@qoder-ai/qmind-cli 1.1.2 → 2.0.0

package/dist/qmind.js

@@ -3,17 +3,17 @@ import { z } from "zod";
 import { Command, CommanderError, Option } from "commander";
 import { createHash, randomBytes } from "node:crypto";
 import { chmod, copyFile, link, lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
-import { createReadStream, createWriteStream } from "node:fs";
 import { homedir } from "node:os";
-import pLimit from "p-limit";
-import picomatch from "picomatch";
-import open from "open";
+import { basename, dirname, extname, join, relative, resolve, sep } from "node:path";
 import lockfile from "proper-lockfile";
+import open from "open";
+import { createReadStream, createWriteStream } from "node:fs";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createParser } from "eventsource-parser";
 import { Agent, EnvHttpProxyAgent, request } from "undici";
+import pLimit from "p-limit";
+import picomatch from "picomatch";
 import { decodeHTML } from "entities";
 //#region ../sdk/src/errors.ts
 var QMindError = class extends Error {
@@ -47,12 +47,12 @@ const credentialHeaders = /* @__PURE__ */ new Set([
 	"x-csrf-token",
 	"x-xsrf-token"
 ]);
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function nestedRecord(value, key) {
 	const nested = value[key];
-	return isRecord$4(nested) ? nested : void 0;
+	return isRecord$5(nested) ? nested : void 0;
 }
 function firstString(records, keys) {
 	for (const record of records) {
@@ -78,7 +78,7 @@ function errorCodeForStatus$1(status) {
 }
 function httpError(access, operation, profile, response) {
 	const body = profile.unwrapError(response.body);
-	const root = isRecord$4(body) ? body : void 0;
+	const root = isRecord$5(body) ? body : void 0;
 	const records = [
 		root,
 		root === void 0 ? void 0 : nestedRecord(root, "error"),
@@ -106,7 +106,7 @@ function httpError(access, operation, profile, response) {
 	});
 }
 function isAbortLike(cause) {
-	return isRecord$4(cause) && (cause.name === "AbortError" && typeof cause.name === "string" || cause.code === "ABORT_ERR");
+	return isRecord$5(cause) && (cause.name === "AbortError" && typeof cause.name === "string" || cause.code === "ABORT_ERR");
 }
 function transportError(access, operation, request, cause) {
 	if (cause instanceof QMindError) return cause;
@@ -121,7 +121,11 @@ function requestWasAborted(request) {
 	return request.signal?.aborted === true;
 }
 function assertWireRequestInvariant(request) {
-	if (!Number.isFinite(request.timeoutMs ?? 1) || (request.timeoutMs ?? 1) <= 0) throw new QMindError("INVALID_ARGUMENT", "timeoutMs must be a positive finite number", { details: { field: "timeoutMs" } });
+	for (const [field, value] of [
+		["connectTimeoutMs", request.connectTimeoutMs],
+		["idleTimeoutMs", request.idleTimeoutMs],
+		["timeoutMs", request.timeoutMs]
+	]) if (!Number.isFinite(value ?? 1) || (value ?? 1) <= 0) throw new QMindError("INVALID_ARGUMENT", `${field} must be a positive finite number`, { details: { field } });
 	if (request.destination.kind === "host") {
 		if (!request.destination.path.startsWith("/") || request.destination.path.startsWith("//")) throw new QMindError("HOST_POLICY_ERROR", "host destination must be a root-relative path", { details: { destination: request.destination.kind } });
 		return;
@@ -307,6 +311,10 @@ function normalizeQMindTaskRunStatus(status) {
 }
 //#endregion
 //#region ../sdk/src/schemas.ts
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const wirePageNumberSchema = z.number().int().nonnegative().optional();
 const timestampSchema = z.union([z.string(), z.object({
 	nanos: z.number().int().optional(),
 	seconds: z.union([z.number(), z.string()])
@@ -347,26 +355,39 @@ const notebookSchema = z.object({
 	userId: z.string().default("")
 });
 const notebookListSchema = z.object({
-	currentPage: z.number().int().positive().optional(),
-	notebooks: z.array(notebookSchema),
-	pageSize: z.number().int().positive().optional(),
+	currentPage: wirePageNumberSchema,
+	notebooks: z.array(notebookSchema).nullish().transform((notebooks) => notebooks ?? []),
+	pageSize: wirePageNumberSchema,
 	totalSize: z.number().int().nonnegative().default(0)
 });
-const wikiDocumentSchema = z.object({
+const wikiDocumentSchema = z.preprocess((value) => isRecord$4(value) ? {
+	...value,
+	contentHash: value.contentHash ?? value.content_hash,
+	contentUrl: value.contentUrl ?? value.content_url
+} : value, z.object({
 	contentHash: z.string().default(""),
 	contentUrl: z.string().min(1),
 	language: z.string().default("")
-});
-const wikiBranchSchema = z.object({
+}));
+const wikiBranchSchema = z.preprocess((value) => isRecord$4(value) ? {
+	...value,
+	commitTimestamp: value.commitTimestamp ?? value.commit_timestamp,
+	knowledgeCount: value.knowledgeCount ?? value.knowledge_count,
+	repoUrl: value.repoUrl ?? value.repo_url,
+	resultVersion: value.resultVersion ?? value.result_version,
+	updatedAt: value.updatedAt ?? value.updated_at
+} : value, z.object({
 	branch: z.string().min(1),
 	commitTimestamp: z.number().optional(),
-	documents: z.array(wikiDocumentSchema).default([]),
+	documents: z.array(wikiDocumentSchema).nullish().transform((documents) => documents ?? []),
+	exists: z.boolean().optional(),
 	knowledgeCount: z.number().int().nonnegative().default(0),
 	repo: z.string().min(1),
 	repoUrl: z.string().optional(),
-	resultVersion: z.string().default("")
-});
-const wikiBranchListSchema = z.object({ branches: z.array(wikiBranchSchema) });
+	resultVersion: z.string().default(""),
+	updatedAt: timestampSchema.optional()
+}));
+const wikiBranchListSchema = z.object({ branches: z.array(wikiBranchSchema).nullish().transform((branches) => branches ?? []) });
 const cardLinkSchema = z.object({
 	description: z.string().optional(),
 	linkType: z.string().default(""),
@@ -374,6 +395,7 @@ const cardLinkSchema = z.object({
 	targetTitle: z.string().optional()
 });
 const cardSchema = z.object({
+	branch: z.string().optional(),
 	cardType: z.string().optional(),
 	category: z.string().optional(),
 	content: z.string().default(""),
@@ -382,6 +404,7 @@ const cardSchema = z.object({
 	id: z.string().min(1),
 	keywords: z.array(z.string()).default([]),
 	knowledgeId: z.string().optional(),
+	language: z.string().optional(),
 	links: z.array(cardLinkSchema).default([]),
 	notebookId: z.string().optional(),
 	orgId: z.string().optional(),
@@ -391,35 +414,58 @@ const cardSchema = z.object({
 	title: z.string().default(""),
 	updatedAt: timestampSchema.optional()
 });
+const cardCategoryCountSchema = z.object({
+	category: z.string(),
+	count: z.number().int().nonnegative()
+});
+const cardLanguageCountSchema = z.object({
+	count: z.number().int().nonnegative(),
+	language: z.string()
+});
+const cardAppliedFiltersSchema = z.object({
+	branch: z.string().optional(),
+	category: z.string().optional(),
+	language: z.string().optional(),
+	query: z.string().optional(),
+	repo: z.string().optional(),
+	source: z.string().optional()
+});
 const cardListSchema = z.object({
+	appliedFilters: cardAppliedFiltersSchema.optional(),
 	cards: z.array(cardSchema).nullish().transform((cards) => cards ?? []),
-	currentPage: z.number().int().positive().optional(),
-	pageSize: z.number().int().positive().optional(),
+	categoryCounts: z.array(cardCategoryCountSchema).nullish().transform((counts) => counts ?? []),
+	currentPage: wirePageNumberSchema,
+	languageCounts: z.array(cardLanguageCountSchema).nullish().transform((counts) => counts ?? []),
+	pageSize: wirePageNumberSchema,
 	totalSize: z.number().int().nonnegative().default(0)
 });
 const sourcePageInfoSchema = z.object({
-	currentPage: z.number().int().positive().optional(),
-	lastPage: z.number().int().positive().optional(),
-	nextPage: z.number().int().positive().optional(),
+	currentPage: wirePageNumberSchema,
+	lastPage: wirePageNumberSchema,
+	nextPage: wirePageNumberSchema,
 	nextToken: z.string().optional(),
-	pageSize: z.number().int().positive().optional(),
-	prevPage: z.number().int().positive().optional(),
+	pageSize: wirePageNumberSchema,
+	prevPage: wirePageNumberSchema,
 	totalSize: z.number().int().nonnegative().optional()
 });
 const sourceSchema = z.object({
 	childrenCount: z.number().int().nonnegative().optional(),
 	createdAt: timestampSchema.optional(),
 	errorMessage: z.string().default(""),
+	filename: z.string().optional(),
 	hasChildren: z.boolean().optional(),
 	id: z.string().min(1),
 	isDir: z.boolean().default(false),
 	metadata: z.record(z.string(), z.unknown()).nullable().optional(),
+	mimeType: z.string().optional(),
+	name: z.string().optional(),
 	notebookId: z.string().default(""),
 	orgId: z.string().default(""),
 	originUrl: z.string().optional(),
 	parentSourceId: z.string().default(""),
 	path: z.string().default(""),
 	sourceType: z.string().default(""),
+	size: z.number().int().nonnegative().optional(),
 	status: z.string().default(""),
 	title: z.string().default(""),
 	updatedAt: timestampSchema.optional(),
@@ -427,10 +473,10 @@ const sourceSchema = z.object({
 	userId: z.string().default("")
 });
 const sourceListSchema = z.object({
-	currentPage: z.number().int().positive().optional(),
-	pageSize: z.number().int().positive().optional(),
+	currentPage: wirePageNumberSchema,
+	pageSize: wirePageNumberSchema,
 	pages: sourcePageInfoSchema.optional(),
-	sources: z.array(sourceSchema),
+	sources: z.array(sourceSchema).nullish().transform((sources) => sources ?? []),
 	totalSize: z.number().int().nonnegative().optional()
 });
 const sourceTreeNodeSchema = z.lazy(() => z.object({
@@ -449,6 +495,7 @@ const sourceTreeSchema = z.object({
 const sourceContentSchema = z.object({
 	content: z.string(),
 	contentType: z.string().default("text/markdown"),
+	size: z.number().int().nonnegative().optional(),
 	sourceId: z.string().default("")
 });
 const sourceImportResultSchema = z.object({
@@ -474,10 +521,39 @@ const imageUrlsSchema = z.object({
 	expiresAt: z.string().optional(),
 	urls: z.record(z.string(), httpsUrlSchema)
 });
+const notebookCitationSchema = z.preprocess((value) => isRecord$4(value) ? {
+	...value,
+	chunkId: value.chunkId ?? value.chunk_id,
+	chunkIndex: value.chunkIndex ?? value.chunk_index,
+	originUrl: value.originUrl ?? value.origin_url,
+	sourceId: value.sourceId ?? value.source_id,
+	sourceTitle: value.sourceTitle ?? value.source_title,
+	sourceUri: value.sourceUri ?? value.source_uri
+} : value, z.object({
+	chunkId: z.string().default(""),
+	chunkIndex: z.number().int().nonnegative().default(0),
+	metadata: z.record(z.string(), z.unknown()).optional(),
+	originUrl: z.string().optional(),
+	snippet: z.string().default(""),
+	sourceId: z.string().default(""),
+	sourceTitle: z.string().default(""),
+	sourceUri: z.string().default("")
+}));
 const chatMessageSchema = z.object({
+	chatSessionId: z.string().optional(),
+	citations: z.array(notebookCitationSchema).nullish().transform((citations) => citations === null ? [] : citations),
 	content: z.string().default(""),
+	createdAt: timestampSchema.optional(),
 	id: z.string().min(1),
-	role: z.string().default("")
+	metadata: z.record(z.string(), z.unknown()).optional(),
+	model: z.string().optional(),
+	notebookId: z.string().optional(),
+	orgId: z.string().optional(),
+	role: z.string().default(""),
+	sceneType: z.string().optional(),
+	sequence: z.number().int().nonnegative().optional(),
+	updatedAt: timestampSchema.optional(),
+	userId: z.string().optional()
 });
 const streamWireEventSchema = z.object({
 	assistantMessage: chatMessageSchema.optional(),
@@ -522,16 +598,6 @@ const chatSessionSchema = z.object({
 	updatedAt: timestampSchema.optional(),
 	userId: z.string().default("")
 });
-const notebookCitationSchema = z.object({
-	chunkId: z.string().default(""),
-	chunkIndex: z.number().int().nonnegative().default(0),
-	metadata: z.record(z.string(), z.unknown()).optional(),
-	originUrl: z.string().optional(),
-	snippet: z.string().default(""),
-	sourceId: z.string().default(""),
-	sourceTitle: z.string().default(""),
-	sourceUri: z.string().default("")
-});
 const notebookContextChunkSchema = z.object({
 	chunkId: z.string().default(""),
 	chunkIndex: z.number().int().nonnegative().default(0),
@@ -586,6 +652,7 @@ const taskRunSchema = z.object({
 	reportMarkdown: z.string().optional(),
 	sceneType: z.string().default(""),
 	scheduledTaskId: z.string().optional(),
+	sourceId: z.string().optional(),
 	startedAt: timestampSchema.optional(),
 	stats: z.record(z.string(), z.unknown()).optional(),
 	status: z.string().default(""),
@@ -598,9 +665,9 @@ const taskRunSchema = z.object({
 	status: normalizeQMindTaskRunStatus(value.status)
 }));
 const taskRunListSchema = z.object({
-	currentPage: z.number().int().positive().optional(),
-	pageSize: z.number().int().positive().optional(),
-	runs: z.array(taskRunSchema).default([]),
+	currentPage: wirePageNumberSchema,
+	pageSize: wirePageNumberSchema,
+	runs: z.array(taskRunSchema).nullish().transform((runs) => runs ?? []),
 	totalSize: z.number().int().nonnegative().default(0)
 });
 //#endregion
@@ -806,6 +873,8 @@ function taskRunBody(input) {
 		config: optionalRecord(input.config, "config"),
 		parentRunId: optionalTrimmedString(input.parentRunId, "parentRunId"),
 		sceneType: requiredString$2(input.sceneType, "sceneType"),
+		settings: optionalRecord(input.settings, "settings"),
+		sourceId: optionalTrimmedString(input.sourceId, "sourceId"),
 		scheduledTaskId: optionalTrimmedString(input.scheduledTaskId, "scheduledTaskId"),
 		trigger: optionalTrimmedString(input.trigger, "trigger")
 	});
@@ -826,6 +895,7 @@ function taskRunListPath(context, notebookId, input = {}) {
 		["scheduled_task_id", optionalTrimmedString(input.scheduledTaskId, "scheduledTaskId")],
 		["parent_run_id", optionalTrimmedString(input.parentRunId, "parentRunId")],
 		["scene_type", optionalTrimmedString(input.sceneType, "sceneType")],
+		["source_id", optionalTrimmedString(input.sourceId, "sourceId")],
 		["trigger", optionalTrimmedString(input.trigger, "trigger")],
 		["status", status],
 		["page", normalizedPage.page],
@@ -853,6 +923,13 @@ function callOptions(options) {
 		...options?.timeoutMs === void 0 ? {} : { timeoutMs: options.timeoutMs }
 	};
 }
+function streamCallOptions(options) {
+	return {
+		...callOptions(options),
+		...options?.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: options.connectTimeoutMs },
+		...options?.idleTimeoutMs === void 0 ? {} : { idleTimeoutMs: options.idleTimeoutMs }
+	};
+}
 function createAgentOperations(context) {
 	const createChatSession = (notebookId, input, options) => {
 		const notebook = requiredString$2(notebookId, "notebookId");
@@ -885,7 +962,7 @@ function createAgentOperations(context) {
 				},
 				idempotent: false,
 				method: "POST",
-				...callOptions(options)
+				...streamCallOptions(options)
 			},
 			transport: context.transport
 		});
@@ -1056,8 +1133,7 @@ function createNotebookOperations(context) {
 					client: context.client,
 					description,
 					settings,
-					title,
-					userId: context.userId.length === 0 ? void 0 : context.userId
+					title
 				}),
 				callOptions: options,
 				capability: "notebooks.write",
@@ -1197,15 +1273,18 @@ function buildSourceTree(sources) {
 function sourceBody(input) {
 	return compactUndefined({
 		isDir: optionalBoolean(input?.isDir, "isDir"),
+		metadata: optionalRecord(input?.metadata, "metadata"),
 		parentSourceId: optionalString$1(input?.parentSourceId, "parentSourceId"),
 		path: optionalString$1(input?.path, "path"),
 		sourceType: optionalTrimmedString(input?.sourceType, "sourceType"),
 		status: optionalTrimmedString(input?.status, "status"),
-		title: requiredString$2(input?.title, "title")
+		title: requiredString$2(input?.title, "title"),
+		uri: optionalString$1(input?.uri, "uri")
 	});
 }
 function sourcePatch(input) {
 	const patch = compactUndefined({
+		content: optionalString$1(input?.content, "content"),
 		errorMessage: optionalString$1(input?.errorMessage, "errorMessage"),
 		isDir: optionalBoolean(input?.isDir, "isDir"),
 		metadata: optionalRecord(input?.metadata, "metadata"),
@@ -1271,6 +1350,7 @@ function createSourceOperations(context) {
 	const readSourcePage = async (notebookId, input = {}, options, operation = "sources.list") => {
 		const notebook = requiredString$2(notebookId, "notebookId");
 		const normalizedPage = pagination$1(input);
+		const isDir = optionalBoolean(input.isDir, "isDir");
 		const view = input.view ?? "list";
 		if (view !== "list" && view !== "children") throw invalidArgument$1("view must be either \"list\" or \"children\"", "view");
 		const parentSourceId = optionalString$1(input.parentSourceId, "parentSourceId");
@@ -1286,6 +1366,7 @@ function createSourceOperations(context) {
 			operation,
 			path: queryPath(context.profile.apiPath("notebooks", notebook, "sources"), [
 				["view", view === "list" ? void 0 : view],
+				["is_dir", isDir === void 0 ? void 0 : String(isDir)],
 				["parent_source_id", parentSourceId],
 				["page", normalizedPage.page],
 				["page_size", normalizedPage.pageSize],
@@ -1703,21 +1784,21 @@ function createTransferOperations(context) {
 //#endregion
 //#region ../sdk/src/capabilities.ts
 const dashboardCapabilities = Object.freeze({
-	botGateway: true,
+	botGateway: false,
 	"cards.read": true,
 	"cards.write": true,
 	chat: true,
-	"featuredNotebooks.read": true,
+	"featuredNotebooks.read": false,
 	"images.presignUpload": false,
 	"images.presignUrls": false,
-	members: true,
+	members: false,
 	"notebooks.filterByClient": false,
 	"notebooks.read": true,
 	"notebooks.write": true,
-	"notes.read": true,
-	"notes.write": true,
+	"notes.read": false,
+	"notes.write": false,
 	retrieval: true,
-	scheduledTasks: true,
+	scheduledTasks: false,
 	"sources.children": true,
 	"sources.importWeb": true,
 	"sources.read": true,
@@ -1734,17 +1815,17 @@ const sashCapabilities = Object.freeze({
 	"cards.read": true,
 	"cards.write": true,
 	chat: true,
-	"featuredNotebooks.read": true,
+	"featuredNotebooks.read": false,
 	"images.presignUpload": true,
 	"images.presignUrls": true,
-	members: true,
+	members: false,
 	"notebooks.filterByClient": true,
 	"notebooks.read": true,
 	"notebooks.write": true,
-	"notes.read": true,
-	"notes.write": true,
+	"notes.read": false,
+	"notes.write": false,
 	retrieval: true,
-	scheduledTasks: true,
+	scheduledTasks: false,
 	"sources.children": false,
 	"sources.importWeb": false,
 	"sources.read": true,
@@ -1958,8 +2039,7 @@ function createQMindClient(options) {
 	const context = {
 		client: optionalTrimmedString(options.client, "client") ?? "qmind",
 		profile,
-		transport: options.transport,
-		userId: optionalTrimmedString(options.userId, "userId") ?? ""
+		transport: options.transport
 	};
 	return Object.freeze({
 		access: profile.access,
@@ -2024,7 +2104,7 @@ function requestsJsonOutput(argv) {
 }
 //#endregion
 //#region src/build-info.ts
-const QMIND_CLI_VERSION = "1.1.2";
+const QMIND_CLI_VERSION = "2.0.0";
 const QMIND_CLI_BUILD_TIME = "development";
 const QMIND_CLI_UPDATE_BASE_URL = typeof __QMIND_CLI_UPDATE_BASE_URL__ === "string" ? __QMIND_CLI_UPDATE_BASE_URL__ : "https://qoder-ide-cn.oss-cn-hangzhou.aliyuncs.com/qmind/cli/";
 function qmindCliPlatform() {
@@ -2034,1562 +2114,1598 @@ function qmindCliArchitecture() {
 	return process.arch === "x64" ? "amd64" : process.arch;
 }
 //#endregion
-//#region src/files.ts
-function safeQMindDownloadName(title, fallback) {
-	const normalized = [...title.normalize("NFKC")].map((character) => {
-		const codePoint = character.codePointAt(0) ?? 0;
-		return codePoint <= 31 || codePoint === 127 ? "_" : character;
-	}).join("").replace(/[\\/]/g, "_").replace(/^\.+$/, "").trim().slice(0, 240);
-	const safe = basename(normalized);
-	if (safe.length > 0 && safe !== "." && safe !== "..") return safe;
-	return basename(fallback.replace(/[\\/]/g, "_")) || "download";
+//#region ../node-host/src/auth.ts
+const responseRecordSchema = z.record(z.string(), z.unknown());
+const personalTokenExchangeSchema = z.object({ token: z.string().min(1) });
+const devicePollSchema = z.object({
+	expires_at: z.string().default(""),
+	refresh_token: z.string().default(""),
+	refresh_token_expires_at: z.string().default(""),
+	token: z.string().min(1)
+});
+const refreshSchema = z.object({
+	device_token: z.string().min(1),
+	expires_at: z.string().default(""),
+	refresh_token: z.string().optional(),
+	refresh_token_expires_at: z.string().optional()
+});
+const POLL_INTERVAL_MS = 2e3;
+const LOGIN_TIMEOUT_MS = 3e5;
+const EXPIRY_SKEW_MS = 3e4;
+function base64Url(bytes) {
+	return Buffer.from(bytes).toString("base64url");
 }
-async function commitQMindTemporaryFile(temporary, path, overwrite) {
-	if (!overwrite) {
-		await link(temporary, path).catch((error) => {
-			if (error.code === "EEXIST") throw new QMindError("CONFLICT", `target already exists: ${path}`);
-			throw error;
-		});
-		await rm(temporary, { force: true });
-		return;
-	}
-	if (process.platform !== "win32") {
-		await rename(temporary, path);
-		return;
-	}
-	const backup = `${path}.${randomBytes(8).toString("hex")}.old`;
-	let backedUp = false;
-	try {
-		try {
-			await rename(path, backup);
-			backedUp = true;
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-		}
-		await rename(temporary, path);
-		if (backedUp) await rm(backup, { force: true });
-	} catch (error) {
-		if (backedUp) await rename(backup, path).catch(() => void 0);
-		throw error;
-	}
+function createPkce() {
+	const verifier = base64Url(randomBytes(32));
+	return {
+		challenge: createHash("sha256").update(verifier).digest("base64url"),
+		nonce: base64Url(randomBytes(16)),
+		verifier
+	};
 }
-/** Atomic write with a no-clobber default. Temporary files are always cleaned. */
-async function atomicQMindWrite(path, content, overwrite = false) {
-	await mkdir(dirname(path), { recursive: true });
-	const temporary = join(dirname(path), `.${basename(path)}.${randomBytes(8).toString("hex")}.tmp`);
-	try {
-		await writeFile(temporary, content, {
-			flag: "wx",
-			mode: 420
-		});
-		await commitQMindTemporaryFile(temporary, path, overwrite);
-	} catch (error) {
-		await rm(temporary, { force: true });
-		throw error;
-	}
+function errorCodeForStatus(status) {
+	if (status === 401 || status === 403) return "AUTH_REQUIRED";
+	if (status === 404) return "NOT_FOUND";
+	if (status === 409) return "CONFLICT";
+	if (status === 429) return "RATE_LIMITED";
+	if (status >= 400 && status < 500) return "INVALID_ARGUMENT";
+	return "REMOTE_ERROR";
 }
-//#endregion
-//#region src/folder-sync.ts
-const QMIND_FOLDER_SYNC_DEFAULT_EXTENSIONS = Object.freeze([
-	".mdx",
-	".md",
-	".pdf",
-	".txt",
-	".docx",
-	".pptx",
-	".png",
-	".jpg",
-	".jpeg",
-	".gif",
-	".svg",
-	".webp"
-]);
-function posix(path) {
-	return path.split(sep).join("/");
+function record$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
-function qmindFolderSyncIndexKey(parentId, title) {
-	return `${parentId}\u0000${title}`;
+function responseString(response, ...keys) {
+	const body = record$1(response.body);
+	const nestedError = record$1(body?.error);
+	for (const source of [body, nestedError]) for (const key of keys) {
+		const value = source?.[key];
+		if (typeof value === "string" && value.length > 0) return value;
+	}
 }
-function normalizeExtensions(values) {
-	return new Set(values.map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0).map((value) => value.startsWith(".") ? value : `.${value}`));
+function header(response, name) {
+	const normalized = name.toLowerCase();
+	for (const [key, value] of Object.entries(response.headers)) if (key.toLowerCase() === normalized && value.length > 0) return value;
 }
-function validateMapping(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new QMindError("INVALID_ARGUMENT", "directory ID mapping must be a JSON object");
-	const result = {};
-	for (const [path, id] of Object.entries(value)) {
-		if (typeof id !== "string" || id.trim().length === 0) throw new QMindError("INVALID_ARGUMENT", "directory ID mapping values must be non-empty strings");
-		result[posix(path)] = id.trim();
+function authResponseError(response, operation) {
+	const requestId = responseString(response, "requestId", "request_id") ?? header(response, "x-request-id");
+	const upstreamCode = responseString(response, "errorCode", "error_code", "code");
+	return new QMindError(errorCodeForStatus(response.status), `${operation} failed`, {
+		details: { operation },
+		...requestId === void 0 ? {} : { requestId },
+		status: response.status,
+		...upstreamCode === void 0 ? {} : { upstreamCode }
+	});
+}
+async function authRequest(transport, method, path, operation, body) {
+	const request = {
+		...body === void 0 ? {} : { body: {
+			kind: "json",
+			value: body
+		} },
+		destination: {
+			kind: "host",
+			path
+		},
+		idempotent: method === "GET",
+		method
+	};
+	let response;
+	try {
+		response = await transport.request(request);
+	} catch (cause) {
+		if (cause instanceof QMindError) throw cause;
+		throw new QMindError("NETWORK_ERROR", `${operation} failed`);
 	}
-	return result;
+	if (response.status < 200 || response.status >= 300) throw authResponseError(response, operation);
+	const parsed = responseRecordSchema.safeParse(response.body);
+	if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", `${operation} returned an invalid response`, {
+		details: { operation },
+		status: response.status
+	});
+	return parsed.data;
 }
-async function sha256(path) {
-	const hash = createHash("sha256");
-	for await (const chunk of createReadStream(path)) hash.update(chunk);
-	return hash.digest("hex");
+function credentialsFromLogin(value, sashOrigin) {
+	return {
+		deviceToken: value.token,
+		expiresAt: value.expires_at,
+		refreshToken: value.refresh_token,
+		refreshTokenExpiresAt: value.refresh_token_expires_at,
+		sashOrigin,
+		savedAt: "",
+		schemaVersion: 2
+	};
 }
-function createNodeQMindFolderSyncFileSystem() {
+function isExpired(timestamp, now, skew = 0) {
+	if (timestamp.length === 0) return false;
+	const value = Date.parse(timestamp);
+	return Number.isFinite(value) && value <= now + skew;
+}
+function aborted(signal) {
+	return signal?.aborted === true ? new QMindError("ABORTED", "QMind authorization was aborted") : void 0;
+}
+function createSystemClock() {
 	return Object.freeze({
-		async isDirectory(path) {
-			return (await stat(path).catch(() => void 0))?.isDirectory() === true;
-		},
-		async readMapping(path) {
-			try {
-				return validateMapping(JSON.parse(await readFile(path, "utf8")));
-			} catch (error) {
-				if (error instanceof QMindError) throw error;
-				throw new QMindError("INVALID_ARGUMENT", `unable to read directory ID mapping: ${path}`);
-			}
-		},
-		async scan(baseDirectory, options) {
-			const directories = [];
-			const files = [];
-			let skipped = 0;
-			const isIgnored = options.ignorePatterns.length === 0 ? () => false : picomatch([...options.ignorePatterns], { dot: true });
-			const visit = async (directory) => {
-				const entries = await readdir(directory, { withFileTypes: true });
-				entries.sort((left, right) => left.name.localeCompare(right.name));
-				for (const entry of entries) {
-					const absolute = join(directory, entry.name);
-					const path = posix(relative(baseDirectory, absolute));
-					if (entry.name.startsWith(".") || isIgnored(path)) {
-						skipped += entry.isFile() ? 1 : 0;
-						continue;
-					}
-					if (entry.isDirectory()) {
-						directories.push(path);
-						await visit(absolute);
-					} else if (entry.isFile()) {
-						if (options.extensions.has(extname(entry.name).toLowerCase())) files.push(path);
-						else skipped += 1;
-					}
+		now: Date.now,
+		sleep(milliseconds, signal) {
+			return new Promise((resolve, reject) => {
+				const alreadyAborted = aborted(signal);
+				if (alreadyAborted !== void 0) {
+					reject(alreadyAborted);
+					return;
 				}
-			};
-			await visit(baseDirectory);
-			directories.sort((left, right) => left.split("/").length - right.split("/").length || left.localeCompare(right));
-			files.sort((left, right) => left.localeCompare(right));
-			return {
-				directories,
-				files,
-				skipped
-			};
-		},
-		sha256,
-		async writeMapping(path, mapping) {
-			await mkdir(dirname(path), { recursive: true });
-			await writeFile(path, `${JSON.stringify(mapping, null, 2)}\n`, { mode: 384 });
+				const onAbort = () => {
+					clearTimeout(timer);
+					reject(new QMindError("ABORTED", "QMind authorization was aborted"));
+				};
+				const timer = setTimeout(() => {
+					signal?.removeEventListener("abort", onAbort);
+					resolve();
+				}, milliseconds);
+				signal?.addEventListener("abort", onAbort, { once: true });
+			});
 		}
 	});
 }
-async function shouldReplaceQMindFolderFile(mode, existing, localPath, fileSystem = createNodeQMindFolderSyncFileSystem()) {
-	if (mode === "skip") return false;
-	if (mode === "overwrite") return true;
-	const metadata = existing.metadata ?? {};
-	const remoteHash = metadata.fileSha256 ?? metadata.rawFileSha256 ?? metadata.sha256;
-	if (typeof remoteHash !== "string" || !/^[a-f0-9]{64}$/i.test(remoteHash)) return true;
-	return (await fileSystem.sha256(localPath)).toLowerCase() !== remoteHash.toLowerCase();
+function createQMindCliAuthManager(options) {
+	let credentials = options.credentials;
+	let explicitToken = options.explicitToken;
+	let token = "";
+	let refreshPromise;
+	const login = async (loginOptions = {}) => {
+		if (options.config.nonInteractive) throw new QMindError("AUTH_REQUIRED", "login requires an interactive terminal");
+		const pkce = createPkce();
+		const browserUrl = new URL("/device/selectAccounts", options.config.dashboardOrigin);
+		browserUrl.searchParams.set("nonce", pkce.nonce);
+		browserUrl.searchParams.set("challenge", pkce.challenge);
+		browserUrl.searchParams.set("challenge_method", "S256");
+		browserUrl.searchParams.set("machine_id", pkce.nonce);
+		if (loginOptions.clientId !== void 0 && loginOptions.clientId.trim().length > 0) browserUrl.searchParams.set("client_id", loginOptions.clientId.trim());
+		options.reporter.info(`Opening browser for authorization. If it does not open, visit:\n${browserUrl.toString()}`);
+		if (loginOptions.openBrowser !== false) try {
+			await options.browser.open(browserUrl.toString());
+		} catch {
+			options.reporter.warn("warning: unable to open a browser; use the authorization URL above");
+		}
+		options.reporter.info("Waiting for authorization (timeout: 5m)...");
+		const deadline = options.clock.now() + LOGIN_TIMEOUT_MS;
+		while (options.clock.now() < deadline) {
+			const abortError = aborted(loginOptions.signal);
+			if (abortError !== void 0) throw abortError;
+			await options.clock.sleep(POLL_INTERVAL_MS, loginOptions.signal);
+			const pollPath = `/api/v1/deviceToken/poll?${new URLSearchParams({
+				challenge_method: "S256",
+				nonce: pkce.nonce,
+				verifier: pkce.verifier
+			}).toString()}`;
+			try {
+				const raw = await authRequest(options.transport, "GET", pollPath, "device authorization polling");
+				const parsed = devicePollSchema.safeParse(raw);
+				if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", "device authorization returned an invalid response");
+				credentials = credentialsFromLogin(parsed.data, options.config.sashOrigin);
+				await options.vault.save(credentials);
+				explicitToken = "";
+				token = credentials.deviceToken;
+				return {
+					expiresAt: credentials.expiresAt,
+					sashOrigin: credentials.sashOrigin
+				};
+			} catch (error) {
+				if (error instanceof QMindError && error.status === 404) continue;
+				throw error;
+			}
+		}
+		throw new QMindError("AUTH_REQUIRED", "authorization timed out after 5m");
+	};
+	const refreshInternal = async (reason) => {
+		if (credentials === void 0 || credentials.refreshToken.length === 0) {
+			token = "";
+			throw new QMindError("AUTH_REQUIRED", `credentials cannot be refreshed after ${reason}`);
+		}
+		if (isExpired(credentials.refreshTokenExpiresAt, options.clock.now())) {
+			await options.vault.deleteIf(credentials);
+			credentials = void 0;
+			token = "";
+			throw new QMindError("AUTH_REQUIRED", "stored refresh credentials have expired");
+		}
+		const raw = await authRequest(options.transport, "POST", "/api/v1/deviceToken/refresh", "credential refresh", { refresh_token: credentials.refreshToken });
+		const parsed = refreshSchema.safeParse(raw);
+		if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", "credential refresh returned an invalid response");
+		const basis = credentials;
+		const legacy = basis.schemaVersion !== 2;
+		const refreshed = {
+			...basis,
+			deviceToken: parsed.data.device_token,
+			expiresAt: parsed.data.expires_at,
+			refreshToken: parsed.data.refresh_token ?? basis.refreshToken,
+			refreshTokenExpiresAt: parsed.data.refresh_token_expires_at ?? basis.refreshTokenExpiresAt,
+			sashOrigin: options.config.sashOrigin,
+			schemaVersion: 2
+		};
+		const current = await options.vault.compareAndSwap(basis, refreshed, { migrateLegacy: legacy }) ? refreshed : await options.vault.load();
+		if (current === void 0) {
+			credentials = void 0;
+			token = "";
+			throw new QMindError("AUTH_REQUIRED", "credentials changed during refresh");
+		}
+		credentials = current;
+		token = current.deviceToken;
+		return token;
+	};
+	const manager = {
+		async getToken() {
+			if (token.length > 0) return token;
+			const candidate = explicitToken || credentials?.deviceToken || "";
+			if (candidate.length === 0) {
+				if (options.config.nonInteractive) throw new QMindError("AUTH_REQUIRED", "no credentials found; run 'qmind login' in an interactive terminal");
+				await login();
+				return token;
+			}
+			if (candidate.startsWith("pt-")) {
+				const raw = await authRequest(options.transport, "POST", "/api/v1/jobToken/exchange", "personal token exchange", { personal_token: candidate });
+				const parsed = personalTokenExchangeSchema.safeParse(raw);
+				if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", "personal token exchange returned an invalid response");
+				token = parsed.data.token;
+				return token;
+			}
+			if (credentials !== void 0 && candidate === credentials.deviceToken && isExpired(credentials.expiresAt, options.clock.now(), EXPIRY_SKEW_MS)) return manager.refreshToken("expired", candidate);
+			token = candidate;
+			return token;
+		},
+		login,
+		async logout() {
+			await options.vault.delete();
+			credentials = void 0;
+			explicitToken = "";
+			token = "";
+			refreshPromise = void 0;
+		},
+		async refreshToken(reason, rejectedToken) {
+			if (rejectedToken !== void 0 && token.length > 0 && token !== rejectedToken) return token;
+			refreshPromise ??= refreshInternal(reason).finally(() => {
+				refreshPromise = void 0;
+			});
+			return await refreshPromise;
+		}
+	};
+	return Object.freeze(manager);
 }
-function retryable(error) {
-	if (!(error instanceof QMindError)) return true;
-	if (error.code === "FILE_TOO_LARGE" || error.code === "INVALID_ARGUMENT" || error.code === "AUTH_REQUIRED" || error.code === "FORBIDDEN") return false;
-	return error.status === void 0 || error.status === 408 || error.status === 429 || error.status >= 500;
+//#endregion
+//#region ../node-host/src/authenticated-transport.ts
+function withBearer(request, token) {
+	return {
+		...request,
+		headers: {
+			...request.headers,
+			authorization: `Bearer ${token}`
+		}
+	};
 }
-async function withUploadRetry(task, sleep) {
-	let lastFailure;
-	for (let attempt = 0; attempt < 3; attempt += 1) try {
-		return await task();
-	} catch (error) {
-		lastFailure = error;
-		if (!retryable(error) || attempt === 2) break;
-		await sleep(250 * 2 ** attempt);
-	}
-	throw lastFailure;
+function createAuthenticatedQMindTransport(transport, auth) {
+	return Object.freeze({
+		async request(request) {
+			if (request.destination.kind === "signed") return await transport.request(request);
+			const token = await auth.getToken();
+			const response = await transport.request(withBearer(request, token));
+			if (response.status !== 401) return response;
+			const refreshed = await auth.refreshToken("unauthorized", token);
+			return await transport.request(withBearer(request, refreshed));
+		},
+		async stream(request) {
+			const token = await auth.getToken();
+			const response = await transport.stream(withBearer(request, token));
+			if (response.kind !== "response" || response.status !== 401) return response;
+			const refreshed = await auth.refreshToken("unauthorized", token);
+			return await transport.stream(withBearer(request, refreshed));
+		}
+	});
 }
-function defaultSleep(milliseconds) {
-	return new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+//#endregion
+//#region ../node-host/src/config.ts
+const fileConfigSchema = z.object({
+	client: z.string().optional(),
+	dashboard_url: z.string().optional(),
+	proxy_from_env: z.boolean().optional(),
+	request_timeout_ms: z.number().int().positive().optional(),
+	sash_url: z.string().optional(),
+	stream_idle_timeout_ms: z.number().int().positive().optional(),
+	tls_ca_file: z.string().optional(),
+	tls_reject_unauthorized: z.boolean().optional(),
+	update_public_key: z.string().optional()
+}).passthrough();
+const PRESETS = Object.freeze({
+	daily: {
+		dashboardOrigin: "https://daily.qoder.ai",
+		sashOrigin: "https://daily-openapi.qoder.sh"
+	},
+	prod: {
+		dashboardOrigin: "https://qoder.com",
+		sashOrigin: "https://openapi.qoder.sh"
+	},
+	test: {
+		dashboardOrigin: "https://test.qoder.ai",
+		sashOrigin: "https://test-openapi.qoder.sh"
+	}
+});
+function invalidConfig(message, field) {
+	return new QMindError("INVALID_ARGUMENT", message, { ...field === void 0 ? {} : { details: { field } } });
 }
-function mappingPath(baseDirectory, cacheDirectory) {
-	const cache = cacheDirectory ?? process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache");
-	const name = createHash("sha1").update(baseDirectory).digest("hex").slice(0, 16);
-	return join(cache, "qmind", "dir-ids", `${name}.json`);
+function normalizeOrigin$1(rawValue, field) {
+	let url;
+	try {
+		url = new URL(rawValue);
+	} catch {
+		throw invalidConfig(`${field} must be a valid HTTP(S) origin`, field);
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0) throw invalidConfig(`${field} must contain only an HTTP(S) scheme and authority`, field);
+	return url.origin;
 }
-function addFailure(stats, field, path) {
-	(stats[field] ??= []).push(path);
+function optionalTrimmed(value) {
+	const trimmed = value?.trim();
+	return trimmed === void 0 || trimmed.length === 0 ? void 0 : trimmed;
 }
-function publicStats(stats) {
-	return Object.freeze({
-		...stats,
-		...stats.failed_dirs === void 0 ? {} : { failed_dirs: Object.freeze(stats.failed_dirs) },
-		...stats.failed_files === void 0 ? {} : { failed_files: Object.freeze(stats.failed_files) },
-		...stats.failed_deletes === void 0 ? {} : { failed_deletes: Object.freeze(stats.failed_deletes) }
-	});
+function parseBoolean(value, field) {
+	const normalized = optionalTrimmed(value)?.toLowerCase();
+	if (normalized === void 0) return void 0;
+	if (normalized === "1" || normalized === "true") return true;
+	if (normalized === "0" || normalized === "false") return false;
+	throw invalidConfig(`${field} must be 1, 0, true, or false`, field);
 }
-async function synchronizeQMindFolder(host, options) {
-	const notebookId = options.notebookId.trim();
-	if (notebookId.length === 0) throw new QMindError("INVALID_ARGUMENT", "notebookId is required");
-	const fileSystem = options.fileSystem ?? createNodeQMindFolderSyncFileSystem();
-	const baseDirectory = resolve(options.baseDirectory);
-	if (!await fileSystem.isDirectory(baseDirectory)) throw new QMindError("INVALID_ARGUMENT", `${baseDirectory} is not a directory`);
-	const mode = options.mode ?? "skip";
-	if (options.skipUpload === true && options.delete === true) throw new QMindError("INVALID_ARGUMENT", "delete cannot be combined with skipUpload because local files would not enter the mirror plan");
-	const requestedConcurrency = options.concurrency ?? 3;
-	if (!Number.isSafeInteger(requestedConcurrency) || requestedConcurrency < 1) throw new QMindError("INVALID_ARGUMENT", "concurrency must be a positive integer");
-	const concurrency = Math.min(10, requestedConcurrency);
-	const diagnostics = [];
-	if (requestedConcurrency > 10) diagnostics.push(`warning: concurrency ${requestedConcurrency} exceeds maximum (10); clamped to 10`);
-	const extensions = normalizeExtensions(options.extensions ?? QMIND_FOLDER_SYNC_DEFAULT_EXTENSIONS);
-	const tree = await fileSystem.scan(baseDirectory, {
-		extensions,
-		ignorePatterns: options.ignorePatterns ?? []
-	});
-	const remote = await host.client.listAllSources(notebookId);
-	const remoteIndex = new Map(remote.map((source) => [qmindFolderSyncIndexKey(source.parentSourceId, source.title), source]));
-	const remoteById = new Map(remote.map((source) => [source.id, source]));
-	const stats = {
-		dirs_created: 0,
-		dirs_reused: 0,
-		dirs_failed: 0,
-		dirs_refresh_failed: 0,
-		files_uploaded: 0,
-		files_skipped: options.skipUpload === true ? 0 : tree.skipped,
-		files_already_exist: 0,
-		files_failed: 0,
-		...options.delete === true ? {
-			delete_failed: 0,
-			dirs_deleted: 0,
-			files_deleted: 0
-		} : {},
-		...options.dryRun === true ? { dry_run: true } : {}
-	};
-	const configuredMapping = options.directoryIdsPath === void 0 ? {} : await fileSystem.readMapping(options.directoryIdsPath);
-	const directoryIds = {};
-	const desiredKeys = /* @__PURE__ */ new Set();
-	for (const directory of tree.directories) {
-		const parentPath = posix(dirname(directory)) === "." ? "" : posix(dirname(directory));
-		const parentId = directoryIds[parentPath] ?? "";
-		if (parentPath.length > 0 && parentId.length === 0) {
-			stats.dirs_failed += 1;
-			addFailure(stats, "failed_dirs", directory);
-			continue;
-		}
-		const title = basename(directory);
-		const key = qmindFolderSyncIndexKey(parentId, title);
-		desiredKeys.add(key);
-		const mappedId = configuredMapping[directory];
-		const mapped = mappedId === void 0 ? void 0 : remoteById.get(mappedId);
-		const existing = mappedId === void 0 || mapped === void 0 ? remoteIndex.get(key) : mapped;
-		if (existing?.isDir === true && existing.parentSourceId === parentId && existing.title === title) {
-			directoryIds[directory] = existing.id;
-			stats.dirs_reused += 1;
-			continue;
-		}
-		if (existing !== void 0) {
-			stats.dirs_failed += 1;
-			addFailure(stats, "failed_dirs", directory);
-			continue;
-		}
-		if (options.dryRun === true) {
-			directoryIds[directory] = `dry-run:${directory}`;
-			stats.dirs_created += 1;
-			continue;
-		}
-		try {
-			const created = await host.client.createDirectory(notebookId, {
-				parentSourceId: parentId,
-				path: title,
-				title
-			});
-			directoryIds[directory] = created.id;
-			remoteIndex.set(key, created);
-			remoteById.set(created.id, created);
-			stats.dirs_created += 1;
-		} catch {
-			stats.dirs_failed += 1;
-			addFailure(stats, "failed_dirs", directory);
-		}
-	}
-	let savedMappingPath;
-	if (options.directoryIdsPath === void 0 && options.dryRun !== true) {
-		savedMappingPath = options.saveDirectoryIdsPath ?? mappingPath(baseDirectory, options.cacheDirectory);
-		await fileSystem.writeMapping(savedMappingPath, directoryIds);
-		diagnostics.push(`directory mapping saved: ${savedMappingPath}`);
-	}
-	if (options.skipUpload !== true) {
-		const limit = pLimit(concurrency);
-		await Promise.all(tree.files.map((file) => limit(async () => {
-			const absolute = join(baseDirectory, file);
-			const parentPath = posix(dirname(file)) === "." ? "" : posix(dirname(file));
-			const parentId = directoryIds[parentPath] ?? "";
-			if (parentPath.length > 0 && parentId.length === 0) {
-				stats.files_failed += 1;
-				addFailure(stats, "failed_files", file);
-				return;
-			}
-			const title = basename(file);
-			const key = qmindFolderSyncIndexKey(parentId, title);
-			desiredKeys.add(key);
-			const existing = remoteIndex.get(key);
-			if (existing?.isDir === true) {
-				stats.files_failed += 1;
-				addFailure(stats, "failed_files", file);
-				return;
-			}
-			if (existing !== void 0 && !await shouldReplaceQMindFolderFile(mode, existing, absolute, fileSystem)) {
-				stats.files_already_exist += 1;
-				return;
-			}
-			if (options.dryRun === true) {
-				stats.files_uploaded += 1;
-				return;
-			}
-			try {
-				const hash = await fileSystem.sha256(absolute);
-				const uploaded = await withUploadRetry(async () => {
-					const binary = await host.createFileSource(absolute);
-					return await host.client.uploadSource(notebookId, binary, {
-						parentSourceId: parentId,
-						path: file,
-						sha256: hash,
-						title
-					});
-				}, options.sleep ?? defaultSleep);
-				if (existing !== void 0) await host.client.deleteSource(notebookId, existing.id);
-				remoteIndex.set(key, uploaded);
-				remoteById.set(uploaded.id, uploaded);
-				stats.files_uploaded += 1;
-			} catch {
-				stats.files_failed += 1;
-				addFailure(stats, "failed_files", file);
-			}
-		})));
+function parsePositiveInteger(value, field) {
+	const normalized = optionalTrimmed(value);
+	if (normalized === void 0) return void 0;
+	const parsed = Number(normalized);
+	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw invalidConfig(`${field} must be a positive safe integer`, field);
+	return parsed;
+}
+function qmindEnvironmentAssignment(line) {
+	const trimmed = line.trim();
+	if (trimmed.length === 0 || trimmed.startsWith("#")) return void 0;
+	const assignment = trimmed.startsWith("export ") ? trimmed.slice(7) : trimmed;
+	const separator = assignment.indexOf("=");
+	if (separator < 1) return void 0;
+	const key = assignment.slice(0, separator).trim();
+	if (!/^QMIND_[A-Z0-9_]+$/.test(key)) return void 0;
+	let value = assignment.slice(separator + 1).trim();
+	if (value.length >= 2 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+	return [key, value];
+}
+async function mergedEnvironment(environment, legacyEnvironmentPath) {
+	const merged = { ...environment };
+	if (legacyEnvironmentPath === false) return merged;
+	let content;
+	try {
+		content = await readFile(legacyEnvironmentPath, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return merged;
+		throw invalidConfig("unable to read the legacy QMind environment file");
 	}
-	if (options.dryRun !== true) for (const [directory, id] of Object.entries(directoryIds)) {
-		if (id.startsWith("dry-run:")) continue;
-		try {
-			await host.client.updateSource(notebookId, id, {
-				isDir: true,
-				title: basename(directory)
-			});
-		} catch {
-			stats.dirs_refresh_failed += 1;
-		}
+	for (const line of content.split(/\r?\n/)) {
+		const parsed = qmindEnvironmentAssignment(line);
+		if (parsed === void 0) continue;
+		const [key, value] = parsed;
+		if (merged[key] === void 0) merged[key] = value;
 	}
-	const preDeleteFailures = stats.files_failed + stats.dirs_failed;
-	if (options.delete === true && preDeleteFailures === 0) {
-		const deletions = remote.filter((source) => !desiredKeys.has(qmindFolderSyncIndexKey(source.parentSourceId, source.title))).sort((left, right) => {
-			if (left.isDir !== right.isDir) return left.isDir ? 1 : -1;
-			return right.path.split("/").length - left.path.split("/").length;
-		});
-		for (const source of deletions) try {
-			if (options.dryRun !== true) await host.client.deleteSource(notebookId, source.id);
-			if (source.isDir) stats.dirs_deleted = (stats.dirs_deleted ?? 0) + 1;
-			else stats.files_deleted = (stats.files_deleted ?? 0) + 1;
-		} catch {
-			stats.delete_failed = (stats.delete_failed ?? 0) + 1;
-			(stats.failed_deletes ??= []).push(source.path || source.title);
-		}
+	return merged;
+}
+async function fileConfiguration(homeDirectory) {
+	try {
+		return fileConfigSchema.parse(JSON.parse(await readFile(join(homeDirectory, "config.json"), "utf8")));
+	} catch (error) {
+		if (error.code === "ENOENT") return {};
+		throw invalidConfig("stored QMind configuration is invalid");
 	}
-	const exitCode = stats.files_failed > 0 || stats.dirs_failed > 0 || stats.dirs_refresh_failed > 0 || (stats.delete_failed ?? 0) > 0 ? 1 : 0;
+}
+function defaultProcessEnvironment() {
+	return process.env;
+}
+async function loadQMindCliConfig(options = {}) {
+	const initialEnvironment = options.environment ?? defaultProcessEnvironment();
+	const baseHome = options.homeDirectory ?? homedir();
+	const environment = await mergedEnvironment(initialEnvironment, options.legacyEnvironmentPath === void 0 ? join(baseHome, ".qmind-env") : options.legacyEnvironmentPath);
+	const configuredHome = optionalTrimmed(environment.QMIND_HOME);
+	const homeDirectory = resolve(options.homeDirectory ?? configuredHome ?? join(baseHome, ".qmind"));
+	const file = await fileConfiguration(homeDirectory);
+	const flags = options.flags ?? {};
+	const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY === true;
+	const presetName = optionalTrimmed(environment.QMIND_ENV) ?? "prod";
+	const preset = PRESETS[presetName] ?? PRESETS.prod;
+	if (!(presetName in PRESETS)) options.reporter?.warn(`warning: unknown QMIND_ENV ${JSON.stringify(presetName)}, falling back to prod`);
+	const sashOrigin = normalizeOrigin$1(optionalTrimmed(flags.sash) ?? optionalTrimmed(environment.QMIND_SASH_URL) ?? optionalTrimmed(file.sash_url) ?? optionalTrimmed(options.credentialSashOrigin) ?? preset.sashOrigin, "sash");
+	const dashboardOrigin = normalizeOrigin$1(optionalTrimmed(flags.dashboard) ?? optionalTrimmed(environment.QMIND_DASHBOARD_URL) ?? optionalTrimmed(file.dashboard_url) ?? preset.dashboardOrigin, "dashboard");
+	const runtime = Object.freeze({
+		client: optionalTrimmed(flags.client) ?? optionalTrimmed(environment.QMIND_CLIENT) ?? optionalTrimmed(file.client) ?? "qmind",
+		dashboardOrigin,
+		homeDirectory,
+		nonInteractive: flags.nonInteractive === true || parseBoolean(environment.QMIND_NON_INTERACTIVE, "QMIND_NON_INTERACTIVE") === true || !stdinIsTTY,
+		sashOrigin,
+		updatePublicKey: optionalTrimmed(environment.QMIND_UPDATE_PUBLIC_KEY) ?? optionalTrimmed(file.update_public_key) ?? ""
+	});
 	return {
-		diagnostics: Object.freeze(diagnostics),
-		exitCode,
-		...savedMappingPath === void 0 ? {} : { mappingPath: savedMappingPath },
-		stats: publicStats(stats)
+		debug: parseBoolean(environment.QMIND_DEBUG, "QMIND_DEBUG") ?? false,
+		environment,
+		proxyFromEnvironment: parseBoolean(environment.QMIND_PROXY_FROM_ENV, "QMIND_PROXY_FROM_ENV") ?? file.proxy_from_env ?? true,
+		requestTimeoutMs: parsePositiveInteger(environment.QMIND_REQUEST_TIMEOUT_MS, "QMIND_REQUEST_TIMEOUT_MS") ?? file.request_timeout_ms ?? 3e4,
+		runtime,
+		streamIdleTimeoutMs: parsePositiveInteger(environment.QMIND_STREAM_IDLE_TIMEOUT_MS, "QMIND_STREAM_IDLE_TIMEOUT_MS") ?? file.stream_idle_timeout_ms ?? 12e4,
+		...(() => {
+			const tlsCaFile = optionalTrimmed(environment.QMIND_TLS_CA_FILE) ?? optionalTrimmed(file.tls_ca_file);
+			return tlsCaFile === void 0 ? {} : { tlsCaFile };
+		})(),
+		tlsRejectUnauthorized: parseBoolean(environment.QMIND_TLS_REJECT_UNAUTHORIZED, "QMIND_TLS_REJECT_UNAUTHORIZED") ?? file.tls_reject_unauthorized ?? true,
+		token: optionalTrimmed(flags.token) ?? optionalTrimmed(environment.QMIND_TOKEN) ?? ""
 	};
 }
 //#endregion
-//#region src/auth.ts
-const responseRecordSchema = z.record(z.string(), z.unknown());
-const personalTokenExchangeSchema = z.object({ token: z.string().min(1) });
-const devicePollSchema = z.object({
+//#region ../node-host/src/credentials.ts
+const serializedCredentialsSchema = z.object({
+	device_token: z.string().default(""),
 	expires_at: z.string().default(""),
 	refresh_token: z.string().default(""),
 	refresh_token_expires_at: z.string().default(""),
-	token: z.string().min(1)
-});
-const refreshSchema = z.object({
-	device_token: z.string().min(1),
-	expires_at: z.string().default(""),
-	refresh_token: z.string().optional(),
-	refresh_token_expires_at: z.string().optional()
-});
-const POLL_INTERVAL_MS = 2e3;
-const LOGIN_TIMEOUT_MS = 3e5;
-const EXPIRY_SKEW_MS = 3e4;
-function base64Url(bytes) {
-	return Buffer.from(bytes).toString("base64url");
-}
-function createPkce() {
-	const verifier = base64Url(randomBytes(32));
-	return {
-		challenge: createHash("sha256").update(verifier).digest("base64url"),
-		nonce: base64Url(randomBytes(16)),
-		verifier
-	};
-}
-function errorCodeForStatus(status) {
-	if (status === 401 || status === 403) return "AUTH_REQUIRED";
-	if (status === 404) return "NOT_FOUND";
-	if (status === 409) return "CONFLICT";
-	if (status === 429) return "RATE_LIMITED";
-	if (status >= 400 && status < 500) return "INVALID_ARGUMENT";
-	return "REMOTE_ERROR";
-}
-function record$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
-}
-function responseString(response, ...keys) {
-	const body = record$1(response.body);
-	const nestedError = record$1(body?.error);
-	for (const source of [body, nestedError]) for (const key of keys) {
-		const value = source?.[key];
-		if (typeof value === "string" && value.length > 0) return value;
-	}
+	sash_url: z.string().default(""),
+	saved_at: z.string().default(""),
+	schema_version: z.number().int().positive().optional()
+}).passthrough();
+function storedCredentialsInvalid() {
+	return new QMindError("AUTH_REQUIRED", "stored QMind credentials are invalid");
 }
-function header(response, name) {
-	const normalized = name.toLowerCase();
-	for (const [key, value] of Object.entries(response.headers)) if (key.toLowerCase() === normalized && value.length > 0) return value;
+function isMissing(error) {
+	return error.code === "ENOENT";
 }
-function authResponseError(response, operation) {
-	const requestId = responseString(response, "requestId", "request_id") ?? header(response, "x-request-id");
-	const upstreamCode = responseString(response, "errorCode", "error_code", "code");
-	return new QMindError(errorCodeForStatus(response.status), `${operation} failed`, {
-		details: { operation },
-		...requestId === void 0 ? {} : { requestId },
-		status: response.status,
-		...upstreamCode === void 0 ? {} : { upstreamCode }
-	});
+function isValidOptionalTimestamp(value) {
+	return value.length === 0 || Number.isFinite(Date.parse(value));
 }
-async function authRequest(transport, method, path, operation, body) {
-	const request = {
-		...body === void 0 ? {} : { body: {
-			kind: "json",
-			value: body
-		} },
-		destination: {
-			kind: "host",
-			path
-		},
-		idempotent: method === "GET",
-		method
-	};
-	let response;
+function normalizeStoredCredentials(value) {
+	let parsed;
 	try {
-		response = await transport.request(request);
-	} catch (cause) {
-		if (cause instanceof QMindError) throw cause;
-		throw new QMindError("NETWORK_ERROR", `${operation} failed`);
+		parsed = serializedCredentialsSchema.parse(value);
+	} catch {
+		throw storedCredentialsInvalid();
 	}
-	if (response.status < 200 || response.status >= 300) throw authResponseError(response, operation);
-	const parsed = responseRecordSchema.safeParse(response.body);
-	if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", `${operation} returned an invalid response`, {
-		details: { operation },
-		status: response.status
-	});
-	return parsed.data;
-}
-function credentialsFromLogin(value, sashOrigin) {
+	if (parsed.schema_version !== void 0 && parsed.schema_version > 2 || parsed.device_token.length === 0 && parsed.refresh_token.length === 0 || !isValidOptionalTimestamp(parsed.expires_at) || !isValidOptionalTimestamp(parsed.refresh_token_expires_at)) throw storedCredentialsInvalid();
 	return {
-		deviceToken: value.token,
-		expiresAt: value.expires_at,
-		refreshToken: value.refresh_token,
-		refreshTokenExpiresAt: value.refresh_token_expires_at,
-		sashOrigin,
-		savedAt: "",
-		schemaVersion: 2
+		deviceToken: parsed.device_token,
+		expiresAt: parsed.expires_at,
+		refreshToken: parsed.refresh_token,
+		refreshTokenExpiresAt: parsed.refresh_token_expires_at,
+		sashOrigin: parsed.sash_url,
+		savedAt: parsed.saved_at,
+		schemaVersion: parsed.schema_version ?? 1
 	};
 }
-function isExpired(timestamp, now, skew = 0) {
-	if (timestamp.length === 0) return false;
-	const value = Date.parse(timestamp);
-	return Number.isFinite(value) && value <= now + skew;
+function serializedCredentials(credentials, now) {
+	return `${JSON.stringify({
+		device_token: credentials.deviceToken,
+		expires_at: credentials.expiresAt,
+		refresh_token: credentials.refreshToken,
+		refresh_token_expires_at: credentials.refreshTokenExpiresAt,
+		sash_url: credentials.sashOrigin,
+		saved_at: new Date(now).toISOString().replace(/\.\d{3}Z$/, "Z"),
+		schema_version: 2
+	}, null, 2)}\n`;
 }
-function aborted(signal) {
-	return signal?.aborted === true ? new QMindError("ABORTED", "QMind authorization was aborted") : void 0;
+function sameCredentials(left, right) {
+	return left !== void 0 && right !== void 0 && left.deviceToken === right.deviceToken && left.expiresAt === right.expiresAt && left.refreshToken === right.refreshToken && left.refreshTokenExpiresAt === right.refreshTokenExpiresAt && left.sashOrigin === right.sashOrigin && left.schemaVersion === right.schemaVersion;
 }
-function createSystemClock() {
-	return Object.freeze({
-		now: Date.now,
-		sleep(milliseconds, signal) {
-			return new Promise((resolve, reject) => {
-				const alreadyAborted = aborted(signal);
-				if (alreadyAborted !== void 0) {
-					reject(alreadyAborted);
-					return;
-				}
-				const onAbort = () => {
-					clearTimeout(timer);
-					reject(new QMindError("ABORTED", "QMind authorization was aborted"));
-				};
-				const timer = setTimeout(() => {
-					signal?.removeEventListener("abort", onAbort);
-					resolve();
-				}, milliseconds);
-				signal?.addEventListener("abort", onAbort, { once: true });
-			});
-		}
+async function secureDirectory(path) {
+	await mkdir(path, {
+		mode: 448,
+		recursive: true
 	});
+	const info = await lstat(path);
+	if (!info.isDirectory() || info.isSymbolicLink()) throw storedCredentialsInvalid();
+	if (process.platform !== "win32") await chmod(path, 448);
 }
-function createQMindCliAuthManager(options) {
-	let credentials = options.credentials;
-	let explicitToken = options.explicitToken;
-	let token = "";
-	let refreshPromise;
-	const login = async (loginOptions = {}) => {
-		if (options.config.nonInteractive) throw new QMindError("AUTH_REQUIRED", "login requires an interactive terminal");
-		const pkce = createPkce();
-		const browserUrl = new URL("/device/selectAccounts", options.config.dashboardOrigin);
-		browserUrl.searchParams.set("nonce", pkce.nonce);
-		browserUrl.searchParams.set("challenge", pkce.challenge);
-		browserUrl.searchParams.set("challenge_method", "S256");
-		browserUrl.searchParams.set("machine_id", pkce.nonce);
-		if (loginOptions.clientId !== void 0 && loginOptions.clientId.trim().length > 0) browserUrl.searchParams.set("client_id", loginOptions.clientId.trim());
-		options.reporter.info(`Opening browser for authorization. If it does not open, visit:\n${browserUrl.toString()}`);
-		if (loginOptions.openBrowser !== false) try {
-			await options.browser.open(browserUrl.toString());
-		} catch {
-			options.reporter.warn("warning: unable to open a browser; use the authorization URL above");
-		}
-		options.reporter.info("Waiting for authorization (timeout: 5m)...");
-		const deadline = options.clock.now() + LOGIN_TIMEOUT_MS;
-		while (options.clock.now() < deadline) {
-			const abortError = aborted(loginOptions.signal);
-			if (abortError !== void 0) throw abortError;
-			await options.clock.sleep(POLL_INTERVAL_MS, loginOptions.signal);
-			const pollPath = `/api/v1/deviceToken/poll?${new URLSearchParams({
-				challenge_method: "S256",
-				nonce: pkce.nonce,
-				verifier: pkce.verifier
-			}).toString()}`;
-			try {
-				const raw = await authRequest(options.transport, "GET", pollPath, "device authorization polling");
-				const parsed = devicePollSchema.safeParse(raw);
-				if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", "device authorization returned an invalid response");
-				credentials = credentialsFromLogin(parsed.data, options.config.sashOrigin);
-				await options.vault.save(credentials);
-				explicitToken = "";
-				token = credentials.deviceToken;
-				return {
-					expiresAt: credentials.expiresAt,
-					sashOrigin: credentials.sashOrigin
-				};
-			} catch (error) {
-				if (error instanceof QMindError && error.status === 404) continue;
-				throw error;
-			}
+async function secureRegularFile(path) {
+	const info = await lstat(path);
+	if (!info.isFile() || info.isSymbolicLink()) throw storedCredentialsInvalid();
+	if (process.platform !== "win32" && (info.mode & 63) !== 0) await chmod(path, 384);
+}
+async function replaceFileAtomically(tempPath, targetPath) {
+	try {
+		await rename(tempPath, targetPath);
+		return;
+	} catch (error) {
+		if (process.platform !== "win32") throw error;
+	}
+	const backupPath = `${targetPath}.${randomBytes(6).toString("hex")}.old`;
+	let backedUp = false;
+	try {
+		try {
+			await rename(targetPath, backupPath);
+			backedUp = true;
+		} catch (error) {
+			if (!isMissing(error)) throw error;
 		}
-		throw new QMindError("AUTH_REQUIRED", "authorization timed out after 5m");
+		await rename(tempPath, targetPath);
+		if (backedUp) await rm(backupPath, { force: true });
+	} catch (error) {
+		if (backedUp) await rename(backupPath, targetPath).catch(() => void 0);
+		throw error;
+	}
+}
+async function optionalSecret(operation, fallback) {
+	try {
+		return await operation();
+	} catch {
+		return fallback;
+	}
+}
+function createOptionalKeyringSecretStore() {
+	const entry = async () => {
+		const { Entry } = await import("@napi-rs/keyring");
+		return new Entry("qmind-cli", "device-token");
 	};
-	const refreshInternal = async (reason) => {
-		if (credentials === void 0 || credentials.refreshToken.length === 0) {
-			token = "";
-			throw new QMindError("AUTH_REQUIRED", `credentials cannot be refreshed after ${reason}`);
+	return Object.freeze({
+		async delete() {
+			await optionalSecret(async () => void (await entry()).deletePassword(), void 0);
+		},
+		async get() {
+			return await optionalSecret(async () => (await entry()).getPassword() ?? void 0, void 0);
+		},
+		async set(token) {
+			await optionalSecret(async () => void (await entry()).setPassword(token), void 0);
 		}
-		if (isExpired(credentials.refreshTokenExpiresAt, options.clock.now())) {
-			await options.vault.delete();
-			credentials = void 0;
-			token = "";
-			throw new QMindError("AUTH_REQUIRED", "stored refresh credentials have expired");
+	});
+}
+function createFileCredentialVault(options) {
+	const credentialsPath = join(options.homeDirectory, "credentials.json");
+	const legacyBackupPath = `${credentialsPath}.v1.bak`;
+	const secretStore = options.secretStore ?? createOptionalKeyringSecretStore();
+	const now = options.now ?? Date.now;
+	const loadUnlocked = async () => {
+		let serialized;
+		try {
+			await secureRegularFile(credentialsPath);
+			serialized = JSON.parse(await readFile(credentialsPath, "utf8"));
+		} catch (error) {
+			if (isMissing(error)) return void 0;
+			if (error instanceof QMindError) throw error;
+			throw storedCredentialsInvalid();
 		}
-		const raw = await authRequest(options.transport, "POST", "/api/v1/deviceToken/refresh", "credential refresh", { refresh_token: credentials.refreshToken });
-		const parsed = refreshSchema.safeParse(raw);
-		if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", "credential refresh returned an invalid response");
-		const legacy = credentials.schemaVersion !== 2;
-		const refreshed = {
+		const credentials = normalizeStoredCredentials(serialized);
+		const keychainToken = await optionalSecret(() => secretStore.get(), void 0);
+		return keychainToken === void 0 || keychainToken.length === 0 ? credentials : {
 			...credentials,
-			deviceToken: parsed.data.device_token,
-			expiresAt: parsed.data.expires_at,
-			refreshToken: parsed.data.refresh_token ?? credentials.refreshToken,
-			refreshTokenExpiresAt: parsed.data.refresh_token_expires_at ?? credentials.refreshTokenExpiresAt,
-			sashOrigin: options.config.sashOrigin,
-			schemaVersion: 2
+			deviceToken: keychainToken
 		};
-		await options.vault.save(refreshed, { migrateLegacy: legacy });
-		credentials = refreshed;
-		token = refreshed.deviceToken;
-		return token;
 	};
-	const manager = {
-		async getToken() {
-			if (token.length > 0) return token;
-			const candidate = explicitToken || credentials?.deviceToken || "";
-			if (candidate.length === 0) {
-				if (options.config.nonInteractive) throw new QMindError("AUTH_REQUIRED", "no credentials found; run 'qmind login' in an interactive terminal");
-				await login();
-				return token;
-			}
-			if (candidate.startsWith("pt-")) {
-				const raw = await authRequest(options.transport, "POST", "/api/v1/jobToken/exchange", "personal token exchange", { personal_token: candidate });
-				const parsed = personalTokenExchangeSchema.safeParse(raw);
-				if (!parsed.success) throw new QMindError("PROTOCOL_ERROR", "personal token exchange returned an invalid response");
-				token = parsed.data.token;
-				return token;
+	const withLock = async (operation) => {
+		await secureDirectory(options.homeDirectory);
+		const release = await lockfile.lock(options.homeDirectory, {
+			lockfilePath: join(options.homeDirectory, ".credentials.lock"),
+			realpath: false,
+			retries: {
+				factor: 1.5,
+				maxTimeout: 100,
+				minTimeout: 20,
+				retries: 8
+			},
+			stale: 1e4
+		});
+		try {
+			return await operation();
+		} finally {
+			await release();
+		}
+	};
+	const persist = async (credentials, saveOptions = {}) => {
+		const tempPath = `${credentialsPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+		try {
+			if (saveOptions.migrateLegacy === true) try {
+				await secureRegularFile(credentialsPath);
+				await copyFile(credentialsPath, legacyBackupPath);
+				if (process.platform !== "win32") await chmod(legacyBackupPath, 384);
+			} catch (error) {
+				if (!isMissing(error)) throw error;
 			}
-			if (credentials !== void 0 && candidate === credentials.deviceToken && isExpired(credentials.expiresAt, options.clock.now(), EXPIRY_SKEW_MS)) return manager.refreshToken("expired", candidate);
-			token = candidate;
-			return token;
-		},
-		login,
-		async logout() {
-			await options.vault.delete();
-			credentials = void 0;
-			explicitToken = "";
-			token = "";
-			refreshPromise = void 0;
-		},
-		async refreshToken(reason, rejectedToken) {
-			if (rejectedToken !== void 0 && token.length > 0 && token !== rejectedToken) return token;
-			refreshPromise ??= refreshInternal(reason).finally(() => {
-				refreshPromise = void 0;
+			await writeFile(tempPath, serializedCredentials(credentials, now()), {
+				flag: "wx",
+				mode: 384
 			});
-			return await refreshPromise;
+			if (process.platform !== "win32") await chmod(tempPath, 384);
+			await replaceFileAtomically(tempPath, credentialsPath);
+			if (process.platform !== "win32") await chmod(credentialsPath, 384);
+			await optionalSecret(() => secretStore.set(credentials.deviceToken), void 0);
+		} finally {
+			await rm(tempPath, { force: true });
 		}
 	};
-	return Object.freeze(manager);
-}
-//#endregion
-//#region src/authenticated-transport.ts
-function withBearer(request, token) {
-	return {
-		...request,
-		headers: {
-			...request.headers,
-			authorization: `Bearer ${token}`
-		}
+	const deleteUnlocked = async () => {
+		await Promise.all([rm(credentialsPath, { force: true }), rm(legacyBackupPath, { force: true })]);
+		await optionalSecret(() => secretStore.delete(), void 0);
 	};
-}
-function createAuthenticatedQMindTransport(transport, auth) {
 	return Object.freeze({
-		async request(request) {
-			if (request.destination.kind === "signed") return await transport.request(request);
-			const token = await auth.getToken();
-			const response = await transport.request(withBearer(request, token));
-			if (response.status !== 401) return response;
-			const refreshed = await auth.refreshToken("unauthorized", token);
-			return await transport.request(withBearer(request, refreshed));
+		async compareAndSwap(expected, credentials, saveOptions = {}) {
+			return await withLock(async () => {
+				if (!sameCredentials(await loadUnlocked(), expected)) return false;
+				await persist(credentials, saveOptions);
+				return true;
+			});
 		},
-		async stream(request) {
-			const token = await auth.getToken();
-			const response = await transport.stream(withBearer(request, token));
-			if (response.kind !== "response" || response.status !== 401) return response;
-			const refreshed = await auth.refreshToken("unauthorized", token);
-			return await transport.stream(withBearer(request, refreshed));
+		async delete() {
+			await withLock(deleteUnlocked);
+		},
+		async deleteIf(expected) {
+			return await withLock(async () => {
+				if (!sameCredentials(await loadUnlocked(), expected)) return false;
+				await deleteUnlocked();
+				return true;
+			});
+		},
+		async load() {
+			return await loadUnlocked();
+		},
+		async save(credentials, saveOptions = {}) {
+			await withLock(async () => persist(credentials, saveOptions));
 		}
 	});
 }
 //#endregion
-//#region src/config.ts
-const fileConfigSchema = z.object({
-	client: z.string().optional(),
-	dashboard_url: z.string().optional(),
-	proxy_from_env: z.boolean().optional(),
-	request_timeout_ms: z.number().int().positive().optional(),
-	sash_url: z.string().optional(),
-	stream_idle_timeout_ms: z.number().int().positive().optional(),
-	tls_ca_file: z.string().optional(),
-	tls_reject_unauthorized: z.boolean().optional(),
-	update_public_key: z.string().optional(),
-	user_id: z.string().optional()
-}).passthrough();
-const PRESETS = Object.freeze({
-	daily: {
-		dashboardOrigin: "https://daily.qoder.ai",
-		sashOrigin: "https://daily-openapi.qoder.sh"
-	},
-	prod: {
-		dashboardOrigin: "https://qoder.com",
-		sashOrigin: "https://openapi.qoder.sh"
-	},
-	test: {
-		dashboardOrigin: "https://test.qoder.ai",
-		sashOrigin: "https://test-openapi.qoder.sh"
+//#region ../node-host/src/files.ts
+function safeQMindDownloadName(title, fallback) {
+	const normalized = [...title.normalize("NFKC")].map((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint <= 31 || codePoint === 127 ? "_" : character;
+	}).join("").replace(/[\\/]/g, "_").replace(/^\.+$/, "").trim().slice(0, 240);
+	const safe = basename(normalized);
+	if (safe.length > 0 && safe !== "." && safe !== "..") return safe;
+	return basename(fallback.replace(/[\\/]/g, "_")) || "download";
+}
+async function commitQMindTemporaryFile(temporary, path, overwrite) {
+	if (!overwrite) {
+		await link(temporary, path).catch((error) => {
+			if (error.code === "EEXIST") throw new QMindError("CONFLICT", `target already exists: ${path}`);
+			throw error;
+		});
+		await rm(temporary, { force: true });
+		return;
+	}
+	if (process.platform !== "win32") {
+		await rename(temporary, path);
+		return;
+	}
+	const backup = `${path}.${randomBytes(8).toString("hex")}.old`;
+	let backedUp = false;
+	try {
+		try {
+			await rename(path, backup);
+			backedUp = true;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		await rename(temporary, path);
+		if (backedUp) await rm(backup, { force: true });
+	} catch (error) {
+		if (backedUp) await rename(backup, path).catch(() => void 0);
+		throw error;
+	}
+}
+/** Atomic write with a no-clobber default. Temporary files are always cleaned. */
+async function atomicQMindWrite(path, content, overwrite = false) {
+	await mkdir(dirname(path), { recursive: true });
+	const temporary = join(dirname(path), `.${basename(path)}.${randomBytes(8).toString("hex")}.tmp`);
+	try {
+		await writeFile(temporary, content, {
+			flag: "wx",
+			mode: 420
+		});
+		await commitQMindTemporaryFile(temporary, path, overwrite);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+//#endregion
+//#region ../node-host/src/node-transport.ts
+const RETRYABLE_STATUS = /* @__PURE__ */ new Set([
+	408,
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+const CREDENTIAL_HEADERS = /* @__PURE__ */ new Set([
+	"authorization",
+	"cookie",
+	"proxy-authorization",
+	"x-csrf-token",
+	"x-xsrf-token"
+]);
+const SSE_MAX_BUFFER_SIZE = 8388608;
+function invalidArgument(message, field) {
+	return new QMindError("INVALID_ARGUMENT", message, { details: { field } });
+}
+function positiveInteger(value, fallback, field) {
+	if (value === void 0) return fallback;
+	if (!Number.isSafeInteger(value) || value <= 0) throw invalidArgument(`${field} must be a positive safe integer`, field);
+	return value;
+}
+function nonNegativeInteger(value, fallback, field) {
+	if (value === void 0) return fallback;
+	if (!Number.isSafeInteger(value) || value < 0) throw invalidArgument(`${field} must be a non-negative safe integer`, field);
+	return value;
+}
+function normalizeOrigin(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw invalidArgument("origin must be a valid HTTP(S) origin", "origin");
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0) throw invalidArgument("origin must contain only an HTTP(S) scheme and authority", "origin");
+	return url;
+}
+function environmentValue(environment, ...keys) {
+	for (const key of keys) {
+		const value = environment[key]?.trim();
+		if (value !== void 0 && value.length > 0) return value;
+	}
+}
+function tlsConnectOptions(options, withTls) {
+	const timeout = positiveInteger(options.connectTimeoutMs, 1e4, "connectTimeoutMs");
+	if (!withTls) return { timeout };
+	const ca = options.tls?.ca;
+	return {
+		...ca === void 0 ? {} : { ca: typeof ca === "string" ? ca : [...ca] },
+		rejectUnauthorized: options.tls?.rejectUnauthorized ?? true,
+		timeout
+	};
+}
+function createDispatchers(options) {
+	const environment = options.environment ?? process.env;
+	if (options.proxyFromEnvironment === false) return {
+		host: new Agent({ connect: tlsConnectOptions(options, true) }),
+		signed: new Agent({ connect: tlsConnectOptions(options, true) })
+	};
+	const httpProxy = environmentValue(environment, "HTTP_PROXY", "http_proxy");
+	const httpsProxy = environmentValue(environment, "HTTPS_PROXY", "https_proxy");
+	const noProxy = environmentValue(environment, "NO_PROXY", "no_proxy");
+	if (httpProxy === void 0 && httpsProxy === void 0) return {
+		host: new Agent({ connect: tlsConnectOptions(options, true) }),
+		signed: new Agent({ connect: tlsConnectOptions(options, true) })
+	};
+	const proxy = {
+		httpProxy: httpProxy ?? "",
+		httpsProxy: httpsProxy ?? "",
+		noProxy: noProxy ?? ""
+	};
+	return {
+		host: new EnvHttpProxyAgent({
+			...proxy,
+			requestTls: tlsConnectOptions(options, true)
+		}),
+		signed: new EnvHttpProxyAgent({
+			...proxy,
+			requestTls: tlsConnectOptions(options, true)
+		})
+	};
+}
+function headersToRecord(headers) {
+	const result = {};
+	for (const [name, value] of Object.entries(headers)) {
+		if (value === void 0) continue;
+		result[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
 	}
-});
-function invalidConfig(message, field) {
-	return new QMindError("INVALID_ARGUMENT", message, { ...field === void 0 ? {} : { details: { field } } });
+	return result;
 }
-function normalizeOrigin$1(rawValue, field) {
-	let url;
+function parseRawBody(rawBody) {
+	if (rawBody.trim().length === 0) return void 0;
 	try {
-		url = new URL(rawValue);
+		return JSON.parse(rawBody);
 	} catch {
-		throw invalidConfig(`${field} must be a valid HTTP(S) origin`, field);
+		return rawBody;
 	}
-	if (url.protocol !== "http:" && url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0) throw invalidConfig(`${field} must contain only an HTTP(S) scheme and authority`, field);
-	return url.origin;
 }
-function optionalTrimmed(value) {
-	const trimmed = value?.trim();
-	return trimmed === void 0 || trimmed.length === 0 ? void 0 : trimmed;
+async function wireResponse(response) {
+	const rawBody = await response.body.text();
+	return {
+		body: parseRawBody(rawBody),
+		headers: headersToRecord(response.headers),
+		rawBody,
+		status: response.statusCode
+	};
 }
-function parseBoolean(value, field) {
-	const normalized = optionalTrimmed(value)?.toLowerCase();
-	if (normalized === void 0) return void 0;
-	if (normalized === "1" || normalized === "true") return true;
-	if (normalized === "0" || normalized === "false") return false;
-	throw invalidConfig(`${field} must be 1, 0, true, or false`, field);
+function assertWireRequest(request) {
+	if (request.timeoutMs !== void 0) positiveInteger(request.timeoutMs, request.timeoutMs, "timeoutMs");
+	if (request.destination.kind === "host") {
+		if (!request.destination.path.startsWith("/") || request.destination.path.startsWith("//")) throw new QMindError("HOST_POLICY_ERROR", "host destination must be root-relative");
+		return;
+	}
+	let url;
+	try {
+		url = new URL(request.destination.url);
+	} catch {
+		throw new QMindError("HOST_POLICY_ERROR", "signed destination must be valid HTTPS");
+	}
+	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0) throw new QMindError("HOST_POLICY_ERROR", "signed destination must be credential-free HTTPS");
+	for (const name of Object.keys(request.headers ?? {})) if (CREDENTIAL_HEADERS.has(name.toLowerCase())) throw new QMindError("HOST_POLICY_ERROR", "host credentials cannot reach a signed URL", { details: { header: name.toLowerCase() } });
 }
-function parsePositiveInteger(value, field) {
-	const normalized = optionalTrimmed(value);
-	if (normalized === void 0) return void 0;
-	const parsed = Number(normalized);
-	if (!Number.isSafeInteger(parsed) || parsed <= 0) throw invalidConfig(`${field} must be a positive safe integer`, field);
-	return parsed;
+function sourceFailure(message, source, yieldedBytes) {
+	return new QMindError("HOST_POLICY_ERROR", message, { details: {
+		filename: source.filename,
+		size: source.size,
+		...yieldedBytes === void 0 ? {} : { yieldedBytes }
+	} });
 }
-function qmindEnvironmentAssignment(line) {
-	const trimmed = line.trim();
-	if (trimmed.length === 0 || trimmed.startsWith("#")) return void 0;
-	const assignment = trimmed.startsWith("export ") ? trimmed.slice(7) : trimmed;
-	const separator = assignment.indexOf("=");
-	if (separator < 1) return void 0;
-	const key = assignment.slice(0, separator).trim();
-	if (!/^QMIND_[A-Z0-9_]+$/.test(key)) return void 0;
-	let value = assignment.slice(separator + 1).trim();
-	if (value.length >= 2 && (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
-	return [key, value];
+function assertSource(source) {
+	if (!Number.isSafeInteger(source.size) || source.size <= 0 || typeof source.open !== "function") throw sourceFailure("binary source metadata is invalid", source);
 }
-async function mergedEnvironment(environment, legacyEnvironmentPath) {
-	const merged = { ...environment };
-	if (legacyEnvironmentPath === false) return merged;
-	let content;
-	try {
-		content = await readFile(legacyEnvironmentPath, "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return merged;
-		throw invalidConfig("unable to read the legacy QMind environment file");
-	}
-	for (const line of content.split(/\r?\n/)) {
-		const parsed = qmindEnvironmentAssignment(line);
-		if (parsed === void 0) continue;
-		const [key, value] = parsed;
-		if (merged[key] === void 0) merged[key] = value;
+async function* sourceBytes(source, signal, onProgress) {
+	assertSource(source);
+	let bytes = 0;
+	for await (const chunk of source.open()) {
+		if (signal?.aborted === true) throw signal.reason;
+		if (!(chunk instanceof Uint8Array)) throw sourceFailure("binary source yielded a non-Uint8Array chunk", source, bytes);
+		bytes += chunk.byteLength;
+		if (bytes > source.size) throw sourceFailure("binary source yielded more bytes than declared", source, bytes);
+		yield chunk;
+		onProgress?.(bytes);
 	}
-	return merged;
+	if (bytes !== source.size) throw sourceFailure("binary source yielded fewer bytes than declared", source, bytes);
 }
-async function fileConfiguration(homeDirectory) {
-	try {
-		return fileConfigSchema.parse(JSON.parse(await readFile(join(homeDirectory, "config.json"), "utf8")));
-	} catch (error) {
-		if (error.code === "ENOENT") return {};
-		throw invalidConfig("stored QMind configuration is invalid");
-	}
+function quoteDisposition(value) {
+	return value.replace(/["\r\n]/g, "_");
 }
-function defaultProcessEnvironment() {
-	return process.env;
+function multipartPart(name, value, boundary) {
+	return `--${boundary}\r\nContent-Disposition: form-data; name="${quoteDisposition(name)}"\r\n\r\n${value}\r\n`;
 }
-async function loadQMindCliConfig(options = {}) {
-	const initialEnvironment = options.environment ?? defaultProcessEnvironment();
-	const baseHome = options.homeDirectory ?? homedir();
-	const environment = await mergedEnvironment(initialEnvironment, options.legacyEnvironmentPath === void 0 ? join(baseHome, ".qmind-env") : options.legacyEnvironmentPath);
-	const configuredHome = optionalTrimmed(environment.QMIND_HOME);
-	const homeDirectory = resolve(options.homeDirectory ?? configuredHome ?? join(baseHome, ".qmind"));
-	const file = await fileConfiguration(homeDirectory);
-	const flags = options.flags ?? {};
-	const stdinIsTTY = options.stdinIsTTY ?? process.stdin.isTTY === true;
-	const presetName = optionalTrimmed(environment.QMIND_ENV) ?? "prod";
-	const preset = PRESETS[presetName] ?? PRESETS.prod;
-	if (!(presetName in PRESETS)) options.reporter?.warn(`warning: unknown QMIND_ENV ${JSON.stringify(presetName)}, falling back to prod`);
-	const sashOrigin = normalizeOrigin$1(optionalTrimmed(flags.sash) ?? optionalTrimmed(environment.QMIND_SASH_URL) ?? optionalTrimmed(file.sash_url) ?? optionalTrimmed(options.credentialSashOrigin) ?? preset.sashOrigin, "sash");
-	const dashboardOrigin = normalizeOrigin$1(optionalTrimmed(flags.dashboard) ?? optionalTrimmed(environment.QMIND_DASHBOARD_URL) ?? optionalTrimmed(file.dashboard_url) ?? preset.dashboardOrigin, "dashboard");
-	const runtime = Object.freeze({
-		client: optionalTrimmed(flags.client) ?? optionalTrimmed(environment.QMIND_CLIENT) ?? optionalTrimmed(file.client) ?? "qmind",
-		dashboardOrigin,
-		homeDirectory,
-		nonInteractive: flags.nonInteractive === true || parseBoolean(environment.QMIND_NON_INTERACTIVE, "QMIND_NON_INTERACTIVE") === true || !stdinIsTTY,
-		sashOrigin,
-		updatePublicKey: optionalTrimmed(environment.QMIND_UPDATE_PUBLIC_KEY) ?? optionalTrimmed(file.update_public_key) ?? "",
-		userId: optionalTrimmed(flags.user) ?? optionalTrimmed(environment.QMIND_USER_ID) ?? optionalTrimmed(file.user_id) ?? ""
-	});
+function multipartPreamble(source, boundary) {
+	return `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${quoteDisposition(source.filename)}"\r\nContent-Type: ${source.mimeType}\r\n\r\n`;
+}
+function byteLength(value) {
+	return Buffer.byteLength(value, "utf8");
+}
+function encodeBody(request, boundary) {
+	const initialHeaders = { ...request.headers };
+	const body = request.body;
+	if (body === void 0) return { headers: initialHeaders };
+	if (body.kind === "json") {
+		initialHeaders["content-type"] ??= "application/json";
+		return {
+			body: JSON.stringify(body.value),
+			headers: initialHeaders
+		};
+	}
+	if (body.kind === "binary") {
+		assertSource(body.source);
+		initialHeaders["content-type"] ??= body.source.mimeType;
+		initialHeaders["content-length"] = String(body.source.size);
+		return {
+			body: Readable.from(sourceBytes(body.source, request.signal, body.onProgress)),
+			headers: initialHeaders
+		};
+	}
+	const multipartBody = body;
+	assertSource(multipartBody.file);
+	const fieldParts = Object.entries(multipartBody.fields).map(([name, value]) => multipartPart(name, value, boundary));
+	const preamble = multipartPreamble(multipartBody.file, boundary);
+	const closing = `\r\n--${boundary}--\r\n`;
+	const contentLength = fieldParts.reduce((total, part) => total + byteLength(part), 0) + byteLength(preamble) + multipartBody.file.size + byteLength(closing);
+	async function* multipart() {
+		for (const part of fieldParts) yield Buffer.from(part);
+		yield Buffer.from(preamble);
+		yield* sourceBytes(multipartBody.file, request.signal, multipartBody.onProgress);
+		yield Buffer.from(closing);
+	}
+	initialHeaders["content-type"] = `multipart/form-data; boundary=${boundary}`;
+	initialHeaders["content-length"] = String(contentLength);
 	return {
-		debug: parseBoolean(environment.QMIND_DEBUG, "QMIND_DEBUG") ?? false,
-		environment,
-		proxyFromEnvironment: parseBoolean(environment.QMIND_PROXY_FROM_ENV, "QMIND_PROXY_FROM_ENV") ?? file.proxy_from_env ?? true,
-		requestTimeoutMs: parsePositiveInteger(environment.QMIND_REQUEST_TIMEOUT_MS, "QMIND_REQUEST_TIMEOUT_MS") ?? file.request_timeout_ms ?? 3e4,
-		runtime,
-		streamIdleTimeoutMs: parsePositiveInteger(environment.QMIND_STREAM_IDLE_TIMEOUT_MS, "QMIND_STREAM_IDLE_TIMEOUT_MS") ?? file.stream_idle_timeout_ms ?? 12e4,
-		...(() => {
-			const tlsCaFile = optionalTrimmed(environment.QMIND_TLS_CA_FILE) ?? optionalTrimmed(file.tls_ca_file);
-			return tlsCaFile === void 0 ? {} : { tlsCaFile };
-		})(),
-		tlsRejectUnauthorized: parseBoolean(environment.QMIND_TLS_REJECT_UNAUTHORIZED, "QMIND_TLS_REJECT_UNAUTHORIZED") ?? file.tls_reject_unauthorized ?? true,
-		token: optionalTrimmed(flags.token) ?? optionalTrimmed(environment.QMIND_TOKEN) ?? ""
+		body: Readable.from(multipart()),
+		headers: initialHeaders
 	};
 }
-//#endregion
-//#region src/credentials.ts
-const serializedCredentialsSchema = z.object({
-	device_token: z.string().default(""),
-	expires_at: z.string().default(""),
-	refresh_token: z.string().default(""),
-	refresh_token_expires_at: z.string().default(""),
-	sash_url: z.string().default(""),
-	saved_at: z.string().default(""),
-	schema_version: z.number().int().positive().optional()
-}).passthrough();
-function storedCredentialsInvalid() {
-	return new QMindError("AUTH_REQUIRED", "stored QMind credentials are invalid");
+function isTimeoutCause(cause) {
+	const code = cause.code;
+	const name = cause.name;
+	return code === "QMIND_REQUEST_TIMEOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "UND_ERR_HEADERS_TIMEOUT" || code === "UND_ERR_BODY_TIMEOUT" || name === "TimeoutError";
 }
-function isMissing(error) {
-	return error.code === "ENOENT";
+function safeCause(cause) {
+	const record = cause;
+	return {
+		...typeof record.name === "string" ? { name: record.name } : {},
+		...typeof record.code === "string" ? { code: record.code } : {}
+	};
 }
-function isValidOptionalTimestamp(value) {
-	return value.length === 0 || Number.isFinite(Date.parse(value));
+function transportFailure(request, cause, deadlineExpired = false) {
+	if (cause instanceof QMindError) return cause;
+	if (request.signal?.aborted === true) return new QMindError("ABORTED", "QMind request was aborted");
+	if (deadlineExpired || isTimeoutCause(cause)) return new QMindError("TIMEOUT", "QMind request timed out", { cause: safeCause(cause) });
+	return new QMindError("NETWORK_ERROR", "QMind network request failed", { cause: safeCause(cause) });
 }
-function normalizeStoredCredentials(value) {
-	let parsed;
-	try {
-		parsed = serializedCredentialsSchema.parse(value);
-	} catch {
-		throw storedCredentialsInvalid();
-	}
-	if (parsed.schema_version !== void 0 && parsed.schema_version > 2 || parsed.device_token.length === 0 && parsed.refresh_token.length === 0 || !isValidOptionalTimestamp(parsed.expires_at) || !isValidOptionalTimestamp(parsed.refresh_token_expires_at)) throw storedCredentialsInvalid();
+function requestDeadline(signal, milliseconds) {
+	const controller = new AbortController();
+	let timedOut = false;
+	const timeout = setTimeout(() => {
+		timedOut = true;
+		const error = Object.assign(/* @__PURE__ */ new Error("QMind request deadline expired"), {
+			code: "QMIND_REQUEST_TIMEOUT",
+			name: "TimeoutError"
+		});
+		controller.abort(error);
+	}, milliseconds);
+	timeout.unref();
+	const onAbort = () => controller.abort(signal?.reason);
+	if (signal?.aborted === true) onAbort();
+	else signal?.addEventListener("abort", onAbort, { once: true });
+	const clearDeadline = () => clearTimeout(timeout);
 	return {
-		deviceToken: parsed.device_token,
-		expiresAt: parsed.expires_at,
-		refreshToken: parsed.refresh_token,
-		refreshTokenExpiresAt: parsed.refresh_token_expires_at,
-		sashOrigin: parsed.sash_url,
-		savedAt: parsed.saved_at,
-		schemaVersion: parsed.schema_version ?? 1
+		clearTimeout: clearDeadline,
+		dispose() {
+			clearDeadline();
+			signal?.removeEventListener("abort", onAbort);
+		},
+		signal: controller.signal,
+		get timedOut() {
+			return timedOut;
+		}
 	};
 }
-function serializedCredentials(credentials, now) {
-	return `${JSON.stringify({
-		device_token: credentials.deviceToken,
-		expires_at: credentials.expiresAt,
-		refresh_token: credentials.refreshToken,
-		refresh_token_expires_at: credentials.refreshTokenExpiresAt,
-		sash_url: credentials.sashOrigin,
-		saved_at: new Date(now).toISOString().replace(/\.\d{3}Z$/, "Z"),
-		schema_version: 2
-	}, null, 2)}\n`;
-}
-async function secureDirectory(path) {
-	await mkdir(path, {
-		mode: 448,
-		recursive: true
+function abortableSleep(milliseconds, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted === true) {
+			reject(signal.reason);
+			return;
+		}
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(signal?.reason);
+		};
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, milliseconds);
+		signal?.addEventListener("abort", onAbort, { once: true });
 	});
-	const info = await lstat(path);
-	if (!info.isDirectory() || info.isSymbolicLink()) throw storedCredentialsInvalid();
-	if (process.platform !== "win32") await chmod(path, 448);
-}
-async function secureRegularFile(path) {
-	const info = await lstat(path);
-	if (!info.isFile() || info.isSymbolicLink()) throw storedCredentialsInvalid();
-	if (process.platform !== "win32" && (info.mode & 63) !== 0) await chmod(path, 384);
 }
-async function replaceFileAtomically(tempPath, targetPath) {
-	try {
-		await rename(tempPath, targetPath);
-		return;
-	} catch (error) {
-		if (process.platform !== "win32") throw error;
-	}
-	const backupPath = `${targetPath}.${randomBytes(6).toString("hex")}.old`;
-	let backedUp = false;
-	try {
-		try {
-			await rename(targetPath, backupPath);
-			backedUp = true;
-		} catch (error) {
-			if (!isMissing(error)) throw error;
-		}
-		await rename(tempPath, targetPath);
-		if (backedUp) await rm(backupPath, { force: true });
-	} catch (error) {
-		if (backedUp) await rename(backupPath, targetPath).catch(() => void 0);
-		throw error;
-	}
+function requestUrl(origin, request) {
+	return request.destination.kind === "host" ? new URL(request.destination.path, origin) : new URL(request.destination.url);
 }
-async function optionalSecret(operation, fallback) {
-	try {
-		return await operation();
-	} catch {
-		return fallback;
-	}
+function debugRequest(options, request, url) {
+	options.debugLog?.(`[qmind-debug] ${request.method} ${url.origin}${url.pathname}`);
 }
-function createOptionalKeyringSecretStore() {
-	const entry = async () => {
-		const { Entry } = await import("@napi-rs/keyring");
-		return new Entry("qmind-cli", "device-token");
-	};
-	return Object.freeze({
-		async delete() {
-			await optionalSecret(async () => void (await entry()).deletePassword(), void 0);
-		},
-		async get() {
-			return await optionalSecret(async () => (await entry()).getPassword() ?? void 0, void 0);
+async function* decodedEvents(body, request, disposeSignal) {
+	const decoder = new TextDecoder("utf-8", { fatal: true });
+	const pending = [];
+	let done = false;
+	let parserFailure;
+	const parser = createParser({
+		maxBufferSize: SSE_MAX_BUFFER_SIZE,
+		onError(error) {
+			if (error.type === "max-buffer-size-exceeded") parserFailure = error;
 		},
-		async set(token) {
-			await optionalSecret(async () => void (await entry()).setPassword(token), void 0);
+		onEvent(event) {
+			if (event.data.trim() === "[DONE]") done = true;
+			else pending.push(event.data);
 		}
 	});
-}
-function createFileCredentialVault(options) {
-	const credentialsPath = join(options.homeDirectory, "credentials.json");
-	const legacyBackupPath = `${credentialsPath}.v1.bak`;
-	const secretStore = options.secretStore ?? createOptionalKeyringSecretStore();
-	const now = options.now ?? Date.now;
-	const withLock = async (operation) => {
-		await secureDirectory(options.homeDirectory);
-		const release = await lockfile.lock(options.homeDirectory, {
-			lockfilePath: join(options.homeDirectory, ".credentials.lock"),
-			realpath: false,
-			retries: {
-				factor: 1.5,
-				maxTimeout: 100,
-				minTimeout: 20,
-				retries: 8
-			},
-			stale: 1e4
-		});
-		try {
-			return await operation();
-		} finally {
-			await release();
+	const drain = function* () {
+		while (pending.length > 0) {
+			const value = pending.shift();
+			if (value !== void 0) yield value;
 		}
 	};
+	try {
+		for await (const chunk of body) {
+			parser.feed(decoder.decode(chunk, { stream: true }));
+			if (parserFailure !== void 0) throw new QMindError("STREAM_ERROR", "SSE parser buffer limit exceeded", { details: { limitBytes: SSE_MAX_BUFFER_SIZE } });
+			yield* drain();
+			if (done) return;
+		}
+		parser.feed(decoder.decode());
+		parser.reset({ consume: true });
+		if (parserFailure !== void 0) throw new QMindError("STREAM_ERROR", "SSE parser buffer limit exceeded", { details: { limitBytes: SSE_MAX_BUFFER_SIZE } });
+		yield* drain();
+	} catch (cause) {
+		if (cause instanceof QMindError) throw cause;
+		if (request.signal?.aborted === true) throw new QMindError("ABORTED", "QMind stream was aborted");
+		if (isTimeoutCause(cause)) throw new QMindError("TIMEOUT", "QMind stream timed out", { cause: safeCause(cause) });
+		throw new QMindError("STREAM_ERROR", "QMind SSE stream failed", { cause: safeCause(cause) });
+	} finally {
+		disposeSignal();
+		body.destroy();
+	}
+}
+function createQMindNodeTransport(options) {
+	const origin = normalizeOrigin(options.origin);
+	const requestTimeoutMs = positiveInteger(options.requestTimeoutMs, 3e4, "requestTimeoutMs");
+	const streamIdleTimeoutMs = positiveInteger(options.streamIdleTimeoutMs, 12e4, "streamIdleTimeoutMs");
+	const maxRetries = nonNegativeInteger(options.maxRetries, 2, "maxRetries");
+	const dispatchers = createDispatchers(options);
+	const dispatcherFor = (request) => request.destination.kind === "host" ? dispatchers.host : dispatchers.signed;
 	return Object.freeze({
-		async delete() {
-			await withLock(async () => {
-				await Promise.all([rm(credentialsPath, { force: true }), rm(legacyBackupPath, { force: true })]);
-				await optionalSecret(() => secretStore.delete(), void 0);
-			});
+		async close() {
+			const unique = /* @__PURE__ */ new Set([dispatchers.host, dispatchers.signed]);
+			await Promise.all([...unique].map(async (dispatcher) => dispatcher.close()));
+		},
+		async downloadToFile(download) {
+			const request$1 = {
+				destination: {
+					kind: "signed",
+					url: download.url
+				},
+				idempotent: true,
+				method: "GET",
+				...download.signal === void 0 ? {} : { signal: download.signal }
+			};
+			assertWireRequest(request$1);
+			const url = requestUrl(origin, request$1);
+			await mkdir(dirname(download.targetPath), { recursive: true });
+			if (download.overwrite !== true) try {
+				await stat(download.targetPath);
+				throw new QMindError("CONFLICT", `target already exists: ${download.targetPath}`);
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+			}
+			const temporary = join(dirname(download.targetPath), `.${basename(download.targetPath)}.${randomBytes(8).toString("hex")}.tmp`);
+			let response;
+			try {
+				response = await request(url, {
+					bodyTimeout: requestTimeoutMs,
+					dispatcher: dispatchers.signed,
+					headersTimeout: requestTimeoutMs,
+					idempotent: true,
+					method: "GET",
+					...download.signal === void 0 ? {} : { signal: download.signal }
+				});
+				if (response.statusCode < 200 || response.statusCode >= 300) {
+					const decoded = await wireResponse(response);
+					throw new QMindError("REMOTE_ERROR", "download request failed", {
+						...decoded.rawBody === void 0 ? {} : { rawBody: decoded.rawBody },
+						status: decoded.status
+					});
+				}
+				await pipeline(response.body, createWriteStream(temporary, {
+					flags: "wx",
+					mode: 384
+				}));
+				const size = (await stat(temporary)).size;
+				await chmod(temporary, 420);
+				await commitQMindTemporaryFile(temporary, download.targetPath, download.overwrite === true);
+				return size;
+			} catch (cause) {
+				response?.body.destroy();
+				await rm(temporary, { force: true });
+				if (cause instanceof QMindError) throw cause;
+				throw transportFailure(request$1, cause);
+			}
+		},
+		async request(request$2) {
+			assertWireRequest(request$2);
+			const url = requestUrl(origin, request$2);
+			const attempts = request$2.idempotent ? maxRetries + 1 : 1;
+			let lastFailure;
+			let lastDeadlineExpired = false;
+			for (let attempt = 0; attempt < attempts; attempt += 1) {
+				const deadline = requestDeadline(request$2.signal, request$2.timeoutMs ?? requestTimeoutMs);
+				try {
+					debugRequest(options, request$2, url);
+					const encoded = encodeBody(request$2, `----qmind-${randomBytes(18).toString("hex")}`);
+					const response = await request(url, {
+						...encoded.body === void 0 ? {} : { body: encoded.body },
+						bodyTimeout: request$2.timeoutMs ?? requestTimeoutMs,
+						dispatcher: dispatcherFor(request$2),
+						headers: encoded.headers,
+						headersTimeout: request$2.timeoutMs ?? requestTimeoutMs,
+						idempotent: request$2.idempotent,
+						method: request$2.method,
+						signal: deadline.signal
+					});
+					if (attempt + 1 < attempts && RETRYABLE_STATUS.has(response.statusCode)) {
+						await response.body.dump();
+						await abortableSleep(250 * 2 ** attempt, request$2.signal);
+						continue;
+					}
+					return await wireResponse(response);
+				} catch (cause) {
+					lastFailure = cause;
+					lastDeadlineExpired = deadline.timedOut;
+					if (attempt + 1 < attempts && request$2.signal?.aborted !== true) {
+						await abortableSleep(250 * 2 ** attempt, request$2.signal);
+						continue;
+					}
+				} finally {
+					deadline.dispose();
+				}
+			}
+			throw transportFailure(request$2, lastFailure, lastDeadlineExpired);
 		},
-		async load() {
-			let serialized;
+		async stream(request$3) {
+			assertWireRequest(request$3);
+			const url = requestUrl(origin, request$3);
+			debugRequest(options, request$3, url);
+			const encoded = encodeBody(request$3, `----qmind-${randomBytes(18).toString("hex")}`);
+			let response;
+			const deadline = requestDeadline(request$3.signal, request$3.timeoutMs ?? requestTimeoutMs);
 			try {
-				await secureRegularFile(credentialsPath);
-				serialized = JSON.parse(await readFile(credentialsPath, "utf8"));
-			} catch (error) {
-				if (isMissing(error)) return void 0;
-				if (error instanceof QMindError) throw error;
-				throw storedCredentialsInvalid();
+				response = await request(url, {
+					...encoded.body === void 0 ? {} : { body: encoded.body },
+					bodyTimeout: streamIdleTimeoutMs,
+					dispatcher: dispatchers.host,
+					headers: {
+						accept: "text/event-stream",
+						...encoded.headers
+					},
+					headersTimeout: request$3.timeoutMs ?? requestTimeoutMs,
+					idempotent: request$3.idempotent,
+					method: request$3.method,
+					signal: deadline.signal
+				});
+			} catch (cause) {
+				deadline.dispose();
+				throw transportFailure(request$3, cause, deadline.timedOut);
+			}
+			deadline.clearTimeout();
+			const headers = headersToRecord(response.headers);
+			if (response.statusCode < 200 || response.statusCode >= 300 || !headers["content-type"]?.toLowerCase().includes("text/event-stream")) try {
+				return {
+					...await wireResponse(response),
+					kind: "response"
+				};
+			} finally {
+				deadline.dispose();
 			}
-			const credentials = normalizeStoredCredentials(serialized);
-			const keychainToken = await optionalSecret(() => secretStore.get(), void 0);
-			return keychainToken === void 0 || keychainToken.length === 0 ? credentials : {
-				...credentials,
-				deviceToken: keychainToken
+			return {
+				events: decodedEvents(response.body, request$3, deadline.dispose),
+				headers,
+				kind: "events",
+				status: response.statusCode
 			};
-		},
-		async save(credentials, saveOptions = {}) {
-			await withLock(async () => {
-				const tempPath = `${credentialsPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-				try {
-					if (saveOptions.migrateLegacy === true) try {
-						await secureRegularFile(credentialsPath);
-						await copyFile(credentialsPath, legacyBackupPath);
-						if (process.platform !== "win32") await chmod(legacyBackupPath, 384);
-					} catch (error) {
-						if (!isMissing(error)) throw error;
-					}
-					await writeFile(tempPath, serializedCredentials(credentials, now()), {
-						flag: "wx",
-						mode: 384
-					});
-					if (process.platform !== "win32") await chmod(tempPath, 384);
-					await replaceFileAtomically(tempPath, credentialsPath);
-					if (process.platform !== "win32") await chmod(credentialsPath, 384);
-					await optionalSecret(() => secretStore.set(credentials.deviceToken), void 0);
-				} finally {
-					await rm(tempPath, { force: true });
-				}
-			});
 		}
 	});
 }
-//#endregion
-//#region src/node-transport.ts
-const RETRYABLE_STATUS = /* @__PURE__ */ new Set([
-	408,
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-const CREDENTIAL_HEADERS = /* @__PURE__ */ new Set([
-	"authorization",
-	"cookie",
-	"proxy-authorization",
-	"x-csrf-token",
-	"x-xsrf-token"
-]);
-const SSE_MAX_BUFFER_SIZE = 8388608;
-function invalidArgument(message, field) {
-	return new QMindError("INVALID_ARGUMENT", message, { details: { field } });
-}
-function positiveInteger(value, fallback, field) {
-	if (value === void 0) return fallback;
-	if (!Number.isSafeInteger(value) || value <= 0) throw invalidArgument(`${field} must be a positive safe integer`, field);
-	return value;
-}
-function nonNegativeInteger(value, fallback, field) {
-	if (value === void 0) return fallback;
-	if (!Number.isSafeInteger(value) || value < 0) throw invalidArgument(`${field} must be a non-negative safe integer`, field);
-	return value;
-}
-function normalizeOrigin(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		throw invalidArgument("origin must be a valid HTTP(S) origin", "origin");
-	}
-	if (url.protocol !== "http:" && url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0) throw invalidArgument("origin must contain only an HTTP(S) scheme and authority", "origin");
-	return url;
-}
-function environmentValue(environment, ...keys) {
-	for (const key of keys) {
-		const value = environment[key]?.trim();
-		if (value !== void 0 && value.length > 0) return value;
-	}
-}
-function tlsConnectOptions(options, withTls) {
-	const timeout = positiveInteger(options.connectTimeoutMs, 1e4, "connectTimeoutMs");
-	if (!withTls) return { timeout };
-	const ca = options.tls?.ca;
-	return {
-		...ca === void 0 ? {} : { ca: typeof ca === "string" ? ca : [...ca] },
-		rejectUnauthorized: options.tls?.rejectUnauthorized ?? true,
-		timeout
-	};
-}
-function createDispatchers(options) {
-	const environment = options.environment ?? process.env;
-	if (options.proxyFromEnvironment === false) return {
-		host: new Agent({ connect: tlsConnectOptions(options, true) }),
-		signed: new Agent({ connect: tlsConnectOptions(options, true) })
-	};
-	const httpProxy = environmentValue(environment, "HTTP_PROXY", "http_proxy");
-	const httpsProxy = environmentValue(environment, "HTTPS_PROXY", "https_proxy");
-	const noProxy = environmentValue(environment, "NO_PROXY", "no_proxy");
-	const proxy = {
-		...httpProxy === void 0 ? {} : { httpProxy },
-		...httpsProxy === void 0 ? {} : { httpsProxy },
-		...noProxy === void 0 ? {} : { noProxy }
-	};
-	return {
-		host: new EnvHttpProxyAgent({
-			...proxy,
-			requestTls: tlsConnectOptions(options, true)
-		}),
-		signed: new EnvHttpProxyAgent({
-			...proxy,
-			requestTls: tlsConnectOptions(options, true)
-		})
-	};
-}
-function headersToRecord(headers) {
-	const result = {};
-	for (const [name, value] of Object.entries(headers)) {
-		if (value === void 0) continue;
-		result[name.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
-	}
-	return result;
-}
-function parseRawBody(rawBody) {
-	if (rawBody.trim().length === 0) return void 0;
-	try {
-		return JSON.parse(rawBody);
-	} catch {
-		return rawBody;
-	}
-}
-async function wireResponse(response) {
-	const rawBody = await response.body.text();
-	return {
-		body: parseRawBody(rawBody),
-		headers: headersToRecord(response.headers),
-		rawBody,
-		status: response.statusCode
-	};
-}
-function assertWireRequest(request) {
-	if (request.timeoutMs !== void 0) positiveInteger(request.timeoutMs, request.timeoutMs, "timeoutMs");
-	if (request.destination.kind === "host") {
-		if (!request.destination.path.startsWith("/") || request.destination.path.startsWith("//")) throw new QMindError("HOST_POLICY_ERROR", "host destination must be root-relative");
-		return;
-	}
-	let url;
-	try {
-		url = new URL(request.destination.url);
-	} catch {
-		throw new QMindError("HOST_POLICY_ERROR", "signed destination must be valid HTTPS");
-	}
-	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0) throw new QMindError("HOST_POLICY_ERROR", "signed destination must be credential-free HTTPS");
-	for (const name of Object.keys(request.headers ?? {})) if (CREDENTIAL_HEADERS.has(name.toLowerCase())) throw new QMindError("HOST_POLICY_ERROR", "host credentials cannot reach a signed URL", { details: { header: name.toLowerCase() } });
-}
-function sourceFailure(message, source, yieldedBytes) {
-	return new QMindError("HOST_POLICY_ERROR", message, { details: {
-		filename: source.filename,
-		size: source.size,
-		...yieldedBytes === void 0 ? {} : { yieldedBytes }
-	} });
-}
-function assertSource(source) {
-	if (!Number.isSafeInteger(source.size) || source.size <= 0 || typeof source.open !== "function") throw sourceFailure("binary source metadata is invalid", source);
-}
-async function* sourceBytes(source, signal, onProgress) {
-	assertSource(source);
-	let bytes = 0;
-	for await (const chunk of source.open()) {
-		if (signal?.aborted === true) throw signal.reason;
-		if (!(chunk instanceof Uint8Array)) throw sourceFailure("binary source yielded a non-Uint8Array chunk", source, bytes);
-		bytes += chunk.byteLength;
-		if (bytes > source.size) throw sourceFailure("binary source yielded more bytes than declared", source, bytes);
-		yield chunk;
-		onProgress?.(bytes);
-	}
-	if (bytes !== source.size) throw sourceFailure("binary source yielded fewer bytes than declared", source, bytes);
-}
-function quoteDisposition(value) {
-	return value.replace(/["\r\n]/g, "_");
-}
-function multipartPart(name, value, boundary) {
-	return `--${boundary}\r\nContent-Disposition: form-data; name="${quoteDisposition(name)}"\r\n\r\n${value}\r\n`;
-}
-function multipartPreamble(source, boundary) {
-	return `--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="${quoteDisposition(source.filename)}"\r\nContent-Type: ${source.mimeType}\r\n\r\n`;
-}
-function byteLength(value) {
-	return Buffer.byteLength(value, "utf8");
-}
-function encodeBody(request, boundary) {
-	const initialHeaders = { ...request.headers };
-	const body = request.body;
-	if (body === void 0) return { headers: initialHeaders };
-	if (body.kind === "json") {
-		initialHeaders["content-type"] ??= "application/json";
-		return {
-			body: JSON.stringify(body.value),
-			headers: initialHeaders
-		};
-	}
-	if (body.kind === "binary") {
-		assertSource(body.source);
-		initialHeaders["content-type"] ??= body.source.mimeType;
-		initialHeaders["content-length"] = String(body.source.size);
-		return {
-			body: Readable.from(sourceBytes(body.source, request.signal, body.onProgress)),
-			headers: initialHeaders
-		};
-	}
-	const multipartBody = body;
-	assertSource(multipartBody.file);
-	const fieldParts = Object.entries(multipartBody.fields).map(([name, value]) => multipartPart(name, value, boundary));
-	const preamble = multipartPreamble(multipartBody.file, boundary);
-	const closing = `\r\n--${boundary}--\r\n`;
-	const contentLength = fieldParts.reduce((total, part) => total + byteLength(part), 0) + byteLength(preamble) + multipartBody.file.size + byteLength(closing);
-	async function* multipart() {
-		for (const part of fieldParts) yield Buffer.from(part);
-		yield Buffer.from(preamble);
-		yield* sourceBytes(multipartBody.file, request.signal, multipartBody.onProgress);
-		yield Buffer.from(closing);
+const MIME_TYPES = Object.freeze({
+	".csv": "text/csv",
+	".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+	".gif": "image/gif",
+	".jpeg": "image/jpeg",
+	".jpg": "image/jpeg",
+	".md": "text/markdown",
+	".mdx": "text/markdown",
+	".pdf": "application/pdf",
+	".png": "image/png",
+	".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+	".svg": "image/svg+xml",
+	".txt": "text/plain",
+	".webp": "image/webp",
+	".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+});
+function detectQMindMimeType(filename) {
+	return MIME_TYPES[extname(filename).toLowerCase()] ?? "application/octet-stream";
+}
+async function createQMindFileSource(path, options = {}) {
+	let info;
+	try {
+		info = await stat(path);
+	} catch {
+		throw invalidArgument("source path must reference a readable file", "path");
 	}
-	initialHeaders["content-type"] = `multipart/form-data; boundary=${boundary}`;
-	initialHeaders["content-length"] = String(contentLength);
-	return {
-		body: Readable.from(multipart()),
-		headers: initialHeaders
-	};
+	if (!info.isFile() || info.size <= 0) throw invalidArgument("source path must reference a non-empty regular file", "path");
+	const filename = options.filename?.trim() || basename(path);
+	const mimeType = options.mimeType?.trim() || detectQMindMimeType(filename);
+	return Object.freeze({
+		filename,
+		mimeType,
+		async *open() {
+			for await (const chunk of createReadStream(path)) yield chunk;
+		},
+		size: info.size
+	});
 }
-function isTimeoutCause(cause) {
-	const code = cause.code;
-	const name = cause.name;
-	return code === "QMIND_REQUEST_TIMEOUT" || code === "UND_ERR_CONNECT_TIMEOUT" || code === "UND_ERR_HEADERS_TIMEOUT" || code === "UND_ERR_BODY_TIMEOUT" || name === "TimeoutError";
+//#endregion
+//#region ../node-host/src/host.ts
+function defaultReporter() {
+	return Object.freeze({
+		info(message) {
+			console.error(message);
+		},
+		warn(message) {
+			console.error(message);
+		}
+	});
 }
-function safeCause(cause) {
-	const record = cause;
-	return {
-		...typeof record.name === "string" ? { name: record.name } : {},
-		...typeof record.code === "string" ? { code: record.code } : {}
-	};
+function defaultBrowser() {
+	return Object.freeze({ async open(url) {
+		(await open(url, { wait: false })).unref();
+	} });
 }
-function transportFailure(request, cause, deadlineExpired = false) {
-	if (cause instanceof QMindError) return cause;
-	if (request.signal?.aborted === true) return new QMindError("ABORTED", "QMind request was aborted");
-	if (deadlineExpired || isTimeoutCause(cause)) return new QMindError("TIMEOUT", "QMind request timed out", { cause: safeCause(cause) });
-	return new QMindError("NETWORK_ERROR", "QMind network request failed", { cause: safeCause(cause) });
+async function tlsAuthority(path) {
+	if (path === void 0) return void 0;
+	try {
+		return await readFile(path, "utf8");
+	} catch {
+		throw new QMindError("HOST_POLICY_ERROR", "unable to read the configured TLS CA file", { details: { field: "tlsCaFile" } });
+	}
 }
-function requestDeadline(signal, milliseconds) {
-	const controller = new AbortController();
-	let timedOut = false;
-	const timeout = setTimeout(() => {
-		timedOut = true;
-		const error = Object.assign(/* @__PURE__ */ new Error("QMind request deadline expired"), {
-			code: "QMIND_REQUEST_TIMEOUT",
-			name: "TimeoutError"
-		});
-		controller.abort(error);
-	}, milliseconds);
-	timeout.unref();
-	const onAbort = () => controller.abort(signal?.reason);
-	if (signal?.aborted === true) onAbort();
-	else signal?.addEventListener("abort", onAbort, { once: true });
-	const clearDeadline = () => clearTimeout(timeout);
+function configurationOptions(options, reporter) {
 	return {
-		clearTimeout: clearDeadline,
-		dispose() {
-			clearDeadline();
-			signal?.removeEventListener("abort", onAbort);
-		},
-		signal: controller.signal,
-		get timedOut() {
-			return timedOut;
-		}
+		...options.credentialSashOrigin === void 0 ? {} : { credentialSashOrigin: options.credentialSashOrigin },
+		...options.environment === void 0 ? {} : { environment: options.environment },
+		...options.flags === void 0 ? {} : { flags: options.flags },
+		...options.homeDirectory === void 0 ? {} : { homeDirectory: options.homeDirectory },
+		...options.legacyEnvironmentPath === void 0 ? {} : { legacyEnvironmentPath: options.legacyEnvironmentPath },
+		...reporter === void 0 ? {} : { reporter },
+		...options.stdinIsTTY === void 0 ? {} : { stdinIsTTY: options.stdinIsTTY }
 	};
 }
-function abortableSleep(milliseconds, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted === true) {
-			reject(signal.reason);
-			return;
+async function createQMindCliHost(options = {}) {
+	const reporter = options.adapters?.reporter ?? defaultReporter();
+	const clock = options.adapters?.clock ?? createSystemClock();
+	const vault = createFileCredentialVault({
+		homeDirectory: (await loadQMindCliConfig(configurationOptions(options))).runtime.homeDirectory,
+		now: () => clock.now(),
+		secretStore: options.adapters?.secretStore ?? createOptionalKeyringSecretStore()
+	});
+	let credentials;
+	try {
+		credentials = await vault.load();
+	} catch (error) {
+		if (options.credentialReadFailure !== "unauthenticated") throw error;
+		reporter.warn("QMind credential vault is unavailable; authentication is required.");
+		credentials = void 0;
+	}
+	const resolved = await loadQMindCliConfig({
+		...configurationOptions(options, reporter),
+		...credentials?.sashOrigin ? { credentialSashOrigin: credentials.sashOrigin } : {},
+		reporter
+	});
+	const ca = await tlsAuthority(resolved.tlsCaFile);
+	const nodeOptions = {
+		...options.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: options.connectTimeoutMs },
+		...resolved.debug ? { debugLog: (message) => reporter.info(message) } : {},
+		environment: resolved.environment,
+		...options.maxRetries === void 0 ? {} : { maxRetries: options.maxRetries },
+		origin: resolved.runtime.sashOrigin,
+		proxyFromEnvironment: resolved.proxyFromEnvironment,
+		requestTimeoutMs: resolved.requestTimeoutMs,
+		streamIdleTimeoutMs: resolved.streamIdleTimeoutMs,
+		tls: {
+			...ca === void 0 ? {} : { ca },
+			rejectUnauthorized: resolved.tlsRejectUnauthorized
 		}
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason);
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, milliseconds);
-		signal?.addEventListener("abort", onAbort, { once: true });
+	};
+	const ownedTransport = options.adapters?.transport === void 0 ? createQMindNodeTransport(nodeOptions) : void 0;
+	const rawTransport = options.adapters?.transport ?? ownedTransport;
+	if (rawTransport === void 0) throw new QMindError("HOST_POLICY_ERROR", "unable to initialize the QMind transport");
+	const auth = createQMindCliAuthManager({
+		browser: options.adapters?.browser ?? defaultBrowser(),
+		clock,
+		config: resolved.runtime,
+		credentials,
+		explicitToken: resolved.token,
+		reporter,
+		transport: rawTransport,
+		vault
+	});
+	const client = createQMindClient({
+		access: "sash",
+		client: resolved.runtime.client,
+		transport: createAuthenticatedQMindTransport(rawTransport, auth)
+	});
+	return Object.freeze({
+		client,
+		async close() {
+			await ownedTransport?.close();
+		},
+		config: resolved.runtime,
+		createFileSource: createQMindFileSource,
+		async downloadToFile(downloadOptions) {
+			const downloader = options.adapters?.downloader ?? ownedTransport;
+			if (downloader === void 0) throw new QMindError("UNSUPPORTED_OPERATION", "the injected CLI transport does not provide file downloads");
+			return await downloader.downloadToFile(downloadOptions);
+		},
+		login: auth.login,
+		logout: auth.logout
 	});
 }
-function requestUrl(origin, request) {
-	return request.destination.kind === "host" ? new URL(request.destination.path, origin) : new URL(request.destination.url);
+//#endregion
+//#region src/folder-sync.ts
+const QMIND_FOLDER_SYNC_DEFAULT_EXTENSIONS = Object.freeze([
+	".mdx",
+	".md",
+	".pdf",
+	".txt",
+	".docx",
+	".pptx",
+	".png",
+	".jpg",
+	".jpeg",
+	".gif",
+	".svg",
+	".webp"
+]);
+function posix(path) {
+	return path.split(sep).join("/");
 }
-function debugRequest(options, request, url) {
-	options.debugLog?.(`[qmind-debug] ${request.method} ${url.origin}${url.pathname}`);
+function qmindFolderSyncIndexKey(parentId, title) {
+	return `${parentId}\u0000${title}`;
 }
-async function* decodedEvents(body, request, disposeSignal) {
-	const decoder = new TextDecoder("utf-8", { fatal: true });
-	const pending = [];
-	let done = false;
-	let parserFailure;
-	const parser = createParser({
-		maxBufferSize: SSE_MAX_BUFFER_SIZE,
-		onError(error) {
-			if (error.type === "max-buffer-size-exceeded") parserFailure = error;
-		},
-		onEvent(event) {
-			if (event.data.trim() === "[DONE]") done = true;
-			else pending.push(event.data);
-		}
-	});
-	const drain = function* () {
-		while (pending.length > 0) {
-			const value = pending.shift();
-			if (value !== void 0) yield value;
-		}
-	};
-	try {
-		for await (const chunk of body) {
-			parser.feed(decoder.decode(chunk, { stream: true }));
-			if (parserFailure !== void 0) throw new QMindError("STREAM_ERROR", "SSE parser buffer limit exceeded", { details: { limitBytes: SSE_MAX_BUFFER_SIZE } });
-			yield* drain();
-			if (done) return;
-		}
-		parser.feed(decoder.decode());
-		parser.reset({ consume: true });
-		if (parserFailure !== void 0) throw new QMindError("STREAM_ERROR", "SSE parser buffer limit exceeded", { details: { limitBytes: SSE_MAX_BUFFER_SIZE } });
-		yield* drain();
-	} catch (cause) {
-		if (cause instanceof QMindError) throw cause;
-		if (request.signal?.aborted === true) throw new QMindError("ABORTED", "QMind stream was aborted");
-		if (isTimeoutCause(cause)) throw new QMindError("TIMEOUT", "QMind stream timed out", { cause: safeCause(cause) });
-		throw new QMindError("STREAM_ERROR", "QMind SSE stream failed", { cause: safeCause(cause) });
-	} finally {
-		disposeSignal();
-		body.destroy();
-	}
+function normalizeExtensions(values) {
+	return new Set(values.map((value) => value.trim().toLowerCase()).filter((value) => value.length > 0).map((value) => value.startsWith(".") ? value : `.${value}`));
 }
-function createQMindNodeTransport(options) {
-	const origin = normalizeOrigin(options.origin);
-	const requestTimeoutMs = positiveInteger(options.requestTimeoutMs, 3e4, "requestTimeoutMs");
-	const streamIdleTimeoutMs = positiveInteger(options.streamIdleTimeoutMs, 12e4, "streamIdleTimeoutMs");
-	const maxRetries = nonNegativeInteger(options.maxRetries, 2, "maxRetries");
-	const dispatchers = createDispatchers(options);
-	const dispatcherFor = (request) => request.destination.kind === "host" ? dispatchers.host : dispatchers.signed;
+function validateMapping(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new QMindError("INVALID_ARGUMENT", "directory ID mapping must be a JSON object");
+	const result = {};
+	for (const [path, id] of Object.entries(value)) {
+		if (typeof id !== "string" || id.trim().length === 0) throw new QMindError("INVALID_ARGUMENT", "directory ID mapping values must be non-empty strings");
+		result[posix(path)] = id.trim();
+	}
+	return result;
+}
+async function sha256(path) {
+	const hash = createHash("sha256");
+	for await (const chunk of createReadStream(path)) hash.update(chunk);
+	return hash.digest("hex");
+}
+function createNodeQMindFolderSyncFileSystem() {
 	return Object.freeze({
-		async close() {
-			const unique = /* @__PURE__ */ new Set([dispatchers.host, dispatchers.signed]);
-			await Promise.all([...unique].map(async (dispatcher) => dispatcher.close()));
+		async isDirectory(path) {
+			return (await stat(path).catch(() => void 0))?.isDirectory() === true;
 		},
-		async downloadToFile(download) {
-			const request$1 = {
-				destination: {
-					kind: "signed",
-					url: download.url
-				},
-				idempotent: true,
-				method: "GET",
-				...download.signal === void 0 ? {} : { signal: download.signal }
-			};
-			assertWireRequest(request$1);
-			const url = requestUrl(origin, request$1);
-			await mkdir(dirname(download.targetPath), { recursive: true });
-			if (download.overwrite !== true) try {
-				await stat(download.targetPath);
-				throw new QMindError("CONFLICT", `target already exists: ${download.targetPath}`);
-			} catch (error) {
-				if (error.code !== "ENOENT") throw error;
-			}
-			const temporary = join(dirname(download.targetPath), `.${basename(download.targetPath)}.${randomBytes(8).toString("hex")}.tmp`);
-			let response;
+		async readMapping(path) {
 			try {
-				response = await request(url, {
-					bodyTimeout: requestTimeoutMs,
-					dispatcher: dispatchers.signed,
-					headersTimeout: requestTimeoutMs,
-					idempotent: true,
-					method: "GET",
-					...download.signal === void 0 ? {} : { signal: download.signal }
-				});
-				if (response.statusCode < 200 || response.statusCode >= 300) {
-					const decoded = await wireResponse(response);
-					throw new QMindError("REMOTE_ERROR", "download request failed", {
-						...decoded.rawBody === void 0 ? {} : { rawBody: decoded.rawBody },
-						status: decoded.status
-					});
-				}
-				await pipeline(response.body, createWriteStream(temporary, {
-					flags: "wx",
-					mode: 384
-				}));
-				const size = (await stat(temporary)).size;
-				await chmod(temporary, 420);
-				await commitQMindTemporaryFile(temporary, download.targetPath, download.overwrite === true);
-				return size;
-			} catch (cause) {
-				response?.body.destroy();
-				await rm(temporary, { force: true });
-				if (cause instanceof QMindError) throw cause;
-				throw transportFailure(request$1, cause);
+				return validateMapping(JSON.parse(await readFile(path, "utf8")));
+			} catch (error) {
+				if (error instanceof QMindError) throw error;
+				throw new QMindError("INVALID_ARGUMENT", `unable to read directory ID mapping: ${path}`);
 			}
 		},
-		async request(request$2) {
-			assertWireRequest(request$2);
-			const url = requestUrl(origin, request$2);
-			const attempts = request$2.idempotent ? maxRetries + 1 : 1;
-			let lastFailure;
-			let lastDeadlineExpired = false;
-			for (let attempt = 0; attempt < attempts; attempt += 1) {
-				const deadline = requestDeadline(request$2.signal, request$2.timeoutMs ?? requestTimeoutMs);
-				try {
-					debugRequest(options, request$2, url);
-					const encoded = encodeBody(request$2, `----qmind-${randomBytes(18).toString("hex")}`);
-					const response = await request(url, {
-						...encoded.body === void 0 ? {} : { body: encoded.body },
-						bodyTimeout: request$2.timeoutMs ?? requestTimeoutMs,
-						dispatcher: dispatcherFor(request$2),
-						headers: encoded.headers,
-						headersTimeout: request$2.timeoutMs ?? requestTimeoutMs,
-						idempotent: request$2.idempotent,
-						method: request$2.method,
-						signal: deadline.signal
-					});
-					if (attempt + 1 < attempts && RETRYABLE_STATUS.has(response.statusCode)) {
-						await response.body.dump();
-						await abortableSleep(250 * 2 ** attempt, request$2.signal);
+		async scan(baseDirectory, options) {
+			const directories = [];
+			const files = [];
+			let skipped = 0;
+			const isIgnored = options.ignorePatterns.length === 0 ? () => false : picomatch([...options.ignorePatterns], { dot: true });
+			const visit = async (directory) => {
+				const entries = await readdir(directory, { withFileTypes: true });
+				entries.sort((left, right) => left.name.localeCompare(right.name));
+				for (const entry of entries) {
+					const absolute = join(directory, entry.name);
+					const path = posix(relative(baseDirectory, absolute));
+					if (entry.name.startsWith(".") || isIgnored(path)) {
+						skipped += entry.isFile() ? 1 : 0;
 						continue;
 					}
-					return await wireResponse(response);
-				} catch (cause) {
-					lastFailure = cause;
-					lastDeadlineExpired = deadline.timedOut;
-					if (attempt + 1 < attempts && request$2.signal?.aborted !== true) {
-						await abortableSleep(250 * 2 ** attempt, request$2.signal);
-						continue;
+					if (entry.isDirectory()) {
+						directories.push(path);
+						await visit(absolute);
+					} else if (entry.isFile()) {
+						if (options.extensions.has(extname(entry.name).toLowerCase())) files.push(path);
+						else skipped += 1;
 					}
-				} finally {
-					deadline.dispose();
 				}
+			};
+			await visit(baseDirectory);
+			directories.sort((left, right) => left.split("/").length - right.split("/").length || left.localeCompare(right));
+			files.sort((left, right) => left.localeCompare(right));
+			return {
+				directories,
+				files,
+				skipped
+			};
+		},
+		sha256,
+		async writeMapping(path, mapping) {
+			await mkdir(dirname(path), { recursive: true });
+			await writeFile(path, `${JSON.stringify(mapping, null, 2)}\n`, { mode: 384 });
+		}
+	});
+}
+async function shouldReplaceQMindFolderFile(mode, existing, localPath, fileSystem = createNodeQMindFolderSyncFileSystem()) {
+	if (mode === "skip") return false;
+	if (mode === "overwrite") return true;
+	const metadata = existing.metadata ?? {};
+	const remoteHash = metadata.fileSha256 ?? metadata.rawFileSha256 ?? metadata.sha256;
+	if (typeof remoteHash !== "string" || !/^[a-f0-9]{64}$/i.test(remoteHash)) return true;
+	return (await fileSystem.sha256(localPath)).toLowerCase() !== remoteHash.toLowerCase();
+}
+function retryable(error) {
+	if (!(error instanceof QMindError)) return true;
+	if (error.code === "FILE_TOO_LARGE" || error.code === "INVALID_ARGUMENT" || error.code === "AUTH_REQUIRED" || error.code === "FORBIDDEN") return false;
+	return error.status === void 0 || error.status === 408 || error.status === 429 || error.status >= 500;
+}
+async function withUploadRetry(task, sleep) {
+	let lastFailure;
+	for (let attempt = 0; attempt < 3; attempt += 1) try {
+		return await task();
+	} catch (error) {
+		lastFailure = error;
+		if (!retryable(error) || attempt === 2) break;
+		await sleep(250 * 2 ** attempt);
+	}
+	throw lastFailure;
+}
+function defaultSleep(milliseconds) {
+	return new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+}
+function mappingPath(baseDirectory, cacheDirectory) {
+	const cache = cacheDirectory ?? process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache");
+	const name = createHash("sha1").update(baseDirectory).digest("hex").slice(0, 16);
+	return join(cache, "qmind", "dir-ids", `${name}.json`);
+}
+function addFailure(stats, field, path) {
+	(stats[field] ??= []).push(path);
+}
+function publicStats(stats) {
+	return Object.freeze({
+		...stats,
+		...stats.failed_dirs === void 0 ? {} : { failed_dirs: Object.freeze(stats.failed_dirs) },
+		...stats.failed_files === void 0 ? {} : { failed_files: Object.freeze(stats.failed_files) },
+		...stats.failed_deletes === void 0 ? {} : { failed_deletes: Object.freeze(stats.failed_deletes) }
+	});
+}
+async function synchronizeQMindFolder(host, options) {
+	const notebookId = options.notebookId.trim();
+	if (notebookId.length === 0) throw new QMindError("INVALID_ARGUMENT", "notebookId is required");
+	const fileSystem = options.fileSystem ?? createNodeQMindFolderSyncFileSystem();
+	const baseDirectory = resolve(options.baseDirectory);
+	if (!await fileSystem.isDirectory(baseDirectory)) throw new QMindError("INVALID_ARGUMENT", `${baseDirectory} is not a directory`);
+	const mode = options.mode ?? "skip";
+	if (options.skipUpload === true && options.delete === true) throw new QMindError("INVALID_ARGUMENT", "delete cannot be combined with skipUpload because local files would not enter the mirror plan");
+	const requestedConcurrency = options.concurrency ?? 3;
+	if (!Number.isSafeInteger(requestedConcurrency) || requestedConcurrency < 1) throw new QMindError("INVALID_ARGUMENT", "concurrency must be a positive integer");
+	const concurrency = Math.min(10, requestedConcurrency);
+	const diagnostics = [];
+	if (requestedConcurrency > 10) diagnostics.push(`warning: concurrency ${requestedConcurrency} exceeds maximum (10); clamped to 10`);
+	const extensions = normalizeExtensions(options.extensions ?? QMIND_FOLDER_SYNC_DEFAULT_EXTENSIONS);
+	const tree = await fileSystem.scan(baseDirectory, {
+		extensions,
+		ignorePatterns: options.ignorePatterns ?? []
+	});
+	const remote = await host.client.listAllSources(notebookId);
+	const remoteIndex = new Map(remote.map((source) => [qmindFolderSyncIndexKey(source.parentSourceId, source.title), source]));
+	const remoteById = new Map(remote.map((source) => [source.id, source]));
+	const stats = {
+		dirs_created: 0,
+		dirs_reused: 0,
+		dirs_failed: 0,
+		dirs_refresh_failed: 0,
+		files_uploaded: 0,
+		files_skipped: options.skipUpload === true ? 0 : tree.skipped,
+		files_already_exist: 0,
+		files_failed: 0,
+		...options.delete === true ? {
+			delete_failed: 0,
+			dirs_deleted: 0,
+			files_deleted: 0
+		} : {},
+		...options.dryRun === true ? { dry_run: true } : {}
+	};
+	const configuredMapping = options.directoryIdsPath === void 0 ? {} : await fileSystem.readMapping(options.directoryIdsPath);
+	const directoryIds = {};
+	const desiredKeys = /* @__PURE__ */ new Set();
+	for (const directory of tree.directories) {
+		const parentPath = posix(dirname(directory)) === "." ? "" : posix(dirname(directory));
+		const parentId = directoryIds[parentPath] ?? "";
+		if (parentPath.length > 0 && parentId.length === 0) {
+			stats.dirs_failed += 1;
+			addFailure(stats, "failed_dirs", directory);
+			continue;
+		}
+		const title = basename(directory);
+		const key = qmindFolderSyncIndexKey(parentId, title);
+		desiredKeys.add(key);
+		const mappedId = configuredMapping[directory];
+		const mapped = mappedId === void 0 ? void 0 : remoteById.get(mappedId);
+		const existing = mappedId === void 0 || mapped === void 0 ? remoteIndex.get(key) : mapped;
+		if (existing?.isDir === true && existing.parentSourceId === parentId && existing.title === title) {
+			directoryIds[directory] = existing.id;
+			stats.dirs_reused += 1;
+			continue;
+		}
+		if (existing !== void 0) {
+			stats.dirs_failed += 1;
+			addFailure(stats, "failed_dirs", directory);
+			continue;
+		}
+		if (options.dryRun === true) {
+			directoryIds[directory] = `dry-run:${directory}`;
+			stats.dirs_created += 1;
+			continue;
+		}
+		try {
+			const created = await host.client.createDirectory(notebookId, {
+				parentSourceId: parentId,
+				path: title,
+				title
+			});
+			directoryIds[directory] = created.id;
+			remoteIndex.set(key, created);
+			remoteById.set(created.id, created);
+			stats.dirs_created += 1;
+		} catch {
+			stats.dirs_failed += 1;
+			addFailure(stats, "failed_dirs", directory);
+		}
+	}
+	let savedMappingPath;
+	if (options.directoryIdsPath === void 0 && options.dryRun !== true) {
+		savedMappingPath = options.saveDirectoryIdsPath ?? mappingPath(baseDirectory, options.cacheDirectory);
+		await fileSystem.writeMapping(savedMappingPath, directoryIds);
+		diagnostics.push(`directory mapping saved: ${savedMappingPath}`);
+	}
+	if (options.skipUpload !== true) {
+		const limit = pLimit(concurrency);
+		await Promise.all(tree.files.map((file) => limit(async () => {
+			const absolute = join(baseDirectory, file);
+			const parentPath = posix(dirname(file)) === "." ? "" : posix(dirname(file));
+			const parentId = directoryIds[parentPath] ?? "";
+			if (parentPath.length > 0 && parentId.length === 0) {
+				stats.files_failed += 1;
+				addFailure(stats, "failed_files", file);
+				return;
 			}
-			throw transportFailure(request$2, lastFailure, lastDeadlineExpired);
-		},
-		async stream(request$3) {
-			assertWireRequest(request$3);
-			const url = requestUrl(origin, request$3);
-			debugRequest(options, request$3, url);
-			const encoded = encodeBody(request$3, `----qmind-${randomBytes(18).toString("hex")}`);
-			let response;
-			const deadline = requestDeadline(request$3.signal, request$3.timeoutMs ?? requestTimeoutMs);
-			try {
-				response = await request(url, {
-					...encoded.body === void 0 ? {} : { body: encoded.body },
-					bodyTimeout: streamIdleTimeoutMs,
-					dispatcher: dispatchers.host,
-					headers: {
-						accept: "text/event-stream",
-						...encoded.headers
-					},
-					headersTimeout: request$3.timeoutMs ?? requestTimeoutMs,
-					idempotent: request$3.idempotent,
-					method: request$3.method,
-					signal: deadline.signal
-				});
-			} catch (cause) {
-				deadline.dispose();
-				throw transportFailure(request$3, cause, deadline.timedOut);
+			const title = basename(file);
+			const key = qmindFolderSyncIndexKey(parentId, title);
+			desiredKeys.add(key);
+			const existing = remoteIndex.get(key);
+			if (existing?.isDir === true) {
+				stats.files_failed += 1;
+				addFailure(stats, "failed_files", file);
+				return;
 			}
-			deadline.clearTimeout();
-			const headers = headersToRecord(response.headers);
-			if (response.statusCode < 200 || response.statusCode >= 300 || !headers["content-type"]?.toLowerCase().includes("text/event-stream")) try {
-				return {
-					...await wireResponse(response),
-					kind: "response"
-				};
-			} finally {
-				deadline.dispose();
+			if (existing !== void 0 && !await shouldReplaceQMindFolderFile(mode, existing, absolute, fileSystem)) {
+				stats.files_already_exist += 1;
+				return;
 			}
-			return {
-				events: decodedEvents(response.body, request$3, deadline.dispose),
-				headers,
-				kind: "events",
-				status: response.statusCode
-			};
+			if (options.dryRun === true) {
+				stats.files_uploaded += 1;
+				return;
+			}
+			try {
+				const hash = await fileSystem.sha256(absolute);
+				const uploaded = await withUploadRetry(async () => {
+					const binary = await host.createFileSource(absolute);
+					return await host.client.uploadSource(notebookId, binary, {
+						parentSourceId: parentId,
+						path: file,
+						sha256: hash,
+						title
+					});
+				}, options.sleep ?? defaultSleep);
+				if (existing !== void 0) await host.client.deleteSource(notebookId, existing.id);
+				remoteIndex.set(key, uploaded);
+				remoteById.set(uploaded.id, uploaded);
+				stats.files_uploaded += 1;
+			} catch {
+				stats.files_failed += 1;
+				addFailure(stats, "failed_files", file);
+			}
+		})));
+	}
+	if (options.dryRun !== true) for (const [directory, id] of Object.entries(directoryIds)) {
+		if (id.startsWith("dry-run:")) continue;
+		try {
+			await host.client.updateSource(notebookId, id, {
+				isDir: true,
+				title: basename(directory)
+			});
+		} catch {
+			stats.dirs_refresh_failed += 1;
 		}
-	});
-}
-const MIME_TYPES = Object.freeze({
-	".csv": "text/csv",
-	".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-	".gif": "image/gif",
-	".jpeg": "image/jpeg",
-	".jpg": "image/jpeg",
-	".md": "text/markdown",
-	".mdx": "text/markdown",
-	".pdf": "application/pdf",
-	".png": "image/png",
-	".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-	".svg": "image/svg+xml",
-	".txt": "text/plain",
-	".webp": "image/webp",
-	".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
-});
-function detectQMindMimeType(filename) {
-	return MIME_TYPES[extname(filename).toLowerCase()] ?? "application/octet-stream";
-}
-async function createQMindFileSource(path, options = {}) {
-	let info;
-	try {
-		info = await stat(path);
-	} catch {
-		throw invalidArgument("source path must reference a readable file", "path");
 	}
-	if (!info.isFile() || info.size <= 0) throw invalidArgument("source path must reference a non-empty regular file", "path");
-	const filename = options.filename?.trim() || basename(path);
-	const mimeType = options.mimeType?.trim() || detectQMindMimeType(filename);
-	return Object.freeze({
-		filename,
-		mimeType,
-		async *open() {
-			for await (const chunk of createReadStream(path)) yield chunk;
-		},
-		size: info.size
-	});
-}
-//#endregion
-//#region src/host.ts
-function defaultReporter() {
-	return Object.freeze({
-		info(message) {
-			console.error(message);
-		},
-		warn(message) {
-			console.error(message);
+	const preDeleteFailures = stats.files_failed + stats.dirs_failed;
+	if (options.delete === true && preDeleteFailures === 0) {
+		const deletions = remote.filter((source) => !desiredKeys.has(qmindFolderSyncIndexKey(source.parentSourceId, source.title))).sort((left, right) => {
+			if (left.isDir !== right.isDir) return left.isDir ? 1 : -1;
+			return right.path.split("/").length - left.path.split("/").length;
+		});
+		for (const source of deletions) try {
+			if (options.dryRun !== true) await host.client.deleteSource(notebookId, source.id);
+			if (source.isDir) stats.dirs_deleted = (stats.dirs_deleted ?? 0) + 1;
+			else stats.files_deleted = (stats.files_deleted ?? 0) + 1;
+		} catch {
+			stats.delete_failed = (stats.delete_failed ?? 0) + 1;
+			(stats.failed_deletes ??= []).push(source.path || source.title);
 		}
-	});
-}
-function defaultBrowser() {
-	return Object.freeze({ async open(url) {
-		(await open(url, { wait: false })).unref();
-	} });
-}
-async function tlsAuthority(path) {
-	if (path === void 0) return void 0;
-	try {
-		return await readFile(path, "utf8");
-	} catch {
-		throw new QMindError("HOST_POLICY_ERROR", "unable to read the configured TLS CA file", { details: { field: "tlsCaFile" } });
 	}
-}
-function configurationOptions(options, reporter) {
+	const exitCode = stats.files_failed > 0 || stats.dirs_failed > 0 || stats.dirs_refresh_failed > 0 || (stats.delete_failed ?? 0) > 0 ? 1 : 0;
 	return {
-		...options.credentialSashOrigin === void 0 ? {} : { credentialSashOrigin: options.credentialSashOrigin },
-		...options.environment === void 0 ? {} : { environment: options.environment },
-		...options.flags === void 0 ? {} : { flags: options.flags },
-		...options.homeDirectory === void 0 ? {} : { homeDirectory: options.homeDirectory },
-		...options.legacyEnvironmentPath === void 0 ? {} : { legacyEnvironmentPath: options.legacyEnvironmentPath },
-		...reporter === void 0 ? {} : { reporter },
-		...options.stdinIsTTY === void 0 ? {} : { stdinIsTTY: options.stdinIsTTY }
-	};
-}
-async function createQMindCliHost(options = {}) {
-	const reporter = options.adapters?.reporter ?? defaultReporter();
-	const clock = options.adapters?.clock ?? createSystemClock();
-	const vault = createFileCredentialVault({
-		homeDirectory: (await loadQMindCliConfig(configurationOptions(options))).runtime.homeDirectory,
-		now: () => clock.now(),
-		secretStore: options.adapters?.secretStore ?? createOptionalKeyringSecretStore()
-	});
-	const credentials = await vault.load();
-	const resolved = await loadQMindCliConfig({
-		...configurationOptions(options, reporter),
-		...credentials?.sashOrigin ? { credentialSashOrigin: credentials.sashOrigin } : {},
-		reporter
-	});
-	const ca = await tlsAuthority(resolved.tlsCaFile);
-	const nodeOptions = {
-		...options.connectTimeoutMs === void 0 ? {} : { connectTimeoutMs: options.connectTimeoutMs },
-		...resolved.debug ? { debugLog: (message) => reporter.info(message) } : {},
-		environment: resolved.environment,
-		...options.maxRetries === void 0 ? {} : { maxRetries: options.maxRetries },
-		origin: resolved.runtime.sashOrigin,
-		proxyFromEnvironment: resolved.proxyFromEnvironment,
-		requestTimeoutMs: resolved.requestTimeoutMs,
-		streamIdleTimeoutMs: resolved.streamIdleTimeoutMs,
-		tls: {
-			...ca === void 0 ? {} : { ca },
-			rejectUnauthorized: resolved.tlsRejectUnauthorized
-		}
+		diagnostics: Object.freeze(diagnostics),
+		exitCode,
+		...savedMappingPath === void 0 ? {} : { mappingPath: savedMappingPath },
+		stats: publicStats(stats)
 	};
-	const ownedTransport = options.adapters?.transport === void 0 ? createQMindNodeTransport(nodeOptions) : void 0;
-	const rawTransport = options.adapters?.transport ?? ownedTransport;
-	if (rawTransport === void 0) throw new QMindError("HOST_POLICY_ERROR", "unable to initialize the QMind transport");
-	const auth = createQMindCliAuthManager({
-		browser: options.adapters?.browser ?? defaultBrowser(),
-		clock,
-		config: resolved.runtime,
-		credentials,
-		explicitToken: resolved.token,
-		reporter,
-		transport: rawTransport,
-		vault
-	});
-	const client = createQMindClient({
-		access: "sash",
-		client: resolved.runtime.client,
-		transport: createAuthenticatedQMindTransport(rawTransport, auth),
-		userId: resolved.runtime.userId
-	});
-	return Object.freeze({
-		client,
-		async close() {
-			await ownedTransport?.close();
-		},
-		config: resolved.runtime,
-		createFileSource: createQMindFileSource,
-		async downloadToFile(downloadOptions) {
-			const downloader = options.adapters?.downloader ?? ownedTransport;
-			if (downloader === void 0) throw new QMindError("UNSUPPORTED_OPERATION", "the injected CLI transport does not provide file downloads");
-			return await downloader.downloadToFile(downloadOptions);
-		},
-		login: auth.login,
-		logout: auth.logout
-	});
 }
 //#endregion
 //#region src/output.ts
@@ -4435,14 +4551,12 @@ function commonFlags(options) {
 	const dashboard = optionalString(options, "dashboard");
 	const sash = optionalString(options, "sash");
 	const token = optionalString(options, "token");
-	const user = optionalString(options, "user");
 	return {
 		...client === void 0 ? {} : { client },
 		...dashboard === void 0 ? {} : { dashboard },
 		...options.nonInteractive === true ? { nonInteractive: true } : {},
 		...sash === void 0 ? {} : { sash },
-		...token === void 0 ? {} : { token },
-		...user === void 0 ? {} : { user }
+		...token === void 0 ? {} : { token }
 	};
 }
 async function hostFor(context, options, environmentOverrides = {}) {
@@ -4475,7 +4589,7 @@ function render(context, options, presentation) {
 	context.io.stdout(renderQMindCliPresentation(presentation, formatOf(options)));
 }
 function withCommon(command, output = true) {
-	command.option("--token <token>", "Bearer access token").option("--sash <url>", "Sash server origin").option("--dashboard <url>", "Dashboard origin").option("--org <id>", "organization ID (deprecated and ignored)").option("--user <id>", "user ID (direct-mind mode)").option("--client <name>", "originating client identifier").option("--non-interactive", "never open a browser when credentials are missing");
+	command.option("--token <token>", "Bearer access token").option("--sash <url>", "Sash server origin").option("--dashboard <url>", "Dashboard origin").option("--org <id>", "organization ID (deprecated and ignored)").option("--client <name>", "originating client identifier").option("--non-interactive", "never open a browser when credentials are missing");
 	if (output) command.option("--format <format>", "output format: table | json | agent | ndjson", "table");
 	return command;
 }
@@ -4833,7 +4947,7 @@ function registerUpdateCommand(context, program) {
 			publicKey: String(raw.publicKey ?? "")
 		});
 		if (result.updated) context.io.stdout(`[self-update] updated ${QMIND_CLI_VERSION} -> ${result.version}\n`);
-		else if (result.version === "1.1.2".replace(/^v/, "")) context.io.stdout(`[self-update] already current: ${result.version}\n`);
+		else if (result.version === "2.0.0".replace(/^v/, "")) context.io.stdout(`[self-update] already current: ${result.version}\n`);
 		else context.io.stdout(`[self-update] verified available version: ${result.version}\n`);
 	});
 }