@marcusrbrown/infra 0.21.0 → 0.23.0

package/dist/cli.js

@@ -3,7 +3,7 @@
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = import.meta.require;
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS(function(exports) {
   var ALIAS = Symbol.for("yaml.alias");
   var DOC = Symbol.for("yaml.document");
@@ -57,7 +57,7 @@ var require_identity = __commonJS(function(exports) {
   exports.isSeq = isSeq;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/visit.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/visit.js
 var require_visit = __commonJS(function(exports) {
   var identity = require_identity();
   var BREAK = Symbol("break visit");
@@ -212,7 +212,7 @@ var require_visit = __commonJS(function(exports) {
   exports.visitAsync = visitAsync;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/doc/directives.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/doc/directives.js
 var require_directives = __commonJS(function(exports) {
   var identity = require_identity();
   var visit = require_visit();
@@ -364,7 +364,7 @@ var require_directives = __commonJS(function(exports) {
   exports.Directives = Directives;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/doc/anchors.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/doc/anchors.js
 var require_anchors = __commonJS(function(exports) {
   var identity = require_identity();
   var visit = require_visit();
@@ -426,7 +426,7 @@ var require_anchors = __commonJS(function(exports) {
   exports.findNewAnchor = findNewAnchor;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/doc/applyReviver.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/doc/applyReviver.js
 var require_applyReviver = __commonJS(function(exports) {
   function applyReviver(reviver, obj, key, val) {
     if (val && typeof val === "object") {
@@ -473,7 +473,7 @@ var require_applyReviver = __commonJS(function(exports) {
   exports.applyReviver = applyReviver;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/toJS.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/toJS.js
 var require_toJS = __commonJS(function(exports) {
   var identity = require_identity();
   function toJS(value, arg, ctx) {
@@ -484,8 +484,8 @@ var require_toJS = __commonJS(function(exports) {
         return value.toJSON(arg, ctx);
       const data = { aliasCount: 0, count: 1, res: undefined };
       ctx.anchors.set(value, data);
-      ctx.onCreate = (res2) => {
-        data.res = res2;
+      ctx.onCreate = (res) => {
+        data.res = res;
         delete ctx.onCreate;
       };
       const res = value.toJSON(arg, ctx);
@@ -500,7 +500,7 @@ var require_toJS = __commonJS(function(exports) {
   exports.toJS = toJS;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/Node.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/Node.js
 var require_Node = __commonJS(function(exports) {
   var applyReviver = require_applyReviver();
   var identity = require_identity();
@@ -529,15 +529,15 @@ var require_Node = __commonJS(function(exports) {
       };
       const res = toJS.toJS(this, "", ctx);
       if (typeof onAnchor === "function")
-        for (const { count, res: res2 } of ctx.anchors.values())
-          onAnchor(res2, count);
+        for (const { count, res } of ctx.anchors.values())
+          onAnchor(res, count);
       return typeof reviver === "function" ? applyReviver.applyReviver(reviver, { "": res }, "", res) : res;
     }
   }
   exports.NodeBase = NodeBase;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/Alias.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/Alias.js
 var require_Alias = __commonJS(function(exports) {
   var anchors = require_anchors();
   var visit = require_visit();
@@ -579,36 +579,38 @@ var require_Alias = __commonJS(function(exports) {
         if (node.anchor === this.source)
           found = node;
       }
+      if (found && ctx) {
+        const { anchors, doc, maxAliasCount } = ctx;
+        let data = anchors.get(found);
+        if (!data) {
+          toJS.toJS(found, null, ctx);
+          data = anchors.get(found);
+        }
+        if (data?.res === undefined) {
+          const msg = "This should not happen: Alias anchor was not resolved?";
+          throw new ReferenceError(msg);
+        }
+        if (maxAliasCount >= 0) {
+          data.count += 1;
+          if (data.aliasCount === 0)
+            data.aliasCount = getAliasCount(doc, found, anchors);
+          if (data.count * data.aliasCount > maxAliasCount) {
+            const msg = "Excessive alias count indicates a resource exhaustion attack";
+            throw new ReferenceError(msg);
+          }
+        }
+      }
       return found;
     }
     toJSON(_arg, ctx) {
       if (!ctx)
         return { source: this.source };
-      const { anchors: anchors2, doc, maxAliasCount } = ctx;
-      const source = this.resolve(doc, ctx);
+      const source = this.resolve(ctx.doc, ctx);
       if (!source) {
         const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
         throw new ReferenceError(msg);
       }
-      let data = anchors2.get(source);
-      if (!data) {
-        toJS.toJS(source, null, ctx);
-        data = anchors2.get(source);
-      }
-      if (data?.res === undefined) {
-        const msg = "This should not happen: Alias anchor was not resolved?";
-        throw new ReferenceError(msg);
-      }
-      if (maxAliasCount >= 0) {
-        data.count += 1;
-        if (data.aliasCount === 0)
-          data.aliasCount = getAliasCount(doc, source, anchors2);
-        if (data.count * data.aliasCount > maxAliasCount) {
-          const msg = "Excessive alias count indicates a resource exhaustion attack";
-          throw new ReferenceError(msg);
-        }
-      }
-      return data.res;
+      return ctx.anchors.get(source).res;
     }
     toString(ctx, _onComment, _onChompKeep) {
       const src = `*${this.source}`;
@@ -624,22 +626,22 @@ var require_Alias = __commonJS(function(exports) {
       return src;
     }
   }
-  function getAliasCount(doc, node, anchors2) {
+  function getAliasCount(doc, node, anchors) {
     if (identity.isAlias(node)) {
       const source = node.resolve(doc);
-      const anchor = anchors2 && source && anchors2.get(source);
+      const anchor = anchors && source && anchors.get(source);
       return anchor ? anchor.count * anchor.aliasCount : 0;
     } else if (identity.isCollection(node)) {
       let count = 0;
       for (const item of node.items) {
-        const c = getAliasCount(doc, item, anchors2);
+        const c = getAliasCount(doc, item, anchors);
         if (c > count)
           count = c;
       }
       return count;
     } else if (identity.isPair(node)) {
-      const kc = getAliasCount(doc, node.key, anchors2);
-      const vc = getAliasCount(doc, node.value, anchors2);
+      const kc = getAliasCount(doc, node.key, anchors);
+      const vc = getAliasCount(doc, node.value, anchors);
       return Math.max(kc, vc);
     }
     return 1;
@@ -647,7 +649,7 @@ var require_Alias = __commonJS(function(exports) {
   exports.Alias = Alias;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/Scalar.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/Scalar.js
 var require_Scalar = __commonJS(function(exports) {
   var identity = require_identity();
   var Node = require_Node();
@@ -675,7 +677,7 @@ var require_Scalar = __commonJS(function(exports) {
   exports.isScalarValue = isScalarValue;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/doc/createNode.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/doc/createNode.js
 var require_createNode = __commonJS(function(exports) {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -724,10 +726,10 @@ var require_createNode = __commonJS(function(exports) {
         value = value.toJSON();
       }
       if (!value || typeof value !== "object") {
-        const node2 = new Scalar.Scalar(value);
+        const node = new Scalar.Scalar(value);
         if (ref)
-          ref.node = node2;
-        return node2;
+          ref.node = node;
+        return node;
       }
       tagObj = value instanceof Map ? schema[identity.MAP] : (Symbol.iterator in Object(value)) ? schema[identity.SEQ] : schema[identity.MAP];
     }
@@ -747,7 +749,7 @@ var require_createNode = __commonJS(function(exports) {
   exports.createNode = createNode;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/Collection.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/Collection.js
 var require_Collection = __commonJS(function(exports) {
   var createNode = require_createNode();
   var identity = require_identity();
@@ -862,7 +864,7 @@ var require_Collection = __commonJS(function(exports) {
   exports.isEmptyPath = isEmptyPath;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyComment.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyComment.js
 var require_stringifyComment = __commonJS(function(exports) {
   var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
   function indentComment(comment, indent) {
@@ -879,7 +881,7 @@ var require_stringifyComment = __commonJS(function(exports) {
   exports.stringifyComment = stringifyComment;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/foldFlowLines.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/foldFlowLines.js
 var require_foldFlowLines = __commonJS(function(exports) {
   var FOLD_FLOW = "flow";
   var FOLD_BLOCK = "block";
@@ -976,17 +978,17 @@ var require_foldFlowLines = __commonJS(function(exports) {
     if (onFold)
       onFold();
     let res = text.slice(0, folds[0]);
-    for (let i2 = 0;i2 < folds.length; ++i2) {
-      const fold = folds[i2];
-      const end2 = folds[i2 + 1] || text.length;
+    for (let i = 0;i < folds.length; ++i) {
+      const fold = folds[i];
+      const end = folds[i + 1] || text.length;
       if (fold === 0)
         res = `
-${indent}${text.slice(0, end2)}`;
+${indent}${text.slice(0, end)}`;
       else {
         if (mode === FOLD_QUOTED && escapedFolds[fold])
           res += `${text[fold]}\\`;
         res += `
-${indent}${text.slice(fold + 1, end2)}`;
+${indent}${text.slice(fold + 1, end)}`;
       }
     }
     return res;
@@ -1016,7 +1018,7 @@ ${indent}${text.slice(fold + 1, end2)}`;
   exports.foldFlowLines = foldFlowLines;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyString.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyString.js
 var require_stringifyString = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var foldFlowLines = require_foldFlowLines();
@@ -1314,7 +1316,7 @@ ${indent}`);
   exports.stringifyString = stringifyString;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/stringify.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/stringify.js
 var require_stringify = __commonJS(function(exports) {
   var anchors = require_anchors();
   var identity = require_identity();
@@ -1435,7 +1437,7 @@ ${ctx.indent}${str}`;
   exports.stringify = stringify;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyPair.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyPair.js
 var require_stringifyPair = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -1571,7 +1573,7 @@ ${ctx.indent}`;
   exports.stringifyPair = stringifyPair;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/log.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/log.js
 var require_log = __commonJS(function(exports) {
   var node_process = __require("process");
   function debug(logLevel, ...messages) {
@@ -1590,7 +1592,7 @@ var require_log = __commonJS(function(exports) {
   exports.warn = warn;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/merge.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/merge.js
 var require_merge = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -1622,15 +1624,15 @@ var require_merge = __commonJS(function(exports) {
     if (!identity.isMap(source))
       throw new Error("Merge sources must be maps or map aliases");
     const srcMap = source.toJSON(null, ctx, Map);
-    for (const [key, value2] of srcMap) {
+    for (const [key, value] of srcMap) {
       if (map instanceof Map) {
         if (!map.has(key))
-          map.set(key, value2);
+          map.set(key, value);
       } else if (map instanceof Set) {
         map.add(key);
       } else if (!Object.prototype.hasOwnProperty.call(map, key)) {
         Object.defineProperty(map, key, {
-          value: value2,
+          value,
           writable: true,
           enumerable: true,
           configurable: true
@@ -1647,7 +1649,7 @@ var require_merge = __commonJS(function(exports) {
   exports.merge = merge;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/addPairToJSMap.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/addPairToJSMap.js
 var require_addPairToJSMap = __commonJS(function(exports) {
   var log = require_log();
   var merge = require_merge();
@@ -1708,7 +1710,7 @@ var require_addPairToJSMap = __commonJS(function(exports) {
   exports.addPairToJSMap = addPairToJSMap;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/Pair.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/Pair.js
 var require_Pair = __commonJS(function(exports) {
   var createNode = require_createNode();
   var stringifyPair = require_stringifyPair();
@@ -1746,15 +1748,15 @@ var require_Pair = __commonJS(function(exports) {
   exports.createPair = createPair;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyCollection.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyCollection.js
 var require_stringifyCollection = __commonJS(function(exports) {
   var identity = require_identity();
   var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
   function stringifyCollection(collection, ctx, options) {
     const flow = ctx.inFlow ?? collection.flow;
-    const stringify2 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-    return stringify2(collection, ctx, options);
+    const stringify = flow ? stringifyFlowCollection : stringifyBlockCollection;
+    return stringify(collection, ctx, options);
   }
   function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
     const { indent, options: { commentString } } = ctx;
@@ -1763,13 +1765,13 @@ var require_stringifyCollection = __commonJS(function(exports) {
     const lines = [];
     for (let i = 0;i < items.length; ++i) {
       const item = items[i];
-      let comment2 = null;
+      let comment = null;
       if (identity.isNode(item)) {
         if (!chompKeep && item.spaceBefore)
           lines.push("");
         addCommentBefore(ctx, lines, item.commentBefore, chompKeep);
         if (item.comment)
-          comment2 = item.comment;
+          comment = item.comment;
       } else if (identity.isPair(item)) {
         const ik = identity.isNode(item.key) ? item.key : null;
         if (ik) {
@@ -1779,12 +1781,12 @@ var require_stringifyCollection = __commonJS(function(exports) {
         }
       }
       chompKeep = false;
-      let str2 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
-      if (comment2)
-        str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment2));
-      if (chompKeep && comment2)
+      let str = stringify.stringify(item, itemCtx, () => comment = null, () => chompKeep = true);
+      if (comment)
+        str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
+      if (chompKeep && comment)
         chompKeep = false;
-      lines.push(blockItemPrefix + str2);
+      lines.push(blockItemPrefix + str);
     }
     let str;
     if (lines.length === 0) {
@@ -1898,7 +1900,7 @@ ${indent}${end}`;
   exports.stringifyCollection = stringifyCollection;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/YAMLMap.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/YAMLMap.js
 var require_YAMLMap = __commonJS(function(exports) {
   var stringifyCollection = require_stringifyCollection();
   var addPairToJSMap = require_addPairToJSMap();
@@ -2025,7 +2027,7 @@ var require_YAMLMap = __commonJS(function(exports) {
   exports.findPair = findPair;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/common/map.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/common/map.js
 var require_map = __commonJS(function(exports) {
   var identity = require_identity();
   var YAMLMap = require_YAMLMap();
@@ -2034,17 +2036,17 @@ var require_map = __commonJS(function(exports) {
     default: true,
     nodeClass: YAMLMap.YAMLMap,
     tag: "tag:yaml.org,2002:map",
-    resolve(map2, onError) {
-      if (!identity.isMap(map2))
+    resolve(map, onError) {
+      if (!identity.isMap(map))
         onError("Expected a mapping for this tag");
-      return map2;
+      return map;
     },
     createNode: (schema, obj, ctx) => YAMLMap.YAMLMap.from(schema, obj, ctx)
   };
   exports.map = map;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/nodes/YAMLSeq.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/nodes/YAMLSeq.js
 var require_YAMLSeq = __commonJS(function(exports) {
   var createNode = require_createNode();
   var stringifyCollection = require_stringifyCollection();
@@ -2137,7 +2139,7 @@ var require_YAMLSeq = __commonJS(function(exports) {
   exports.YAMLSeq = YAMLSeq;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/common/seq.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/common/seq.js
 var require_seq = __commonJS(function(exports) {
   var identity = require_identity();
   var YAMLSeq = require_YAMLSeq();
@@ -2146,17 +2148,17 @@ var require_seq = __commonJS(function(exports) {
     default: true,
     nodeClass: YAMLSeq.YAMLSeq,
     tag: "tag:yaml.org,2002:seq",
-    resolve(seq2, onError) {
-      if (!identity.isSeq(seq2))
+    resolve(seq, onError) {
+      if (!identity.isSeq(seq))
         onError("Expected a sequence for this tag");
-      return seq2;
+      return seq;
     },
     createNode: (schema, obj, ctx) => YAMLSeq.YAMLSeq.from(schema, obj, ctx)
   };
   exports.seq = seq;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/common/string.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/common/string.js
 var require_string = __commonJS(function(exports) {
   var stringifyString = require_stringifyString();
   var string = {
@@ -2172,7 +2174,7 @@ var require_string = __commonJS(function(exports) {
   exports.string = string;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/common/null.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/common/null.js
 var require_null = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var nullTag = {
@@ -2187,7 +2189,7 @@ var require_null = __commonJS(function(exports) {
   exports.nullTag = nullTag;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/core/bool.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/core/bool.js
 var require_bool = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var boolTag = {
@@ -2208,7 +2210,7 @@ var require_bool = __commonJS(function(exports) {
   exports.boolTag = boolTag;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyNumber.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyNumber.js
 var require_stringifyNumber = __commonJS(function(exports) {
   function stringifyNumber({ format, minFractionDigits, tag, value }) {
     if (typeof value === "bigint")
@@ -2232,7 +2234,7 @@ var require_stringifyNumber = __commonJS(function(exports) {
   exports.stringifyNumber = stringifyNumber;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/core/float.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/core/float.js
 var require_float = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -2275,7 +2277,7 @@ var require_float = __commonJS(function(exports) {
   exports.floatNaN = floatNaN;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/core/int.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/core/int.js
 var require_int = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -2317,7 +2319,7 @@ var require_int = __commonJS(function(exports) {
   exports.intOct = intOct;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/core/schema.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/core/schema.js
 var require_schema = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
@@ -2342,7 +2344,7 @@ var require_schema = __commonJS(function(exports) {
   exports.schema = schema;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/json/schema.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/json/schema.js
 var require_schema2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var map = require_map();
@@ -2406,7 +2408,7 @@ var require_schema2 = __commonJS(function(exports) {
   exports.schema = schema;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/binary.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/binary.js
 var require_binary = __commonJS(function(exports) {
   var node_buffer = __require("buffer");
   var Scalar = require_Scalar();
@@ -2461,7 +2463,7 @@ var require_binary = __commonJS(function(exports) {
   exports.binary = binary;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/pairs.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/pairs.js
 var require_pairs = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -2495,8 +2497,8 @@ ${cn.comment}` : item.comment;
   }
   function createPairs(schema, iterable, ctx) {
     const { replacer } = ctx;
-    const pairs2 = new YAMLSeq.YAMLSeq(schema);
-    pairs2.tag = "tag:yaml.org,2002:pairs";
+    const pairs = new YAMLSeq.YAMLSeq(schema);
+    pairs.tag = "tag:yaml.org,2002:pairs";
     let i = 0;
     if (iterable && Symbol.iterator in Object(iterable))
       for (let it of iterable) {
@@ -2520,9 +2522,9 @@ ${cn.comment}` : item.comment;
         } else {
           key = it;
         }
-        pairs2.items.push(Pair.createPair(key, value, ctx));
+        pairs.items.push(Pair.createPair(key, value, ctx));
       }
-    return pairs2;
+    return pairs;
   }
   var pairs = {
     collection: "seq",
@@ -2536,7 +2538,7 @@ ${cn.comment}` : item.comment;
   exports.resolvePairs = resolvePairs;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/omap.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/omap.js
 var require_omap = __commonJS(function(exports) {
   var identity = require_identity();
   var toJS = require_toJS();
@@ -2576,9 +2578,9 @@ var require_omap = __commonJS(function(exports) {
     }
     static from(schema, iterable, ctx) {
       const pairs$1 = pairs.createPairs(schema, iterable, ctx);
-      const omap2 = new this;
-      omap2.items = pairs$1.items;
-      return omap2;
+      const omap = new this;
+      omap.items = pairs$1.items;
+      return omap;
     }
   }
   YAMLOMap.tag = "tag:yaml.org,2002:omap";
@@ -2608,7 +2610,7 @@ var require_omap = __commonJS(function(exports) {
   exports.omap = omap;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/bool.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/bool.js
 var require_bool2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   function boolStringify({ value, source }, ctx) {
@@ -2637,7 +2639,7 @@ var require_bool2 = __commonJS(function(exports) {
   exports.trueTag = trueTag;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/float.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/float.js
 var require_float2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -2683,7 +2685,7 @@ var require_float2 = __commonJS(function(exports) {
   exports.floatNaN = floatNaN;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/int.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/int.js
 var require_int2 = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -2704,8 +2706,8 @@ var require_int2 = __commonJS(function(exports) {
           str = `0x${str}`;
           break;
       }
-      const n2 = BigInt(str);
-      return sign === "-" ? BigInt(-1) * n2 : n2;
+      const n = BigInt(str);
+      return sign === "-" ? BigInt(-1) * n : n;
     }
     const n = parseInt(str, radix);
     return sign === "-" ? -1 * n : n;
@@ -2759,7 +2761,7 @@ var require_int2 = __commonJS(function(exports) {
   exports.intOct = intOct;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/set.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/set.js
 var require_set = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -2809,14 +2811,14 @@ var require_set = __commonJS(function(exports) {
     }
     static from(schema, iterable, ctx) {
       const { replacer } = ctx;
-      const set2 = new this(schema);
+      const set = new this(schema);
       if (iterable && Symbol.iterator in Object(iterable))
         for (let value of iterable) {
           if (typeof replacer === "function")
             value = replacer.call(iterable, value, value);
-          set2.items.push(Pair.createPair(value, null, ctx));
+          set.items.push(Pair.createPair(value, null, ctx));
         }
-      return set2;
+      return set;
     }
   }
   YAMLSet.tag = "tag:yaml.org,2002:set";
@@ -2842,14 +2844,14 @@ var require_set = __commonJS(function(exports) {
   exports.set = set;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
 var require_timestamp = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   function parseSexagesimal(str, asBigInt) {
     const sign = str[0];
     const parts = sign === "-" || sign === "+" ? str.substring(1) : str;
     const num = (n) => asBigInt ? BigInt(n) : Number(n);
-    const res = parts.replace(/_/g, "").split(":").reduce((res2, p) => res2 * num(60) + num(p), num(0));
+    const res = parts.replace(/_/g, "").split(":").reduce((res, p) => res * num(60) + num(p), num(0));
     return sign === "-" ? num(-1) * res : res;
   }
   function stringifySexagesimal(node) {
@@ -2924,7 +2926,7 @@ var require_timestamp = __commonJS(function(exports) {
   exports.timestamp = timestamp;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/yaml-1.1/schema.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/yaml-1.1/schema.js
 var require_schema3 = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
@@ -2965,7 +2967,7 @@ var require_schema3 = __commonJS(function(exports) {
   exports.schema = schema;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/tags.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/tags.js
 var require_tags = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
@@ -3040,23 +3042,23 @@ var require_tags = __commonJS(function(exports) {
     }
     if (addMergeTag)
       tags = tags.concat(merge.merge);
-    return tags.reduce((tags2, tag) => {
+    return tags.reduce((tags, tag) => {
       const tagObj = typeof tag === "string" ? tagsByName[tag] : tag;
       if (!tagObj) {
         const tagName = JSON.stringify(tag);
         const keys = Object.keys(tagsByName).map((key) => JSON.stringify(key)).join(", ");
         throw new Error(`Unknown custom tag ${tagName}; use one of ${keys}`);
       }
-      if (!tags2.includes(tagObj))
-        tags2.push(tagObj);
-      return tags2;
+      if (!tags.includes(tagObj))
+        tags.push(tagObj);
+      return tags;
     }, []);
   }
   exports.coreKnownTags = coreKnownTags;
   exports.getTags = getTags;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/schema/Schema.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/schema/Schema.js
 var require_Schema = __commonJS(function(exports) {
   var identity = require_identity();
   var map = require_map();
@@ -3086,7 +3088,7 @@ var require_Schema = __commonJS(function(exports) {
   exports.Schema = Schema;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/stringify/stringifyDocument.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/stringify/stringifyDocument.js
 var require_stringifyDocument = __commonJS(function(exports) {
   var identity = require_identity();
   var stringify = require_stringify();
@@ -3166,7 +3168,7 @@ var require_stringifyDocument = __commonJS(function(exports) {
   exports.stringifyDocument = stringifyDocument;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/doc/Document.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/doc/Document.js
 var require_Document = __commonJS(function(exports) {
   var Alias = require_Alias();
   var Collection = require_Collection();
@@ -3376,8 +3378,8 @@ var require_Document = __commonJS(function(exports) {
       };
       const res = toJS.toJS(this.contents, jsonArg ?? "", ctx);
       if (typeof onAnchor === "function")
-        for (const { count, res: res2 } of ctx.anchors.values())
-          onAnchor(res2, count);
+        for (const { count, res } of ctx.anchors.values())
+          onAnchor(res, count);
       return typeof reviver === "function" ? applyReviver.applyReviver(reviver, { "": res }, "", res) : res;
     }
     toJSON(jsonArg, onAnchor) {
@@ -3401,7 +3403,7 @@ var require_Document = __commonJS(function(exports) {
   exports.Document = Document;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/errors.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/errors.js
 var require_errors = __commonJS(function(exports) {
   class YAMLError extends Error {
     constructor(name, pos, code, message) {
@@ -3466,7 +3468,7 @@ ${pointer}
   exports.prettifyError = prettifyError;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/resolve-props.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-props.js
 var require_resolve_props = __commonJS(function(exports) {
   function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
     let spaceBefore = false;
@@ -3596,7 +3598,7 @@ var require_resolve_props = __commonJS(function(exports) {
   exports.resolveProps = resolveProps;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/util-contains-newline.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/util-contains-newline.js
 var require_util_contains_newline = __commonJS(function(exports) {
   function containsNewline(key) {
     if (!key)
@@ -3636,7 +3638,7 @@ var require_util_contains_newline = __commonJS(function(exports) {
   exports.containsNewline = containsNewline;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/util-flow-indent-check.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/util-flow-indent-check.js
 var require_util_flow_indent_check = __commonJS(function(exports) {
   var utilContainsNewline = require_util_contains_newline();
   function flowIndentCheck(indent, fc, onError) {
@@ -3651,7 +3653,7 @@ var require_util_flow_indent_check = __commonJS(function(exports) {
   exports.flowIndentCheck = flowIndentCheck;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/util-map-includes.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/util-map-includes.js
 var require_util_map_includes = __commonJS(function(exports) {
   var identity = require_identity();
   function mapIncludes(ctx, items, search) {
@@ -3664,7 +3666,7 @@ var require_util_map_includes = __commonJS(function(exports) {
   exports.mapIncludes = mapIncludes;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/resolve-block-map.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-block-map.js
 var require_resolve_block_map = __commonJS(function(exports) {
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -3771,7 +3773,7 @@ var require_resolve_block_map = __commonJS(function(exports) {
   exports.resolveBlockMap = resolveBlockMap;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/resolve-block-seq.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-block-seq.js
 var require_resolve_block_seq = __commonJS(function(exports) {
   var YAMLSeq = require_YAMLSeq();
   var resolveProps = require_resolve_props();
@@ -3819,7 +3821,7 @@ var require_resolve_block_seq = __commonJS(function(exports) {
   exports.resolveBlockSeq = resolveBlockSeq;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/resolve-end.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-end.js
 var require_resolve_end = __commonJS(function(exports) {
   function resolveEnd(end, offset, reqSpace, onError) {
     let comment = "";
@@ -3859,7 +3861,7 @@ var require_resolve_end = __commonJS(function(exports) {
   exports.resolveEnd = resolveEnd;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/resolve-flow-collection.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-flow-collection.js
 var require_resolve_flow_collection = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -4050,7 +4052,7 @@ var require_resolve_flow_collection = __commonJS(function(exports) {
   exports.resolveFlowCollection = resolveFlowCollection;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/compose-collection.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/compose-collection.js
 var require_compose_collection = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -4112,7 +4114,7 @@ var require_compose_collection = __commonJS(function(exports) {
   exports.composeCollection = composeCollection;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/resolve-block-scalar.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-block-scalar.js
 var require_resolve_block_scalar = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   function resolveBlockScalar(ctx, scalar, onError) {
@@ -4131,12 +4133,12 @@ var require_resolve_block_scalar = __commonJS(function(exports) {
         break;
     }
     if (chompStart === 0) {
-      const value2 = header.chomp === "+" && lines.length > 0 ? `
+      const value = header.chomp === "+" && lines.length > 0 ? `
 `.repeat(Math.max(1, lines.length - 1)) : "";
-      let end2 = start + header.length;
+      let end = start + header.length;
       if (scalar.source)
-        end2 += scalar.source.length;
-      return { value: value2, type, comment: header.comment, range: [start, end2, end2] };
+        end += scalar.source.length;
+      return { value, type, comment: header.comment, range: [start, end, end] };
     }
     let trimIndent = scalar.indent + header.indent;
     let offset = scalar.offset + header.length;
@@ -4305,7 +4307,7 @@ var require_resolve_block_scalar = __commonJS(function(exports) {
   exports.resolveBlockScalar = resolveBlockScalar;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/resolve-flow-scalar.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-flow-scalar.js
 var require_resolve_flow_scalar = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var resolveEnd = require_resolve_end();
@@ -4370,33 +4372,32 @@ var require_resolve_flow_scalar = __commonJS(function(exports) {
     }
     if (badChar)
       onError(0, "BAD_SCALAR_START", `Plain value cannot start with ${badChar}`);
-    return foldLines(source);
+    return unfoldLines(source);
   }
   function singleQuotedValue(source, onError) {
     if (source[source.length - 1] !== "'" || source.length === 1)
       onError(source.length, "MISSING_CHAR", "Missing closing 'quote");
-    return foldLines(source.slice(1, -1)).replace(/''/g, "'");
+    return unfoldLines(source.slice(1, -1)).replace(/''/g, "'");
   }
-  function foldLines(source) {
-    let first, line;
+  function unfoldLines(source) {
+    const line = /(.*?)\r?\n/sy;
+    let match = line.exec(source);
+    if (!match)
+      return source;
+    let trimEnd, trimBoth;
     try {
-      first = new RegExp(`(.*?)(?<![ 	])[ 	]*\r?
-`, "sy");
-      line = new RegExp(`[ 	]*(.*?)(?:(?<![ 	])[ 	]*)?\r?
-`, "sy");
+      trimEnd = new RegExp("(?<![ \t])[ \t]+$");
+      trimBoth = new RegExp("^[ \t]+|(?<![ \t])[ \t]+$", "g");
     } catch {
-      first = /(.*?)[ \t]*\r?\n/sy;
-      line = /[ \t]*(.*?)[ \t]*\r?\n/sy;
+      trimEnd = /[ \t]+$/;
+      trimBoth = /^[ \t]+|[ \t]+$/g;
     }
-    let match = first.exec(source);
-    if (!match)
-      return source;
-    let res = match[1];
+    let res = match[1].replace(trimEnd, "");
     let sep = " ";
-    let pos = first.lastIndex;
-    line.lastIndex = pos;
+    let pos = line.lastIndex;
     while (match = line.exec(source)) {
-      if (match[1] === "") {
+      const lm = match[1].replace(trimBoth, "");
+      if (lm === "") {
         if (sep === `
 `)
           res += sep;
@@ -4404,7 +4405,7 @@ var require_resolve_flow_scalar = __commonJS(function(exports) {
           sep = `
 `;
       } else {
-        res += sep + match[1];
+        res += sep + lm;
         sep = " ";
       }
       pos = line.lastIndex;
@@ -4522,7 +4523,7 @@ var require_resolve_flow_scalar = __commonJS(function(exports) {
   exports.resolveFlowScalar = resolveFlowScalar;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/compose-scalar.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/compose-scalar.js
 var require_compose_scalar = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -4585,9 +4586,9 @@ var require_compose_scalar = __commonJS(function(exports) {
     return schema[identity.SCALAR];
   }
   function findScalarTagByTest({ atKey, directives, schema }, value, token, onError) {
-    const tag = schema.tags.find((tag2) => (tag2.default === true || atKey && tag2.default === "key") && tag2.test?.test(value)) || schema[identity.SCALAR];
+    const tag = schema.tags.find((tag) => (tag.default === true || atKey && tag.default === "key") && tag.test?.test(value)) || schema[identity.SCALAR];
     if (schema.compat) {
-      const compat = schema.compat.find((tag2) => tag2.default && tag2.test?.test(value)) ?? schema[identity.SCALAR];
+      const compat = schema.compat.find((tag) => tag.default && tag.test?.test(value)) ?? schema[identity.SCALAR];
       if (tag.tag !== compat.tag) {
         const ts = directives.tagString(tag.tag);
         const cs = directives.tagString(compat.tag);
@@ -4600,7 +4601,7 @@ var require_compose_scalar = __commonJS(function(exports) {
   exports.composeScalar = composeScalar;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/util-empty-scalar-position.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/util-empty-scalar-position.js
 var require_util_empty_scalar_position = __commonJS(function(exports) {
   function emptyScalarPosition(offset, before, pos) {
     if (before) {
@@ -4627,7 +4628,7 @@ var require_util_empty_scalar_position = __commonJS(function(exports) {
   exports.emptyScalarPosition = emptyScalarPosition;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/compose-node.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/compose-node.js
 var require_compose_node = __commonJS(function(exports) {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -4730,7 +4731,7 @@ var require_compose_node = __commonJS(function(exports) {
   exports.composeNode = composeNode;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/compose-doc.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/compose-doc.js
 var require_compose_doc = __commonJS(function(exports) {
   var Document = require_Document();
   var composeNode = require_compose_node();
@@ -4770,7 +4771,7 @@ var require_compose_doc = __commonJS(function(exports) {
   exports.composeDoc = composeDoc;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/compose/composer.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/compose/composer.js
 var require_composer = __commonJS(function(exports) {
   var node_process = __require("process");
   var directives = require_directives();
@@ -4961,7 +4962,7 @@ ${end.comment}` : end.comment;
   exports.Composer = Composer;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/parse/cst-scalar.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/parse/cst-scalar.js
 var require_cst_scalar = __commonJS(function(exports) {
   var resolveBlockScalar = require_resolve_block_scalar();
   var resolveFlowScalar = require_resolve_flow_scalar();
@@ -5151,7 +5152,7 @@ var require_cst_scalar = __commonJS(function(exports) {
   exports.setScalarValue = setScalarValue;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/parse/cst-stringify.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/parse/cst-stringify.js
 var require_cst_stringify = __commonJS(function(exports) {
   var stringify = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
   function stringifyToken(token) {
@@ -5209,7 +5210,7 @@ var require_cst_stringify = __commonJS(function(exports) {
   exports.stringify = stringify;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/parse/cst-visit.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/parse/cst-visit.js
 var require_cst_visit = __commonJS(function(exports) {
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
@@ -5268,7 +5269,7 @@ var require_cst_visit = __commonJS(function(exports) {
   exports.visit = visit;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/parse/cst.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/parse/cst.js
 var require_cst = __commonJS(function(exports) {
   var cstScalar = require_cst_scalar();
   var cstStringify = require_cst_stringify();
@@ -5369,7 +5370,7 @@ var require_cst = __commonJS(function(exports) {
   exports.tokenType = tokenType;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/parse/lexer.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/parse/lexer.js
 var require_lexer = __commonJS(function(exports) {
   var cst = require_cst();
   function isEmpty(ch) {
@@ -5743,18 +5744,18 @@ var require_lexer = __commonJS(function(exports) {
       let indent = 0;
       let ch;
       loop:
-        for (let i2 = this.pos;ch = this.buffer[i2]; ++i2) {
+        for (let i = this.pos;ch = this.buffer[i]; ++i) {
           switch (ch) {
             case " ":
               indent += 1;
               break;
             case `
 `:
-              nl = i2;
+              nl = i;
               indent = 0;
               break;
             case "\r": {
-              const next = this.buffer[i2 + 1];
+              const next = this.buffer[i + 1];
               if (!next && !this.atEnd)
                 return this.setNext("block-scalar");
               if (next === `
@@ -5797,16 +5798,16 @@ var require_lexer = __commonJS(function(exports) {
         nl = i - 1;
       } else if (!this.blockScalarKeep) {
         do {
-          let i2 = nl - 1;
-          let ch2 = this.buffer[i2];
-          if (ch2 === "\r")
-            ch2 = this.buffer[--i2];
-          const lastChar = i2;
-          while (ch2 === " ")
-            ch2 = this.buffer[--i2];
-          if (ch2 === `
-` && i2 >= this.pos && i2 + 1 + indent > lastChar)
-            nl = i2;
+          let i = nl - 1;
+          let ch = this.buffer[i];
+          if (ch === "\r")
+            ch = this.buffer[--i];
+          const lastChar = i;
+          while (ch === " ")
+            ch = this.buffer[--i];
+          if (ch === `
+` && i >= this.pos && i + 1 + indent > lastChar)
+            nl = i;
           else
             break;
         } while (true);
@@ -5966,7 +5967,7 @@ var require_lexer = __commonJS(function(exports) {
   exports.Lexer = Lexer;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/parse/line-counter.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/parse/line-counter.js
 var require_line_counter = __commonJS(function(exports) {
   class LineCounter {
     constructor() {
@@ -5994,7 +5995,7 @@ var require_line_counter = __commonJS(function(exports) {
   exports.LineCounter = LineCounter;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/parse/parser.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/parse/parser.js
 var require_parser = __commonJS(function(exports) {
   var node_process = __require("process");
   var cst = require_cst();
@@ -6493,12 +6494,12 @@ var require_parser = __commonJS(function(exports) {
                 if (includesToken(it.start, "newline")) {
                   Object.assign(it, { key: null, sep: [this.sourceToken] });
                 } else {
-                  const start2 = getFirstKeyStartProps(it.start);
+                  const start = getFirstKeyStartProps(it.start);
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key: null, sep: [this.sourceToken] }]
+                    items: [{ start, key: null, sep: [this.sourceToken] }]
                   });
                 }
               } else if (it.value) {
@@ -6511,7 +6512,7 @@ var require_parser = __commonJS(function(exports) {
                   items: [{ start, key: null, sep: [this.sourceToken] }]
                 });
               } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
-                const start2 = getFirstKeyStartProps(it.start);
+                const start = getFirstKeyStartProps(it.start);
                 const key = it.key;
                 const sep = it.sep;
                 sep.push(this.sourceToken);
@@ -6521,7 +6522,7 @@ var require_parser = __commonJS(function(exports) {
                   type: "block-map",
                   offset: this.offset,
                   indent: this.indent,
-                  items: [{ start: start2, key, sep }]
+                  items: [{ start, key, sep }]
                 });
               } else if (start.length > 0) {
                 it.sep = it.sep.concat(start, this.sourceToken);
@@ -6850,7 +6851,7 @@ var require_parser = __commonJS(function(exports) {
   exports.Parser = Parser;
 });
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/public-api.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/public-api.js
 var require_public_api = __commonJS(function(exports) {
   var composer = require_composer();
   var Document = require_Document();
@@ -6865,22 +6866,22 @@ var require_public_api = __commonJS(function(exports) {
     return { lineCounter: lineCounter$1, prettyErrors };
   }
   function parseAllDocuments(source, options = {}) {
-    const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
-    const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
+    const { lineCounter, prettyErrors } = parseOptions(options);
+    const parser$1 = new parser.Parser(lineCounter?.addNewLine);
     const composer$1 = new composer.Composer(options);
     const docs = Array.from(composer$1.compose(parser$1.parse(source)));
-    if (prettyErrors && lineCounter2)
+    if (prettyErrors && lineCounter)
       for (const doc of docs) {
-        doc.errors.forEach(errors.prettifyError(source, lineCounter2));
-        doc.warnings.forEach(errors.prettifyError(source, lineCounter2));
+        doc.errors.forEach(errors.prettifyError(source, lineCounter));
+        doc.warnings.forEach(errors.prettifyError(source, lineCounter));
       }
     if (docs.length > 0)
       return docs;
     return Object.assign([], { empty: true }, composer$1.streamInfo());
   }
   function parseDocument(source, options = {}) {
-    const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
-    const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
+    const { lineCounter, prettyErrors } = parseOptions(options);
+    const parser$1 = new parser.Parser(lineCounter?.addNewLine);
     const composer$1 = new composer.Composer(options);
     let doc = null;
     for (const _doc of composer$1.compose(parser$1.parse(source), true, source.length)) {
@@ -6891,9 +6892,9 @@ var require_public_api = __commonJS(function(exports) {
         break;
       }
     }
-    if (prettyErrors && lineCounter2) {
-      doc.errors.forEach(errors.prettifyError(source, lineCounter2));
-      doc.warnings.forEach(errors.prettifyError(source, lineCounter2));
+    if (prettyErrors && lineCounter) {
+      doc.errors.forEach(errors.prettifyError(source, lineCounter));
+      doc.warnings.forEach(errors.prettifyError(source, lineCounter));
     }
     return doc;
   }
@@ -6949,7 +6950,7 @@ import { goke } from "goke";
 // package.json
 var package_default = {
   name: "@marcusrbrown/infra",
-  version: "0.21.0",
+  version: "0.23.0",
   description: "Infrastructure management CLI \u2014 deploy automation, health checks, and MCP bridge",
   keywords: [
     "infra",
@@ -6993,7 +6994,7 @@ var package_default = {
   devDependencies: {
     "@marcusrbrown/infra-shared": "workspace:*",
     "@modelcontextprotocol/sdk": "1.30.0",
-    yaml: "2.9.0"
+    yaml: "2.9.1"
   },
   engines: {
     bun: ">=1.0.0"
@@ -7011,7 +7012,7 @@ import { z as z5 } from "zod";
 // src/commands/agent/setup-core/gh.ts
 import { confirm, log, spinner } from "@clack/prompts";
 
-// ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/index.js
+// ../../node_modules/.bun/yaml@2.9.1/node_modules/yaml/dist/index.js
 var composer = require_composer();
 var Document = require_Document();
 var Schema = require_Schema();
@@ -7201,8 +7202,8 @@ function readablePipe(pipe) {
     throw new Error("CLI subprocess did not expose piped output.");
   return pipe;
 }
-function redactExactValues(text2, values) {
-  let redacted = text2;
+function redactExactValues(text, values) {
+  let redacted = text;
   for (const value of new Set(values)) {
     if (value.length > 0)
       redacted = redacted.split(value).join("[REDACTED]");
@@ -7270,8 +7271,8 @@ async function runCommand(command, args, timeoutMs = COMMAND_TIMEOUT_MS, stdin,
 async function runGh(args) {
   return runCommand("gh", args);
 }
-function isGhRateLimitError(text2) {
-  return /rate limit/i.test(text2);
+function isGhRateLimitError(text) {
+  return /rate limit/i.test(text);
 }
 async function queryRateLimitReset() {
   try {
@@ -7383,9 +7384,9 @@ async function deleteManagementApiKey(baseUrl, managementKey, keyValue) {
 }
 async function applyGhValue(kind, name, repo, value) {
   if (kind === "secret") {
-    const result2 = await runCommand("gh", ["secret", "set", name, "--repo", repo], COMMAND_TIMEOUT_MS, value);
-    if (result2.exitCode !== 0)
-      throw new Error(`gh secret set ${name} failed: ${result2.stderr.trim()}`.trim());
+    const result = await runCommand("gh", ["secret", "set", name, "--repo", repo], COMMAND_TIMEOUT_MS, value);
+    if (result.exitCode !== 0)
+      throw new Error(`gh secret set ${name} failed: ${result.stderr.trim()}`.trim());
     return;
   }
   const result = await runGh([kind, "set", name, "--repo", repo, "--body", value]);
@@ -7975,13 +7976,13 @@ function buildCannotVerifyMessage(repo, writtenSecretNames, writtenVariableNames
   const variablePart = writtenVariableNames.length > 0 ? `gh variable list --repo ${repo} (expect: ${writtenVariableNames.join(", ")})` : `gh variable list --repo ${repo}`;
   return `Post-write readback: could not verify the written names are visible in ${repo} ` + `(the GitHub list call failed). Verify manually: ${secretPart}; ${variablePart}.`;
 }
-async function verifyWrittenNamesVisible(repo, writtenSecretNames, writtenVariableNames, listExistingGhNames2) {
+async function verifyWrittenNamesVisible(repo, writtenSecretNames, writtenVariableNames, listExistingGhNames) {
   try {
     let secretReadback;
     let variableReadback;
     let readbackFailed = false;
     try {
-      secretReadback = await listExistingGhNames2(repo, "secret");
+      secretReadback = await listExistingGhNames(repo, "secret");
     } catch {
       readbackFailed = true;
       secretReadback = [];
@@ -7990,7 +7991,7 @@ async function verifyWrittenNamesVisible(repo, writtenSecretNames, writtenVariab
       variableReadback = [];
     } else {
       try {
-        variableReadback = await listExistingGhNames2(repo, "variable");
+        variableReadback = await listExistingGhNames(repo, "variable");
       } catch {
         readbackFailed = true;
         variableReadback = [];
@@ -8873,7 +8874,7 @@ function validateNeedsGraph(analyses, violations) {
   }
   const visiting = new Set;
   const visited = new Set;
-  const visit2 = (jobId) => {
+  const visit = (jobId) => {
     if (visiting.has(jobId)) {
       violations.push(`Job needs graph contains a cycle involving '${jobId}'.`);
       return;
@@ -8883,13 +8884,13 @@ function validateNeedsGraph(analyses, violations) {
     visiting.add(jobId);
     for (const need of analyses.get(jobId)?.needs ?? []) {
       if (analyses.has(need))
-        visit2(need);
+        visit(need);
     }
     visiting.delete(jobId);
     visited.add(jobId);
   };
   for (const jobId of analyses.keys())
-    visit2(jobId);
+    visit(jobId);
 }
 function formatStorageWorkflowSnippet() {
   return `jobs:
@@ -9619,14 +9620,14 @@ function registerBrokerDeploy(cli) {
         console.log(`- BROKER_DOMAIN=${env.BROKER_DOMAIN || "(unset)"}`);
         return;
       }
-      const child2 = Bun.spawn(command, {
+      const child = Bun.spawn(command, {
         env,
         stdout: "inherit",
         stderr: "inherit"
       });
-      const exitCode2 = await child2.exited;
-      if (exitCode2 !== 0) {
-        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      const exitCode = await child.exited;
+      if (exitCode !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode}`);
       }
       return;
     }
@@ -10049,14 +10050,14 @@ function registerCliproxyDeploy(cli) {
         console.log(`- CLIPROXY_DOMAIN=${env.CLIPROXY_DOMAIN || "(unset)"}`);
         return;
       }
-      const child2 = Bun.spawn(command, {
+      const child = Bun.spawn(command, {
         env,
         stdout: "inherit",
         stderr: "inherit"
       });
-      const exitCode2 = await child2.exited;
-      if (exitCode2 !== 0) {
-        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      const exitCode = await child.exited;
+      if (exitCode !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode}`);
       }
       return;
     }
@@ -10391,11 +10392,11 @@ import { z as z16 } from "zod";
 import { z as z15 } from "zod";
 
 // src/lib/redact.ts
-function redactHost(text4, host) {
+function redactHost(text, host) {
   if (!host)
-    return text4;
+    return text;
   const escaped = host.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-  return text4.replaceAll(new RegExp(escaped, "gi"), "<host>");
+  return text.replaceAll(new RegExp(escaped, "gi"), "<host>");
 }
 
 // ../shared/server/droplet-helpers.ts
@@ -10547,7 +10548,7 @@ async function checkUsageStats(baseUrl, key) {
       };
     }
     const total = payload.length;
-    const errors2 = countQueueErrors(payload);
+    const errors = countQueueErrors(payload);
     if (total === 0) {
       return {
         title: "Usage stats",
@@ -10557,8 +10558,8 @@ async function checkUsageStats(baseUrl, key) {
     }
     return {
       title: "Usage stats",
-      level: errors2 > 0 ? "warning" : "ok",
-      summary: errors2 > 0 ? `recent: ${total}, errors: ${errors2}` : `recent: ${total}`
+      level: errors > 0 ? "warning" : "ok",
+      summary: errors > 0 ? `recent: ${total}, errors: ${errors}` : `recent: ${total}`
     };
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -10614,8 +10615,8 @@ async function checkRunningVersion(host, spawn = defaultSpawn) {
   try {
     validateCliproxyHost(host);
     const knownHostsArgs = buildKnownHostsArgs();
-    const identity2 = buildIdentityArgs(process.env.CLIPROXY_SSH_KEY);
-    cleanup = identity2.cleanup;
+    const identity = buildIdentityArgs(process.env.CLIPROXY_SSH_KEY);
+    cleanup = identity.cleanup;
     const sshCmd = [
       "ssh",
       "-o",
@@ -10625,7 +10626,7 @@ async function checkRunningVersion(host, spawn = defaultSpawn) {
       "-o",
       "StrictHostKeyChecking=yes",
       ...knownHostsArgs,
-      ...identity2.args,
+      ...identity.args,
       `root@${host}`,
       `docker ps --format '{{.Image}}'`
     ];
@@ -10872,8 +10873,8 @@ function formatUsageSummaryLine(result) {
   }
   const total = Number(recentMatch[1]);
   const errorMatch = /errors:\s*(\d+)/.exec(result.summary);
-  const errors2 = errorMatch ? Number(errorMatch[1]) : 0;
-  return `Recent requests: ${total}${errors2 > 0 ? `, ${errors2} errors` : ""}`;
+  const errors = errorMatch ? Number(errorMatch[1]) : 0;
+  return `Recent requests: ${total}${errors > 0 ? `, ${errors} errors` : ""}`;
 }
 async function getCliproxyStatusSummary(baseUrl, key, verbose, spawn = defaultSpawn) {
   const normalizedBaseUrl = stripTrailingSlash5(baseUrl);
@@ -10998,7 +10999,7 @@ var githubIssueSchema = z16.object({
 var githubIssuesSchema = z16.array(githubIssueSchema);
 var defaultMonitorRuntime = {
   fetch: globalThis.fetch,
-  sleep: (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)),
+  sleep: (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
   ghApi: (token, path, method, body) => runGhApiOnce(token, path, method, body),
   setTimeout,
   clearTimeout
@@ -11289,12 +11290,12 @@ async function cliproxyMonitorAction(options, ctx, runtime = defaultMonitorRunti
   const timestamp = new Date().toISOString();
   try {
     const classification = validation === "live" ? await checkProviderAuthState(proxyUrl, inputs.apiKey) : providerState(validation);
-    const finish = (transition, issue2 = [], discord = "none") => {
+    const finish = (transition, issue = [], discord = "none") => {
       const summary = {
         probeState: classification.state,
         probeReason: classification.reason,
         transition,
-        issue: issue2,
+        issue,
         discord,
         timestamp
       };
@@ -11316,17 +11317,17 @@ async function cliproxyMonitorAction(options, ctx, runtime = defaultMonitorRunti
       return finish("outage", ["created"], "outage-sent");
     }
     if (target === "dead") {
-      const currentMarker2 = notifiedState(issue.body, identityMarker);
-      const wasOpen2 = issue.state === "open";
-      const body = issueBody(identityMarker, "dead", timestamp, currentMarker2 === "dead");
+      const currentMarker = notifiedState(issue.body, identityMarker);
+      const wasOpen = issue.state === "open";
+      const body = issueBody(identityMarker, "dead", timestamp, currentMarker === "dead");
       await updateIssue(client, issue, "open", body);
       issue.state = "open";
-      issueActions.push(wasOpen2 ? "updated" : "reopened");
-      if (currentMarker2 === "dead" && wasOpen2)
+      issueActions.push(wasOpen ? "updated" : "reopened");
+      if (currentMarker === "dead" && wasOpen)
         return finish("none", issueActions);
       await sendDiscord(inputs.discordWebhook, "dead", timestamp, validation !== "live", runtime);
       await persistNotifiedMarker(client, issue, identityMarker, "dead", timestamp);
-      return finish(wasOpen2 ? "notification-retry" : "outage", issueActions, "outage-sent");
+      return finish(wasOpen ? "notification-retry" : "outage", issueActions, "outage-sent");
     }
     const currentMarker = notifiedState(issue.body, identityMarker);
     const wasOpen = issue.state === "open";
@@ -11404,6 +11405,104 @@ function registerCliproxyOpen(cli) {
   });
 }
 
+// src/commands/cliproxy/reset-quota.ts
+import { z as z18 } from "zod";
+var DEFAULT_CLIPROXY_URL8 = "https://cliproxy.fro.bot";
+var ResetQuotaResponseSchema = z18.object({
+  status: z18.literal("ok"),
+  auth_index: z18.string(),
+  models: z18.array(z18.unknown())
+});
+var AuthFileSchema = z18.object({
+  id: z18.string(),
+  auth_index: z18.string(),
+  name: z18.string(),
+  type: z18.string(),
+  provider: z18.string(),
+  email: z18.string()
+});
+var AuthFilesResponseSchema = z18.object({
+  files: z18.array(AuthFileSchema)
+});
+var ManagementErrorSchema = z18.object({ error: z18.string() });
+function stripTrailingSlash6(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function resolveBaseUrl4(input) {
+  return stripTrailingSlash6(input ?? process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL8);
+}
+function resolveManagementKey4(input) {
+  const key = input ?? process.env.CLIPROXY_MANAGEMENT_KEY;
+  if (!key) {
+    throw new Error("Management API key is required. Pass --key or set CLIPROXY_MANAGEMENT_KEY.");
+  }
+  return key;
+}
+async function requestParsedJson(endpoint, init, schema) {
+  const response = await fetch(endpoint, {
+    ...init,
+    signal: AbortSignal.timeout(HTTP_TIMEOUT_MS)
+  });
+  const body = await response.text();
+  let payload;
+  try {
+    payload = body.length === 0 ? null : JSON.parse(body);
+  } catch {
+    payload = undefined;
+  }
+  if (!response.ok) {
+    const error = ManagementErrorSchema.safeParse(payload);
+    if (error.success) {
+      throw new Error(error.data.error);
+    }
+    throw new Error(`${init.method ?? "GET"} ${endpoint} failed with HTTP ${response.status}: ${body}`);
+  }
+  return schema.parse(payload);
+}
+function formatAuthFile(file, index) {
+  return `${index + 1}. ${file.auth_index} \u2014 ${file.name} (${file.provider}, ${file.email})`;
+}
+async function cliproxyResetQuotaAction(authIndex, options, ctx) {
+  try {
+    const baseUrl = resolveBaseUrl4(options.url);
+    const managementKey = resolveManagementKey4(options.key);
+    if (options.list) {
+      const files = (await requestParsedJson(`${baseUrl}/v0/management/auth-files`, {
+        method: "GET",
+        headers: managementHeaders(managementKey)
+      }, AuthFilesResponseSchema)).files;
+      if (options.json) {
+        ctx.console.log(JSON.stringify(files, null, 2));
+      } else if (files.length === 0) {
+        ctx.console.log("No auth files configured");
+      } else {
+        for (const [index, file] of files.entries()) {
+          ctx.console.log(formatAuthFile(file, index));
+        }
+      }
+      return files;
+    }
+    if (!authIndex) {
+      throw new Error("auth_index is required. Pass an auth index or use --list to enumerate auth files.");
+    }
+    const payload = await requestParsedJson(`${baseUrl}/v0/management/reset-quota`, {
+      method: "POST",
+      headers: managementHeaders(managementKey),
+      body: JSON.stringify({ auth_index: authIndex })
+    }, ResetQuotaResponseSchema);
+    ctx.console.log(JSON.stringify(payload, null, 2));
+    return payload;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    ctx.console.error(message);
+    ctx.process.exit(1);
+    return [];
+  }
+}
+function registerCliproxyResetQuota(cli) {
+  cli.command("cliproxy reset-quota [auth-index]", "Reset the quota for one CLIProxyAPI auth record, or list valid auth indexes.").option("--url [url]", z18.string().describe("Base URL for CLIProxyAPI management requests. Falls back to CLIPROXY_URL or https://cliproxy.fro.bot.")).option("--key [key]", z18.string().describe("Management API key. Falls back to CLIPROXY_MANAGEMENT_KEY when omitted.")).option("--list", "List auth records and their auth indexes without resetting quota.").option("--json", "Output auth records as JSON when used with --list.").example("# List valid auth indexes before resetting one").example("infra cliproxy reset-quota --list").example("# Reset quota for one auth record").example("infra cliproxy reset-quota auth-index-123").action(cliproxyResetQuotaAction);
+}
+
 // src/commands/cliproxy/setup.ts
 function registerCliproxySetup(cli) {
   registerSetupCommand(cli, "cliproxy setup");
@@ -11419,11 +11518,12 @@ function registerCliproxyCommands(cli) {
   registerCliproxyModels(cli);
   registerCliproxyMonitor(cli);
   registerCliproxyOpen(cli);
+  registerCliproxyResetQuota(cli);
   registerCliproxySetup(cli);
 }
 
 // src/commands/dashboard/deploy.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var REPO3 = "marcusrbrown/infra";
 var WORKFLOW_NAME3 = "Deploy Dashboard";
 var WORKFLOW_URL3 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-dashboard.yaml";
@@ -11485,7 +11585,7 @@ function validateDashboardRemotePreconditions() {
   }
 }
 function registerDashboardDeploy(cli) {
-  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z18.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z18.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z18.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z18.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
+  cli.command("dashboard deploy", "Deploy the dashboard. Default mode triggers the GitHub Deploy Dashboard workflow, while --local runs apps/dashboard deploy directly with Bun.").option("--local", z19.boolean().default(false).describe("Run local deployment with Bun using apps/dashboard instead of triggering GitHub Actions.")).option("--dry-run", z19.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--image-version <version>", z19.string().optional().describe("CalVer version to deploy (e.g. 2026.06.47). Remote-only. Triggers the versioned release path and requires dashboard environment approval. Must match YYYY.MM.N. Forwarded as -f version=<value> to gh workflow run.")).option("--digest <digest>", z19.string().optional().describe("Expected sha256 digest (e.g. sha256:abc...def). Remote-only. Requires --image-version. When set, the workflow fails if GHCR resolves the tag to a different digest. Must match sha256:<64 hex chars>.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra dashboard deploy").example("# Deploy a specific CalVer release via GitHub Actions").example("infra dashboard deploy --image-version 2026.06.47").example("# Deploy a specific release with digest cross-check").example("infra dashboard deploy --image-version 2026.06.47 --digest sha256:<64 hex>").example("# Validate local deploy preconditions and planned command").example("infra dashboard deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra dashboard deploy --local").action(async (options) => {
     validateReleaseFlags({ imageVersion: options.imageVersion, digest: options.digest, local: options.local });
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/dashboard", "deploy"];
@@ -11495,14 +11595,14 @@ function registerDashboardDeploy(cli) {
         return;
       }
       const env = getDashboardDeployEnv();
-      const child2 = Bun.spawn(command, {
+      const child = Bun.spawn(command, {
         env,
         stdout: "inherit",
         stderr: "inherit"
       });
-      const exitCode2 = await child2.exited;
-      if (exitCode2 !== 0) {
-        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      const exitCode = await child.exited;
+      if (exitCode !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode}`);
       }
       return;
     }
@@ -11528,7 +11628,7 @@ function registerDashboardDeploy(cli) {
 }
 
 // src/commands/dashboard/logs.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // src/commands/dashboard/host.ts
 var VALID_HOST_RE3 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -11601,7 +11701,7 @@ async function streamDashboardLogs(opts, spawn = defaultLogsSpawn2, printOut, pr
   return { refused: false, exitCode };
 }
 function registerDashboardLogs(cli) {
-  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z19.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z19.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z19.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("dashboard logs [service]", "Stream logs from a dashboard service via SSH and docker compose.").option("--tail [n]", z20.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z20.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z20.string().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "dashboard";
     try {
       validateService(targetService);
@@ -11631,7 +11731,7 @@ function registerDashboardLogs(cli) {
 }
 
 // src/commands/dashboard/status.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var COMPOSE_PROJECT_DIR2 = "/opt/dashboard";
 function parseComposePsOutput(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -11805,7 +11905,7 @@ async function dashboardStatusAction(options, ctx, spawn) {
   }
 }
 function registerDashboardStatus(cli) {
-  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z20.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
+  cli.command("dashboard status", "Show operational health of the dashboard deployment via docker compose ps.").option("--key [key]", z21.string().optional().describe("Environment variable name holding the SSH host. Falls back to DASHBOARD_DOMAIN when omitted.")).action((options, ctx) => dashboardStatusAction(options, ctx));
 }
 
 // src/commands/dashboard/index.ts
@@ -11817,7 +11917,7 @@ function registerDashboardCommands(cli) {
 
 // src/commands/gateway/backup.ts
 import { closeSync, constants as fsConstants, openSync, renameSync, unlinkSync, writeSync } from "fs";
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 
 // src/commands/gateway/host.ts
 var VALID_HOST_RE4 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -11927,11 +12027,11 @@ async function gatewayBackupAction(options, ctx, spawn) {
   ctx.console.log(`CA backup written to: ${output}`);
 }
 function registerGatewayBackup(cli) {
-  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z21.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z21.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
+  cli.command("gateway backup", "Back up the mitmproxy CA certificate and private key from the gateway Docker volume to a local tarball. The output contains the CA private trust anchor \u2014 treat it as sensitive material.").option("--output [file]", z22.string().default(DEFAULT_OUTPUT).describe("Local path to write the CA tarball. File permissions are set to 0600 after writing.")).option("--include-ca", z22.boolean().default(true).describe("Include the mitmproxy CA certificate and private key in the backup. Currently the only supported backup target.")).example("# Back up the CA to the default path").example("infra gateway backup --include-ca").example("# Back up the CA to a custom path").example("infra gateway backup --output /secure/backup/mitmproxy-ca.tar").action(gatewayBackupAction);
 }
 
 // src/commands/gateway/deploy.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var REPO4 = "marcusrbrown/infra";
 var WORKFLOW_NAME4 = "Deploy Gateway";
 var WORKFLOW_URL4 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-gateway.yaml";
@@ -12000,7 +12100,7 @@ function validateGatewayRemotePreconditions() {
   }
 }
 function registerGatewayDeploy(cli) {
-  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z22.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z22.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z22.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
+  cli.command("gateway deploy", "Deploy the gateway. Default mode triggers the GitHub Deploy Gateway workflow, while --local runs apps/gateway deploy directly with Bun.").option("--local", z23.boolean().default(false).describe("Run local deployment with Bun using apps/gateway instead of triggering GitHub Actions.")).option("--dry-run", z23.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-recreate", z23.boolean().default(false).describe("Force recreate containers. Forwarded only in local mode.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra gateway deploy").example("# Validate local deploy preconditions and planned command").example("infra gateway deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra gateway deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -12016,14 +12116,14 @@ function registerGatewayDeploy(cli) {
         return;
       }
       const env = getGatewayDeployEnv();
-      const child2 = Bun.spawn(command, {
+      const child = Bun.spawn(command, {
         env,
         stdout: "inherit",
         stderr: "inherit"
       });
-      const exitCode2 = await child2.exited;
-      if (exitCode2 !== 0) {
-        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      const exitCode = await child.exited;
+      if (exitCode !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode}`);
       }
       return;
     }
@@ -12048,7 +12148,7 @@ function registerGatewayDeploy(cli) {
 }
 
 // src/commands/gateway/logs.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var COMPOSE_PROJECT_DIR3 = "/opt/gateway/deploy";
 var SENSITIVE_WARNING4 = "Warning: Logs may contain Discord tokens, S3 credentials, or user data. Treat output as sensitive; do not capture in shared logs or chat.";
 var VALID_SERVICES2 = ["gateway", "workspace", "mitmproxy"];
@@ -12097,7 +12197,7 @@ async function streamGatewayLogs(opts, spawn = defaultLogsSpawn3, printOut, prin
   return { refused: false, exitCode };
 }
 function registerGatewayLogs(cli) {
-  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z23.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z23.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z23.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
+  cli.command("gateway logs [service]", "Stream logs from a gateway service via SSH and docker compose.").option("--tail [n]", z24.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z24.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z24.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action(async (service, options) => {
     const targetService = service ?? "gateway";
     try {
       validateService2(targetService);
@@ -12127,7 +12227,7 @@ function registerGatewayLogs(cli) {
 }
 
 // src/commands/gateway/restore.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var MITMPROXY_CERTS_VOLUME2 = "mitmproxy-certs";
 var CA_CERT_FILE2 = "mitmproxy-ca-cert.pem";
 var CA_KEY_FILE2 = "mitmproxy-ca.pem";
@@ -12281,7 +12381,7 @@ async function restoreGatewayCa(opts, spawn = defaultSpawn4) {
   }
 }
 function registerGatewayRestore(cli) {
-  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z24.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z24.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
+  cli.command("gateway restore", "Restore the mitmproxy CA certificate and private key from a local tarball into the gateway Docker volume. Restarts mitmproxy and gateway services after restore and confirms byte-equal content before reporting success.").option("--input <file>", z25.string().describe("Path to the tarball produced by `gateway backup --include-ca`. Required.")).option("--include-ca", z25.boolean().default(true).describe("Restore the mitmproxy CA certificate and private key. Currently the only supported restore target.")).example("# Restore CA from a backup tarball").example("infra gateway restore --input apps/gateway/.local/mitmproxy-ca.tar").example("# Restore CA from a custom path").example("infra gateway restore --input /secure/backup/mitmproxy-ca.tar --include-ca").action(async (options) => {
     const hostEnvKey = "GATEWAY_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -12302,7 +12402,7 @@ function registerGatewayRestore(cli) {
 }
 
 // src/commands/gateway/status.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var COMPOSE_PROJECT_DIR5 = "/opt/gateway/deploy";
 function parseComposePsOutput2(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -12444,7 +12544,7 @@ async function gatewayStatusAction(options, ctx, spawn) {
   }
 }
 function registerGatewayStatus(cli) {
-  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z25.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
+  cli.command("gateway status", "Show operational health of the gateway deployment via docker compose ps.").option("--key [key]", z26.string().describe("Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.")).action((options, ctx) => gatewayStatusAction(options, ctx));
 }
 
 // src/commands/gateway/index.ts
@@ -12459,7 +12559,7 @@ function registerGatewayCommands(cli) {
 // src/commands/keeweb/deploy.ts
 import { existsSync as existsSync5 } from "fs";
 import { join as join6 } from "path";
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var REPO5 = "marcusrbrown/infra";
 var WORKFLOW_NAME5 = "Deploy KeeWeb";
 var WORKFLOW_URL5 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-keeweb.yaml";
@@ -12513,21 +12613,21 @@ function validateRemotePreconditions3() {
   }
 }
 function registerKeewebDeploy(cli) {
-  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z26.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z26.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z26.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
+  cli.command("keeweb deploy", "Trigger KeeWeb deployment. Default mode dispatches the GitHub Deploy KeeWeb workflow. Use --local to run apps/keeweb/deploy.sh directly from this repo.").option("--local", z27.boolean().default(false).describe("Run local deployment using apps/keeweb/deploy.sh instead of triggering GitHub Actions.")).option("--nginx", z27.boolean().default(false).describe("Include nginx config deployment. Valid only with --local and passed through to deploy.sh as --nginx.")).option("--dry-run", z27.boolean().default(false).describe("Print planned actions without validating preconditions, executing deploy.sh, or triggering GitHub Actions.")).example("# Trigger GitHub Deploy KeeWeb workflow (default mode)").example("infra keeweb deploy").example("# Preview local deploy plan without side effects").example("infra keeweb deploy --local --dry-run").example("# Run local deploy including nginx config update").example("infra keeweb deploy --local --nginx").action(async (options) => {
     if (options.nginx && !options.local) {
       throw new Error("--nginx is only valid with --local");
     }
     if (options.local) {
       if (options.dryRun) {
-        const deployScriptPath2 = resolveDeployScriptPath();
-        const args2 = ["bash", deployScriptPath2];
+        const deployScriptPath = resolveDeployScriptPath();
+        const args = ["bash", deployScriptPath];
         if (options.nginx) {
-          args2.push("--nginx");
+          args.push("--nginx");
         }
         console.log("Dry run: local KeeWeb deploy");
-        console.log(`- deploy script: ${deployScriptPath2}`);
+        console.log(`- deploy script: ${deployScriptPath}`);
         console.log(`- dist check: ${resolveDistIndexPath()}`);
-        console.log(`- command: ${args2.join(" ")}`);
+        console.log(`- command: ${args.join(" ")}`);
         return;
       }
       const { deployScriptPath } = validateLocalPreconditions3({ nginx: options.nginx });
@@ -12536,14 +12636,14 @@ function registerKeewebDeploy(cli) {
       if (options.nginx) {
         args.push("--nginx");
       }
-      const child2 = Bun.spawn(args, {
+      const child = Bun.spawn(args, {
         env,
         stdout: "inherit",
         stderr: "inherit"
       });
-      const exitCode2 = await child2.exited;
-      if (exitCode2 !== 0) {
-        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      const exitCode = await child.exited;
+      if (exitCode !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode}`);
       }
       return;
     }
@@ -12592,13 +12692,13 @@ function registerKeewebOpen(cli) {
 
 // src/commands/keeweb/status.ts
 import { join as join7 } from "path";
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 var SITE_URL = "https://kw.igg.ms/";
 var GH_REPO = "marcusrbrown/infra";
 var HTTP_TIMEOUT_MS4 = 1e4;
-var ghRunSchema = z27.array(z27.object({
-  createdAt: z27.string().min(1),
-  url: z27.url()
+var ghRunSchema = z28.array(z28.object({
+  createdAt: z28.string().min(1),
+  url: z28.url()
 }));
 function levelLabel2(level) {
   if (level === "ok") {
@@ -12896,10 +12996,10 @@ function registerMcp(cli) {
 }
 
 // src/commands/status.ts
-import { z as z36 } from "zod";
+import { z as z37 } from "zod";
 
 // src/commands/umami/deploy.ts
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var REPO6 = "marcusrbrown/infra";
 var WORKFLOW_NAME6 = "Deploy Umami";
 var WORKFLOW_URL6 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-umami.yaml";
@@ -12934,7 +13034,7 @@ function validateUmamiRemotePreconditions() {
   }
 }
 function registerUmamiDeploy(cli) {
-  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z28.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z28.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
+  cli.command("umami deploy", "Deploy Umami analytics. Default mode triggers the GitHub Deploy Umami workflow, while --local runs apps/umami deploy directly with Bun.").option("--local", z29.boolean().default(false).describe("Run local deployment with Bun using apps/umami instead of triggering GitHub Actions.")).option("--dry-run", z29.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra umami deploy").example("# Validate local deploy preconditions and planned command").example("infra umami deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra umami deploy --local").action(async (options) => {
     if (options.local) {
       const command = ["bun", "run", "--cwd", "apps/umami", "deploy"];
       if (options.dryRun) {
@@ -12943,14 +13043,14 @@ function registerUmamiDeploy(cli) {
         return;
       }
       const env = getUmamiDeployEnv();
-      const child2 = Bun.spawn(command, {
+      const child = Bun.spawn(command, {
         env,
         stdout: "inherit",
         stderr: "inherit"
       });
-      const exitCode2 = await child2.exited;
-      if (exitCode2 !== 0) {
-        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      const exitCode = await child.exited;
+      if (exitCode !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode}`);
       }
       return;
     }
@@ -12975,7 +13075,7 @@ function registerUmamiDeploy(cli) {
 }
 
 // src/commands/umami/logs.ts
-import { z as z29 } from "zod";
+import { z as z30 } from "zod";
 
 // src/commands/umami/host.ts
 var VALID_HOST_RE5 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -13039,7 +13139,7 @@ async function streamUmamiLogs(opts, spawn = defaultLogsSpawn4, printOut, printE
   return { refused: false, exitCode };
 }
 function registerUmamiLogs(cli) {
-  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z29.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z29.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z29.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
+  cli.command("umami logs [service]", "Stream logs from an Umami service via SSH and docker compose.").option("--tail [n]", z30.number().default(100).describe("Number of log lines to tail from each service.")).option("--allow-ci", z30.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive credentials.")).option("--key [key]", z30.string().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action(async (service, options) => {
     const targetService = service ?? "umami";
     try {
       validateService3(targetService);
@@ -13069,7 +13169,7 @@ function registerUmamiLogs(cli) {
 }
 
 // src/commands/umami/status.ts
-import { z as z30 } from "zod";
+import { z as z31 } from "zod";
 var COMPOSE_PROJECT_DIR7 = "/opt/umami";
 function parseComposePsOutput3(stdoutText) {
   const trimmed = stdoutText.trim();
@@ -13240,7 +13340,7 @@ async function umamiStatusAction(options, ctx, spawn) {
   }
 }
 function registerUmamiStatus(cli) {
-  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z30.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
+  cli.command("umami status", "Show operational health of the Umami analytics deployment via docker compose ps.").option("--key [key]", z31.string().optional().describe("Environment variable name holding the SSH host. Falls back to UMAMI_DOMAIN when omitted.")).action((options, ctx) => umamiStatusAction(options, ctx));
 }
 
 // src/commands/umami/index.ts
@@ -13253,24 +13353,24 @@ function registerUmamiCommands(cli) {
 // src/commands/vpn/client.ts
 import { mkdir, writeFile as writeFile2 } from "fs/promises";
 import { join as join8, resolve as resolve2 } from "path";
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 
 // src/commands/vpn/peers.ts
 import { readFile, writeFile } from "fs/promises";
-import { z as z31 } from "zod";
-var peerSchema = z31.object({
-  name: z31.string(),
-  publicKey: z31.string(),
-  tunnelIp: z31.string()
+import { z as z32 } from "zod";
+var peerSchema = z32.object({
+  name: z32.string(),
+  publicKey: z32.string(),
+  tunnelIp: z32.string()
 });
-var peersFileSchema = z31.object({
-  peers: z31.array(peerSchema)
+var peersFileSchema = z32.object({
+  peers: z32.array(peerSchema)
 }).superRefine((data, ctx) => {
   const seenIps = new Set;
   for (const peer of data.peers) {
     if (seenIps.has(peer.tunnelIp)) {
       ctx.addIssue({
-        code: z31.ZodIssueCode.custom,
+        code: z32.ZodIssueCode.custom,
         message: `Duplicate tunnel IP "${peer.tunnelIp}" \u2014 each peer must have a unique tunnel IP.`,
         path: ["peers"]
       });
@@ -13282,7 +13382,7 @@ var peersFileSchema = z31.object({
   for (const peer of data.peers) {
     if (seenNames.has(peer.name)) {
       ctx.addIssue({
-        code: z31.ZodIssueCode.custom,
+        code: z32.ZodIssueCode.custom,
         message: `Duplicate name "${peer.name}" \u2014 each peer must have a unique name.`,
         path: ["peers"]
       });
@@ -13524,7 +13624,7 @@ function resolveDefaultClientsDir() {
   return join8(findRepoRoot(), "apps", "vpn", "clients");
 }
 function registerVpnClient(cli) {
-  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z32.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z32.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z32.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z32.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
+  cli.command("vpn client add <name>", "Add a new VPN client peer. Generates a keypair, assigns a tunnel IP, writes the client .conf to apps/vpn/clients/, and syncs the roster to the VPN_PEERS GitHub secret (best-effort).").option("--split-tunnel [cidrs]", z33.string().describe("Comma-separated CIDRs for split-tunnel routing. Defaults to 0.0.0.0/0 (full tunnel).")).option("--dns [dns]", z33.string().describe("DNS server for the client config.")).option("--server-pubkey [key]", z33.string().describe("Server public key. Falls back to VPN_SERVER_PUBKEY env var.")).option("--endpoint [host]", z33.string().describe("VPN server endpoint (IP or hostname). Falls back to VPN_HOST env var.")).example('# Add a new client named "laptop"').example("infra vpn client add laptop").example("# Add a split-tunnel client").example("infra vpn client add laptop --split-tunnel 10.0.0.0/8,192.168.0.0/16").action(async (name, options) => {
     const serverPublicKey = options.serverPubkey ?? process.env.VPN_SERVER_PUBKEY;
     const endpoint = options.endpoint ?? process.env.VPN_HOST;
     if (!serverPublicKey) {
@@ -13588,7 +13688,7 @@ function registerVpnClient(cli) {
 }
 
 // src/commands/vpn/deploy.ts
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 var REPO7 = "marcusrbrown/infra";
 var WORKFLOW_NAME7 = "Deploy VPN";
 var WORKFLOW_URL7 = "https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml";
@@ -13618,7 +13718,7 @@ function validateVpnRemotePreconditions() {
   }
 }
 function registerVpnDeploy(cli) {
-  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z33.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z33.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z33.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
+  cli.command("vpn deploy", "Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.").option("--local", z34.boolean().default(false).describe("Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.")).option("--dry-run", z34.boolean().default(false).describe("Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.")).option("--force-server-key", z34.boolean().default(false).describe("Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.")).example("# Trigger remote GitHub Actions deploy (default mode)").example("infra vpn deploy").example("# Validate local deploy preconditions and planned command").example("infra vpn deploy --local --dry-run").example("# Run local deploy with explicit SSH agent context").example("infra vpn deploy --local").action(async (options) => {
     if (options.local) {
       const command = [
         "bun",
@@ -13634,14 +13734,14 @@ function registerVpnDeploy(cli) {
         return;
       }
       const env = getVpnDeployEnv();
-      const child2 = Bun.spawn(command, {
+      const child = Bun.spawn(command, {
         env,
         stdout: "inherit",
         stderr: "inherit"
       });
-      const exitCode2 = await child2.exited;
-      if (exitCode2 !== 0) {
-        throw new Error(`Local deploy failed with exit code ${exitCode2}`);
+      const exitCode = await child.exited;
+      if (exitCode !== 0) {
+        throw new Error(`Local deploy failed with exit code ${exitCode}`);
       }
       return;
     }
@@ -13666,7 +13766,7 @@ function registerVpnDeploy(cli) {
 }
 
 // src/commands/vpn/logs.ts
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 
 // src/commands/vpn/host.ts
 var VALID_HOST_RE6 = /^[a-z\d][a-z\d.\-]*$/i;
@@ -13722,7 +13822,7 @@ async function streamVpnLogs(opts, spawn = defaultLogsSpawn5, printOut, printErr
   return { refused: false, exitCode };
 }
 function registerVpnLogs(cli) {
-  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z34.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z34.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z34.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
+  cli.command("vpn logs", "Stream WireGuard VPN logs via SSH and journalctl.").option("--tail [n]", z35.number().default(100).describe("Number of log lines to tail.")).option("--allow-ci", z35.boolean().default(false).describe("Allow log streaming in CI environments. Logs may contain sensitive VPN data.")).option("--key [key]", z35.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action(async (options) => {
     const hostEnvKey = options.key ?? "VPN_HOST";
     const host = process.env[hostEnvKey];
     if (!host) {
@@ -13744,7 +13844,7 @@ function registerVpnLogs(cli) {
 }
 
 // src/commands/vpn/status.ts
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 
 // src/commands/vpn/shared.ts
 function parseWgShowOutput(output) {
@@ -13871,7 +13971,7 @@ async function vpnStatusAction(options, ctx, spawn) {
   }
 }
 function registerVpnStatus(cli) {
-  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z35.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
+  cli.command("vpn status", "Show operational health of the VPN box via SSH and wg show.").option("--key [key]", z36.string().describe("Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.")).action((options, ctx) => vpnStatusAction(options, ctx));
 }
 
 // src/commands/vpn/index.ts
@@ -13883,7 +13983,7 @@ function registerVpnCommands(cli) {
 }
 
 // src/commands/status.ts
-var DEFAULT_CLIPROXY_URL8 = "https://cliproxy.fro.bot";
+var DEFAULT_CLIPROXY_URL9 = "https://cliproxy.fro.bot";
 var ERROR_PREFIX = "\u274C";
 var TABLE_COLUMNS = [
   { key: "app", label: "App" },
@@ -13893,7 +13993,7 @@ var TABLE_COLUMNS = [
   { key: "contentHash", label: "Content Hash" },
   { key: "usageStats", label: "Usage Stats" }
 ];
-function stripTrailingSlash6(value) {
+function stripTrailingSlash7(value) {
   return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 function errorSummary(app, reason) {
@@ -13933,7 +14033,7 @@ async function unifiedStatusAction(options, ctx, dependencies = {
   getBrokerStatusSummary
 }) {
   const verbose = options.verbose === true;
-  const cliproxyBaseUrl = stripTrailingSlash6(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL8);
+  const cliproxyBaseUrl = stripTrailingSlash7(process.env.CLIPROXY_URL ?? DEFAULT_CLIPROXY_URL9);
   const cliproxyKey = process.env.CLIPROXY_MANAGEMENT_KEY ?? "";
   const gatewayHost = process.env.GATEWAY_HOST ?? "";
   const umamiHost = process.env.UMAMI_DOMAIN ?? "";
@@ -13978,7 +14078,7 @@ function registerStatus(cli, dependencies = {
   getVpnStatusSummary,
   getBrokerStatusSummary
 }) {
-  cli.command("status", "Show status of all deployments").option("--json", z36.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z36.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
+  cli.command("status", "Show status of all deployments").option("--json", z37.boolean().describe("Output machine-readable JSON with keeweb, cliproxy, gateway, umami, dashboard, vpn, and broker summary objects.")).option("--verbose", z37.boolean().describe("Include verbose per-app health check details when building the summary rows.")).action((options, ctx) => unifiedStatusAction(options, ctx, dependencies));
 }
 
 // src/cli.ts