFields, overflow) {
   const constrainedFields = {};
-  for (const fieldName of timeFieldNamesAsc) {
-    constrainedFields[fieldName] = clampEntity(fieldName, timeFields[fieldName], 0, maxValues[fieldName] || 999, overflow);
+  for (const fieldName2 of timeFieldNamesAsc) {
+    constrainedFields[fieldName2] = clampEntity(fieldName2, timeFields[fieldName2], 0, maxValues[fieldName2] || 999, overflow);
   }
   return constrainedFields;
 }
@@ -1479,15 +1479,15 @@ function negateDuration(slots) {
 }
 function negateDurationFields(fields) {
   const res = {};
-  for (const fieldName of durationFieldNamesAsc) {
-    res[fieldName] = -1 * fields[fieldName] || 0;
+  for (const fieldName2 of durationFieldNamesAsc) {
+    res[fieldName2] = -1 * fields[fieldName2] || 0;
   }
   return res;
 }
 function computeDurationSign(fields, fieldNames = durationFieldNamesAsc) {
   let sign = 0;
-  for (const fieldName of fieldNames) {
-    const fieldSign = Math.sign(fields[fieldName]);
+  for (const fieldName2 of fieldNames) {
+    const fieldSign = Math.sign(fields[fieldName2]);
     fieldSign && (sign && sign !== fieldSign && throwRangeError("Cannot mix duration signs"), sign = fieldSign);
   }
   return sign;
@@ -1675,14 +1675,14 @@ var zonedDateTimeFieldRefiners = {
 function readAndRefineBagFields(bag, validFieldNames, fieldRefiners, requiredFieldNames, disallowEmpty = !requiredFieldNames) {
   const res = {};
   let anyMatching = 0;
-  for (const fieldName of validFieldNames) {
-    let fieldVal = bag[fieldName];
+  for (const fieldName2 of validFieldNames) {
+    let fieldVal = bag[fieldName2];
     if (void 0 !== fieldVal) {
       anyMatching = 1;
-      const refiner = fieldRefiners[fieldName];
-      refiner && (fieldVal = refiner(fieldVal, fieldName)), res[fieldName] = fieldVal;
+      const refiner = fieldRefiners[fieldName2];
+      refiner && (fieldVal = refiner(fieldVal, fieldName2)), res[fieldName2] = fieldVal;
     } else {
-      requiredFieldNames && requiredFieldNames.includes(fieldName) && throwTypeError(missingField(fieldName));
+      requiredFieldNames && requiredFieldNames.includes(fieldName2) && throwTypeError(missingField(fieldName2));
     }
   }
   return disallowEmpty && !anyMatching && throwTypeError(noValidFields(validFieldNames)), res;
@@ -2392,8 +2392,8 @@ function organizeAnnotationParts(s) {
   const calendarIds = [];
   return s.replace(annotationRegExp, (whole, criticalStr, mainStr) => {
     const isCritical = Boolean(criticalStr);
-    const [val, name] = mainStr.split("=").reverse();
-    return name ? "u-ca" === name ? (calendarIds.push(val.toLowerCase()), calendarIsCritical || (calendarIsCritical = isCritical)) : (isCritical || /[A-Z]/.test(name)) && throwRangeError(invalidSubstring(whole)) : (timeZoneId && throwRangeError(invalidSubstring(whole)), timeZoneId = val), "";
+    const [val, name2] = mainStr.split("=").reverse();
+    return name2 ? "u-ca" === name2 ? (calendarIds.push(val.toLowerCase()), calendarIsCritical || (calendarIsCritical = isCritical)) : (isCritical || /[A-Z]/.test(name2)) && throwRangeError(invalidSubstring(whole)) : (timeZoneId && throwRangeError(invalidSubstring(whole)), timeZoneId = val), "";
   }), calendarIds.length > 1 && calendarIsCritical && throwRangeError(invalidSubstring(s)), {
     timeZoneId,
     calendarId: calendarIds[0] || "iso8601"
@@ -2583,9 +2583,9 @@ function createOptionsTransformer(shapeFieldNames, invalidShapeFieldNames, ignor
     const otherFields = {};
     let hasInvalidGranularShapeFields = 0;
     let hasInvalidStyleFields = 0;
-    for (const name of Object.keys(options)) {
-      const value = options[name];
-      void 0 === value || ignoredFieldNameSet.has(name) || (shapeFieldNameSet.has(name) ? "dateStyle" === name ? dateStyle = value : "timeStyle" === name ? timeStyle = value : granularShapeFields[name] = value : "era" === name ? modifierFields[name] = value : invalidShapeFieldNameSet.has(name) ? "dateStyle" === name || "timeStyle" === name ? hasInvalidStyleFields = 1 : hasInvalidGranularShapeFields = 1 : otherFields[name] = value);
+    for (const name2 of Object.keys(options)) {
+      const value = options[name2];
+      void 0 === value || ignoredFieldNameSet.has(name2) || (shapeFieldNameSet.has(name2) ? "dateStyle" === name2 ? dateStyle = value : "timeStyle" === name2 ? timeStyle = value : granularShapeFields[name2] = value : "era" === name2 ? modifierFields[name2] = value : invalidShapeFieldNameSet.has(name2) ? "dateStyle" === name2 || "timeStyle" === name2 ? hasInvalidStyleFields = 1 : hasInvalidGranularShapeFields = 1 : otherFields[name2] = value);
     }
     const hasDateStyle = void 0 !== dateStyle;
     const hasTimeStyle = void 0 !== timeStyle;
@@ -3751,7 +3751,7 @@ function harnessOf({
 }) {
   if (env.CLAUDECODE === "1") return "claude-code";
   const names = Object.keys(env);
-  return names.some((name) => name.startsWith("CODEX_")) ? "codex" : "other";
+  return names.some((name2) => name2.startsWith("CODEX_")) ? "codex" : "other";
 }
 function cliEnvironment({
   env = process.env
@@ -3796,27 +3796,27 @@ var ConfigStore = class _ConfigStore {
     await rename(temporary, this.path);
   }
   async saveProfile({
-    name,
+    name: name2,
     profile,
     bindDirectory
   }) {
     const config2 = await this.read();
     await this.write({
-      current: bindDirectory ? config2.current ?? name : name,
-      profiles: { ...config2.profiles, [name]: profile },
-      bindings: bindDirectory ? { ...config2.bindings, [resolve(bindDirectory)]: name } : config2.bindings
+      current: bindDirectory ? config2.current ?? name2 : name2,
+      profiles: { ...config2.profiles, [name2]: profile },
+      bindings: bindDirectory ? { ...config2.bindings, [resolve(bindDirectory)]: name2 } : config2.bindings
     });
   }
-  async removeProfile({ name }) {
+  async removeProfile({ name: name2 }) {
     const config2 = await this.read();
-    if (!config2.profiles[name]) return false;
+    if (!config2.profiles[name2]) return false;
     const profiles = Object.fromEntries(
-      Object.entries(config2.profiles).filter(([key]) => key !== name)
+      Object.entries(config2.profiles).filter(([key]) => key !== name2)
     );
     const bindings = Object.fromEntries(
-      Object.entries(config2.bindings).filter(([, bound]) => bound !== name)
+      Object.entries(config2.bindings).filter(([, bound]) => bound !== name2)
     );
-    const current = config2.current === name ? Object.keys(profiles)[0] : config2.current;
+    const current = config2.current === name2 ? Object.keys(profiles)[0] : config2.current;
     await this.write({ current, profiles, bindings });
     return true;
   }
@@ -3828,9 +3828,9 @@ function chooseProfile({
   cwd
 }) {
   const bound = boundProfileOf({ bindings: config2.bindings, cwd });
-  const name = flag || environment || bound || config2.current;
-  const profile = name ? config2.profiles[name] : void 0;
-  return name && profile ? { name, profile } : { name: void 0, profile: void 0 };
+  const name2 = flag || environment || bound || config2.current;
+  const profile = name2 ? config2.profiles[name2] : void 0;
+  return name2 && profile ? { name: name2, profile } : { name: void 0, profile: void 0 };
 }
 function boundProfileOf({
   bindings,
@@ -3863,9 +3863,9 @@ function parseArgs({ argv }) {
   const words = [];
   const flags = {};
   const lists = {};
-  const remember = (name, value) => {
-    flags[name] = value;
-    lists[name] = [...lists[name] ?? [], value];
+  const remember = (name2, value) => {
+    flags[name2] = value;
+    lists[name2] = [...lists[name2] ?? [], value];
   };
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index] ?? "";
@@ -3874,12 +3874,12 @@ function parseArgs({ argv }) {
       words.push(arg);
       continue;
     }
-    const [name = "", inline] = arg.slice(2).split(/=(.*)/s, 2);
+    const [name2 = "", inline] = arg.slice(2).split(/=(.*)/s, 2);
     const next = argv[index + 1];
-    if (inline !== void 0) remember(name, inline);
-    else if (SWITCHES.has(name) || next === void 0 || next.startsWith("--")) flags[name] = true;
+    if (inline !== void 0) remember(name2, inline);
+    else if (SWITCHES.has(name2) || next === void 0 || next.startsWith("--")) flags[name2] = true;
     else {
-      remember(name, next);
+      remember(name2, next);
       index += 1;
     }
   }
@@ -3887,15 +3887,15 @@ function parseArgs({ argv }) {
 }
 function flagText({
   args,
-  name,
+  name: name2,
   fallback = ""
 }) {
-  const value = args.flags[name];
+  const value = args.flags[name2];
   return typeof value === "string" ? value : fallback;
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.0";
+var STAMPED = "0.1.2";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -4032,6 +4032,7 @@ var CliUsageError = class extends Error {
 };
 
 // src/services/laze-client.service.ts
+var CLI_VERSION_HEADER = "x-laze-cli-version";
 var LazeApiError = class extends Error {
   constructor(status, code, message) {
     super(message);
@@ -4069,7 +4070,10 @@ var LazeClient = class _LazeClient {
     path,
     body
   }) {
-    const headers = { accept: "application/json" };
+    const headers = {
+      accept: "application/json",
+      [CLI_VERSION_HEADER]: cliVersionOf()
+    };
     if (body !== void 0) headers["content-type"] = "application/json";
     if (this.token) headers.authorization = `Bearer ${this.token}`;
     const response = await this.fetcher(`${this.baseUrl}${path}`, {
@@ -4077,8 +4081,8 @@ var LazeClient = class _LazeClient {
       headers,
       ...body !== void 0 ? { body: JSON.stringify(body) } : {}
     });
-    const text = await response.text();
-    const parsed = text ? JSON.parse(text) : void 0;
+    const text2 = await response.text();
+    const parsed = text2 ? JSON.parse(text2) : void 0;
     if (!response.ok) throw errorOf({ status: response.status, body: parsed });
     return parsed;
   }
@@ -4130,9 +4134,9 @@ async function listChannels({ context, args }) {
   if (args.flags.json) return context.out(`${JSON.stringify(channels, null, 2)}
 `);
   for (const channel of channels) {
-    const name = channel.kind === "dm" || channel.kind === "group" ? "(direct)" : `#${channel.name}`;
+    const name2 = channel.kind === "dm" || channel.kind === "group" ? "(direct)" : `#${channel.name}`;
     const unread = channel.unread > 0 ? `	${channel.unread} unread` : "";
-    context.out(`${channel.id}	${name}${unread}
+    context.out(`${channel.id}	${name2}${unread}
 `);
   }
 }
@@ -4142,9 +4146,9 @@ async function textOf({
   from
 }) {
   const words = args.words.slice(from);
-  const text = (words.join(" ") === "-" ? await context.readStdin() : words.join(" ")).trim();
-  if (!text) throw new CliUsageError("Say something: the message text is missing.");
-  return text;
+  const text2 = (words.join(" ") === "-" ? await context.readStdin() : words.join(" ")).trim();
+  if (!text2) throw new CliUsageError("Say something: the message text is missing.");
+  return text2;
 }
 async function post({ context, args }) {
   const channel = args.words[1];
@@ -4236,14 +4240,14 @@ function harnessOf2({ context, args }) {
   if (named === "claude-code" || named === "codex" || named === "other") return named;
   return context.environment.harness;
 }
-function slugOf(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent";
+function slugOf(name2) {
+  return name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent";
 }
 async function installStopHook({ context, profile }) {
   const directory = join2(context.cwd, ".claude");
   const path = join2(directory, "settings.local.json");
   const current = await readFile2(path, "utf8").then(
-    (text) => JSON.parse(text),
+    (text2) => JSON.parse(text2),
     () => ({})
   );
   const command = stopHookCommand({ program: context.program, profile });
@@ -4283,9 +4287,9 @@ async function linkAgent({ context, args }) {
   const harness = harnessOf2({ context, args });
   const client = LazeClient.create({ baseUrl: url2, fetcher: context.fetcher });
   const linked = await client.post("/api/agents/links/redeem", { token, harness });
-  const name = flagText({ args, name: "profile" }) || `agent-${slugOf(linked.agent.name)}`;
+  const name2 = flagText({ args, name: "profile" }) || `agent-${slugOf(linked.agent.name)}`;
   await context.store.saveProfile({
-    name,
+    name: name2,
     bindDirectory: context.cwd,
     profile: {
       url: url2,
@@ -4296,13 +4300,13 @@ async function linkAgent({ context, args }) {
       agentId: linked.agent.id
     }
   });
-  const hookPath = harness === "claude-code" && !args.flags["no-hook"] ? await installStopHook({ context, profile: name }) : void 0;
+  const hookPath = harness === "claude-code" && !args.flags["no-hook"] ? await installStopHook({ context, profile: name2 }) : void 0;
   context.out(
     [
-      `Linked as ${linked.agent.name} (${linked.agent.id}), profile "${name}" for ${context.cwd}.`,
+      `Linked as ${linked.agent.name} (${linked.agent.id}), profile "${name2}" for ${context.cwd}.`,
       ...hookPath ? [`Added the Laze Stop hook to ${hookPath}.`] : [],
       "",
-      nextStepsFor({ harness, profile: name, laze: lazeCommandOf({ program: context.program }) }),
+      nextStepsFor({ harness, profile: name2, laze: lazeCommandOf({ program: context.program }) }),
       ""
     ].join("\n")
   );
@@ -4415,50 +4419,50 @@ function isFeatureName(feature) {
 
 // ../../packages/module/src/module-api-token.ts
 var FeatureApiIdentity = class {
-  constructor(name) {
-    this.name = name;
+  constructor(name2) {
+    this.name = name2;
   }
   name;
 };
 var ModuleApiToken = class _ModuleApiToken extends FeatureApiIdentity {
-  constructor(name) {
-    super(name);
+  constructor(name2) {
+    super(name2);
   }
-  static create(name) {
-    publicNamespaceFromUnknown(name);
-    const token = new _ModuleApiToken(name);
+  static create(name2) {
+    publicNamespaceFromUnknown(name2);
+    const token = new _ModuleApiToken(name2);
     Object.freeze(token);
     return token;
   }
 };
-function moduleApi(name) {
-  if (name === void 0) {
+function moduleApi(name2) {
+  if (name2 === void 0) {
     return (id) => ModuleApiToken.create(id);
   }
-  return ModuleApiToken.create(name);
+  return ModuleApiToken.create(name2);
 }
 
 // ../../packages/module/src/contract/trpc-contract.ts
 function contractBuilder(namespace, members2) {
-  const member = (name, kind, read = {}) => ({
+  const member = (name2, kind, read = {}) => ({
     withInput: (input2) => {
-      assertUndeclared(namespace, name, members2);
+      assertUndeclared(namespace, name2, members2);
       const cached2 = {
         ...read.invalidatedBy ? { invalidatedBy: read.invalidatedBy } : {},
         ...read.fromProjection ? { fromProjection: read.fromProjection } : {},
         ...read.revision === void 0 ? {} : { revision: read.revision }
       };
-      const declared = { ...members2, [name]: { kind, input: input2, output: void 0, ...cached2 } };
+      const declared = { ...members2, [name2]: { kind, input: input2, output: void 0, ...cached2 } };
       return {
         ...contractBuilder(namespace, declared),
-        withOutput: (output2) => contractBuilder(namespace, { ...members2, [name]: { kind, input: input2, output: output2, ...cached2 } })
+        withOutput: (output2) => contractBuilder(namespace, { ...members2, [name2]: { kind, input: input2, output: output2, ...cached2 } })
       };
     }
   });
   return {
-    query: (name, options) => member(name, "query", options),
-    mutation: (name) => member(name, "mutation"),
-    subscription: (name) => member(name, "subscription"),
+    query: (name2, options) => member(name2, "query", options),
+    mutation: (name2) => member(name2, "mutation"),
+    subscription: (name2) => member(name2, "subscription"),
     build: () => {
       assertQueriesAnswer(namespace, members2);
       const built = { namespace, members: Object.freeze({ ...members2 }) };
@@ -4466,15 +4470,15 @@ function contractBuilder(namespace, members2) {
     }
   };
 }
-function assertUndeclared(namespace, name, members2) {
-  if (name in members2) {
-    throw new Error(`tRPC contract "${namespace}" declares procedure "${name}" twice`);
+function assertUndeclared(namespace, name2, members2) {
+  if (name2 in members2) {
+    throw new Error(`tRPC contract "${namespace}" declares procedure "${name2}" twice`);
   }
 }
 function assertQueriesAnswer(namespace, members2) {
-  for (const [name, member] of Object.entries(members2)) {
+  for (const [name2, member] of Object.entries(members2)) {
     if (member.kind === "query" && member.output === void 0) {
-      throw new Error(`tRPC contract "${namespace}" declares query "${name}" without withOutput`);
+      throw new Error(`tRPC contract "${namespace}" declares query "${name2}" without withOutput`);
     }
   }
 }
@@ -5600,12 +5604,12 @@ function merge(a, b) {
   });
   return clone(a, def);
 }
-function partial(Class2, schema, mask, name = "partial") {
+function partial(Class2, schema, mask, name2 = "partial") {
   const currDef = schema._zod.def;
   const checks = currDef.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
-    throw new Error(`.${name}() cannot be used on object schemas containing refinements`);
+    throw new Error(`.${name2}() cannot be used on object schemas containing refinements`);
   }
   const selected = mask ? new Set(maskedKeys(schema, mask)) : void 0;
   const newShape = {};
@@ -5933,7 +5937,7 @@ function newError(Definition) {
   return new Definition();
 }
 // @__NO_SIDE_EFFECTS__
-function $constructor(name, initializer3, proto, params) {
+function $constructor(name2, initializer3, proto, params) {
   const zodProto = {};
   function Internals(def) {
     this.def = def;
@@ -5951,10 +5955,10 @@ function $constructor(name, initializer3, proto, params) {
       } finally {
         _zodDesc.value = void 0;
       }
-    } else if (inst._zod.traits.has(name)) {
+    } else if (inst._zod.traits.has(name2)) {
       return;
     }
-    inst._zod.traits.add(name);
+    inst._zod.traits.add(name2);
     initializer3(inst, def);
     if (initialized) {
       const own2 = Object.getPrototypeOf(inst);
@@ -5980,7 +5984,7 @@ function $constructor(name, initializer3, proto, params) {
   const Parent = params?.Parent ?? Object;
   class Definition extends Parent {
   }
-  Object.defineProperty(Definition, "name", { value: name });
+  Object.defineProperty(Definition, "name", { value: name2 });
   function _(def) {
     const inst = params?.Parent ? newError(Definition) : this;
     init(inst, def);
@@ -6001,10 +6005,10 @@ function $constructor(name, initializer3, proto, params) {
     value: (inst) => {
       if (params?.Parent && inst instanceof params.Parent)
         return true;
-      return inst?._zod?.traits?.has(name);
+      return inst?._zod?.traits?.has(name2);
     }
   });
-  Object.defineProperty(_, "name", { value: name });
+  Object.defineProperty(_, "name", { value: name2 });
   return _;
 }
 var $brand = /* @__PURE__ */ Symbol("zod_brand");
@@ -6014,8 +6018,8 @@ var $ZodAsyncError = class extends Error {
   }
 };
 var $ZodEncodeError = class extends Error {
-  constructor(name) {
-    super(`Encountered unidirectional transform during encode: ${name}`);
+  constructor(name2) {
+    super(`Encountered unidirectional transform during encode: ${name2}`);
     this.name = "ZodEncodeError";
   }
 };
@@ -13791,8 +13795,8 @@ function ko_default() {
 }
 
 // ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/lt.js
-var capitalizeFirstCharacter = (text) => {
-  return text.charAt(0).toUpperCase() + text.slice(1);
+var capitalizeFirstCharacter = (text2) => {
+  return text2.charAt(0).toUpperCase() + text2.slice(1);
 };
 function getUnitTypeFromNumber(number4) {
   const abs = Math.abs(number4);
@@ -17514,13 +17518,13 @@ ${code}
   return fn;
 }
 function addConstant(ctx, value) {
-  for (const [name2, v] of ctx.constants) {
+  for (const [name3, v] of ctx.constants) {
     if (v === value)
-      return name2;
+      return name3;
   }
-  const name = `c${ctx.constantCounter++}`;
-  ctx.constants.set(name, value);
-  return name;
+  const name2 = `c${ctx.constantCounter++}`;
+  ctx.constants.set(name2, value);
+  return name2;
 }
 function addUserConstant(ctx, fn) {
   ctx.definite = false;
@@ -24152,10 +24156,10 @@ function date4(params) {
 
 // ../../packages/module/src/contract/ui-tokens.ts
 var UiTokenIdentity = class {
-  constructor(kind, owner, name) {
+  constructor(kind, owner, name2) {
     this.kind = kind;
     this.owner = owner;
-    this.name = name;
+    this.name = name2;
   }
   kind;
   owner;
@@ -24166,22 +24170,22 @@ var UiTokenIdentity = class {
   }
 };
 var UiToken = class _UiToken extends UiTokenIdentity {
-  constructor(kind, owner, name) {
-    super(kind, owner, name);
+  constructor(kind, owner, name2) {
+    super(kind, owner, name2);
   }
-  static create(kind, owner, name) {
-    const token = new _UiToken(kind, owner, name);
+  static create(kind, owner, name2) {
+    const token = new _UiToken(kind, owner, name2);
     Object.freeze(token);
     return token;
   }
 };
 function uiTokens(owner) {
   return {
-    component: (name) => UiToken.create("component", owner, name),
-    extension: (name) => UiToken.create("extension", owner, name),
-    operations: (name) => UiToken.create("operations", owner, name),
-    hooks: (name) => UiToken.create("hooks", owner, name),
-    drawer: (name) => UiToken.create("drawer", owner, name)
+    component: (name2) => UiToken.create("component", owner, name2),
+    extension: (name2) => UiToken.create("extension", owner, name2),
+    operations: (name2) => UiToken.create("operations", owner, name2),
+    hooks: (name2) => UiToken.create("hooks", owner, name2),
+    drawer: (name2) => UiToken.create("drawer", owner, name2)
   };
 }
 
@@ -25110,7 +25114,7 @@ function wrapSpanContext(spanContext) {
 var contextApi = ContextAPI.getInstance();
 var NoopTracer = class {
   // startSpan starts a noop span.
-  startSpan(name, options, context = contextApi.active()) {
+  startSpan(name2, options, context = contextApi.active()) {
     const root = Boolean(options === null || options === void 0 ? void 0 : options.root);
     if (root) {
       return new NonRecordingSpan();
@@ -25122,7 +25126,7 @@ var NoopTracer = class {
       return new NonRecordingSpan();
     }
   }
-  startActiveSpan(name, arg2, arg3, arg4) {
+  startActiveSpan(name2, arg2, arg3, arg4) {
     let opts;
     let ctx;
     let fn;
@@ -25139,7 +25143,7 @@ var NoopTracer = class {
       fn = arg4;
     }
     const parentContext = ctx !== null && ctx !== void 0 ? ctx : contextApi.active();
-    const span = this.startSpan(name, opts, parentContext);
+    const span = this.startSpan(name2, opts, parentContext);
     const contextWithSpanSet = setSpan(parentContext, span);
     return contextApi.with(contextWithSpanSet, fn, void 0, span);
   }
@@ -25151,14 +25155,14 @@ function isSpanContext(spanContext) {
 // ../../node_modules/.pnpm/@opentelemetry+api@1.9.1/node_modules/@opentelemetry/api/build/esm/trace/ProxyTracer.js
 var NOOP_TRACER = new NoopTracer();
 var ProxyTracer = class {
-  constructor(provider, name, version2, options) {
+  constructor(provider, name2, version2, options) {
     this._provider = provider;
-    this.name = name;
+    this.name = name2;
     this.version = version2;
     this.options = options;
   }
-  startSpan(name, options, context) {
-    return this._getTracer().startSpan(name, options, context);
+  startSpan(name2, options, context) {
+    return this._getTracer().startSpan(name2, options, context);
   }
   startActiveSpan(_name, _options, _context, _fn) {
     const tracer = this._getTracer();
@@ -25194,9 +25198,9 @@ var ProxyTracerProvider = class {
   /**
    * Get a {@link ProxyTracer}
    */
-  getTracer(name, version2, options) {
+  getTracer(name2, version2, options) {
     var _a3;
-    return (_a3 = this.getDelegateTracer(name, version2, options)) !== null && _a3 !== void 0 ? _a3 : new ProxyTracer(this, name, version2, options);
+    return (_a3 = this.getDelegateTracer(name2, version2, options)) !== null && _a3 !== void 0 ? _a3 : new ProxyTracer(this, name2, version2, options);
   }
   getDelegate() {
     var _a3;
@@ -25208,9 +25212,9 @@ var ProxyTracerProvider = class {
   setDelegate(delegate) {
     this._delegate = delegate;
   }
-  getDelegateTracer(name, version2, options) {
+  getDelegateTracer(name2, version2, options) {
     var _a3;
-    return (_a3 = this._delegate) === null || _a3 === void 0 ? void 0 : _a3.getTracer(name, version2, options);
+    return (_a3 = this._delegate) === null || _a3 === void 0 ? void 0 : _a3.getTracer(name2, version2, options);
   }
 };
 
@@ -25257,8 +25261,8 @@ var TraceAPI = class _TraceAPI {
   /**
    * Returns a tracer from the global tracer provider.
    */
-  getTracer(name, version2) {
-    return this.getTracerProvider().getTracer(name, version2);
+  getTracer(name2, version2) {
+    return this.getTracerProvider().getTracer(name2, version2);
   }
   /** Remove the global tracer provider */
   disable() {
@@ -26641,9 +26645,9 @@ function isSkippedPath({ path }) {
   return path.split("/").some((segment) => segment.startsWith(".") || segment === "node_modules");
 }
 function buildFileOf({ path, bytes }) {
-  const text = bytes.toString("utf8");
-  const isText = !text.includes("\0") && Buffer.from(text, "utf8").equals(bytes);
-  return isText ? { path, content: text, encoding: "utf8", bytes: bytes.length } : { path, content: bytes.toString("base64"), encoding: "base64", bytes: bytes.length };
+  const text2 = bytes.toString("utf8");
+  const isText = !text2.includes("\0") && Buffer.from(text2, "utf8").equals(bytes);
+  return isText ? { path, content: text2, encoding: "utf8", bytes: bytes.length } : { path, content: bytes.toString("base64"), encoding: "base64", bytes: bytes.length };
 }
 function versionLine({ version: version2 }) {
   const at = version2.createdAt.slice(0, 16).replace("T", " ");
@@ -27209,10 +27213,10 @@ var STARTER_TEMPLATES = {
 };
 function templateFiles({
   template,
-  name
+  name: name2
 }) {
   return {
-    "index.html": indexHtml({ title: name.replaceAll("&", "&amp;").replaceAll("<", "&lt;") }),
+    "index.html": indexHtml({ title: name2.replaceAll("&", "&amp;").replaceAll("<", "&lt;") }),
     "app.js": template.appJs,
     "laze.js": LAZE_CLIENT_JS,
     "laze-kit.css": LAZE_KIT_CSS
@@ -27235,9 +27239,9 @@ function folderOf({ context, word }) {
   return resolve2(context.cwd, word ?? ".");
 }
 async function readManifest(folder) {
-  const text = await readFile3(join3(folder, APP_MANIFEST_FILE), "utf8").catch(() => void 0);
-  if (text === void 0) return void 0;
-  const parsed = appManifestSchema.safeParse(JSON.parse(text));
+  const text2 = await readFile3(join3(folder, APP_MANIFEST_FILE), "utf8").catch(() => void 0);
+  if (text2 === void 0) return void 0;
+  const parsed = appManifestSchema.safeParse(JSON.parse(text2));
   if (!parsed.success) {
     throw new CliUsageError(`${APP_MANIFEST_FILE} is not valid: ${parsed.error.message}`);
   }
@@ -27266,15 +27270,15 @@ async function appIdOf({
 async function jsonFlag({
   context,
   args,
-  name
+  name: name2
 }) {
-  const raw = flagText({ args, name });
+  const raw = flagText({ args, name: name2 });
   if (!raw) return void 0;
-  const text = raw.startsWith("@") ? await readFile3(resolve2(context.cwd, raw.slice(1)), "utf8") : raw;
+  const text2 = raw.startsWith("@") ? await readFile3(resolve2(context.cwd, raw.slice(1)), "utf8") : raw;
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    throw new CliUsageError(`--${name} must be JSON (or @file holding JSON)`);
+    throw new CliUsageError(`--${name2} must be JSON (or @file holding JSON)`);
   }
 }
 async function listFiles(folder) {
@@ -27298,14 +27302,14 @@ function print({
   context,
   args,
   value,
-  text
+  text: text2
 }) {
   context.out(args.flags.json ? `${JSON.stringify(value, null, 2)}
-` : text);
+` : text2);
 }
 var appCreate = async ({ context, args }) => {
-  const name = args.words.slice(2).join(" ").trim();
-  if (!name) throw new CliUsageError(USAGE);
+  const name2 = args.words.slice(2).join(" ").trim();
+  if (!name2) throw new CliUsageError(USAGE);
   const templateName = flagText({ args, name: "template" });
   if (templateName && !APP_TEMPLATES.includes(templateName)) {
     throw new CliUsageError(
@@ -27318,14 +27322,14 @@ var appCreate = async ({ context, args }) => {
   const slug = flagText({ args, name: "slug" });
   const visibility = flagText({ args, name: "visibility" });
   const app2 = await client.post("/api/apps/create", {
-    name,
+    name: name2,
     ...slug ? { slug } : {},
     ...channel ? { channel } : {},
     ...visibility ? { visibility } : {}
   });
   const folder = resolve2(context.cwd, flagText({ args, name: "dir", fallback: app2.slug }));
   await mkdir3(folder, { recursive: true });
-  const files = template ? templateFiles({ template, name }) : {};
+  const files = template ? templateFiles({ template, name: name2 }) : {};
   for (const [path, content] of Object.entries(files)) {
     await writeFile3(join3(folder, path), content);
   }
@@ -27380,11 +27384,11 @@ var appPush = async ({ context, args }) => {
   if (files.length === 0) throw new CliUsageError(`No files to push in ${folder}`);
   const { client } = await signedIn({ context, args });
   const appId = await appIdOf({ client, args, folder });
-  for (const [name, collection] of Object.entries(manifest?.collections ?? {})) {
+  for (const [name2, collection] of Object.entries(manifest?.collections ?? {})) {
     await client.post("/api/apps/collections/define", {
       appId,
       site: "draft",
-      name,
+      name: name2,
       fields: collection.fields
     });
   }
@@ -27498,13 +27502,13 @@ var appCollections = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   const appId = await appIdOf({ client, args, folder: folderOf({ context, word: void 0 }) });
   if (args.words[2] === "define") {
-    const name = args.words[3];
+    const name2 = args.words[3];
     const fields = await jsonFlag({ context, args, name: "fields" });
-    if (!name || !Array.isArray(fields)) throw new CliUsageError(USAGE);
+    if (!name2 || !Array.isArray(fields)) throw new CliUsageError(USAGE);
     const collection = await client.post("/api/apps/collections/define", {
       appId,
       site: siteOf(args, "draft"),
-      name,
+      name: name2,
       fields
     });
     return print({
@@ -27616,12 +27620,12 @@ var APP_COMMANDS = {
   export: appExport
 };
 async function app({ context, args }) {
-  const name = args.words[1] ?? "";
-  const command = Object.hasOwn(APP_COMMANDS, name) ? APP_COMMANDS[name] : void 0;
+  const name2 = args.words[1] ?? "";
+  const command = Object.hasOwn(APP_COMMANDS, name2) ? APP_COMMANDS[name2] : void 0;
   if (!command) {
     context.out(`${USAGE}
 `);
-    if (name) throw new CliUsageError(`laze app has no command ${name}`);
+    if (name2) throw new CliUsageError(`laze app has no command ${name2}`);
     return;
   }
   await command({ context, args });
@@ -27646,12 +27650,12 @@ async function profileOf({
 }
 async function login({ context, args }) {
   const url2 = serverUrlOf({ context, args });
-  const name = flagText({ args, name: "profile", fallback: "default" });
+  const name2 = flagText({ args, name: "profile", fallback: "default" });
   const given = flagText({ args, name: "token" });
   const token = given || await deviceToken({ context, url: url2, args });
   const profile = await profileOf({ context, url: url2, token });
-  await context.store.saveProfile({ name, profile });
-  context.out(`Signed in to ${url2} as ${profile.name} (profile "${name}").
+  await context.store.saveProfile({ name: name2, profile });
+  context.out(`Signed in to ${url2} as ${profile.name} (profile "${name2}").
 `);
 }
 async function deviceToken({
@@ -27682,18 +27686,18 @@ async function deviceToken({
   throw new CliUsageError("The sign-in code expired: run `laze login` again.");
 }
 async function logout({ context, args }) {
-  const { name } = await signedIn({ context, args });
-  await context.store.removeProfile({ name });
-  context.out(`Signed out of profile "${name}". Its key stays valid until revoked in Laze.
+  const { name: name2 } = await signedIn({ context, args });
+  await context.store.removeProfile({ name: name2 });
+  context.out(`Signed out of profile "${name2}". Its key stays valid until revoked in Laze.
 `);
 }
 async function whoami({ context, args }) {
-  const { client, name, profile } = await signedIn({ context, args });
+  const { client, name: name2, profile } = await signedIn({ context, args });
   const me = await client.get("/api/agents/me");
   if (args.flags.json) return context.out(`${JSON.stringify(me, null, 2)}
 `);
   const who = me.kind === "agent" ? `agent ${me.name} (${me.id})` : `${me.name} (${me.id})`;
-  context.out(`${who} in workspace ${me.workspaceId} at ${profile.url}, profile "${name}"
+  context.out(`${who} in workspace ${me.workspaceId} at ${profile.url}, profile "${name2}"
 `);
 }
 async function workspaces({ context, args }) {
@@ -27701,10 +27705,10 @@ async function workspaces({ context, args }) {
   const entries = Object.entries(config2.profiles);
   if (entries.length === 0) return context.out("Not signed in: run `laze login` first.\n");
   const active = await signedIn({ context, args }).catch(() => void 0);
-  for (const [name, profile] of entries) {
-    const star = active?.name === name ? "*" : " ";
+  for (const [name2, profile] of entries) {
+    const star = active?.name === name2 ? "*" : " ";
     context.out(
-      `${star} ${name}	${profile.workspaceId}	${profile.kind} ${profile.name}	${profile.url}
+      `${star} ${name2}	${profile.workspaceId}	${profile.kind} ${profile.name}	${profile.url}
 `
     );
   }
@@ -27761,7 +27765,7 @@ var CodexAppServer = class _CodexAppServer {
     this.write({ method });
   }
   /** Runs one turn and waits for it to complete, keeping its last agent message. */
-  async turn({ threadId, text }) {
+  async turn({ threadId, text: text2 }) {
     const result = { answer: "" };
     const done = new Promise((resolve6) => {
       const listen = (message) => {
@@ -27774,7 +27778,7 @@ var CodexAppServer = class _CodexAppServer {
     });
     await this.call("turn/start", {
       threadId,
-      input: [{ type: "text", text, text_elements: [] }]
+      input: [{ type: "text", text: text2, text_elements: [] }]
     });
     await done;
     return result;
@@ -28013,12 +28017,12 @@ async function feedUpdate({ context, args }) {
 }
 async function feedReply({ context, args }) {
   const itemId = args.words[2];
-  const text = args.words.slice(3).join(" ").trim();
-  if (!itemId || !text) throw new CliUsageError(USAGE2);
+  const text2 = args.words.slice(3).join(" ").trim();
+  if (!itemId || !text2) throw new CliUsageError(USAGE2);
   const { client } = await signedIn({ context, args });
   const replied = await client.post("/api/feed/items/reply", {
     itemId,
-    body: text,
+    body: text2,
     urgent: Boolean(args.flags.urgent)
   });
   printItem({ context, args, item: replied });
@@ -28048,8 +28052,8 @@ var FEED_COMMANDS = {
   inbox: feedInbox
 };
 async function feed({ context, args }) {
-  const name = args.words[1] ?? "";
-  const command = Object.hasOwn(FEED_COMMANDS, name) ? FEED_COMMANDS[name] : void 0;
+  const name2 = args.words[1] ?? "";
+  const command = Object.hasOwn(FEED_COMMANDS, name2) ? FEED_COMMANDS[name2] : void 0;
   if (!command) throw new CliUsageError(USAGE2);
   await command({ context, args });
 }
@@ -28113,6 +28117,12 @@ async function signedGhArgs({
   }
   return out;
 }
+var LOCAL_COMMANDS = /* @__PURE__ */ new Set(["--version", "version", "help", "--help", "-h", "completion"]);
+function isLocalGhCall(args) {
+  const [first] = args;
+  if (first === void 0 || LOCAL_COMMANDS.has(first)) return true;
+  return args.includes("--help");
+}
 
 // src/services/github-commands.service.ts
 var REAL_GH = "/usr/bin/gh";
@@ -28121,7 +28131,7 @@ async function credentialOf({ env }) {
   const placeholder = (env.GH_TOKEN ?? "").split(TURN_SEPARATOR)[0] ?? "";
   if (!placeholder.startsWith("laze-ph-")) throw new CliUsageError(NOT_SET);
   const turn = env.LAZE_TURN_FILE ? await readFile5(env.LAZE_TURN_FILE, "utf8").then(
-    (text) => text.trim(),
+    (text2) => text2.trim(),
     () => ""
   ) : "";
   return turn ? `${placeholder}${TURN_SEPARATOR}${turn}` : placeholder;
@@ -28137,6 +28147,12 @@ async function githubGh({
   args
 }) {
   const env = context.environment.inherited;
+  if (isLocalGhCall(args.rest)) {
+    return context.runCommand({
+      command: [REAL_GH, ...args.rest],
+      env: { GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1" }
+    });
+  }
   const credential = await credentialOf({ env });
   const { profile } = await signedIn({ context, args: { ...args, flags: {} } });
   const ghArgs = await signedGhArgs({
@@ -28266,7 +28282,7 @@ async function relayMcpLines({
   for await (const line of lines) {
     if (!line.trim()) continue;
     const turn = await readFile6(turnFile, "utf8").then(
-      (text2) => text2.trim(),
+      (text3) => text3.trim(),
       () => ""
     );
     const response = await context.fetcher(url2, {
@@ -28279,8 +28295,8 @@ async function relayMcpLines({
       },
       body: line
     });
-    const text = await response.text();
-    if (text.trim()) context.out(`${text.trim()}
+    const text2 = await response.text();
+    if (text2.trim()) context.out(`${text2.trim()}
 `);
   }
 }
@@ -28331,10 +28347,10 @@ function textOf2(value) {
 async function callTool({
   context,
   client,
-  name,
+  name: name2,
   input: input2
 }) {
-  switch (name) {
+  switch (name2) {
     case "whoami":
       return JSON.stringify(await client.get("/api/agents/me"));
     case "list_channels":
@@ -28364,7 +28380,7 @@ async function callTool({
       return `Replied ${posted.messageId}.`;
     }
     default:
-      throw new Error(`Unknown tool ${name}`);
+      throw new Error(`Unknown tool ${name2}`);
   }
 }
 async function answer2({
@@ -28383,13 +28399,13 @@ async function answer2({
   if (request.method === "tools/list") return { tools: TOOLS };
   if (request.method === "tools/call") {
     try {
-      const text = await callTool({
+      const text2 = await callTool({
         context,
         client,
         name: textOf2(params.name),
         input: params.arguments ?? {}
       });
-      return { content: [{ type: "text", text }] };
+      return { content: [{ type: "text", text: text2 }] };
     } catch (error62) {
       return { content: [{ type: "text", text: String(error62) }], isError: true };
     }
@@ -28500,9 +28516,9 @@ async function memoryAppend({ context, args }) {
   const ref = fileRef({ context, args });
   const value = args.words.slice(3).join(" ");
   if (!value) throw new CliUsageError(USAGE3);
-  const text = await textArgument({ context, value });
+  const text2 = await textArgument({ context, value });
   const { client } = await signedIn({ context, args });
-  const saved = await client.post("/api/memory/append", { ...ref, text });
+  const saved = await client.post("/api/memory/append", { ...ref, text: text2 });
   if (args.flags.json) return printDocument({ context, args, document: saved });
   context.out(`Saved ${saved.file} version ${saved.version}
 `);
@@ -28540,8 +28556,8 @@ var MEMORY_COMMANDS = {
   pull: memoryPull
 };
 async function memory({ context, args }) {
-  const name = args.words[1] ?? "";
-  const command = Object.hasOwn(MEMORY_COMMANDS, name) ? MEMORY_COMMANDS[name] : void 0;
+  const name2 = args.words[1] ?? "";
+  const command = Object.hasOwn(MEMORY_COMMANDS, name2) ? MEMORY_COMMANDS[name2] : void 0;
   if (!command) throw new CliUsageError(USAGE3);
   await command({ context, args });
 }
@@ -28572,15 +28588,15 @@ function printSchedule({ context, schedule: schedule2 }) {
   );
 }
 async function scheduleAdd({ context, args }) {
-  const name = args.words.slice(2).join(" ").trim();
+  const name2 = args.words.slice(2).join(" ").trim();
   const prompt = flagText({ args, name: "prompt" });
-  if (!name || !prompt) throw new CliUsageError(USAGE4);
+  if (!name2 || !prompt) throw new CliUsageError(USAGE4);
   const timing = timingOf(args);
   const { client } = await signedIn({ context, args });
   const channelId = flagText({ args, name: "channel" });
   const agentId = flagText({ args, name: "agent" });
   const schedule2 = await client.post("/api/schedules", {
-    name,
+    name: name2,
     prompt,
     timing,
     timezone: flagText({ args, name: "tz", fallback: "UTC" }),
@@ -28636,8 +28652,8 @@ var SCHEDULE_COMMANDS = {
   runs: scheduleRuns
 };
 async function schedule({ context, args }) {
-  const name = args.words[1] ?? "";
-  const command = Object.hasOwn(SCHEDULE_COMMANDS, name) ? SCHEDULE_COMMANDS[name] : void 0;
+  const name2 = args.words[1] ?? "";
+  const command = Object.hasOwn(SCHEDULE_COMMANDS, name2) ? SCHEDULE_COMMANDS[name2] : void 0;
   if (!command) throw new CliUsageError(USAGE4);
   await command({ context, args });
 }
@@ -28677,12 +28693,12 @@ async function skillInstall({ context, args }) {
   const catalogueId = args.words[2];
   const from = flagText({ args, name: "from" });
   if (!catalogueId === !from) throw new CliUsageError(USAGE5);
-  const name = flagText({ args, name: "as" });
+  const name2 = flagText({ args, name: "as" });
   const files = from ? await folderFiles({ root: resolve5(context.cwd, from) }) : void 0;
   const { client } = await signedIn({ context, args });
   const installed = await client.post("/api/skills/install", {
     ...catalogueId ? { catalogueId } : {},
-    ...name ? { name } : {},
+    ...name2 ? { name: name2 } : {},
     ...files ? { files } : {}
   });
   if (args.flags.json) return context.out(`${JSON.stringify(installed, null, 2)}
@@ -28691,10 +28707,10 @@ async function skillInstall({ context, args }) {
 `);
 }
 async function skillShow({ context, args }) {
-  const name = args.words[2];
-  if (!name) throw new CliUsageError(USAGE5);
+  const name2 = args.words[2];
+  if (!name2) throw new CliUsageError(USAGE5);
   const { client } = await signedIn({ context, args });
-  const skill2 = await client.post("/api/skills/show", { name });
+  const skill2 = await client.post("/api/skills/show", { name: name2 });
   if (args.flags.json) return context.out(`${JSON.stringify(skill2, null, 2)}
 `);
   context.out(`${skill2.name}${skill2.installed ? "" : " (not installed)"}: ${skill2.description}
@@ -28722,14 +28738,676 @@ var SKILL_COMMANDS = {
   pull: skillPull
 };
 async function skill({ context, args }) {
-  const name = args.words[1] ?? "";
-  const command = Object.hasOwn(SKILL_COMMANDS, name) ? SKILL_COMMANDS[name] : void 0;
+  const name2 = args.words[1] ?? "";
+  const command = Object.hasOwn(SKILL_COMMANDS, name2) ? SKILL_COMMANDS[name2] : void 0;
   if (!command) throw new CliUsageError(USAGE5);
   await command({ context, args });
 }
 
 // src/services/vault-commands.service.ts
 import { readFile as readFile9 } from "node:fs/promises";
+
+// ../../modules/vault/contract/src/vault-devices.ts
+var base64Url = external_exports.string().regex(/^[A-Za-z0-9_-]+$/).max(16384);
+var name = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/);
+var fieldName = external_exports.string().regex(/^[A-Z][A-Z0-9_]{0,63}$/);
+var vaultDeviceKindSchema = external_exports.enum(["passkey", "ios_secure_enclave"]);
+var vaultDeviceStateSchema = external_exports.enum(["pending", "active"]);
+var vaultDevicePasskeySchemaDefinition = external_exports.object({
+  credentialId: base64Url,
+  prfSalt: base64Url,
+  wrappedPrivateKey: base64Url
+});
+var vaultDeviceSchemaDefinition = external_exports.object({
+  id: external_exports.string().min(1),
+  workspaceId: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  label: external_exports.string(),
+  kind: vaultDeviceKindSchema,
+  state: vaultDeviceStateSchema,
+  /** P-256 uncompressed point, base64url. */
+  publicKey: base64Url,
+  /** `4F2A 91C0`: the first four bytes of sha256(publicKey). */
+  fingerprint: external_exports.string(),
+  /** What the browser needs to unlock the device's key with its passkey; null for native. */
+  passkey: vaultDevicePasskeySchemaDefinition.nullable(),
+  createdAt: external_exports.iso.datetime(),
+  activatedAt: external_exports.iso.datetime().nullable()
+});
+var vaultDeviceSchema = vaultDeviceSchemaDefinition;
+var vaultDeviceEnrolmentSchemaDefinition = external_exports.object({
+  deviceId: external_exports.string(),
+  /** Signed by the vault: the WebAuthn challenge is its UTF-8 bytes. */
+  challenge: external_exports.string(),
+  /** The passkey's user handle and names. */
+  userId: external_exports.string(),
+  /** True when this person has no active device, so the new one is active at once. */
+  first: external_exports.boolean()
+});
+var vaultDeviceEnrolmentSchema = vaultDeviceEnrolmentSchemaDefinition;
+var finishVaultDeviceEnrolmentInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  deviceId: external_exports.string().min(1),
+  challenge: external_exports.string().min(1),
+  label: external_exports.string().trim().min(1).max(80),
+  publicKey: base64Url,
+  passkey: external_exports.object({
+    ...vaultDevicePasskeySchemaDefinition.shape,
+    /** The passkey's own public key, SPKI DER, ES256 only. */
+    credentialPublicKey: base64Url,
+    credentialAlgorithm: external_exports.literal(-7),
+    clientDataJSON: base64Url
+  })
+});
+var finishVaultDeviceEnrolmentInputSchema = finishVaultDeviceEnrolmentInputSchemaDefinition;
+var sealedRecipientSchema = external_exports.object({
+  deviceId: external_exports.string().min(1),
+  epk: base64Url,
+  wrappedKey: base64Url
+});
+var sealedSecretSchemaDefinition = external_exports.object({
+  blob: base64Url,
+  recipients: external_exports.array(sealedRecipientSchema).min(1).max(32)
+});
+var vaultDeviceAssertionSchemaDefinition = external_exports.object({
+  credentialId: base64Url,
+  clientDataJSON: base64Url,
+  authenticatorData: base64Url,
+  signature: base64Url
+});
+var approveVaultDeviceInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  deviceId: external_exports.string().min(1),
+  challenge: external_exports.string().min(1),
+  assertion: vaultDeviceAssertionSchemaDefinition,
+  /** The new device's recipient for every sealed secret of the owner. */
+  recipients: external_exports.array(
+    external_exports.object({ connectionId: external_exports.string().min(1), recipient: sealedRecipientSchema })
+  )
+});
+var approveVaultDeviceInputSchema = approveVaultDeviceInputSchemaDefinition;
+var createSealedConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  name,
+  label: external_exports.string().trim().min(1).max(120),
+  sensitivity: external_exports.enum(["ask", "human_only"]).default("ask"),
+  rules: external_exports.string().max(2e3).default(""),
+  fieldNames: external_exports.array(fieldName).min(1).max(32),
+  sealed: sealedSecretSchemaDefinition,
+  /** Only a personal API key set is sealed for now; anything else is refused, not ignored. */
+  keychain: external_exports.enum(["personal", "workspace", "agent"]).default("personal"),
+  kind: external_exports.enum(["api_key_set", "oauth", "mcp"]).default("api_key_set")
+});
+var createSealedConnectionInputSchema = createSealedConnectionInputSchemaDefinition;
+var resealConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  fieldNames: external_exports.array(fieldName).min(1).max(32),
+  sealed: sealedSecretSchemaDefinition
+});
+var resealConnectionInputSchema = resealConnectionInputSchemaDefinition;
+var vaultSealedMaterialSchemaDefinition = external_exports.object({
+  connectionId: external_exports.string(),
+  workspaceId: external_exports.string(),
+  ownerUserId: external_exports.string(),
+  name,
+  label: external_exports.string(),
+  fieldNames: external_exports.array(external_exports.string()),
+  blob: base64Url,
+  recipients: external_exports.array(sealedRecipientSchema)
+});
+var vaultSealedMaterialSchema = vaultSealedMaterialSchemaDefinition;
+var vaultSealedApprovalSchemaDefinition = external_exports.object({
+  requestId: external_exports.string(),
+  agentId: external_exports.string(),
+  reason: external_exports.string(),
+  command: external_exports.array(external_exports.string()),
+  /** The run's public key; the opened value is encrypted to it and nothing else. */
+  runPublicKey: base64Url,
+  material: vaultSealedMaterialSchemaDefinition
+});
+var vaultSealedApprovalSchema = vaultSealedApprovalSchemaDefinition;
+var answerSealedApprovalInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  requestId: external_exports.string().min(1),
+  release: external_exports.object({ epk: base64Url, ciphertext: base64Url }),
+  via: external_exports.enum(["feed", "channel", "ios", "desktop", "web"]).default("web")
+});
+var answerSealedApprovalInputSchema = answerSealedApprovalInputSchemaDefinition;
+var vaultRunSealedReleaseSchemaDefinition = external_exports.object({
+  requestId: external_exports.string(),
+  epk: base64Url,
+  ciphertext: base64Url
+});
+var vaultRunSealedReleaseSchema = vaultRunSealedReleaseSchemaDefinition;
+
+// ../../modules/vault/contract/src/vault-reason.ts
+var COMMAND_STARTS = new Set(
+  "sudo laze kv aws curl wget npm pnpm yarn npx git gh kubectl helm docker terraform python python3 node bash sh zsh export cd make cargo go ssh scp psql uv pip echo cat env clickhouse-client".split(
+    " "
+  )
+);
+function checkVaultReason(reason) {
+  const text2 = (reason ?? "").trim();
+  if (text2 === "") return "missing";
+  if (text2.includes("\n") || Array.from(text2).length > 200) return "too_long";
+  const words = text2.split(/\s+/);
+  if (COMMAND_STARTS.has((words[0] ?? "").toLowerCase())) return "looks_like_command";
+  if (/(^|\s)--?[A-Za-z]/.test(text2) || /[|;&`$<>{}]/.test(text2)) return "looks_like_command";
+  if (words.length < 4) return "too_short";
+  return "ok";
+}
+var vaultReasonSchema = external_exports.string().transform((reason) => reason.trim()).superRefine((reason, context) => {
+  const problem = checkVaultReason(reason);
+  if (problem !== "ok")
+    context.addIssue({ code: "custom", message: problem, params: { problem } });
+});
+
+// ../../modules/vault/contract/src/vault.ts
+var vaultSensitivitySchema = external_exports.enum(["auto", "checked", "ask", "human_only"]);
+var vaultKeychainSchemaDefinition = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("personal"), ownerUserId: external_exports.string().min(1) }),
+  external_exports.object({ kind: external_exports.literal("workspace") }),
+  external_exports.object({ kind: external_exports.literal("agent"), agentId: external_exports.string().min(1) })
+]);
+var vaultKeychainSchema = vaultKeychainSchemaDefinition;
+var vaultConnectionKindSchema = external_exports.enum(["api_key_set", "oauth", "mcp"]);
+var vaultConnectionStatusSchema = external_exports.enum(["active", "needs_reconnect"]);
+var vaultFieldNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(64);
+var vaultConnectionNameSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/);
+var vaultOAuthRevokeStyleSchema = external_exports.enum(["rfc7009", "github_grant", "slack"]);
+var vaultOAuthClientSchemaDefinition = external_exports.object({
+  tokenUrl: external_exports.url(),
+  clientId: external_exports.string().min(1),
+  clientSecret: external_exports.string().min(1).nullable().default(null),
+  authMethod: external_exports.enum(["client_secret_post", "client_secret_basic", "none", "github_app"]).default("client_secret_post"),
+  /** How the token endpoint reads its body. */
+  bodyFormat: external_exports.enum(["form", "json"]).default("form"),
+  /** Where a nested provider answer keeps the person's token, Slack's `authed_user`. */
+  tokenPath: external_exports.enum(["authed_user"]).nullable().default(null),
+  revoke: external_exports.object({ style: vaultOAuthRevokeStyleSchema, url: external_exports.url() }).nullable().default(null)
+});
+var vaultOAuthClientSchema = vaultOAuthClientSchemaDefinition;
+var vaultOAuthTokensSchemaDefinition = external_exports.object({
+  accessToken: external_exports.string().min(1),
+  refreshToken: external_exports.string().min(1).nullable().default(null),
+  /** ISO 8601; null when the provider's access tokens do not expire. */
+  expiresAt: external_exports.iso.datetime().nullable().default(null),
+  scopes: external_exports.array(external_exports.string().min(1)).default([]),
+  client: vaultOAuthClientSchema
+});
+var vaultOAuthTokensSchema = vaultOAuthTokensSchemaDefinition;
+var vaultSecretBundleSchemaDefinition = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    kind: external_exports.literal("api_key_set"),
+    fields: external_exports.record(vaultFieldNameSchema, external_exports.string().min(1))
+  }),
+  /** A grant from a provider in the connector registry: Gmail, GitHub, Slack and the rest. */
+  external_exports.object({
+    kind: external_exports.literal("oauth"),
+    provider: external_exports.string().min(1),
+    /** Who the grant is for at the provider, shown to the owner: an address or a login. */
+    account: external_exports.string().min(1).nullable().default(null),
+    tokens: vaultOAuthTokensSchema
+  }),
+  /** A remote MCP server: the headers it takes, and its OAuth tokens when it signs people in. */
+  external_exports.object({
+    kind: external_exports.literal("mcp"),
+    serverUrl: external_exports.url(),
+    headers: external_exports.record(external_exports.string().regex(/^[A-Za-z0-9-]{1,64}$/), external_exports.string().min(1)).default({}),
+    tokens: vaultOAuthTokensSchema.nullable().default(null)
+  })
+]);
+var vaultSecretBundleSchema = vaultSecretBundleSchemaDefinition;
+var vaultConnectorDetailsSchemaDefinition = external_exports.object({
+  provider: external_exports.string().nullable(),
+  serverUrl: external_exports.string().nullable(),
+  account: external_exports.string().nullable(),
+  scopes: external_exports.array(external_exports.string()),
+  /** When the access token runs out; the vault refreshes it on the next use. */
+  expiresAt: external_exports.iso.datetime().nullable()
+});
+var vaultConnectorDetailsSchema = vaultConnectorDetailsSchemaDefinition;
+var vaultEgressTargetSchemaDefinition = external_exports.object({
+  upstream: external_exports.url(),
+  header: external_exports.string().min(1).default("Authorization"),
+  prefix: external_exports.string().default("Bearer "),
+  field: vaultFieldNameSchema
+});
+var vaultEgressTargetSchema = vaultEgressTargetSchemaDefinition;
+var vaultConnectionSchemaDefinition = external_exports.object({
+  id: external_exports.string().min(1),
+  workspaceId: external_exports.string().min(1),
+  name: vaultConnectionNameSchema,
+  label: external_exports.string(),
+  kind: vaultConnectionKindSchema,
+  keychain: vaultKeychainSchema,
+  sensitivity: vaultSensitivitySchema,
+  /** Plain-language rules the judge reads: "Read only; never send mail." */
+  rules: external_exports.string(),
+  /** Who answers an ask on a workspace or agent keychain; a personal one asks its owner. */
+  approverUserIds: external_exports.array(external_exports.string().min(1)),
+  /** The longest lease an approver may give, set by an admin. */
+  maxLeaseSeconds: external_exports.number().int().positive().nullable(),
+  fieldNames: external_exports.array(vaultFieldNameSchema),
+  egress: vaultEgressTargetSchema.nullable(),
+  status: vaultConnectionStatusSchema,
+  /** Provider, account, scopes and expiry of an OAuth or MCP connection; null for API keys. */
+  connector: vaultConnectorDetailsSchema.nullable(),
+  /** Sealed to its owner's devices: the server cannot open it. */
+  sealed: external_exports.boolean().default(false),
+  /** False for a sealed connection no enrolled device can open any more. */
+  openable: external_exports.boolean().default(true),
+  createdByUserId: external_exports.string(),
+  /** ISO 8601 */
+  createdAt: external_exports.iso.datetime(),
+  updatedAt: external_exports.iso.datetime()
+});
+var vaultConnectionSchema = vaultConnectionSchemaDefinition;
+var createVaultConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  name: vaultConnectionNameSchema,
+  label: external_exports.string().trim().min(1).max(120),
+  keychain: vaultKeychainSchema,
+  sensitivity: vaultSensitivitySchema,
+  rules: external_exports.string().max(2e3).default(""),
+  approverUserIds: external_exports.array(external_exports.string().min(1)).default([]),
+  maxLeaseSeconds: external_exports.number().int().positive().nullable().default(null),
+  secret: vaultSecretBundleSchema,
+  egress: vaultEgressTargetSchema.nullable().default(null)
+});
+var createVaultConnectionInputSchema = createVaultConnectionInputSchemaDefinition;
+var updateVaultConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  label: external_exports.string().trim().min(1).max(120).optional(),
+  sensitivity: vaultSensitivitySchema.optional(),
+  rules: external_exports.string().max(2e3).optional(),
+  approverUserIds: external_exports.array(external_exports.string().min(1)).optional(),
+  maxLeaseSeconds: external_exports.number().int().positive().nullable().optional(),
+  secret: vaultSecretBundleSchema.optional(),
+  egress: vaultEgressTargetSchema.nullable().optional()
+});
+var updateVaultConnectionInputSchema = updateVaultConnectionInputSchemaDefinition;
+var vaultGrantSubjectSchemaDefinition = external_exports.object({
+  kind: external_exports.enum(["person", "group", "channel", "agent"]),
+  id: external_exports.string().min(1)
+});
+var vaultGrantSubjectSchema = vaultGrantSubjectSchemaDefinition;
+var vaultGrantSchemaDefinition = external_exports.object({
+  id: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  subject: vaultGrantSubjectSchema,
+  /** A lend: a personal connection opened to one channel's members through its owner's agent. */
+  lend: external_exports.boolean(),
+  grantedByUserId: external_exports.string(),
+  expiresAt: external_exports.iso.datetime().nullable(),
+  createdAt: external_exports.iso.datetime()
+});
+var vaultGrantSchema = vaultGrantSchemaDefinition;
+var grantVaultConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  subject: vaultGrantSubjectSchema,
+  /** No end when null. */
+  durationSeconds: external_exports.number().int().positive().nullable().default(null)
+});
+var grantVaultConnectionInputSchema = grantVaultConnectionInputSchemaDefinition;
+var lendVaultConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  channelId: external_exports.string().min(1),
+  durationSeconds: external_exports.number().int().positive().nullable().default(null)
+});
+var lendVaultConnectionInputSchema = lendVaultConnectionInputSchemaDefinition;
+var vaultAgentKindSchema = external_exports.enum(["personal", "team"]);
+var openVaultTurnInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  agent: external_exports.object({
+    id: external_exports.string().min(1),
+    kind: vaultAgentKindSchema,
+    ownerUserId: external_exports.string().min(1)
+  }),
+  requesterUserId: external_exports.string().min(1),
+  requesterGroupIds: external_exports.array(external_exports.string().min(1)).default([]),
+  channel: external_exports.object({ id: external_exports.string().min(1), kind: external_exports.enum(["public", "private", "dm"]) }),
+  /** False when the requester can no longer see the channel (a schedule's creator who left). */
+  requesterSeesChannel: external_exports.boolean().default(true),
+  /** The requester's messages this turn, for the judge; other senders are never permission. */
+  requesterMessages: external_exports.array(external_exports.string()).default([])
+});
+var vaultAlwaysApprovalActionSchema = external_exports.enum([
+  "send_external",
+  "publish_app_public",
+  "rent_compute_above_budget",
+  "create_agent_with_workspace_access",
+  "invite_people"
+]);
+var VAULT_ALWAYS_APPROVAL_ACTIONS = vaultAlwaysApprovalActionSchema.options;
+var vaultPurposeSchema = external_exports.enum(["use", "send_external"]);
+var vaultUseInputSchemaDefinition = external_exports.object({
+  turnToken: external_exports.string().min(1),
+  /** The connection's name as the agent asks for it, or its id. */
+  connection: external_exports.string().min(1),
+  purpose: vaultPurposeSchema.default("use"),
+  reason: vaultReasonSchema,
+  command: external_exports.array(external_exports.string()).default([]),
+  /** OAuth scopes this use needs; a grant without them is refused with the missing ones. */
+  requiredScopes: external_exports.array(external_exports.string().min(1)).default([]),
+  /** A floor on the connection's sensitivity, for a tool its owner marked more guarded. */
+  atLeast: vaultSensitivitySchema.optional()
+});
+var vaultRunReleaseSchemaDefinition = external_exports.discriminatedUnion("outcome", [
+  external_exports.object({
+    outcome: external_exports.literal("allow"),
+    env: external_exports.record(external_exports.string(), external_exports.string()),
+    /** A sealed connection's values, encrypted to the run's own key. */
+    sealed: vaultRunSealedReleaseSchema.optional()
+  }),
+  external_exports.object({
+    outcome: external_exports.literal("ask"),
+    requestId: external_exports.string(),
+    message: external_exports.string()
+  }),
+  external_exports.object({ outcome: external_exports.literal("deny"), exitCode: external_exports.number().int(), message: external_exports.string() })
+]);
+var vaultEgressResolveInputSchemaDefinition = external_exports.object({
+  agentId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  method: external_exports.string().default("GET"),
+  host: external_exports.string().default(""),
+  path: external_exports.string().default("/"),
+  /** A floor the proxy sets for a guarded request, such as a git push asking before it goes. */
+  atLeast: vaultSensitivitySchema.optional(),
+  /** What the proxy knows the request is, such as "git push to github.com/acme/widgets". */
+  reason: external_exports.string().max(300).optional()
+});
+var vaultEgressResolutionSchemaDefinition = external_exports.discriminatedUnion("decision", [
+  external_exports.object({ decision: external_exports.literal("allow"), value: external_exports.string() }),
+  external_exports.object({ decision: external_exports.literal("pending"), requestId: external_exports.string() }),
+  external_exports.object({ decision: external_exports.literal("deny"), code: external_exports.string() })
+]);
+var vaultEgressReleaseInputSchemaDefinition = external_exports.object({
+  agentId: external_exports.string().min(1),
+  connection: external_exports.string().min(1),
+  reason: external_exports.string(),
+  command: external_exports.array(external_exports.string()).default([]),
+  /** The run's P-256 public key, base64url; a sealed connection is released only to it. */
+  recipient: external_exports.string().max(200).optional()
+});
+var vaultApprovalStateSchema = external_exports.enum([
+  "pending",
+  "approved_once",
+  "approved_for_agent",
+  "denied",
+  "expired"
+]);
+var vaultAnswerViaSchema = external_exports.enum(["feed", "channel", "ios", "desktop", "web"]);
+var vaultApprovalRequestSchemaDefinition = external_exports.object({
+  id: external_exports.string(),
+  workspaceId: external_exports.string(),
+  /** Null for an always-approval action that uses no connection. */
+  connectionId: external_exports.string().nullable(),
+  action: external_exports.string(),
+  agentId: external_exports.string(),
+  agentKind: vaultAgentKindSchema,
+  requesterUserId: external_exports.string(),
+  channelId: external_exports.string(),
+  reason: external_exports.string(),
+  command: external_exports.array(external_exports.string()),
+  why: external_exports.string(),
+  approverUserIds: external_exports.array(external_exports.string()),
+  state: vaultApprovalStateSchema,
+  /** How many asks joined this card. */
+  joinCount: external_exports.number().int().positive(),
+  createdAt: external_exports.iso.datetime(),
+  expiresAt: external_exports.iso.datetime(),
+  answeredByUserId: external_exports.string().nullable(),
+  answeredVia: vaultAnswerViaSchema.nullable(),
+  answeredAt: external_exports.iso.datetime().nullable(),
+  leaseExpiresAt: external_exports.iso.datetime().nullable()
+});
+var vaultApprovalRequestSchema = vaultApprovalRequestSchemaDefinition;
+var answerVaultApprovalInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  requestId: external_exports.string().min(1),
+  answer: external_exports.enum(["approve_once", "approve_for_agent", "deny"]),
+  /** Approve for this agent only: up to the connection's admin maximum. */
+  durationSeconds: external_exports.number().int().positive().optional(),
+  via: vaultAnswerViaSchema
+});
+var answerVaultApprovalInputSchema = answerVaultApprovalInputSchemaDefinition;
+var requestVaultActionInputSchemaDefinition = external_exports.object({
+  turnToken: external_exports.string().min(1),
+  action: vaultAlwaysApprovalActionSchema,
+  reason: vaultReasonSchema,
+  /** The people the owning module says decide; the requester when empty. */
+  approverUserIds: external_exports.array(external_exports.string().min(1)).default([])
+});
+var vaultAuditEntrySchemaDefinition = external_exports.object({
+  id: external_exports.string(),
+  seq: external_exports.number().int().positive(),
+  at: external_exports.iso.datetime(),
+  actorKind: external_exports.enum(["user", "agent", "system"]),
+  actorId: external_exports.string().nullable(),
+  action: external_exports.string(),
+  connectionId: external_exports.string().nullable(),
+  outcome: external_exports.string(),
+  decider: external_exports.string().nullable(),
+  requesterUserId: external_exports.string().nullable(),
+  agentId: external_exports.string().nullable(),
+  channelId: external_exports.string().nullable(),
+  requestId: external_exports.string().nullable(),
+  reason: external_exports.string().nullable(),
+  detail: external_exports.record(external_exports.string(), external_exports.unknown()),
+  prevHash: external_exports.string(),
+  hash: external_exports.string()
+});
+var vaultAuditEntrySchema = vaultAuditEntrySchemaDefinition;
+var vaultAuditPageSchemaDefinition = external_exports.object({
+  entries: external_exports.array(vaultAuditEntrySchema),
+  /** The chain re-hashed: when broken, the first entry that does not follow from the last. */
+  chain: external_exports.object({ intact: external_exports.boolean(), brokenAtSeq: external_exports.number().int().nullable() })
+});
+var vaultAuditPageSchema = vaultAuditPageSchemaDefinition;
+var vaultConnectionUseSchemaDefinition = external_exports.object({
+  at: external_exports.iso.datetime(),
+  action: external_exports.string(),
+  outcome: external_exports.string(),
+  agentId: external_exports.string().nullable(),
+  requesterUserId: external_exports.string().nullable(),
+  channelId: external_exports.string().nullable(),
+  reason: external_exports.string().nullable(),
+  /** The command or tool, as the use named it. */
+  command: external_exports.array(external_exports.string())
+});
+var vaultConnectionUseSchema = vaultConnectionUseSchemaDefinition;
+var vaultRevokeAtProviderSchema = external_exports.enum(["revoked", "failed", "not_supported"]);
+var saveGithubInstallationInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  installationId: external_exports.string().regex(/^\d{1,20}$/),
+  account: external_exports.string().min(1).max(100),
+  name: external_exports.string().min(1).max(64),
+  label: external_exports.string().min(1).max(200),
+  approverUserIds: external_exports.array(external_exports.string()).default([]),
+  /** The connection to point at this installation again, after a reinstall. */
+  connectionId: external_exports.string().optional()
+});
+var VaultApi = moduleApi()("vault");
+var workspaceInput = external_exports.object({ workspaceId: external_exports.string().min(1) });
+var connectionInput = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1)
+});
+var vaultTrpc = defineTrpcContract("vault").mutation("createConnection").withInput(createVaultConnectionInputSchema).withOutput(vaultConnectionSchema).query("listConnections").withInput(workspaceInput).withOutput(external_exports.array(vaultConnectionSchema)).mutation("updateConnection").withInput(updateVaultConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("deleteConnection").withInput(connectionInput).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).mutation("revokeConnection").withInput(connectionInput).withOutput(external_exports.object({ atProvider: vaultRevokeAtProviderSchema })).query("listConnectionUses").withInput(
+  external_exports.object({ ...connectionInput.shape, limit: external_exports.number().int().min(1).max(200).optional() })
+).withOutput(external_exports.array(vaultConnectionUseSchema)).mutation("revealConnection").withInput(external_exports.object({ ...connectionInput.shape, reason: external_exports.string().trim().min(1).max(200) })).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), grantId: external_exports.string().min(1) })).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(
+  external_exports.object({ ...workspaceInput.shape, limit: external_exports.number().int().min(1).max(500).optional() })
+).withOutput(vaultAuditPageSchema).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(external_exports.object({ ...connectionInput.shape, reason: external_exports.string().trim().min(1).max(200) })).withOutput(vaultSealedMaterialSchema).query("getSealedApproval").withInput(external_exports.object({ ...workspaceInput.shape, requestId: external_exports.string().min(1) })).withOutput(vaultSealedApprovalSchema).mutation("answerSealedApproval").withInput(answerSealedApprovalInputSchema).withOutput(vaultApprovalRequestSchema).build();
+
+// ../../modules/vault/contract/src/vault.config.ts
+var positiveInt = external_exports.coerce.number().int().positive();
+var vaultConfig = Config.define((c) => ({
+  approvalTimeoutMinutes: c.env("VAULT_APPROVAL_TIMEOUT_MINUTES", positiveInt.default(60)),
+  /** How long an approve-once answer waits for the same ask to come back for it. */
+  approveOnceWindowMinutes: c.env("VAULT_APPROVE_ONCE_WINDOW_MINUTES", positiveInt.default(10)),
+  /** The lease cap when an admin set none on the connection. */
+  defaultMaxLeaseHours: c.env("VAULT_DEFAULT_MAX_LEASE_HOURS", positiveInt.default(168)),
+  turnTtlMinutes: c.env("VAULT_TURN_TTL_MINUTES", positiveInt.default(720)),
+  judgeTimeoutMs: c.env("VAULT_JUDGE_TIMEOUT_MS", positiveInt.default(2e4)),
+  /** How long after a process starts it still accepts turn tokens signed under the previous key. */
+  previousKeyGraceMinutes: c.env(
+    "VAULT_PREVIOUS_KEY_GRACE_MINUTES",
+    external_exports.coerce.number().int().min(0).default(30)
+  ),
+  /** The origin passkeys are made on; unset accepts any localhost origin, for development. */
+  publicBaseUrl
+}));
+
+// ../../modules/vault/contract/src/vault.errors.ts
+var VaultSealMismatchError = class extends HandledError {
+  constructor() {
+    super("vault_seal_mismatch", "This sealed value does not belong to the secret it names", {
+      httpStatus: 422
+    });
+    this.name = "VaultSealMismatchError";
+  }
+};
+
+// ../../modules/vault/contract/src/vault.events.ts
+var vaultApprovalRequestedPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  requestId: external_exports.string().min(1),
+  connectionId: external_exports.string().nullable(),
+  connectionLabel: external_exports.string().nullable(),
+  action: external_exports.string(),
+  agentId: external_exports.string(),
+  requesterUserId: external_exports.string(),
+  channelId: external_exports.string(),
+  approverUserIds: external_exports.array(external_exports.string()),
+  reason: external_exports.string(),
+  why: external_exports.string(),
+  /** The longest lease the card may offer; null offers only once and deny. */
+  maxLeaseSeconds: external_exports.number().int().positive().nullable(),
+  expiresAt: external_exports.iso.datetime()
+});
+var vaultApprovalResolvedPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  requestId: external_exports.string().min(1),
+  state: external_exports.enum(["approved_once", "approved_for_agent", "denied", "expired"]),
+  answeredByUserId: external_exports.string().nullable(),
+  answeredVia: external_exports.string().nullable(),
+  leaseExpiresAt: external_exports.iso.datetime().nullable(),
+  at: external_exports.iso.datetime()
+});
+
+// ../../modules/vault/contract/src/vault-oauth.ts
+var tokenFieldsSchema = external_exports.object({
+  access_token: external_exports.string().min(1).optional(),
+  refresh_token: external_exports.string().min(1).optional(),
+  expires_in: external_exports.coerce.number().positive().optional(),
+  scope: external_exports.string().optional(),
+  token_type: external_exports.string().optional()
+});
+var oauthTokenResponseSchemaDefinition = external_exports.object({
+  ...tokenFieldsSchema.shape,
+  ok: external_exports.boolean().optional(),
+  error: external_exports.string().optional(),
+  error_description: external_exports.string().optional(),
+  authed_user: tokenFieldsSchema.optional()
+});
+
+// ../../modules/vault/contract/src/sealing.ts
+var subtle = () => globalThis.crypto.subtle;
+var IV_BYTES = 12;
+var P256 = { name: "ECDH", namedCurve: "P-256" };
+var text = new TextEncoder();
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64Url(value) {
+  const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+var concat = (...parts) => {
+  const out = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+};
+async function hkdfKey(input2) {
+  const base = await subtle().importKey("raw", input2.ikm, "HKDF", false, ["deriveKey"]);
+  return subtle().deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: input2.salt, info: text.encode(input2.info) },
+    base,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function gcmOpen(input2) {
+  try {
+    const plain = await subtle().decrypt(
+      {
+        name: "AES-GCM",
+        iv: input2.sealed.subarray(0, IV_BYTES),
+        additionalData: text.encode(input2.aad)
+      },
+      input2.key,
+      input2.sealed.subarray(IV_BYTES)
+    );
+    return new Uint8Array(plain);
+  } catch {
+    throw new VaultSealMismatchError();
+  }
+}
+var importPublic = (raw) => subtle().importKey("raw", raw, P256, true, []);
+async function sharedSecret(input2) {
+  const bits = await subtle().deriveBits(
+    { name: "ECDH", public: await importPublic(input2.publicKey) },
+    input2.privateKey,
+    256
+  );
+  return new Uint8Array(bits);
+}
+async function decryptFrom(input2) {
+  const epk = fromBase64Url(input2.epk);
+  const ikm = await sharedSecret({ privateKey: input2.privateKey, publicKey: epk });
+  const key = await hkdfKey({ ikm, salt: concat(epk, input2.publicKey), info: input2.info });
+  return gcmOpen({ key, sealed: fromBase64Url(input2.sealed), aad: input2.aad });
+}
+async function generateEcdhKeys() {
+  const pair = await subtle().generateKey(P256, true, ["deriveBits"]);
+  const raw = new Uint8Array(await subtle().exportKey("raw", pair.publicKey));
+  return { publicKey: toBase64Url(raw), privateKey: pair.privateKey };
+}
+function fieldsOf(value) {
+  if (typeof value !== "object" || value === null) throw new VaultSealMismatchError();
+  const entries = Object.entries(value);
+  if (entries.some(([, field]) => typeof field !== "string")) throw new VaultSealMismatchError();
+  return Object.fromEntries(entries);
+}
+var releaseLabel = (requestId) => `laze-vault/release/v1/${requestId}`;
+async function openRunRelease(input2) {
+  const plain = await decryptFrom({
+    privateKey: input2.runPrivateKey,
+    publicKey: fromBase64Url(input2.runPublicKey),
+    epk: input2.release.epk,
+    sealed: input2.release.ciphertext,
+    info: releaseLabel(input2.requestId),
+    aad: releaseLabel(input2.requestId)
+  });
+  return fieldsOf(JSON.parse(new TextDecoder().decode(plain)).fields);
+}
+
+// src/services/vault-commands.service.ts
 var USAGE6 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
 Runs the command with the connection's values in its environment, inside a Laze agent's sandbox.`;
 var POLL_MS = 3e3;
@@ -28760,7 +29438,8 @@ async function askRelease({
   context,
   connection,
   reason,
-  command
+  command,
+  recipient
 }) {
   const env = context.environment.inherited;
   const proxy = proxyOf({ env });
@@ -28771,18 +29450,31 @@ async function askRelease({
       "proxy-authorization": proxy.authorization,
       "x-laze-turn": await turnTokenOf({ env })
     },
-    body: JSON.stringify({ connection, reason, command })
+    body: JSON.stringify({ connection, reason, command, recipient })
   });
-  const text = await response.text();
+  const text2 = await response.text();
   if (!response.ok) {
-    const code = /"code"\s*:\s*"([^"]+)"/.exec(text)?.[1] ?? `status ${response.status}`;
+    const code = /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1] ?? `status ${response.status}`;
     return {
       outcome: "deny",
       exitCode: 1,
       message: `laze vault: the release was refused (${code})`
     };
   }
-  return JSON.parse(text);
+  return JSON.parse(text2);
+}
+async function envOf({
+  release,
+  run
+}) {
+  if (!release.sealed) return release.env;
+  const sealed = await openRunRelease({
+    release: release.sealed,
+    runPrivateKey: run.privateKey,
+    runPublicKey: run.publicKey,
+    requestId: release.sealed.requestId
+  });
+  return { ...release.env, ...sealed };
 }
 async function vaultRun({
   context,
@@ -28796,10 +29488,17 @@ ${USAGE6}`);
   const waitSeconds = Number(flagText({ args, name: "wait", fallback: `${DEFAULT_WAIT_SECONDS}` }));
   const deadline = context.nowMs() + Math.max(0, waitSeconds) * 1e3;
   let told = false;
+  const run = await generateEcdhKeys();
   for (; ; ) {
-    const release = await askRelease({ context, connection, reason, command: args.rest });
+    const release = await askRelease({
+      context,
+      connection,
+      reason,
+      command: args.rest,
+      recipient: run.publicKey
+    });
     if (release.outcome === "allow") {
-      return context.runCommand({ command: args.rest, env: release.env });
+      return context.runCommand({ command: args.rest, env: await envOf({ release, run }) });
     }
     if (release.outcome === "deny") {
       context.err(`${release.message}
@@ -28883,8 +29582,8 @@ async function wikiSearch({ context, args }) {
 }
 var WIKI_COMMANDS = { list: wikiList, get: wikiGet, put: wikiPut, search: wikiSearch };
 async function wiki({ context, args }) {
-  const name = args.words[1] ?? "";
-  const command = Object.hasOwn(WIKI_COMMANDS, name) ? WIKI_COMMANDS[name] : void 0;
+  const name2 = args.words[1] ?? "";
+  const command = Object.hasOwn(WIKI_COMMANDS, name2) ? WIKI_COMMANDS[name2] : void 0;
   if (!command) throw new CliUsageError(USAGE7);
   await command({ context, args });
 }
@@ -29013,8 +29712,8 @@ if (true) {
       program: [process.execPath, ...process.execArgv, process.argv[1] ?? ""],
       store: ConfigStore.create({ path: environment.configPath }),
       fetcher: (input2, init) => fetch(input2, init),
-      out: (text) => void process.stdout.write(text),
-      err: (text) => void process.stderr.write(text),
+      out: (text2) => void process.stdout.write(text2),
+      err: (text2) => void process.stderr.write(text2),
       readStdin,
       sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
       nowMs: () => nowInstant().epochMilliseconds,