@mnemonik/cli 7.109.3 → 7.110.0

package/dist/router.js

@@ -5,6 +5,12 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res, err2) => function __init() {
   if (err2) throw err2[0];
   try {
@@ -13,7 +19,7 @@ var __esm = (fn, res, err2) => function __init() {
     throw err2 = [e], e;
   }
 };
-var __commonJS = (cb, mod) => function __require() {
+var __commonJS = (cb, mod) => function __require2() {
   try {
     return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
   } catch (e) {
@@ -496,11 +502,73 @@ var require_ignore = __commonJS({
 });
 
 // packages/shared/dist/runtimeSigners.js
-var ttl;
+import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
+import { execFile, execFileSync } from "node:child_process";
+function windowsCommand(file) {
+  const root = process.env.SystemRoot;
+  if (!root || !win32.isAbsolute(root))
+    throw new Error("acl_system_root_unavailable");
+  return win32.join(root, "System32", file);
+}
+function readIdentity(stdout) {
+  const match = /^"([^"\r\n]+)","(S-1-(?:\d+-)+\d+)"$/.exec(stdout.trim());
+  if (!match?.[1] || !match[2] || stdout.includes("\uFFFD"))
+    throw new Error("acl_identity_unavailable");
+  return { name: match[1], sid: match[2] };
+}
+function* readWindowsIdentity() {
+  const user = readIdentity(yield [windowsCommand("whoami.exe"), identityArgs]);
+  if (!ADMINISTRATOR_RID.test(user.sid))
+    return user;
+  const groups = yield [windowsCommand("whoami.exe"), groupArgs];
+  const local = /^"[^"\r\n]*","[^"\r\n]*","S-1-5-113",/m.test(groups);
+  return {
+    ...user,
+    localAdministratorSid: local ? `${user.sid.slice(0, user.sid.lastIndexOf("-"))}-500` : null
+  };
+}
+function windowsCurrentAccountSync() {
+  if (currentIdentity)
+    return currentIdentity;
+  const commands = readWindowsIdentity();
+  let step = commands.next();
+  while (!step.done)
+    step = commands.next(hookExecuteSync(...step.value));
+  return currentIdentity = step.value;
+}
+function hookInvocation(file, args2) {
+  if (win32.basename(file) === "whoami.exe") {
+    if ([file, ...args2].some((arg) => /[%!"\r\n]/.test(arg)))
+      throw new Error("acl_path_unavailable");
+    const command = args2.map((arg) => /^(?:[a-z0-9]+|\/[a-z]+)$/i.test(arg) ? arg : `"${arg}"`).join(" ");
+    return [
+      windowsCommand("cmd.exe"),
+      ["/d", "/v:off", "/s", "/c", `"chcp 65001>nul & "${file}" ${command}"`]
+    ];
+  }
+  if (win32.basename(file) === "cmd.exe")
+    return [file, ["/u", ...args2]];
+  return [file, args2];
+}
+function hookExecuteSync(file, args2, input) {
+  [file, args2] = hookInvocation(file, args2);
+  return execFileSync(file, args2, { ...hookOptions(file, args2), input });
+}
+var identityArgs, groupArgs, ADMINISTRATOR_RID, currentIdentity, ttl, hookOptions;
 var init_runtimeSigners = __esm({
   "packages/shared/dist/runtimeSigners.js"() {
     "use strict";
+    identityArgs = ["/user", "/fo", "csv", "/nh"];
+    groupArgs = ["/groups", "/fo", "csv", "/nh"];
+    ADMINISTRATOR_RID = /^S-1-5-21-\d+-\d+-\d+-500$/;
     ttl = 10 * 6e4;
+    hookOptions = (file, args2) => ({
+      encoding: args2.includes("/u") ? "utf16le" : "utf8",
+      timeout: win32.basename(file) === "powershell.exe" ? 3e4 : 5e3,
+      windowsHide: true,
+      maxBuffer: 16 * 1024 * 1024,
+      windowsVerbatimArguments: win32.basename(file) === "cmd.exe"
+    });
   }
 });
 
@@ -518,7 +586,7 @@ var init_repositoryFingerprint = __esm({
 
 // packages/shared/dist/projectIdentityFile.js
 import { lstat, readFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 function parseIdentityFile(text) {
   let value;
   try {
@@ -571,7 +639,7 @@ function parseIdentityFile(text) {
   };
 }
 async function readIdentityFile(dir, options = {}) {
-  const path = join2(dir, ".mnemonik.json");
+  const path = join3(dir, ".mnemonik.json");
   try {
     const stat = await lstat(path);
     if (stat.isSymbolicLink())
@@ -612,9 +680,9 @@ var init_projectIdentityFile = __esm({
 
 // packages/shared/dist/repositoryRoot.js
 import { lstat as lstat2, readFile as readFile2 } from "node:fs/promises";
-import { execFile } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 import { homedir } from "node:os";
-import { dirname as dirname2, join as join3, resolve } from "node:path";
+import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
 function gitEnvironment() {
   const env = {};
   for (const key of GIT_ENV_KEYS) {
@@ -626,7 +694,7 @@ function gitEnvironment() {
 }
 function runGit(cwd, args2) {
   return new Promise((resolvePromise, reject) => {
-    execFile("git", args2, { cwd, timeout: GIT_TIMEOUT_MS, encoding: "utf8", env: gitEnvironment() }, (error, stdout, stderr) => {
+    execFile2("git", args2, { cwd, timeout: GIT_TIMEOUT_MS, encoding: "utf8", env: gitEnvironment() }, (error, stdout, stderr) => {
       if (error)
         reject(Object.assign(error, { stdout, stderr }));
       else
@@ -636,7 +704,7 @@ function runGit(cwd, args2) {
 }
 async function boundaryAt(path) {
   try {
-    const stat = await lstat2(join3(path, ".git"));
+    const stat = await lstat2(join4(path, ".git"));
     if (stat.isDirectory())
       return { path, kind: "directory" };
     if (stat.isFile())
@@ -666,7 +734,7 @@ async function boundariesBetween(cwd, root) {
     const boundary = await confirmedBoundaryAt(directory);
     if (boundary)
       boundaries.push(boundary);
-    const parent = dirname2(directory);
+    const parent = dirname3(directory);
     if (parent === directory)
       break;
     directory = parent;
@@ -674,12 +742,12 @@ async function boundariesBetween(cwd, root) {
   return boundaries;
 }
 async function containingRepository(root) {
-  let directory = dirname2(root);
+  let directory = dirname3(root);
   while (true) {
     const boundary = await confirmedBoundaryAt(directory);
     if (boundary)
       return boundary;
-    const parent = dirname2(directory);
+    const parent = dirname3(directory);
     if (parent === directory)
       return void 0;
     directory = parent;
@@ -688,13 +756,13 @@ async function containingRepository(root) {
 async function canonicalBoundaryRoot(boundary) {
   if (boundary.kind === "directory")
     return boundary.path;
-  const pointer = /^gitdir:\s*(.+)\s*$/im.exec(await readFile2(join3(boundary.path, ".git"), "utf8"))?.[1];
+  const pointer = /^gitdir:\s*(.+)\s*$/im.exec(await readFile2(join4(boundary.path, ".git"), "utf8"))?.[1];
   if (!pointer)
     return boundary.path;
-  const gitDir = resolve(boundary.path, pointer);
+  const gitDir = resolve2(boundary.path, pointer);
   try {
-    const commonDir = resolve(gitDir, (await readFile2(join3(gitDir, "commondir"), "utf8")).trim());
-    return dirname2(commonDir);
+    const commonDir = resolve2(gitDir, (await readFile2(join4(gitDir, "commondir"), "utf8")).trim());
+    return dirname3(commonDir);
   } catch (error) {
     if (error.code === "ENOENT")
       return boundary.path;
@@ -702,7 +770,7 @@ async function canonicalBoundaryRoot(boundary) {
   }
 }
 async function resolveRepositoryRoot(cwd) {
-  const absoluteCwd = resolve(cwd);
+  const absoluteCwd = resolve2(cwd);
   try {
     const { stdout } = await runGit(absoluteCwd, [
       "rev-parse",
@@ -713,9 +781,9 @@ async function resolveRepositoryRoot(cwd) {
     if (!rootLine || !commonLine || extra.length) {
       return { kind: "git_unavailable", detail: "git rev-parse returned an unexpected response" };
     }
-    const root = resolve(rootLine);
-    const commonDir = resolve(root, commonLine);
-    const isLinkedWorktree = commonDir !== join3(root, ".git");
+    const root = resolve2(rootLine);
+    const commonDir = resolve2(root, commonLine);
+    const isLinkedWorktree = commonDir !== join4(root, ".git");
     const nested = await boundariesBetween(absoluteCwd, root);
     if (!isLinkedWorktree && await containingRepository(root)) {
       const boundary = await boundaryAt(root);
@@ -738,7 +806,7 @@ async function resolveRepositoryRoot(cwd) {
   }
 }
 async function readPlainIdentity(start2) {
-  const home = resolve(homedir());
+  const home = resolve2(homedir());
   let directory = start2;
   while (true) {
     const result = await readIdentityFile(directory);
@@ -746,7 +814,7 @@ async function readPlainIdentity(start2) {
       return { root: directory, result };
     if (directory === home)
       break;
-    const parent = dirname2(directory);
+    const parent = dirname3(directory);
     if (parent === directory)
       break;
     directory = parent;
@@ -758,7 +826,7 @@ function withBase(repository, root, nested) {
 }
 async function resolveProjectIdentity(cwd, options = {}) {
   const resolved = await resolveRepositoryRoot(cwd);
-  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: resolve(cwd) } : resolved;
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: resolve2(cwd) } : resolved;
   if (repository.kind === "plain") {
     const { root, result } = options.selectedRoot ? { root: repository.root, result: await readIdentityFile(repository.root, options) } : await readPlainIdentity(repository.root);
     const base2 = withBase(repository, root, []);
@@ -770,7 +838,7 @@ async function resolveProjectIdentity(cwd, options = {}) {
       return { ...base2, ...result, path: root };
     return { ...base2, kind: "absent" };
   }
-  const ownRoot = repository.isLinkedWorktree ? dirname2(repository.commonDir) : repository.root;
+  const ownRoot = repository.isLinkedWorktree ? dirname3(repository.commonDir) : repository.root;
   const outer = repository.isLinkedWorktree ? void 0 : await containingRepository(repository.root);
   const own = await readIdentityFile(ownRoot, options);
   if (!outer || options.selectedRoot || own.kind === "ok") {
@@ -802,65 +870,1663 @@ async function resolveProjectIdentity(cwd, options = {}) {
       ...parent.kind === "ok" ? { parentIdentity: parent.identity } : {}
     };
   }
-  if (parent.kind === "ok")
-    return { ...base, kind: "ok", identity: parent.identity };
-  return { ...base, kind: "absent" };
-}
-var GIT_TIMEOUT_MS, GIT_ENV_KEYS;
-var init_repositoryRoot = __esm({
-  "packages/shared/dist/repositoryRoot.js"() {
+  if (parent.kind === "ok")
+    return { ...base, kind: "ok", identity: parent.identity };
+  return { ...base, kind: "absent" };
+}
+var GIT_TIMEOUT_MS, GIT_ENV_KEYS;
+var init_repositoryRoot = __esm({
+  "packages/shared/dist/repositoryRoot.js"() {
+    "use strict";
+    init_projectIdentityFile();
+    GIT_TIMEOUT_MS = 2e3;
+    GIT_ENV_KEYS = [
+      "PATH",
+      "HOME",
+      "LANG",
+      "LC_ALL",
+      "SYSTEMROOT",
+      "TEMP",
+      "TMP",
+      "USERPROFILE"
+    ];
+  }
+});
+
+// packages/shared/dist/runtimeReader.js
+var RuntimeError;
+var init_runtimeReader = __esm({
+  "packages/shared/dist/runtimeReader.js"() {
+    "use strict";
+    init_runtimeSigners();
+    init_runtimeSigners();
+    RuntimeError = class extends Error {
+      reason;
+      constructor(reason) {
+        super(reason);
+        this.reason = reason;
+        this.name = "RuntimeError";
+      }
+    };
+  }
+});
+
+// packages/shared/dist/projectSetupHandoff.js
+var init_projectSetupHandoff = __esm({
+  "packages/shared/dist/projectSetupHandoff.js"() {
+    "use strict";
+    init_runtimeSigners();
+    init_runtimeReader();
+  }
+});
+
+// packages/shared/dist/hookRuntime.js
+var init_hookRuntime = __esm({
+  "packages/shared/dist/hookRuntime.js"() {
+    "use strict";
+    init_runtimeSigners();
+    init_repositoryRoot();
+    init_runtimeReader();
+    init_runtimeSigners();
+    init_projectSetupHandoff();
+  }
+});
+
+// node_modules/graceful-fs/polyfills.js
+var require_polyfills = __commonJS({
+  "node_modules/graceful-fs/polyfills.js"(exports, module2) {
+    var constants = __require("constants");
+    var origCwd = process.cwd;
+    var cwd = null;
+    var platform = process.env.GRACEFUL_FS_PLATFORM || process.platform;
+    process.cwd = function() {
+      if (!cwd)
+        cwd = origCwd.call(process);
+      return cwd;
+    };
+    try {
+      process.cwd();
+    } catch (er) {
+    }
+    if (typeof process.chdir === "function") {
+      chdir = process.chdir;
+      process.chdir = function(d) {
+        cwd = null;
+        chdir.call(process, d);
+      };
+      if (Object.setPrototypeOf) Object.setPrototypeOf(process.chdir, chdir);
+    }
+    var chdir;
+    module2.exports = patch;
+    function patch(fs3) {
+      if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
+        patchLchmod(fs3);
+      }
+      if (!fs3.lutimes) {
+        patchLutimes(fs3);
+      }
+      fs3.chown = chownFix(fs3.chown);
+      fs3.fchown = chownFix(fs3.fchown);
+      fs3.lchown = chownFix(fs3.lchown);
+      fs3.chmod = chmodFix(fs3.chmod);
+      fs3.fchmod = chmodFix(fs3.fchmod);
+      fs3.lchmod = chmodFix(fs3.lchmod);
+      fs3.chownSync = chownFixSync(fs3.chownSync);
+      fs3.fchownSync = chownFixSync(fs3.fchownSync);
+      fs3.lchownSync = chownFixSync(fs3.lchownSync);
+      fs3.chmodSync = chmodFixSync(fs3.chmodSync);
+      fs3.fchmodSync = chmodFixSync(fs3.fchmodSync);
+      fs3.lchmodSync = chmodFixSync(fs3.lchmodSync);
+      fs3.stat = statFix(fs3.stat);
+      fs3.fstat = statFix(fs3.fstat);
+      fs3.lstat = statFix(fs3.lstat);
+      fs3.statSync = statFixSync(fs3.statSync);
+      fs3.fstatSync = statFixSync(fs3.fstatSync);
+      fs3.lstatSync = statFixSync(fs3.lstatSync);
+      if (fs3.chmod && !fs3.lchmod) {
+        fs3.lchmod = function(path, mode, cb) {
+          if (cb) process.nextTick(cb);
+        };
+        fs3.lchmodSync = function() {
+        };
+      }
+      if (fs3.chown && !fs3.lchown) {
+        fs3.lchown = function(path, uid, gid, cb) {
+          if (cb) process.nextTick(cb);
+        };
+        fs3.lchownSync = function() {
+        };
+      }
+      if (platform === "win32") {
+        fs3.rename = typeof fs3.rename !== "function" ? fs3.rename : (function(fs$rename) {
+          function rename2(from, to, cb) {
+            var start2 = Date.now();
+            var backoff = 0;
+            fs$rename(from, to, function CB(er) {
+              if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start2 < 6e4) {
+                setTimeout(function() {
+                  fs3.stat(to, function(stater, st) {
+                    if (stater && stater.code === "ENOENT")
+                      fs$rename(from, to, CB);
+                    else
+                      cb(er);
+                  });
+                }, backoff);
+                if (backoff < 100)
+                  backoff += 10;
+                return;
+              }
+              if (cb) cb(er);
+            });
+          }
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename2, fs$rename);
+          return rename2;
+        })(fs3.rename);
+      }
+      fs3.read = typeof fs3.read !== "function" ? fs3.read : (function(fs$read) {
+        function read(fd, buffer, offset, length, position, callback_) {
+          var callback;
+          if (callback_ && typeof callback_ === "function") {
+            var eagCounter = 0;
+            callback = function(er, _, __) {
+              if (er && er.code === "EAGAIN" && eagCounter < 10) {
+                eagCounter++;
+                return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
+              }
+              callback_.apply(this, arguments);
+            };
+          }
+          return fs$read.call(fs3, fd, buffer, offset, length, position, callback);
+        }
+        if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
+        return read;
+      })(fs3.read);
+      fs3.readSync = typeof fs3.readSync !== "function" ? fs3.readSync : /* @__PURE__ */ (function(fs$readSync) {
+        return function(fd, buffer, offset, length, position) {
+          var eagCounter = 0;
+          while (true) {
+            try {
+              return fs$readSync.call(fs3, fd, buffer, offset, length, position);
+            } catch (er) {
+              if (er.code === "EAGAIN" && eagCounter < 10) {
+                eagCounter++;
+                continue;
+              }
+              throw er;
+            }
+          }
+        };
+      })(fs3.readSync);
+      function patchLchmod(fs4) {
+        fs4.lchmod = function(path, mode, callback) {
+          fs4.open(
+            path,
+            constants.O_WRONLY | constants.O_SYMLINK,
+            mode,
+            function(err2, fd) {
+              if (err2) {
+                if (callback) callback(err2);
+                return;
+              }
+              fs4.fchmod(fd, mode, function(err3) {
+                fs4.close(fd, function(err22) {
+                  if (callback) callback(err3 || err22);
+                });
+              });
+            }
+          );
+        };
+        fs4.lchmodSync = function(path, mode) {
+          var fd = fs4.openSync(path, constants.O_WRONLY | constants.O_SYMLINK, mode);
+          var threw = true;
+          var ret;
+          try {
+            ret = fs4.fchmodSync(fd, mode);
+            threw = false;
+          } finally {
+            if (threw) {
+              try {
+                fs4.closeSync(fd);
+              } catch (er) {
+              }
+            } else {
+              fs4.closeSync(fd);
+            }
+          }
+          return ret;
+        };
+      }
+      function patchLutimes(fs4) {
+        if (constants.hasOwnProperty("O_SYMLINK") && fs4.futimes) {
+          fs4.lutimes = function(path, at, mt, cb) {
+            fs4.open(path, constants.O_SYMLINK, function(er, fd) {
+              if (er) {
+                if (cb) cb(er);
+                return;
+              }
+              fs4.futimes(fd, at, mt, function(er2) {
+                fs4.close(fd, function(er22) {
+                  if (cb) cb(er2 || er22);
+                });
+              });
+            });
+          };
+          fs4.lutimesSync = function(path, at, mt) {
+            var fd = fs4.openSync(path, constants.O_SYMLINK);
+            var ret;
+            var threw = true;
+            try {
+              ret = fs4.futimesSync(fd, at, mt);
+              threw = false;
+            } finally {
+              if (threw) {
+                try {
+                  fs4.closeSync(fd);
+                } catch (er) {
+                }
+              } else {
+                fs4.closeSync(fd);
+              }
+            }
+            return ret;
+          };
+        } else if (fs4.futimes) {
+          fs4.lutimes = function(_a, _b, _c, cb) {
+            if (cb) process.nextTick(cb);
+          };
+          fs4.lutimesSync = function() {
+          };
+        }
+      }
+      function chmodFix(orig) {
+        if (!orig) return orig;
+        return function(target, mode, cb) {
+          return orig.call(fs3, target, mode, function(er) {
+            if (chownErOk(er)) er = null;
+            if (cb) cb.apply(this, arguments);
+          });
+        };
+      }
+      function chmodFixSync(orig) {
+        if (!orig) return orig;
+        return function(target, mode) {
+          try {
+            return orig.call(fs3, target, mode);
+          } catch (er) {
+            if (!chownErOk(er)) throw er;
+          }
+        };
+      }
+      function chownFix(orig) {
+        if (!orig) return orig;
+        return function(target, uid, gid, cb) {
+          return orig.call(fs3, target, uid, gid, function(er) {
+            if (chownErOk(er)) er = null;
+            if (cb) cb.apply(this, arguments);
+          });
+        };
+      }
+      function chownFixSync(orig) {
+        if (!orig) return orig;
+        return function(target, uid, gid) {
+          try {
+            return orig.call(fs3, target, uid, gid);
+          } catch (er) {
+            if (!chownErOk(er)) throw er;
+          }
+        };
+      }
+      function statFix(orig) {
+        if (!orig) return orig;
+        return function(target, options, cb) {
+          if (typeof options === "function") {
+            cb = options;
+            options = null;
+          }
+          function callback(er, stats) {
+            if (stats) {
+              if (stats.uid < 0) stats.uid += 4294967296;
+              if (stats.gid < 0) stats.gid += 4294967296;
+            }
+            if (cb) cb.apply(this, arguments);
+          }
+          return options ? orig.call(fs3, target, options, callback) : orig.call(fs3, target, callback);
+        };
+      }
+      function statFixSync(orig) {
+        if (!orig) return orig;
+        return function(target, options) {
+          var stats = options ? orig.call(fs3, target, options) : orig.call(fs3, target);
+          if (stats) {
+            if (stats.uid < 0) stats.uid += 4294967296;
+            if (stats.gid < 0) stats.gid += 4294967296;
+          }
+          return stats;
+        };
+      }
+      function chownErOk(er) {
+        if (!er)
+          return true;
+        if (er.code === "ENOSYS")
+          return true;
+        var nonroot = !process.getuid || process.getuid() !== 0;
+        if (nonroot) {
+          if (er.code === "EINVAL" || er.code === "EPERM")
+            return true;
+        }
+        return false;
+      }
+    }
+  }
+});
+
+// node_modules/graceful-fs/legacy-streams.js
+var require_legacy_streams = __commonJS({
+  "node_modules/graceful-fs/legacy-streams.js"(exports, module2) {
+    var Stream = __require("stream").Stream;
+    module2.exports = legacy;
+    function legacy(fs3) {
+      return {
+        ReadStream,
+        WriteStream
+      };
+      function ReadStream(path, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path, options);
+        Stream.call(this);
+        var self = this;
+        this.path = path;
+        this.fd = null;
+        this.readable = true;
+        this.paused = false;
+        this.flags = "r";
+        this.mode = 438;
+        this.bufferSize = 64 * 1024;
+        options = options || {};
+        var keys = Object.keys(options);
+        for (var index = 0, length = keys.length; index < length; index++) {
+          var key = keys[index];
+          this[key] = options[key];
+        }
+        if (this.encoding) this.setEncoding(this.encoding);
+        if (this.start !== void 0) {
+          if ("number" !== typeof this.start) {
+            throw TypeError("start must be a Number");
+          }
+          if (this.end === void 0) {
+            this.end = Infinity;
+          } else if ("number" !== typeof this.end) {
+            throw TypeError("end must be a Number");
+          }
+          if (this.start > this.end) {
+            throw new Error("start must be <= end");
+          }
+          this.pos = this.start;
+        }
+        if (this.fd !== null) {
+          process.nextTick(function() {
+            self._read();
+          });
+          return;
+        }
+        fs3.open(this.path, this.flags, this.mode, function(err2, fd) {
+          if (err2) {
+            self.emit("error", err2);
+            self.readable = false;
+            return;
+          }
+          self.fd = fd;
+          self.emit("open", fd);
+          self._read();
+        });
+      }
+      function WriteStream(path, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path, options);
+        Stream.call(this);
+        this.path = path;
+        this.fd = null;
+        this.writable = true;
+        this.flags = "w";
+        this.encoding = "binary";
+        this.mode = 438;
+        this.bytesWritten = 0;
+        options = options || {};
+        var keys = Object.keys(options);
+        for (var index = 0, length = keys.length; index < length; index++) {
+          var key = keys[index];
+          this[key] = options[key];
+        }
+        if (this.start !== void 0) {
+          if ("number" !== typeof this.start) {
+            throw TypeError("start must be a Number");
+          }
+          if (this.start < 0) {
+            throw new Error("start must be >= zero");
+          }
+          this.pos = this.start;
+        }
+        this.busy = false;
+        this._queue = [];
+        if (this.fd === null) {
+          this._open = fs3.open;
+          this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
+          this.flush();
+        }
+      }
+    }
+  }
+});
+
+// node_modules/graceful-fs/clone.js
+var require_clone = __commonJS({
+  "node_modules/graceful-fs/clone.js"(exports, module2) {
+    "use strict";
+    module2.exports = clone;
+    var getPrototypeOf = Object.getPrototypeOf || function(obj) {
+      return obj.__proto__;
+    };
+    function clone(obj) {
+      if (obj === null || typeof obj !== "object")
+        return obj;
+      if (obj instanceof Object)
+        var copy = { __proto__: getPrototypeOf(obj) };
+      else
+        var copy = /* @__PURE__ */ Object.create(null);
+      Object.getOwnPropertyNames(obj).forEach(function(key) {
+        Object.defineProperty(copy, key, Object.getOwnPropertyDescriptor(obj, key));
+      });
+      return copy;
+    }
+  }
+});
+
+// node_modules/graceful-fs/graceful-fs.js
+var require_graceful_fs = __commonJS({
+  "node_modules/graceful-fs/graceful-fs.js"(exports, module2) {
+    var fs3 = __require("fs");
+    var polyfills = require_polyfills();
+    var legacy = require_legacy_streams();
+    var clone = require_clone();
+    var util = __require("util");
+    var gracefulQueue;
+    var previousSymbol;
+    if (typeof Symbol === "function" && typeof Symbol.for === "function") {
+      gracefulQueue = /* @__PURE__ */ Symbol.for("graceful-fs.queue");
+      previousSymbol = /* @__PURE__ */ Symbol.for("graceful-fs.previous");
+    } else {
+      gracefulQueue = "___graceful-fs.queue";
+      previousSymbol = "___graceful-fs.previous";
+    }
+    function noop() {
+    }
+    function publishQueue(context, queue2) {
+      Object.defineProperty(context, gracefulQueue, {
+        get: function() {
+          return queue2;
+        }
+      });
+    }
+    var debug2 = noop;
+    if (util.debuglog)
+      debug2 = util.debuglog("gfs4");
+    else if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || ""))
+      debug2 = function() {
+        var m = util.format.apply(util, arguments);
+        m = "GFS4: " + m.split(/\n/).join("\nGFS4: ");
+        console.error(m);
+      };
+    if (!fs3[gracefulQueue]) {
+      queue = global[gracefulQueue] || [];
+      publishQueue(fs3, queue);
+      fs3.close = (function(fs$close) {
+        function close(fd, cb) {
+          return fs$close.call(fs3, fd, function(err2) {
+            if (!err2) {
+              resetQueue();
+            }
+            if (typeof cb === "function")
+              cb.apply(this, arguments);
+          });
+        }
+        Object.defineProperty(close, previousSymbol, {
+          value: fs$close
+        });
+        return close;
+      })(fs3.close);
+      fs3.closeSync = (function(fs$closeSync) {
+        function closeSync(fd) {
+          fs$closeSync.apply(fs3, arguments);
+          resetQueue();
+        }
+        Object.defineProperty(closeSync, previousSymbol, {
+          value: fs$closeSync
+        });
+        return closeSync;
+      })(fs3.closeSync);
+      if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
+        process.on("exit", function() {
+          debug2(fs3[gracefulQueue]);
+          __require("assert").equal(fs3[gracefulQueue].length, 0);
+        });
+      }
+    }
+    var queue;
+    if (!global[gracefulQueue]) {
+      publishQueue(global, fs3[gracefulQueue]);
+    }
+    module2.exports = patch(clone(fs3));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs3.__patched) {
+      module2.exports = patch(fs3);
+      fs3.__patched = true;
+    }
+    function patch(fs4) {
+      polyfills(fs4);
+      fs4.gracefulify = patch;
+      fs4.createReadStream = createReadStream;
+      fs4.createWriteStream = createWriteStream;
+      var fs$readFile = fs4.readFile;
+      fs4.readFile = readFile5;
+      function readFile5(path, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        return go$readFile(path, options, cb);
+        function go$readFile(path2, options2, cb2, startTime) {
+          return fs$readFile(path2, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$readFile, [path2, options2, cb2], err2, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$writeFile = fs4.writeFile;
+      fs4.writeFile = writeFile2;
+      function writeFile2(path, data, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        return go$writeFile(path, data, options, cb);
+        function go$writeFile(path2, data2, options2, cb2, startTime) {
+          return fs$writeFile(path2, data2, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$writeFile, [path2, data2, options2, cb2], err2, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$appendFile = fs4.appendFile;
+      if (fs$appendFile)
+        fs4.appendFile = appendFile;
+      function appendFile(path, data, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        return go$appendFile(path, data, options, cb);
+        function go$appendFile(path2, data2, options2, cb2, startTime) {
+          return fs$appendFile(path2, data2, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$appendFile, [path2, data2, options2, cb2], err2, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$copyFile = fs4.copyFile;
+      if (fs$copyFile)
+        fs4.copyFile = copyFile;
+      function copyFile(src, dest, flags2, cb) {
+        if (typeof flags2 === "function") {
+          cb = flags2;
+          flags2 = 0;
+        }
+        return go$copyFile(src, dest, flags2, cb);
+        function go$copyFile(src2, dest2, flags3, cb2, startTime) {
+          return fs$copyFile(src2, dest2, flags3, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$copyFile, [src2, dest2, flags3, cb2], err2, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      var fs$readdir = fs4.readdir;
+      fs4.readdir = readdir;
+      var noReaddirOptionVersions = /^v[0-5]\./;
+      function readdir(path, options, cb) {
+        if (typeof options === "function")
+          cb = options, options = null;
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path2, options2, cb2, startTime) {
+          return fs$readdir(path2, fs$readdirCallback(
+            path2,
+            options2,
+            cb2,
+            startTime
+          ));
+        } : function go$readdir2(path2, options2, cb2, startTime) {
+          return fs$readdir(path2, options2, fs$readdirCallback(
+            path2,
+            options2,
+            cb2,
+            startTime
+          ));
+        };
+        return go$readdir(path, options, cb);
+        function fs$readdirCallback(path2, options2, cb2, startTime) {
+          return function(err2, files) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([
+                go$readdir,
+                [path2, options2, cb2],
+                err2,
+                startTime || Date.now(),
+                Date.now()
+              ]);
+            else {
+              if (files && files.sort)
+                files.sort();
+              if (typeof cb2 === "function")
+                cb2.call(this, err2, files);
+            }
+          };
+        }
+      }
+      if (process.version.substr(0, 4) === "v0.8") {
+        var legStreams = legacy(fs4);
+        ReadStream = legStreams.ReadStream;
+        WriteStream = legStreams.WriteStream;
+      }
+      var fs$ReadStream = fs4.ReadStream;
+      if (fs$ReadStream) {
+        ReadStream.prototype = Object.create(fs$ReadStream.prototype);
+        ReadStream.prototype.open = ReadStream$open;
+      }
+      var fs$WriteStream = fs4.WriteStream;
+      if (fs$WriteStream) {
+        WriteStream.prototype = Object.create(fs$WriteStream.prototype);
+        WriteStream.prototype.open = WriteStream$open;
+      }
+      Object.defineProperty(fs4, "ReadStream", {
+        get: function() {
+          return ReadStream;
+        },
+        set: function(val) {
+          ReadStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      Object.defineProperty(fs4, "WriteStream", {
+        get: function() {
+          return WriteStream;
+        },
+        set: function(val) {
+          WriteStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      var FileReadStream = ReadStream;
+      Object.defineProperty(fs4, "FileReadStream", {
+        get: function() {
+          return FileReadStream;
+        },
+        set: function(val) {
+          FileReadStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      var FileWriteStream = WriteStream;
+      Object.defineProperty(fs4, "FileWriteStream", {
+        get: function() {
+          return FileWriteStream;
+        },
+        set: function(val) {
+          FileWriteStream = val;
+        },
+        enumerable: true,
+        configurable: true
+      });
+      function ReadStream(path, options) {
+        if (this instanceof ReadStream)
+          return fs$ReadStream.apply(this, arguments), this;
+        else
+          return ReadStream.apply(Object.create(ReadStream.prototype), arguments);
+      }
+      function ReadStream$open() {
+        var that = this;
+        open2(that.path, that.flags, that.mode, function(err2, fd) {
+          if (err2) {
+            if (that.autoClose)
+              that.destroy();
+            that.emit("error", err2);
+          } else {
+            that.fd = fd;
+            that.emit("open", fd);
+            that.read();
+          }
+        });
+      }
+      function WriteStream(path, options) {
+        if (this instanceof WriteStream)
+          return fs$WriteStream.apply(this, arguments), this;
+        else
+          return WriteStream.apply(Object.create(WriteStream.prototype), arguments);
+      }
+      function WriteStream$open() {
+        var that = this;
+        open2(that.path, that.flags, that.mode, function(err2, fd) {
+          if (err2) {
+            that.destroy();
+            that.emit("error", err2);
+          } else {
+            that.fd = fd;
+            that.emit("open", fd);
+          }
+        });
+      }
+      function createReadStream(path, options) {
+        return new fs4.ReadStream(path, options);
+      }
+      function createWriteStream(path, options) {
+        return new fs4.WriteStream(path, options);
+      }
+      var fs$open = fs4.open;
+      fs4.open = open2;
+      function open2(path, flags2, mode, cb) {
+        if (typeof mode === "function")
+          cb = mode, mode = null;
+        return go$open(path, flags2, mode, cb);
+        function go$open(path2, flags3, mode2, cb2, startTime) {
+          return fs$open(path2, flags3, mode2, function(err2, fd) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$open, [path2, flags3, mode2, cb2], err2, startTime || Date.now(), Date.now()]);
+            else {
+              if (typeof cb2 === "function")
+                cb2.apply(this, arguments);
+            }
+          });
+        }
+      }
+      return fs4;
+    }
+    function enqueue(elem) {
+      debug2("ENQUEUE", elem[0].name, elem[1]);
+      fs3[gracefulQueue].push(elem);
+      retry();
+    }
+    var retryTimer;
+    function resetQueue() {
+      var now = Date.now();
+      for (var i2 = 0; i2 < fs3[gracefulQueue].length; ++i2) {
+        if (fs3[gracefulQueue][i2].length > 2) {
+          fs3[gracefulQueue][i2][3] = now;
+          fs3[gracefulQueue][i2][4] = now;
+        }
+      }
+      retry();
+    }
+    function retry() {
+      clearTimeout(retryTimer);
+      retryTimer = void 0;
+      if (fs3[gracefulQueue].length === 0)
+        return;
+      var elem = fs3[gracefulQueue].shift();
+      var fn = elem[0];
+      var args2 = elem[1];
+      var err2 = elem[2];
+      var startTime = elem[3];
+      var lastTime = elem[4];
+      if (startTime === void 0) {
+        debug2("RETRY", fn.name, args2);
+        fn.apply(null, args2);
+      } else if (Date.now() - startTime >= 6e4) {
+        debug2("TIMEOUT", fn.name, args2);
+        var cb = args2.pop();
+        if (typeof cb === "function")
+          cb.call(null, err2);
+      } else {
+        var sinceAttempt = Date.now() - lastTime;
+        var sinceStart = Math.max(lastTime - startTime, 1);
+        var desiredDelay = Math.min(sinceStart * 1.2, 100);
+        if (sinceAttempt >= desiredDelay) {
+          debug2("RETRY", fn.name, args2);
+          fn.apply(null, args2.concat([startTime]));
+        } else {
+          fs3[gracefulQueue].push(elem);
+        }
+      }
+      if (retryTimer === void 0) {
+        retryTimer = setTimeout(retry, 0);
+      }
+    }
+  }
+});
+
+// node_modules/retry/lib/retry_operation.js
+var require_retry_operation = __commonJS({
+  "node_modules/retry/lib/retry_operation.js"(exports, module2) {
+    function RetryOperation(timeouts, options) {
+      if (typeof options === "boolean") {
+        options = { forever: options };
+      }
+      this._originalTimeouts = JSON.parse(JSON.stringify(timeouts));
+      this._timeouts = timeouts;
+      this._options = options || {};
+      this._maxRetryTime = options && options.maxRetryTime || Infinity;
+      this._fn = null;
+      this._errors = [];
+      this._attempts = 1;
+      this._operationTimeout = null;
+      this._operationTimeoutCb = null;
+      this._timeout = null;
+      this._operationStart = null;
+      if (this._options.forever) {
+        this._cachedTimeouts = this._timeouts.slice(0);
+      }
+    }
+    module2.exports = RetryOperation;
+    RetryOperation.prototype.reset = function() {
+      this._attempts = 1;
+      this._timeouts = this._originalTimeouts;
+    };
+    RetryOperation.prototype.stop = function() {
+      if (this._timeout) {
+        clearTimeout(this._timeout);
+      }
+      this._timeouts = [];
+      this._cachedTimeouts = null;
+    };
+    RetryOperation.prototype.retry = function(err2) {
+      if (this._timeout) {
+        clearTimeout(this._timeout);
+      }
+      if (!err2) {
+        return false;
+      }
+      var currentTime = (/* @__PURE__ */ new Date()).getTime();
+      if (err2 && currentTime - this._operationStart >= this._maxRetryTime) {
+        this._errors.unshift(new Error("RetryOperation timeout occurred"));
+        return false;
+      }
+      this._errors.push(err2);
+      var timeout = this._timeouts.shift();
+      if (timeout === void 0) {
+        if (this._cachedTimeouts) {
+          this._errors.splice(this._errors.length - 1, this._errors.length);
+          this._timeouts = this._cachedTimeouts.slice(0);
+          timeout = this._timeouts.shift();
+        } else {
+          return false;
+        }
+      }
+      var self = this;
+      var timer = setTimeout(function() {
+        self._attempts++;
+        if (self._operationTimeoutCb) {
+          self._timeout = setTimeout(function() {
+            self._operationTimeoutCb(self._attempts);
+          }, self._operationTimeout);
+          if (self._options.unref) {
+            self._timeout.unref();
+          }
+        }
+        self._fn(self._attempts);
+      }, timeout);
+      if (this._options.unref) {
+        timer.unref();
+      }
+      return true;
+    };
+    RetryOperation.prototype.attempt = function(fn, timeoutOps) {
+      this._fn = fn;
+      if (timeoutOps) {
+        if (timeoutOps.timeout) {
+          this._operationTimeout = timeoutOps.timeout;
+        }
+        if (timeoutOps.cb) {
+          this._operationTimeoutCb = timeoutOps.cb;
+        }
+      }
+      var self = this;
+      if (this._operationTimeoutCb) {
+        this._timeout = setTimeout(function() {
+          self._operationTimeoutCb();
+        }, self._operationTimeout);
+      }
+      this._operationStart = (/* @__PURE__ */ new Date()).getTime();
+      this._fn(this._attempts);
+    };
+    RetryOperation.prototype.try = function(fn) {
+      console.log("Using RetryOperation.try() is deprecated");
+      this.attempt(fn);
+    };
+    RetryOperation.prototype.start = function(fn) {
+      console.log("Using RetryOperation.start() is deprecated");
+      this.attempt(fn);
+    };
+    RetryOperation.prototype.start = RetryOperation.prototype.try;
+    RetryOperation.prototype.errors = function() {
+      return this._errors;
+    };
+    RetryOperation.prototype.attempts = function() {
+      return this._attempts;
+    };
+    RetryOperation.prototype.mainError = function() {
+      if (this._errors.length === 0) {
+        return null;
+      }
+      var counts2 = {};
+      var mainError = null;
+      var mainErrorCount = 0;
+      for (var i2 = 0; i2 < this._errors.length; i2++) {
+        var error = this._errors[i2];
+        var message = error.message;
+        var count = (counts2[message] || 0) + 1;
+        counts2[message] = count;
+        if (count >= mainErrorCount) {
+          mainError = error;
+          mainErrorCount = count;
+        }
+      }
+      return mainError;
+    };
+  }
+});
+
+// node_modules/retry/lib/retry.js
+var require_retry = __commonJS({
+  "node_modules/retry/lib/retry.js"(exports) {
+    var RetryOperation = require_retry_operation();
+    exports.operation = function(options) {
+      var timeouts = exports.timeouts(options);
+      return new RetryOperation(timeouts, {
+        forever: options && options.forever,
+        unref: options && options.unref,
+        maxRetryTime: options && options.maxRetryTime
+      });
+    };
+    exports.timeouts = function(options) {
+      if (options instanceof Array) {
+        return [].concat(options);
+      }
+      var opts = {
+        retries: 10,
+        factor: 2,
+        minTimeout: 1 * 1e3,
+        maxTimeout: Infinity,
+        randomize: false
+      };
+      for (var key in options) {
+        opts[key] = options[key];
+      }
+      if (opts.minTimeout > opts.maxTimeout) {
+        throw new Error("minTimeout is greater than maxTimeout");
+      }
+      var timeouts = [];
+      for (var i2 = 0; i2 < opts.retries; i2++) {
+        timeouts.push(this.createTimeout(i2, opts));
+      }
+      if (options && options.forever && !timeouts.length) {
+        timeouts.push(this.createTimeout(i2, opts));
+      }
+      timeouts.sort(function(a, b) {
+        return a - b;
+      });
+      return timeouts;
+    };
+    exports.createTimeout = function(attempt, opts) {
+      var random = opts.randomize ? Math.random() + 1 : 1;
+      var timeout = Math.round(random * opts.minTimeout * Math.pow(opts.factor, attempt));
+      timeout = Math.min(timeout, opts.maxTimeout);
+      return timeout;
+    };
+    exports.wrap = function(obj, options, methods) {
+      if (options instanceof Array) {
+        methods = options;
+        options = null;
+      }
+      if (!methods) {
+        methods = [];
+        for (var key in obj) {
+          if (typeof obj[key] === "function") {
+            methods.push(key);
+          }
+        }
+      }
+      for (var i2 = 0; i2 < methods.length; i2++) {
+        var method = methods[i2];
+        var original = obj[method];
+        obj[method] = function retryWrapper(original2) {
+          var op = exports.operation(options);
+          var args2 = Array.prototype.slice.call(arguments, 1);
+          var callback = args2.pop();
+          args2.push(function(err2) {
+            if (op.retry(err2)) {
+              return;
+            }
+            if (err2) {
+              arguments[0] = op.mainError();
+            }
+            callback.apply(this, arguments);
+          });
+          op.attempt(function() {
+            original2.apply(obj, args2);
+          });
+        }.bind(obj, original);
+        obj[method].options = options;
+      }
+    };
+  }
+});
+
+// node_modules/retry/index.js
+var require_retry2 = __commonJS({
+  "node_modules/retry/index.js"(exports, module2) {
+    module2.exports = require_retry();
+  }
+});
+
+// node_modules/proper-lockfile/node_modules/signal-exit/signals.js
+var require_signals = __commonJS({
+  "node_modules/proper-lockfile/node_modules/signal-exit/signals.js"(exports, module2) {
+    module2.exports = [
+      "SIGABRT",
+      "SIGALRM",
+      "SIGHUP",
+      "SIGINT",
+      "SIGTERM"
+    ];
+    if (process.platform !== "win32") {
+      module2.exports.push(
+        "SIGVTALRM",
+        "SIGXCPU",
+        "SIGXFSZ",
+        "SIGUSR2",
+        "SIGTRAP",
+        "SIGSYS",
+        "SIGQUIT",
+        "SIGIOT"
+        // should detect profiler and enable/disable accordingly.
+        // see #21
+        // 'SIGPROF'
+      );
+    }
+    if (process.platform === "linux") {
+      module2.exports.push(
+        "SIGIO",
+        "SIGPOLL",
+        "SIGPWR",
+        "SIGSTKFLT",
+        "SIGUNUSED"
+      );
+    }
+  }
+});
+
+// node_modules/proper-lockfile/node_modules/signal-exit/index.js
+var require_signal_exit = __commonJS({
+  "node_modules/proper-lockfile/node_modules/signal-exit/index.js"(exports, module2) {
+    var process2 = global.process;
+    var processOk = function(process3) {
+      return process3 && typeof process3 === "object" && typeof process3.removeListener === "function" && typeof process3.emit === "function" && typeof process3.reallyExit === "function" && typeof process3.listeners === "function" && typeof process3.kill === "function" && typeof process3.pid === "number" && typeof process3.on === "function";
+    };
+    if (!processOk(process2)) {
+      module2.exports = function() {
+        return function() {
+        };
+      };
+    } else {
+      assert = __require("assert");
+      signals = require_signals();
+      isWin = /^win/i.test(process2.platform);
+      EE = __require("events");
+      if (typeof EE !== "function") {
+        EE = EE.EventEmitter;
+      }
+      if (process2.__signal_exit_emitter__) {
+        emitter = process2.__signal_exit_emitter__;
+      } else {
+        emitter = process2.__signal_exit_emitter__ = new EE();
+        emitter.count = 0;
+        emitter.emitted = {};
+      }
+      if (!emitter.infinite) {
+        emitter.setMaxListeners(Infinity);
+        emitter.infinite = true;
+      }
+      module2.exports = function(cb, opts) {
+        if (!processOk(global.process)) {
+          return function() {
+          };
+        }
+        assert.equal(typeof cb, "function", "a callback must be provided for exit handler");
+        if (loaded === false) {
+          load();
+        }
+        var ev = "exit";
+        if (opts && opts.alwaysLast) {
+          ev = "afterexit";
+        }
+        var remove = function() {
+          emitter.removeListener(ev, cb);
+          if (emitter.listeners("exit").length === 0 && emitter.listeners("afterexit").length === 0) {
+            unload();
+          }
+        };
+        emitter.on(ev, cb);
+        return remove;
+      };
+      unload = function unload2() {
+        if (!loaded || !processOk(global.process)) {
+          return;
+        }
+        loaded = false;
+        signals.forEach(function(sig) {
+          try {
+            process2.removeListener(sig, sigListeners[sig]);
+          } catch (er) {
+          }
+        });
+        process2.emit = originalProcessEmit;
+        process2.reallyExit = originalProcessReallyExit;
+        emitter.count -= 1;
+      };
+      module2.exports.unload = unload;
+      emit = function emit2(event, code, signal) {
+        if (emitter.emitted[event]) {
+          return;
+        }
+        emitter.emitted[event] = true;
+        emitter.emit(event, code, signal);
+      };
+      sigListeners = {};
+      signals.forEach(function(sig) {
+        sigListeners[sig] = function listener() {
+          if (!processOk(global.process)) {
+            return;
+          }
+          var listeners = process2.listeners(sig);
+          if (listeners.length === emitter.count) {
+            unload();
+            emit("exit", null, sig);
+            emit("afterexit", null, sig);
+            if (isWin && sig === "SIGHUP") {
+              sig = "SIGINT";
+            }
+            process2.kill(process2.pid, sig);
+          }
+        };
+      });
+      module2.exports.signals = function() {
+        return signals;
+      };
+      loaded = false;
+      load = function load2() {
+        if (loaded || !processOk(global.process)) {
+          return;
+        }
+        loaded = true;
+        emitter.count += 1;
+        signals = signals.filter(function(sig) {
+          try {
+            process2.on(sig, sigListeners[sig]);
+            return true;
+          } catch (er) {
+            return false;
+          }
+        });
+        process2.emit = processEmit;
+        process2.reallyExit = processReallyExit;
+      };
+      module2.exports.load = load;
+      originalProcessReallyExit = process2.reallyExit;
+      processReallyExit = function processReallyExit2(code) {
+        if (!processOk(global.process)) {
+          return;
+        }
+        process2.exitCode = code || /* istanbul ignore next */
+        0;
+        emit("exit", process2.exitCode, null);
+        emit("afterexit", process2.exitCode, null);
+        originalProcessReallyExit.call(process2, process2.exitCode);
+      };
+      originalProcessEmit = process2.emit;
+      processEmit = function processEmit2(ev, arg) {
+        if (ev === "exit" && processOk(global.process)) {
+          if (arg !== void 0) {
+            process2.exitCode = arg;
+          }
+          var ret = originalProcessEmit.apply(this, arguments);
+          emit("exit", process2.exitCode, null);
+          emit("afterexit", process2.exitCode, null);
+          return ret;
+        } else {
+          return originalProcessEmit.apply(this, arguments);
+        }
+      };
+    }
+    var assert;
+    var signals;
+    var isWin;
+    var EE;
+    var emitter;
+    var unload;
+    var emit;
+    var sigListeners;
+    var loaded;
+    var load;
+    var originalProcessReallyExit;
+    var processReallyExit;
+    var originalProcessEmit;
+    var processEmit;
+  }
+});
+
+// node_modules/proper-lockfile/lib/mtime-precision.js
+var require_mtime_precision = __commonJS({
+  "node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module2) {
     "use strict";
-    init_projectIdentityFile();
-    GIT_TIMEOUT_MS = 2e3;
-    GIT_ENV_KEYS = [
-      "PATH",
-      "HOME",
-      "LANG",
-      "LC_ALL",
-      "SYSTEMROOT",
-      "TEMP",
-      "TMP",
-      "USERPROFILE"
-    ];
+    var cacheSymbol = /* @__PURE__ */ Symbol();
+    function probe(file, fs3, callback) {
+      const cachedPrecision = fs3[cacheSymbol];
+      if (cachedPrecision) {
+        return fs3.stat(file, (err2, stat) => {
+          if (err2) {
+            return callback(err2);
+          }
+          callback(null, stat.mtime, cachedPrecision);
+        });
+      }
+      const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
+      fs3.utimes(file, mtime, mtime, (err2) => {
+        if (err2) {
+          return callback(err2);
+        }
+        fs3.stat(file, (err3, stat) => {
+          if (err3) {
+            return callback(err3);
+          }
+          const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
+          Object.defineProperty(fs3, cacheSymbol, { value: precision });
+          callback(null, stat.mtime, precision);
+        });
+      });
+    }
+    function getMtime(precision) {
+      let now = Date.now();
+      if (precision === "s") {
+        now = Math.ceil(now / 1e3) * 1e3;
+      }
+      return new Date(now);
+    }
+    module2.exports.probe = probe;
+    module2.exports.getMtime = getMtime;
   }
 });
 
-// packages/shared/dist/runtimeReader.js
-var init_runtimeReader = __esm({
-  "packages/shared/dist/runtimeReader.js"() {
+// node_modules/proper-lockfile/lib/lockfile.js
+var require_lockfile = __commonJS({
+  "node_modules/proper-lockfile/lib/lockfile.js"(exports, module2) {
     "use strict";
-    init_runtimeSigners();
-    init_runtimeSigners();
+    var path = __require("path");
+    var fs3 = require_graceful_fs();
+    var retry = require_retry2();
+    var onExit = require_signal_exit();
+    var mtimePrecision = require_mtime_precision();
+    var locks = {};
+    function getLockFile(file, options) {
+      return options.lockfilePath || `${file}.lock`;
+    }
+    function resolveCanonicalPath(file, options, callback) {
+      if (!options.realpath) {
+        return callback(null, path.resolve(file));
+      }
+      options.fs.realpath(file, callback);
+    }
+    function acquireLock(file, options, callback) {
+      const lockfilePath = getLockFile(file, options);
+      options.fs.mkdir(lockfilePath, (err2) => {
+        if (!err2) {
+          return mtimePrecision.probe(lockfilePath, options.fs, (err3, mtime, mtimePrecision2) => {
+            if (err3) {
+              options.fs.rmdir(lockfilePath, () => {
+              });
+              return callback(err3);
+            }
+            callback(null, mtime, mtimePrecision2);
+          });
+        }
+        if (err2.code !== "EEXIST") {
+          return callback(err2);
+        }
+        if (options.stale <= 0) {
+          return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
+        }
+        options.fs.stat(lockfilePath, (err3, stat) => {
+          if (err3) {
+            if (err3.code === "ENOENT") {
+              return acquireLock(file, { ...options, stale: 0 }, callback);
+            }
+            return callback(err3);
+          }
+          if (!isLockStale(stat, options)) {
+            return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
+          }
+          removeLock(file, options, (err4) => {
+            if (err4) {
+              return callback(err4);
+            }
+            acquireLock(file, { ...options, stale: 0 }, callback);
+          });
+        });
+      });
+    }
+    function isLockStale(stat, options) {
+      return stat.mtime.getTime() < Date.now() - options.stale;
+    }
+    function removeLock(file, options, callback) {
+      options.fs.rmdir(getLockFile(file, options), (err2) => {
+        if (err2 && err2.code !== "ENOENT") {
+          return callback(err2);
+        }
+        callback();
+      });
+    }
+    function updateLock(file, options) {
+      const lock2 = locks[file];
+      if (lock2.updateTimeout) {
+        return;
+      }
+      lock2.updateDelay = lock2.updateDelay || options.update;
+      lock2.updateTimeout = setTimeout(() => {
+        lock2.updateTimeout = null;
+        options.fs.stat(lock2.lockfilePath, (err2, stat) => {
+          const isOverThreshold = lock2.lastUpdate + options.stale < Date.now();
+          if (err2) {
+            if (err2.code === "ENOENT" || isOverThreshold) {
+              return setLockAsCompromised(file, lock2, Object.assign(err2, { code: "ECOMPROMISED" }));
+            }
+            lock2.updateDelay = 1e3;
+            return updateLock(file, options);
+          }
+          const isMtimeOurs = lock2.mtime.getTime() === stat.mtime.getTime();
+          if (!isMtimeOurs) {
+            return setLockAsCompromised(
+              file,
+              lock2,
+              Object.assign(
+                new Error("Unable to update lock within the stale threshold"),
+                { code: "ECOMPROMISED" }
+              )
+            );
+          }
+          const mtime = mtimePrecision.getMtime(lock2.mtimePrecision);
+          options.fs.utimes(lock2.lockfilePath, mtime, mtime, (err3) => {
+            const isOverThreshold2 = lock2.lastUpdate + options.stale < Date.now();
+            if (lock2.released) {
+              return;
+            }
+            if (err3) {
+              if (err3.code === "ENOENT" || isOverThreshold2) {
+                return setLockAsCompromised(file, lock2, Object.assign(err3, { code: "ECOMPROMISED" }));
+              }
+              lock2.updateDelay = 1e3;
+              return updateLock(file, options);
+            }
+            lock2.mtime = mtime;
+            lock2.lastUpdate = Date.now();
+            lock2.updateDelay = null;
+            updateLock(file, options);
+          });
+        });
+      }, lock2.updateDelay);
+      if (lock2.updateTimeout.unref) {
+        lock2.updateTimeout.unref();
+      }
+    }
+    function setLockAsCompromised(file, lock2, err2) {
+      lock2.released = true;
+      if (lock2.updateTimeout) {
+        clearTimeout(lock2.updateTimeout);
+      }
+      if (locks[file] === lock2) {
+        delete locks[file];
+      }
+      lock2.options.onCompromised(err2);
+    }
+    function lock(file, options, callback) {
+      options = {
+        stale: 1e4,
+        update: null,
+        realpath: true,
+        retries: 0,
+        fs: fs3,
+        onCompromised: (err2) => {
+          throw err2;
+        },
+        ...options
+      };
+      options.retries = options.retries || 0;
+      options.retries = typeof options.retries === "number" ? { retries: options.retries } : options.retries;
+      options.stale = Math.max(options.stale || 0, 2e3);
+      options.update = options.update == null ? options.stale / 2 : options.update || 0;
+      options.update = Math.max(Math.min(options.update, options.stale / 2), 1e3);
+      resolveCanonicalPath(file, options, (err2, file2) => {
+        if (err2) {
+          return callback(err2);
+        }
+        const operation = retry.operation(options.retries);
+        operation.attempt(() => {
+          acquireLock(file2, options, (err3, mtime, mtimePrecision2) => {
+            if (operation.retry(err3)) {
+              return;
+            }
+            if (err3) {
+              return callback(operation.mainError());
+            }
+            const lock2 = locks[file2] = {
+              lockfilePath: getLockFile(file2, options),
+              mtime,
+              mtimePrecision: mtimePrecision2,
+              options,
+              lastUpdate: Date.now()
+            };
+            updateLock(file2, options);
+            callback(null, (releasedCallback) => {
+              if (lock2.released) {
+                return releasedCallback && releasedCallback(Object.assign(new Error("Lock is already released"), { code: "ERELEASED" }));
+              }
+              unlock(file2, { ...options, realpath: false }, releasedCallback);
+            });
+          });
+        });
+      });
+    }
+    function unlock(file, options, callback) {
+      options = {
+        fs: fs3,
+        realpath: true,
+        ...options
+      };
+      resolveCanonicalPath(file, options, (err2, file2) => {
+        if (err2) {
+          return callback(err2);
+        }
+        const lock2 = locks[file2];
+        if (!lock2) {
+          return callback(Object.assign(new Error("Lock is not acquired/owned by you"), { code: "ENOTACQUIRED" }));
+        }
+        lock2.updateTimeout && clearTimeout(lock2.updateTimeout);
+        lock2.released = true;
+        delete locks[file2];
+        removeLock(file2, options, callback);
+      });
+    }
+    function check(file, options, callback) {
+      options = {
+        stale: 1e4,
+        realpath: true,
+        fs: fs3,
+        ...options
+      };
+      options.stale = Math.max(options.stale || 0, 2e3);
+      resolveCanonicalPath(file, options, (err2, file2) => {
+        if (err2) {
+          return callback(err2);
+        }
+        options.fs.stat(getLockFile(file2, options), (err3, stat) => {
+          if (err3) {
+            return err3.code === "ENOENT" ? callback(null, false) : callback(err3);
+          }
+          return callback(null, !isLockStale(stat, options));
+        });
+      });
+    }
+    function getLocks() {
+      return locks;
+    }
+    onExit(() => {
+      for (const file in locks) {
+        const options = locks[file].options;
+        try {
+          options.fs.rmdirSync(getLockFile(file, options));
+        } catch (e) {
+        }
+      }
+    });
+    module2.exports.lock = lock;
+    module2.exports.unlock = unlock;
+    module2.exports.check = check;
+    module2.exports.getLocks = getLocks;
   }
 });
 
-// packages/shared/dist/projectSetupHandoff.js
-var init_projectSetupHandoff = __esm({
-  "packages/shared/dist/projectSetupHandoff.js"() {
+// node_modules/proper-lockfile/lib/adapter.js
+var require_adapter = __commonJS({
+  "node_modules/proper-lockfile/lib/adapter.js"(exports, module2) {
     "use strict";
-    init_runtimeSigners();
-    init_runtimeReader();
+    var fs3 = require_graceful_fs();
+    function createSyncFs(fs4) {
+      const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
+      const newFs = { ...fs4 };
+      methods.forEach((method) => {
+        newFs[method] = (...args2) => {
+          const callback = args2.pop();
+          let ret;
+          try {
+            ret = fs4[`${method}Sync`](...args2);
+          } catch (err2) {
+            return callback(err2);
+          }
+          callback(null, ret);
+        };
+      });
+      return newFs;
+    }
+    function toPromise(method) {
+      return (...args2) => new Promise((resolve3, reject) => {
+        args2.push((err2, result) => {
+          if (err2) {
+            reject(err2);
+          } else {
+            resolve3(result);
+          }
+        });
+        method(...args2);
+      });
+    }
+    function toSync(method) {
+      return (...args2) => {
+        let err2;
+        let result;
+        args2.push((_err, _result) => {
+          err2 = _err;
+          result = _result;
+        });
+        method(...args2);
+        if (err2) {
+          throw err2;
+        }
+        return result;
+      };
+    }
+    function toSyncOptions(options) {
+      options = { ...options };
+      options.fs = createSyncFs(options.fs || fs3);
+      if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
+        throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
+      }
+      return options;
+    }
+    module2.exports = {
+      toPromise,
+      toSync,
+      toSyncOptions
+    };
   }
 });
 
-// packages/shared/dist/hookRuntime.js
-var init_hookRuntime = __esm({
-  "packages/shared/dist/hookRuntime.js"() {
+// node_modules/proper-lockfile/index.js
+var require_proper_lockfile = __commonJS({
+  "node_modules/proper-lockfile/index.js"(exports, module2) {
     "use strict";
-    init_runtimeSigners();
-    init_repositoryRoot();
-    init_runtimeReader();
-    init_runtimeSigners();
-    init_projectSetupHandoff();
+    var lockfile = require_lockfile();
+    var { toPromise, toSync, toSyncOptions } = require_adapter();
+    async function lock(file, options) {
+      const release = await toPromise(lockfile.lock)(file, options);
+      return toPromise(release);
+    }
+    function lockSync(file, options) {
+      const release = toSync(lockfile.lock)(file, toSyncOptions(options));
+      return toSync(release);
+    }
+    function unlock(file, options) {
+      return toPromise(lockfile.unlock)(file, options);
+    }
+    function unlockSync(file, options) {
+      return toSync(lockfile.unlock)(file, toSyncOptions(options));
+    }
+    function check(file, options) {
+      return toPromise(lockfile.check)(file, options);
+    }
+    function checkSync(file, options) {
+      return toSync(lockfile.check)(file, toSyncOptions(options));
+    }
+    module2.exports = lock;
+    module2.exports.lock = lock;
+    module2.exports.unlock = unlock;
+    module2.exports.lockSync = lockSync;
+    module2.exports.unlockSync = unlockSync;
+    module2.exports.check = check;
+    module2.exports.checkSync = checkSync;
   }
 });
 
 // packages/cli/src/router.ts
-import { humanReason, humanReport, humanIdentityState } from "./humanReason.js";
+import {
+  humanReason,
+  humanReport,
+  humanIdentityState,
+  SCANNER_CONSENT_MESSAGE,
+  SCANNER_UPDATE_CONSENT_MESSAGE
+} from "./humanReason.js";
+import { consentDecision, consentLines } from "./consent.js";
 import { helpScreen } from "./help.js";
 import { enableScanner, updateScannerRoots } from "./scanner/enable.js";
-import { controlScanner, scannerReceipt } from "./scanner/control.js";
-import { updateScanner } from "./scanner/update.js";
+import {
+  ABANDONED_PAUSE_RESUMED,
+  controlScanner,
+  pausedForConsent,
+  scannerReceipt
+} from "./scanner/control.js";
+import { ScannerConsentRequired, updateScanner } from "./scanner/update.js";
 import { deleteScannerIndex } from "./scanner/data.js";
 import { devReadiness } from "./runtime/releaseSource.js";
 import {
@@ -2375,8 +4041,8 @@ var Language = class _Language {
     if (input instanceof Uint8Array) {
       binary2 = input;
     } else if (globalThis.process?.versions.node) {
-      const fs2 = await import("fs/promises");
-      binary2 = await fs2.readFile(input);
+      const fs22 = await import("fs/promises");
+      binary2 = await fs22.readFile(input);
     } else {
       const response = await fetch(input);
       if (!response.ok) {
@@ -2478,13 +4144,13 @@ async function Module2(moduleArg = {}) {
       }
       readAsync = /* @__PURE__ */ __name(async (url) => {
         if (isFileURI(url)) {
-          return new Promise((resolve2, reject) => {
+          return new Promise((resolve3, reject) => {
             var xhr = new XMLHttpRequest();
             xhr.open("GET", url, true);
             xhr.responseType = "arraybuffer";
             xhr.onload = () => {
               if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                resolve2(xhr.response);
+                resolve3(xhr.response);
                 return;
               }
               reject(xhr.status);
@@ -2680,9 +4346,9 @@ async function Module2(moduleArg = {}) {
     __name(receiveInstantiationResult, "receiveInstantiationResult");
     var info22 = getWasmImports();
     if (Module["instantiateWasm"]) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         Module["instantiateWasm"](info22, (mod, inst) => {
-          resolve2(receiveInstance(mod, inst));
+          resolve3(receiveInstance(mod, inst));
         });
       });
     }
@@ -4013,8 +5679,8 @@ async function Module2(moduleArg = {}) {
   if (runtimeInitialized) {
     moduleRtn = Module;
   } else {
-    moduleRtn = new Promise((resolve2, reject) => {
-      readyPromiseResolve = resolve2;
+    moduleRtn = new Promise((resolve3, reject) => {
+      readyPromiseResolve = resolve3;
       readyPromiseReject = reject;
     });
   }
@@ -5161,18 +6827,259 @@ function apiOrigin(env = process.env) {
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname3, join as join4, win32, posix } from "node:path";
 init_hookRuntime();
+import { createHash, randomUUID } from "node:crypto";
+import { execFile as nodeExecFile } from "node:child_process";
+import fs2 from "node:fs";
+import { open, rename, readFile as readFile3, mkdir, lstat as lstat3, chmod, writeFile, unlink, rmdir } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname4, join as join5, win32 as win322, posix } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+var lockfileKey = /* @__PURE__ */ Symbol.for("mnemonik.proper-lockfile");
+function sharedLockfile() {
+  const shared = globalThis;
+  return shared[lockfileKey] ??= Promise.resolve().then(() => __toESM(require_proper_lockfile(), 1)).then((module2) => module2.default);
+}
+var codeIs = (error, code) => error.code === code;
 function stateDirectory(platform = process.platform, env = process.env, home = homedir2()) {
   if (env.MNEMONIK_STATE_DIR)
     return env.MNEMONIK_STATE_DIR;
   if (platform === "win32")
-    return win32.join(env.LOCALAPPDATA || win32.join(home, "AppData", "Local"), "Mnemonik");
+    return win322.join(env.LOCALAPPDATA || win322.join(home, "AppData", "Local"), "Mnemonik");
   if (platform === "darwin")
     return posix.join(home, "Library", "Application Support", "Mnemonik");
   return posix.join(env.XDG_STATE_HOME || posix.join(home, ".local", "state"), "mnemonik");
 }
+async function readBytes(path) {
+  try {
+    if (!(await lstat3(path)).isFile())
+      throw new Error("setup_requires_regular_file");
+    return await readFile3(path);
+  } catch (error) {
+    if (codeIs(error, "ENOENT"))
+      return null;
+    throw error;
+  }
+}
+async function syncDirectory(path) {
+  if (process.platform === "win32")
+    return;
+  const fd = await open(path, "r");
+  try {
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+}
+var windowsCurrentAccount = windowsCurrentAccountSync;
+async function windowsCurrentUserAcl(path, directory = false, options = {}, created = false) {
+  const username = options.username ?? `*${windowsCurrentAccount().sid}`;
+  const grant = `${username}:${directory ? "(OI)(CI)F" : "F"}`;
+  const execFile3 = options.execFile ?? nodeExecFile;
+  await new Promise((resolve3, reject) => {
+    execFile3("icacls.exe", [
+      path,
+      "/inheritance:r",
+      "/grant:r",
+      grant,
+      ...created ? ["/remove:g", "*S-1-5-32-544", "*S-1-5-18"] : []
+    ], (error) => {
+      if (error)
+        reject(error);
+      else
+        resolve3();
+    });
+  });
+}
+async function protectStateFile(path, platform = process.platform, aclOptions) {
+  if (platform === "win32")
+    await windowsCurrentUserAcl(path, false, aclOptions);
+  else
+    await chmod(path, 384);
+  return "private";
+}
+async function atomicWrite(path, bytes, fault, assertOwned) {
+  await assertOwned?.();
+  const temp = `${path}.${randomUUID()}.tmp`;
+  const fd = await open(temp, "wx", 384);
+  let permissionStatus;
+  try {
+    permissionStatus = await protectStateFile(temp);
+    const split = Math.ceil(bytes.length / 2);
+    await fd.writeFile(bytes.subarray(0, split));
+    await fault?.("mid_write");
+    await assertOwned?.();
+    await fd.writeFile(bytes.subarray(split));
+    await fd.sync();
+  } finally {
+    await fd.close();
+  }
+  await assertOwned?.();
+  await rename(temp, path);
+  await syncDirectory(dirname4(path));
+  return permissionStatus;
+}
+async function withLock(path, waitMs, work) {
+  const lockfile = await sharedLockfile();
+  await mkdir(dirname4(path), { recursive: true, mode: 448 });
+  const generation = randomUUID();
+  const owner = join5(`${path}.lock`, "owner");
+  let compromised = false;
+  let acquired = false;
+  const assertOwned = async () => {
+    if (compromised || (await readBytes(owner).catch(() => null))?.toString() !== generation) {
+      compromised = true;
+      throw new Error("lock_lost");
+    }
+  };
+  const leaseFs = {
+    ...fs2,
+    mkdir: (dir, callback) => {
+      void mkdir(dir).then(() => writeFile(owner, generation, { mode: 384, flag: "wx" })).then(() => callback(), callback);
+    },
+    rmdir: (dir, callback) => {
+      void unlink(join5(dir, "owner")).catch((error) => {
+        if (!codeIs(error, "ENOENT"))
+          throw error;
+      }).then(() => rmdir(dir)).then(() => callback(), callback);
+    },
+    rmdirSync: (dir) => {
+      try {
+        fs2.unlinkSync(join5(dir, "owner"));
+      } catch (error) {
+        if (!codeIs(error, "ENOENT"))
+          throw error;
+      }
+      fs2.rmdirSync(dir);
+    },
+    stat: (file, callback) => {
+      void (acquired ? assertOwned() : Promise.resolve()).then(() => fs2.stat(file, callback), () => callback(Object.assign(new Error("lock_lost"), { code: "ENOENT" })));
+    }
+  };
+  const deadline = performance.now() + waitMs;
+  let release;
+  while (!release) {
+    try {
+      release = await lockfile.lock(path, {
+        realpath: false,
+        stale: 3e4,
+        update: 5e3,
+        retries: 0,
+        fs: leaseFs,
+        onCompromised: () => {
+          compromised = true;
+        }
+      });
+    } catch (error) {
+      if (!codeIs(error, "ELOCKED"))
+        throw error;
+      if (performance.now() >= deadline)
+        throw new RuntimeError("lock_held");
+      await delay(Math.min(100, Math.max(1, deadline - performance.now())));
+    }
+  }
+  acquired = true;
+  try {
+    return await work(assertOwned);
+  } finally {
+    if (await assertOwned().then(() => true, () => false))
+      await release();
+  }
+}
+
+// packages/local-setup/dist/automaticUpdate.js
+import { spawn as nodeSpawn } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { stat as nodeStat, utimes } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var DAY_MS = 864e5;
+var statePath = (stateDir) => join6(stateDir, "automatic-update.json");
+function cliLauncherPath(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const home = options.home ?? homedir3();
+  return platform === "win32" ? join6(options.env?.LOCALAPPDATA || join6(home, "AppData", "Local"), "Mnemonik", "bin", "mnemonik.cmd") : join6(home, ".local", "bin", "mnemonik");
+}
+async function readState(path) {
+  const bytes = await readBytes(path);
+  if (!bytes)
+    return {};
+  const value = JSON.parse(bytes.toString());
+  if (!value || typeof value !== "object" || value.lastAttempt !== void 0 && (!Number.isFinite(value.lastAttempt) || value.lastAttempt < 0))
+    throw new Error("automatic_update_state_invalid");
+  return value.lastAttempt === void 0 ? {} : { lastAttempt: value.lastAttempt };
+}
+async function maybeStartAutomaticUpdate(options = {}) {
+  const stateDir = options.stateDir ?? stateDirectory(options.platform, options.env, options.home);
+  const path = statePath(stateDir);
+  try {
+    const now = (options.now ?? Date.now)();
+    const stat = options.stat ?? nodeStat;
+    try {
+      if (now - (await stat(path)).mtimeMs < DAY_MS)
+        return false;
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+    if (!options.spawn && !(await stat(cliLauncherPath(options))).isFile())
+      return false;
+    return await withLock(path, 0, async (assertOwned) => {
+      const state = await readState(path);
+      if (state.lastAttempt !== void 0 && now - state.lastAttempt < DAY_MS)
+        return false;
+      await atomicWrite(path, Buffer.from(`${JSON.stringify({ lastAttempt: now })}
+`), void 0, assertOwned);
+      await utimes(path, now / 1e3, now / 1e3);
+      const platform = options.platform ?? process.platform;
+      const launcher = cliLauncherPath(options);
+      const command = platform === "win32" ? {
+        file: options.env?.ComSpec || "cmd.exe",
+        args: ["/d", "/s", "/c", `""${launcher}" update --automatic"`],
+        windowsVerbatimArguments: true
+      } : platform === "linux" && (options.env ?? process.env).INVOCATION_ID ? {
+        // detached creates a process group, not a new systemd cgroup. An
+        // updater spawned by the scanner must survive stopping that service.
+        file: "systemd-run",
+        args: [
+          "--user",
+          "--collect",
+          "--quiet",
+          `--setenv=MNEMONIK_STATE_DIR=${stateDir}`,
+          "--",
+          launcher,
+          "update",
+          "--automatic"
+        ]
+      } : { file: launcher, args: ["update", "--automatic"] };
+      const child = (options.spawn ?? nodeSpawn)(command.file, command.args, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        ..."windowsVerbatimArguments" in command ? { windowsVerbatimArguments: command.windowsVerbatimArguments } : {}
+      });
+      child.once("error", () => {
+      });
+      child.unref();
+      return true;
+    });
+  } catch {
+    return false;
+  }
+}
+var HELPER_FLAG = "--mnemonik-automatic-update";
+function isHelperInvocation() {
+  if (process.argv[2] !== HELPER_FLAG || !process.argv[3] || !process.argv[1])
+    return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath2(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isHelperInvocation())
+  void maybeStartAutomaticUpdate({ stateDir: process.argv[3] });
 
 // packages/local-setup/dist/index.js
 var MAX_ORIGINAL_BYTES = 64 * 1024;
@@ -5251,12 +7158,13 @@ import {
 import { hostOrder, launchHostLabels } from "./install/adapters.js";
 import { readInstallVersions } from "./install/ownership.js";
 import { ensureLauncher, removeLauncher, LauncherError } from "./launcher.js";
-import { readFile as readFile3, realpath } from "node:fs/promises";
+import { readFile as readFile4, realpath } from "node:fs/promises";
 import { createInterface } from "node:readline";
 import { RuntimeStore, updateRuntime } from "./runtime/store.js";
+import { recordUpdateCheck } from "./runtime/updateCheck.js";
 import { updateCli, cliUpdateHint } from "./runtime/selfUpdate.js";
-import { homedir as homedir3 } from "node:os";
-import { join as join5 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { join as join7 } from "node:path";
 import { Output } from "./output.js";
 import { SCANNER_RESTART_MESSAGE } from "./scanner/service.js";
 import { SCANNER_FAILURE_MESSAGE, SCANNER_RETRY_MESSAGE } from "./screens/journey.js";
@@ -5292,6 +7200,8 @@ import {
   mcpTurnOnAction,
   renderStatusSummaries,
   renderRefusals,
+  REPORT_NOT_SENT,
+  renderScannerFailure,
   statusExitCode
 } from "./status.js";
 import { editorAuthorizationRows } from "./screens/journey.js";
@@ -5312,7 +7222,7 @@ var NOTHING_REMOVED_LINE = "Nothing was removed.";
 var SCANNER_UNINSTALL_PROMPT = "Uninstalling background indexing means your code on this machine is no longer\nindexed. Agents here lose code search and file context until you set it up\nagain with mnemonik scanner enable. This also withdraws your indexing consent\nfor this machine. Type yes to continue.";
 var SCANNER_REMOVED_LINE = "Background indexing removed from this machine.";
 async function revokeScannerCredential(deps, output, stateDir, saved) {
-  const state = saved ?? JSON.parse(await readFile3(`${stateDir}/scanner/state.json`, "utf8"));
+  const state = saved ?? JSON.parse(await readFile4(`${stateDir}/scanner/state.json`, "utf8"));
   const bearer = await ensureCliAuth(deps, output, false);
   const response = await (deps.grantFetch ?? fetch)(
     `${apiOrigin()}/api/v1/component-credentials/${encodeURIComponent(state.config.credentialFamilyId)}/revoke`,
@@ -5334,7 +7244,7 @@ async function confirmScannerOptOut(parsed, deps, output) {
 }
 async function uninstallScannerOptOut(deps, output, service, json) {
   const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
-  const saved = await readFile3(`${stateDir}/scanner/state.json`, "utf8").then(
+  const saved = await readFile4(`${stateDir}/scanner/state.json`, "utf8").then(
     (text) => JSON.parse(text),
     (error) => {
       if (error.code === "ENOENT") return void 0;
@@ -5367,10 +7277,48 @@ async function retryUpdateOnce(update, failed = () => false) {
   try {
     const result = await update();
     return failed(result) ? update() : result;
-  } catch {
+  } catch (error) {
+    if (error instanceof ScannerConsentRequired) throw error;
     return update();
   }
 }
+async function approveScannerUpdate(parsed, deps, output, stateDir) {
+  if (parsed.flags.has("automatic") || parsed.flags.has("json") || parsed.flags.has("non-interactive"))
+    return "pending";
+  const saved = JSON.parse(await readFile4(join7(stateDir, "scanner/state.json"), "utf8"));
+  try {
+    const document = await enableScanner({
+      stateDir,
+      cwd: deps.cwd ?? process.cwd(),
+      home: deps.home,
+      input: deps.input ?? process.stdin,
+      output,
+      noBrowser: parsed.flags.has("no-browser"),
+      roots: saved.config.roots,
+      exclusions: saved.config.exclusions ?? [],
+      ...deps.scannerService,
+      ...deps.scannerEnable,
+      projectExecutor: deps.projectExecutor,
+      projectStateDir: deps.projectStateDir
+    });
+    return document.installation.state === "READY" ? "approved" : "pending";
+  } catch {
+    return "pending";
+  }
+}
+function scannerConsentRequired(output, json) {
+  if (json)
+    output.json({
+      status: "ACTION_REQUIRED",
+      reason: "scanner_consent_required",
+      action: "mnemonik scanner enable"
+    });
+  else {
+    output.line(SCANNER_CONSENT_MESSAGE.sentence);
+    output.line(SCANNER_CONSENT_MESSAGE.nextStep);
+  }
+  return 3;
+}
 function hostUpdateFailed(result) {
   return result.results.some(
     (target) => target.status !== "READY" && target.reason !== "codex_trust_pending"
@@ -5395,7 +7343,10 @@ var booleans = /* @__PURE__ */ new Set([
   "verify",
   "dry-run",
   "reopen-install",
-  "automatic"
+  "automatic",
+  "cancel",
+  "retry",
+  "skip"
 ]);
 var values = /* @__PURE__ */ new Set([
   "components",
@@ -5497,19 +7448,24 @@ function allowed(parsed, names) {
   return void 0;
 }
 function actionRequired2(output, json, message, flag) {
+  const decision = flag ? consentDecision(flag) : void 0;
   if (json)
     output.json({
       status: "action_required",
       reason: "consent_required",
       ...flag ? { flag } : {},
-      action: message
+      action: message,
+      ...decision ? { question: decision.question, then: decision.then, answers: decision.answers } : {}
     });
-  else
-    output.error(
-      flag ? `Missing required consent flag: ${flag}` : /^[a-z][a-z0-9_]*$/u.test(message) ? humanReason(message) : message
-    );
+  else if (flag) for (const line of consentLines(flag)) output.error(line);
+  else output.error(/^[a-z][a-z0-9_]*$/u.test(message) ? humanReason(message) : message);
   return 3;
 }
+function retryOnce(flags2) {
+  if (!flags2.has("retry")) return void 0;
+  let retried = false;
+  return async () => retried ? "skip" : (retried = true, "retry");
+}
 function requireConsent(parsed, output, required) {
   for (const flag of required) {
     if (!parsed.flags.has(flag))
@@ -5558,7 +7514,7 @@ async function hostDependencies(deps, output, state) {
   if (!cliAuth.accountEmail) throw new Error("account_identity_failed");
   const email = await cliAuth.accountEmail(bearer);
   const installation = JSON.parse(
-    await readFile3(join5(state, "installation.json"), "utf8").catch(() => "{}")
+    await readFile4(join7(state, "installation.json"), "utf8").catch(() => "{}")
   );
   return {
     stateDir: state,
@@ -5575,7 +7531,7 @@ async function hostDependencies(deps, output, state) {
 async function updateHostDependencies(deps, state) {
   if (deps.hostManagement) return { ...deps.hostManagement, stateDir: state };
   const installation = JSON.parse(
-    await readFile3(join5(state, "installation.json"), "utf8").catch(() => "{}")
+    await readFile4(join7(state, "installation.json"), "utf8").catch(() => "{}")
   );
   return {
     stateDir: state,
@@ -5583,7 +7539,7 @@ async function updateHostDependencies(deps, state) {
   };
 }
 async function packageVersion() {
-  const contents = await readFile3(new URL("../package.json", import.meta.url), "utf8");
+  const contents = await readFile4(new URL("../package.json", import.meta.url), "utf8");
   return JSON.parse(contents).version;
 }
 async function runHostCommand(command, parsed, deps, output, scannerSelected = false) {
@@ -5628,7 +7584,7 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
         component: component2,
         host: name2,
         scope: "user",
-        home: deps.home ?? homedir3(),
+        home: deps.home ?? homedir4(),
         projectRoot: deps.cwd ?? process.cwd()
       }))
     );
@@ -5697,7 +7653,7 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
         noBrowser: parsed.flags.has("no-browser"),
         source: dependencies.source ?? (updatedCli ? (host2) => hostSource(
           host2,
-          join5(updatedCli.directory, "node_modules/@mnemonik/cli/package.json")
+          join7(updatedCli.directory, "node_modules/@mnemonik/cli/package.json")
         ) : void 0),
         instruction: json ? void 0 : (text) => output.line(text),
         apply: parsed.flags.has("apply")
@@ -5708,7 +7664,7 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
     let scanner;
     let launcher;
     let scannerRecovery;
-    if (all && await readFile3(`${state}/scanner/state.json`).then(
+    if (all && await readFile4(`${state}/scanner/state.json`).then(
       () => true,
       () => false
     )) {
@@ -5721,6 +7677,9 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
               ...deps.scannerService,
               onScannerRestartRequested: () => {
                 if (!json) output.line(SCANNER_RESTART_MESSAGE);
+              },
+              onAbandonedPauseResumed: () => {
+                if (!json) output.line(ABANDONED_PAUSE_RESUMED);
               }
             },
             deps.scannerEnable?.source
@@ -5731,8 +7690,14 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
           version: runtime.manifest.version
         };
       } catch (error) {
-        scanner = { status: "FAILED", reason: error.message };
-        if (!json)
+        if (error instanceof ScannerConsentRequired)
+          scanner = await approveScannerUpdate(parsed, deps, output, state) === "approved" ? { status: "UPDATED" } : {
+            status: "ACTION_REQUIRED",
+            reason: "scanner_update_consent_required",
+            action: "mnemonik scanner enable"
+          };
+        else scanner = { status: "FAILED", reason: error.message };
+        if (!json && scanner.status === "FAILED")
           scannerRecovery = await scannerRecoveryAction(error, {
             stateDir: state,
             ...deps.scannerService
@@ -5740,6 +7705,7 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
       }
     }
     let failed = scanner?.status === "FAILED" || cli?.status === "FAILED";
+    const scannerConsentPending = scanner?.status === "ACTION_REQUIRED";
     const hostExit = maintenanceExitCode(result.results);
     const remaining = command === "repair" ? await collectCurrentInstallation(deps, output) : void 0;
     const remainingExit = remaining?.installation.state === "FAILED" ? 1 : remaining?.installation.state === "READY" || !remaining ? 0 : 3;
@@ -5747,10 +7713,15 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
     const codexTrustPending = result.results.some(
       (target) => target.reason === "codex_trust_pending"
     );
+    if (all)
+      await recordUpdateCheck(
+        state,
+        failed || hostsFailed ? "failed" : cli?.status === "UPDATED" || result.reports.length > 0 || scanner?.status === "UPDATED" ? "updated" : "current"
+      );
     if (fullUninstall && hostExit === 0) {
       const installed = await Promise.all(
         [new RuntimeStore(state).pointerPath("scanner"), `${state}/scanner/state.json`].map(
-          (path) => readFile3(path).then(
+          (path) => readFile4(path).then(
             () => true,
             () => false
           )
@@ -5796,15 +7767,15 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
     else if (command === "update") {
       if (failed || hostsFailed) {
         if (cli?.status === "UPDATED") output.line("The mnemonik command updated.");
-        if (result.reports.length > 0 && !hostsFailed) output.line("Your editors updated.");
+        if (result.reports.length > 0 && !hostsFailed) output.line("Your coding tools updated.");
         if (scanner?.status === "UPDATED") output.line("The scanner updated.");
         if (cli?.status === "FAILED") {
           output.error("The mnemonik command could not update.");
           output.error("Run npx -y @mnemonik/cli@latest install to update it.");
         }
         if (hostsFailed) {
-          output.error("Your editors could not update.");
-          output.error("Run mnemonik repair, then start a new session in each editor.");
+          output.error("Your coding tools could not update.");
+          output.error("Run mnemonik repair, then start a new session in each coding tool.");
         }
         if (scanner?.status === "FAILED") {
           output.error(scannerRecovery?.message ?? "The scanner could not update.");
@@ -5817,6 +7788,10 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
       } else if (cli?.status === "UPDATED" || result.reports.length > 0 || scanner?.status === "UPDATED")
         output.line("Mnemonik updated.");
       else output.line("Mnemonik is up to date.");
+      if (scannerConsentPending) {
+        output.line(SCANNER_UPDATE_CONSENT_MESSAGE.sentence);
+        output.line(SCANNER_UPDATE_CONSENT_MESSAGE.nextStep);
+      }
     } else {
       for (const target of result.results)
         output.line(target.status === "READY" ? "Done." : humanReason(target.reason));
@@ -5841,8 +7816,9 @@ async function runHostCommand(command, parsed, deps, output, scannerSelected = f
       }
     }
     if (failed || remainingExit === 1) return 1;
-    return hostExit || remainingExit;
+    return hostExit || remainingExit || (scannerConsentPending && !parsed.flags.has("automatic") ? 3 : 0);
   } catch (error) {
+    if (command === "update" && !host && !component) await recordUpdateCheck(state, "failed");
     if (command === "update" && !json) {
       output.error(updateFailureMessage);
       return error instanceof LauncherError ? 3 : 1;
@@ -5905,6 +7881,7 @@ async function enableCommand(parsed, deps, output) {
       output,
       nonInteractive: parsed.flags.has("non-interactive") || json,
       noBrowser: parsed.flags.has("no-browser"),
+      timeout: retryOnce(parsed.flags),
       ...typeof roots === "string" ? { roots: roots.split(",").filter(Boolean) } : {},
       ...typeof exclusions === "string" ? { exclusions: exclusions.split(",").filter(Boolean) } : {},
       ...deps.scannerService,
@@ -5941,9 +7918,13 @@ async function installCommand(parsed, deps, output) {
     "without-scanner",
     "apply",
     "no-browser",
-    "dry-run"
+    "dry-run",
+    "retry",
+    "skip"
   ]);
   if (invalid) return flagError(output, parsed, invalid);
+  if (parsed.flags.has("retry") && parsed.flags.has("skip"))
+    return flagError(output, parsed, "Unknown flag combination: --retry --skip");
   if (!deps.install && !parsed.flags.has("dry-run")) {
     const { joinedInstall } = await import("./install/journey.js");
     const state = deps.hostManagement?.stateDir ?? deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
@@ -5997,7 +7978,7 @@ async function doctorCommand(parsed, deps, output) {
   const invalid = allowed(parsed, []);
   if (invalid) return flagError(output, parsed, invalid);
   const result = await runPreflight({ cwd: deps.cwd, home: deps.home, ...deps.preflight });
-  output.setContext({ home: deps.home ?? homedir3(), projectRoot: result.project.root });
+  output.setContext({ home: deps.home ?? homedir4(), projectRoot: result.project.root });
   const document = await collectStatusDocument({
     preflight: result,
     cwd: deps.cwd ?? process.cwd(),
@@ -6024,22 +8005,26 @@ async function doctorCommand(parsed, deps, output) {
   else {
     renderPreflight(result, output);
     renderStatusSummaries(document, output, { diagnostics: true });
+    if (document.installation.reasons.some(
+      (reason) => reason === "scanner_failing" || reason === "scanner_signed_out"
+    ))
+      await renderScannerFailure(refusalStateDir(deps), output);
     await renderRefusals(refusalStateDir(deps), output, true);
   }
   await reportCurrentInstallation(deps, output);
   return document.installation.state === "READY" ? 0 : document.installation.state === "FAILED" ? 1 : 3;
 }
-async function collectCurrentInstallation(deps, output) {
+async function collectCurrentInstallation(deps, output, announce) {
   const result = await runPreflight({
     cwd: deps.cwd,
     home: deps.home,
     ...deps.preflight,
     fetch: async () => new Response(null, { status: 204 })
   });
-  output.setContext({ home: deps.home ?? homedir3(), projectRoot: result.project.root });
+  output.setContext({ home: deps.home ?? homedir4(), projectRoot: result.project.root });
   const hostStateDir = deps.hostManagement?.stateDir ?? deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
   const localConditions = deps.projectHookConditions ? [] : [
-    ...await localInstallationConditions(deps.home ?? homedir3(), hostStateDir, deps.launcher),
+    ...await localInstallationConditions(deps.home ?? homedir4(), hostStateDir, deps.launcher),
     // Installed Codex hooks that Codex has not trusted cannot run.
     ...await (deps.codexTrustConditions ?? (() => codexTrustConditions({
       stateDir: hostStateDir,
@@ -6065,7 +8050,14 @@ async function collectCurrentInstallation(deps, output) {
     configuredHosts: deps.configuredHosts ?? deps.install?.input.hosts,
     details: deps.statusDetails,
     generatedAt: deps.statusGeneratedAt,
-    launcher: { ...deps.launcher, stateDir: hostStateDir, home: deps.home }
+    launcher: { ...deps.launcher, stateDir: hostStateDir, home: deps.home },
+    expectedDisclosureVersion: deps.scannerDisclosureVersion,
+    ...announce ? {
+      abandonedPause: {
+        ...deps.scannerService,
+        onAbandonedPauseResumed: () => announce(ABANDONED_PAUSE_RESUMED)
+      }
+    } : {}
   });
   const versions = await readInstallVersions(hostStateDir, document.scanner?.version ?? void 0);
   const installedCli = await new RuntimeStore(hostStateDir).verifyRuntime("cli").catch(() => void 0);
@@ -6073,21 +8065,33 @@ async function collectCurrentInstallation(deps, output) {
   return { ...document, versions };
 }
 async function reportCurrentInstallation(deps, output, document) {
-  const bearer = await auth(deps, output, false).getCliBearer().catch(() => void 0);
-  if (typeof bearer !== "string") return;
+  let refused;
+  const bearer = await auth(deps, output, false).getCliBearer().catch((error) => {
+    if (isCredentialSessionUnavailableError(error)) return { status: "ACTION_REQUIRED" };
+    const reason = error?.reason;
+    if (error?.name === "CredentialError" && typeof reason === "string")
+      refused = reason;
+    return void 0;
+  });
+  if (refused) return { refused };
+  if (typeof bearer !== "string")
+    return bearer?.status === "ACTION_REQUIRED" ? "signed_out" : "failed";
   const send = deps.grantFetch ?? globalThis.fetch;
-  await postCurrentReadiness(
+  return postCurrentReadiness(
     bearer,
     serializeReadiness(document ?? await collectCurrentInstallation(deps, output)),
     (url, options) => send(url, { ...options, signal: AbortSignal.timeout(2500) })
-  ).catch(() => {
-  });
+  ).then(
+    () => "sent",
+    /* An unreachable server says nothing about this machine. */
+    () => "failed"
+  );
 }
 async function deleteProjectCommand(parsed, rest, deps, output) {
   const json = parsed.flags.has("json");
   const cwd = deps.cwd ?? process.cwd();
-  const resolve2 = deps.projectResolver?.resolveProjectIdentity ?? resolveProjectIdentity;
-  const here = await resolve2(cwd, { allowNestedInherit: false });
+  const resolve3 = deps.projectResolver?.resolveProjectIdentity ?? resolveProjectIdentity;
+  const here = await resolve3(cwd, { allowNestedInherit: false });
   const hereId = here.kind === "ok" ? here.identity.projectId : void 0;
   const root = "root" in here ? here.root : cwd;
   const target = rest[0] ?? hereId;
@@ -6154,7 +8158,7 @@ async function deleteProjectCommand(parsed, rest, deps, output) {
   const result = await response.json().catch(() => ({ success: true }));
   const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
   const saved = JSON.parse(
-    await readFile3(`${stateDir}/scanner/state.json`, "utf8").catch(() => "null")
+    await readFile4(`${stateDir}/scanner/state.json`, "utf8").catch(() => "null")
   );
   let stillWatched = false;
   if (hereId === project.id && saved?.config.roots.includes(root)) {
@@ -6186,7 +8190,7 @@ async function runCli(args2, deps = {}) {
   const stdout = silent ? discard : deps.stdout ?? process.stdout;
   const stderr = silent ? discard : deps.stderr ?? process.stderr;
   const output = new Output(stdout, stderr, {
-    home: deps.home ?? homedir3()
+    home: deps.home ?? homedir4()
   });
   const usageError = (positionals, failure = usageReason(
     parsed.positionals,
@@ -6244,9 +8248,11 @@ async function runCli(args2, deps = {}) {
       );
     const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
     const saved = JSON.parse(
-      await readFile3(`${stateDir}/scanner/state.json`, "utf8").catch(() => "null")
+      await readFile4(`${stateDir}/scanner/state.json`, "utf8").catch(() => "null")
     );
     if (!saved) return actionRequired2(output, parsed.flags.has("json"), "mnemonik install");
+    if ((action === "add" || action === "remove") && pausedForConsent(await scannerReceipt(stateDir)))
+      return scannerConsentRequired(output, parsed.flags.has("json"));
     if (action === "list") {
       if (parsed.flags.has("json")) output.json(saved.config.roots);
       else for (const root of saved.config.roots) output.line(root);
@@ -6407,6 +8413,9 @@ async function runCli(args2, deps = {}) {
               ...options,
               onScannerRestartRequested: () => {
                 if (!parsed.flags.has("json")) output.line(SCANNER_RESTART_MESSAGE);
+              },
+              onAbandonedPauseResumed: () => {
+                if (!parsed.flags.has("json")) output.line(ABANDONED_PAUSE_RESUMED);
               }
             },
             deps.scannerEnable?.source
@@ -6432,6 +8441,25 @@ async function runCli(args2, deps = {}) {
         );
       return 0;
     } catch (error) {
+      if (command === "update" && error instanceof ScannerConsentRequired) {
+        const stateDir = deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home);
+        if (await approveScannerUpdate(parsed, deps, output, stateDir) === "approved") {
+          if (parsed.flags.has("json")) output.json({ status: "updated" });
+          else output.line("Mnemonik updated.");
+          return 0;
+        }
+        if (parsed.flags.has("json"))
+          output.json({
+            status: "ACTION_REQUIRED",
+            reason: "scanner_update_consent_required",
+            action: "mnemonik scanner enable"
+          });
+        else {
+          output.line(SCANNER_UPDATE_CONSENT_MESSAGE.sentence);
+          output.line(SCANNER_UPDATE_CONSENT_MESSAGE.nextStep);
+        }
+        return 3;
+      }
       const failure = scannerFailure(error);
       if (command === "uninstall" && parsed.flags.has("json"))
         output.json({
@@ -6556,7 +8584,11 @@ Preview: ${preview.path}
     const invalid = allowed(parsed, []);
     if (invalid || subcommand)
       return invalid ? flagError(output, parsed, invalid) : usageError(["status"]);
-    const document = await collectCurrentInstallation(deps, output);
+    const document = await collectCurrentInstallation(
+      deps,
+      output,
+      parsed.flags.has("json") ? void 0 : (line) => output.line(line)
+    );
     const version = await packageVersion();
     const store = new RuntimeStore(
       deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home)
@@ -6569,7 +8601,12 @@ Preview: ${preview.path}
     if (parsed.flags.has("json"))
       output.json({ ...document, cli: { version, ...hint ? { updateAvailable: hint } : {} } });
     else if (hint) output.line(hint);
-    await reportCurrentInstallation(deps, output, document);
+    const reported = await reportCurrentInstallation(deps, output, document);
+    if (reported === "signed_out" && !parsed.flags.has("json")) {
+      output.line(REPORT_NOT_SENT.sentence);
+      output.line(REPORT_NOT_SENT.nextStep);
+    } else if (typeof reported === "object" && !parsed.flags.has("json"))
+      output.line(humanReason(reported.refused));
     return statusExitCode(document);
   }
   if (command === "connect") {
@@ -6578,7 +8615,7 @@ Preview: ${preview.path}
     if (!subcommand || rest.length || !hostOrder.includes(subcommand))
       return subcommand && !hostOrder.includes(subcommand) ? usageError(["connect"], { reason: "invalid_value", detail: subcommand }) : argumentError(["connect"], ["connect"], [subcommand ?? "", ...rest].filter(Boolean), 1);
     const host = subcommand;
-    const editor = (await localEditorStatus(deps.home ?? homedir3())).find(
+    const editor = (await localEditorStatus(deps.home ?? homedir4())).find(
       (candidate) => candidate.host === host
     );
     if (host === "codex" && editor?.mcp === "ready" && !parsed.flags.has("json")) {
@@ -6611,7 +8648,7 @@ Preview: ${preview.path}
         return 0;
       }
     }
-    const reason = editor?.mcp === "disabled" ? `${editor.name} connection is turned off.` : editor?.mcp === "ready" ? "Finish signing in to Mnemonik in the editor." : `${launchHostLabels[host]} connection is missing.`;
+    const reason = editor?.mcp === "disabled" ? `${editor.name} connection is turned off.` : editor?.mcp === "ready" ? "Finish signing in to Mnemonik in the coding tool." : `${launchHostLabels[host]} connection is missing.`;
     const actions = editor?.mcp === "ready" ? editorAuthorizationRows([host]) : [
       editor?.mcp === "disabled" ? mcpTurnOnAction[host] : "Run mnemonik install to set it up again."
     ];
@@ -6633,7 +8670,7 @@ Preview: ${preview.path}
     }
     const invalid = allowed(
       parsed,
-      subcommand === "ensure" ? ["agent"] : subcommand === "status" ? [] : subcommand === "link" ? ["apply", "non-git", "confirm-mismatch", "replace"] : ["apply", "non-git", "owner"]
+      subcommand === "ensure" ? ["agent"] : subcommand === "status" ? [] : subcommand === "link" ? ["apply", "non-git", "confirm-mismatch", "replace"] : subcommand === "setup" ? ["apply", "non-git", "owner", "cancel"] : ["apply", "non-git", "owner"]
     );
     if (invalid) return flagError(output, parsed, invalid);
     if (subcommand === "ensure") {
@@ -6672,6 +8709,7 @@ Preview: ${preview.path}
         apply: parsed.flags.has("apply"),
         confirmMismatch: parsed.flags.has("confirm-mismatch"),
         replace: parsed.flags.has("replace"),
+        cancel: parsed.flags.has("cancel"),
         owner: typeof parsed.flags.get("owner") === "string" ? parsed.flags.get("owner") : void 0
       },
       {
@@ -6752,9 +8790,11 @@ Preview: ${preview.path}
       );
     const invalid = allowed(
       parsed,
-      subcommand === "enable" ? ["accept-indexing", "apply", "scan-roots", "exclusions", "no-browser"] : subcommand === "export-preview" ? ["out"] : subcommand === "uninstall" ? ["confirm"] : []
+      subcommand === "enable" ? ["accept-indexing", "apply", "scan-roots", "exclusions", "no-browser", "retry", "skip"] : subcommand === "export-preview" ? ["out"] : subcommand === "uninstall" ? ["confirm"] : subcommand === "start" ? ["retry", "skip"] : []
     );
     if (invalid) return flagError(output, parsed, invalid);
+    if (parsed.flags.has("retry") && parsed.flags.has("skip"))
+      return flagError(output, parsed, "Unknown flag combination: --retry --skip");
     if (subcommand === "enable") return enableCommand(parsed, deps, output);
     if (subcommand === "uninstall") {
       const declined = await confirmScannerOptOut(parsed, deps, output);
@@ -6816,7 +8856,7 @@ Preview: ${preview.path}
     const service = scannerService({
       stateDir: deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home),
       waiting: json ? void 0 : (phase, ms) => output.line(`Waiting for scanner ${phase} (up to ${ms / 1e3} seconds).`),
-      timeout: json || parsed.flags.has("non-interactive") ? void 0 : async (phase) => (await chooseHostProfile(deps.input ?? process.stdin, output, [
+      timeout: json || parsed.flags.has("non-interactive") ? retryOnce(parsed.flags) : async (phase) => (await chooseHostProfile(deps.input ?? process.stdin, output, [
         `Retry scanner ${phase}`,
         "Skip scanner"
       ]))?.startsWith("Retry") ? "retry" : "skip",
@@ -6827,6 +8867,8 @@ Preview: ${preview.path}
         stateDir: deps.installStateDir ?? stateDirectory(process.platform, process.env, deps.home),
         ...deps.scannerService
       };
+      if (subcommand === "resume" && pausedForConsent(await scannerReceipt(options.stateDir)))
+        return scannerConsentRequired(output, json);
       if (subcommand === "pause" || subcommand === "resume")
         await controlScanner(subcommand, options);
       else if (subcommand === "export-preview") {