@schema-weaver/pg-connector 0.0.0-stage → 2.0.1

package/dist/esm/config/db-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-config.js","sourceRoot":"","sources":["../../../src/config/db-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,cAAc,GACf,MAAM,UAAU,CAAC;AAqDlB,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAY/B,IAAI,eAAe,GAAgD,IAAI,CAAC;AAExE,SAAS,OAAO,CAAC,GAAY,EAAE,IAAY;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAA6B,CAAC,IAAI,KAAK,IAAI,CAAC;AACjG,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,aAAqB,EAAE,KAAa;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,KAAK,uBAAuB,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAC1B,0BAA0B,KAAK,aAAa,aAAa,uBAAuB,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,CAAC,QAAQ;QAChB,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,QAAQ;QAChB,OAAO,CAAC,IAAI;KACb,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,GAAG,CAAC,CAAC,KAAK,CAAC;QACX,GAAG,CAAC,GAAG,KAAK,QAAQ;QACpB,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IACE,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,GAAG,KAAK,QAAQ;QAClB,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QACvB,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QACvB,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ;QACvB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EACzB,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,+CAA+C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,gDAAgD,CAAC,CAAC;IACrF,CAAC;IACD,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACtC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,uCAAuC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO;IAC7D,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,+CAA+C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,SAAS,CAAC,GAAG,CAAC,EAAE,CAChH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACnD,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,+CAA+C,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CACvE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,QAAqB,EAAE,OAAe;IACvD,MAAM,WAAW,GAAG,GAAG,OAAO,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC;IAC5G,IAAI,eAAe,IAAI,eAAe,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACnE,OAAO,eAAe,CAAC,GAAG,CAAC;IAC7B,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAC3B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EACpC,SAAS,EACT;QACE,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,MAAM,EAAE,aAAa;KACtB,CACF,CAAC;IACF,eAAe,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,QAAQ,GAAgB;QAC5B,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,QAAQ;QACb,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC/C,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;KAC9C,CAAC;IAEF,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,qDAAqD,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,cAAc,EACd,yCAAyC,SAAS,CAAC,GAAG,CAAC,EAAE,CAC1D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,WAAW,CACnB,cAAc,EACd,uDAAuD,SAAS,CAAC,GAAG,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,2EAA2E;IAC3E,2EAA2E;IAC3E,6DAA6D;IAC7D,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CAAC,OAAe;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,mCAAmC,OAAO,mDAAmD,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,sCAAsC,OAAO,mDAAmD,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE,SAAiB;IAC3E,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACpF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE;QAC5D,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,QAAQ;QACb,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QACjB,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACnC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;KAClB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE,GAAsB;IAChF,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,GAAG,GAAG,8BAA8B,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,wBAAwB,OAAO,CAAC,QAAQ,+KAA+K,OAAO,CAAC,QAAQ,sBAAsB,CAC9P,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,eAA0B,CAAC;IAChD,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,eAA0B,CAAC;IAChD,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,oDAAoD,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,6BAA6B,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,KAAgC,CAAC;QAE9C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;QAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,qFAAqF,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;YAC7C,MAAM,IAAI,kBAAkB,CAC1B,YAAY,OAAO,6BAA6B,SAAS,sHAAsH,CAChL,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,uFAAuF,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,KAAK,4BAA4B,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IACE,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YACxB,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EACpE,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,+DAA+D,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACpF,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,6CAA6C,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QACzB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,iDAAiD,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,4CAA4C,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,oGAAoG,CACxH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,gFAAgF,CACpG,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,+DAA+D,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC3F,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,wEAAwE,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,uDAAuD,CAC3E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,gDAAgD,OAAO,EAAE,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5F,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,sFAAsF,CAC1G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,sDAAsD,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,GAAe,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,SAAS,EAAE,kCAAkC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAAgB;IAC3C,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAI,MAA+B;IAC/D,OAAO,YAAY,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAkC;IAC3D,OAAO,cAAc,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/B,0BAA0B;QAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/E,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAkB,CAC1B,YAAY,KAAK,CAAC,YAAY,6BAA6B,YAAY,CAAC,QAAQ,sHAAsH,CACvM,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,KAAK,CAAC,QAAQ,4BAA4B,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,QAAQ,GAAY;YACxB,GAAG,KAAK;YACR,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,cAAc,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAMD,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,SAAS,EAAE,YAAY,EAAE;KAC1B,CAAC;AACJ,CAAC"}

package/dist/esm/config/machine-config.d.ts

@@ -0,0 +1,85 @@
+import { type Role } from '../protocol/envelope';
+import { PermissionLevel } from '../permissions/checker';
+export { PermissionLevel };
+/**
+ * Machine-level config: sw-agent.config.json
+ * Contains: cloud URL, agent token, agent ID, default permission, machine label.
+ * Does NOT contain: database connection info (that's in db-config.ts).
+ */
+export interface MachineConfig {
+    config_version: 1;
+    cloud_url: string;
+    agent_token: string;
+    agent_id: string;
+    default_permission: PermissionLevel;
+    machine_label: string;
+    log_level: 'debug' | 'info' | 'warn' | 'error';
+    /** Cloud telemetry: ship audit + operation logs to the backend (best-effort). */
+    cloud_telemetry?: {
+        enabled: boolean;
+        ingest_url?: string;
+    };
+    /**
+     * Transport-security overrides. Every key is optional and absent means "the
+     * secure default", so a config written by an older build keeps working and a
+     * partially written block cannot silently relax a control.
+     */
+    security?: {
+        /** Require a per-session MAC on inbound data-channel envelopes. Default: true. */
+        envelope_mac_required?: boolean;
+        /**
+         * Hard local ceiling on the role a relay may assert for a data-channel
+         * session, applied by `InboundEnvelopeGuard` after the negotiated-set
+         * check.
+         *
+         * Default: `'developer'` — `ENVELOPE_MAX_NEGOTIABLE_ROLE_DEFAULT`, not
+         * `'admin'`. An earlier revision of this file documented `'admin'`, which is
+         * not what the code does: the default was the strongest role, so the
+         * ceiling bound nothing. Setting `'admin'` here is honoured and warned
+         * about at daemon startup, and `sw-agent status` reports the effective
+         * ceiling.
+         */
+        max_negotiable_role?: Role;
+    };
+    created_at: string;
+    updated_at: string;
+}
+export declare const DEFAULT_MACHINE_CONFIG: Partial<MachineConfig>;
+/** Least-privileged permission level; the default for every new install. */
+export declare const SAFEST_PERMISSION: PermissionLevel;
+/**
+ * Creates a new default MachineConfig with the given options and current ISO timestamps.
+ * Defaults to the least-privileged permission level; a more permissive level
+ * must be requested explicitly by the caller.
+ */
+export declare function createDefaultMachineConfig(opts: {
+    machineLabel: string;
+    cloudUrl?: string;
+    permission?: PermissionLevel;
+    token?: string;
+}): MachineConfig;
+/**
+ * Validates the raw JSON input to ensure it meets MachineConfig constraints.
+ */
+export declare function validateMachineConfig(raw: unknown): MachineConfig;
+/**
+ * Checks if the sw-agent.config.json file exists.
+ */
+export declare function machineConfigExists(): boolean;
+/**
+ * Loads and validates the machine config file.
+ */
+export declare function loadMachineConfig(): MachineConfig;
+/**
+ * Saves the machine config to disk with 0o600 permissions on POSIX, written
+ * atomically and with the mode repaired if a pre-existing file is readable by
+ * group or other.
+ */
+export declare function saveMachineConfig(config: MachineConfig): void;
+/**
+ * Runs a load → mutate → save cycle over sw-agent.config.json under an advisory
+ * lock, so a concurrent `config set` cannot be lost to a read-modify-write
+ * race. `mutate` edits the config in place; its return value is passed back.
+ */
+export declare function mutateMachineConfig<T>(mutate: (config: MachineConfig) => T): T;
+//# sourceMappingURL=machine-config.d.ts.map

package/dist/esm/config/machine-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-config.d.ts","sourceRoot":"","sources":["../../../src/config/machine-config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAU,KAAK,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,CAAC;AAa3B;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,CAAC,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,eAAe,CAAC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/C,iFAAiF;IACjF,eAAe,CAAC,EAAE;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QACT,kFAAkF;QAClF,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC;;;;;;;;;;;WAWG;QACH,mBAAmB,CAAC,EAAE,IAAI,CAAC;KAC5B,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB,EAAE,OAAO,CAAC,aAAa,CAKzD,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,eAA6B,CAAC;AAE9D;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,aAAa,CAkBhB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CA6GjE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAM7C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,CAyBjD;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAY7D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,CAAC,GAAG,CAAC,CAO9E"}

package/dist/esm/config/machine-config.js

@@ -0,0 +1,190 @@
+import * as fs from 'fs';
+import { getMachineConfigPath } from './paths';
+import { validateAgentTokenFormat, generateAgentToken, generateAgentId, isDevToken, DEV_TOKEN, } from './token';
+import { atomicWriteFile, withFileLock } from './atomic-write';
+import { isRole } from '../protocol/envelope';
+import { ConfigInvalidError, ConfigNotFoundError, ConfigError, isValidIso8601, isValidIdentifier, isSecureCloudUrl, isSecureIngestUrl, } from './schema';
+const CONFIG_FILE_MODE = 0o600;
+export const DEFAULT_MACHINE_CONFIG = {
+    cloud_url: 'wss://api.schemaweaver.dev',
+    default_permission: 'read_only',
+    machine_label: 'unknown',
+    log_level: 'info',
+};
+/** Least-privileged permission level; the default for every new install. */
+export const SAFEST_PERMISSION = 'read_only';
+/**
+ * Creates a new default MachineConfig with the given options and current ISO timestamps.
+ * Defaults to the least-privileged permission level; a more permissive level
+ * must be requested explicitly by the caller.
+ */
+export function createDefaultMachineConfig(opts) {
+    const cloudUrl = opts.cloudUrl || 'wss://api.schemaweaver.dev';
+    const permission = opts.permission || SAFEST_PERMISSION;
+    const token = opts.token || generateAgentToken();
+    const agentId = generateAgentId(opts.machineLabel);
+    const now = new Date().toISOString();
+    return {
+        config_version: 1,
+        cloud_url: cloudUrl,
+        agent_token: token,
+        agent_id: agentId,
+        default_permission: permission,
+        machine_label: opts.machineLabel,
+        log_level: 'info',
+        created_at: now,
+        updated_at: now,
+    };
+}
+/**
+ * Validates the raw JSON input to ensure it meets MachineConfig constraints.
+ */
+export function validateMachineConfig(raw) {
+    if (typeof raw !== 'object' || raw === null) {
+        throw new ConfigInvalidError('Config is not a valid JSON object');
+    }
+    const data = raw;
+    if (data.config_version !== 1) {
+        throw new ConfigInvalidError('Field "config_version" invalid: Must be 1');
+    }
+    // The agent token is a permanent bearer credential, so the transport that
+    // carries it must be TLS end to end. ws:// and http:// are refused rather
+    // than warned about: there is no way to carry a one-shot opt-in flag through
+    // the detached daemon/service start paths, so an accepted-but-plaintext URL
+    // would produce a config the agent can never load again.
+    if (typeof data.cloud_url !== 'string' || !isSecureCloudUrl(data.cloud_url)) {
+        throw new ConfigInvalidError('Field "cloud_url" invalid: Must be a wss:// URL with an explicit authority (ws:// and http:// are not accepted; the agent token would travel in cleartext)');
+    }
+    const token = data.agent_token;
+    if (typeof token !== 'string' || (!validateAgentTokenFormat(token) && !isDevToken(token))) {
+        throw new ConfigInvalidError(`Field "agent_token" invalid: Must match swagt_<32 chars base62> or be ${DEV_TOKEN}`);
+    }
+    const agentId = data.agent_id;
+    if (typeof agentId !== 'string' || !/^agt_[a-zA-Z0-9_-]+_[a-f0-9]{8}$/.test(agentId)) {
+        throw new ConfigInvalidError('Field "agent_id" invalid: Must match pattern agt_<label>_<8 hex>');
+    }
+    const perm = data.default_permission;
+    if (perm !== 'read_only' && perm !== 'auto_upgrade' && perm !== 'manual' && perm !== 'full') {
+        throw new ConfigInvalidError('Field "default_permission" invalid: Must be read_only, auto_upgrade, manual, or full');
+    }
+    const label = data.machine_label;
+    if (typeof label !== 'string' || !isValidIdentifier(label, 64) || label.includes(' ')) {
+        throw new ConfigInvalidError('Field "machine_label" invalid: Must be 1-64 characters containing only letters, numbers, hyphens, and underscores (no spaces)');
+    }
+    const level = data.log_level;
+    if (level !== 'debug' && level !== 'info' && level !== 'warn' && level !== 'error') {
+        throw new ConfigInvalidError('Field "log_level" invalid: Must be debug, info, warn, or error');
+    }
+    // Optional cloud telemetry config.
+    const telemetry = data.cloud_telemetry;
+    if (telemetry !== undefined && telemetry !== null) {
+        if (typeof telemetry !== 'object') {
+            throw new ConfigInvalidError('Field "cloud_telemetry" invalid: Must be an object');
+        }
+        const t = telemetry;
+        if (typeof t.enabled !== 'boolean') {
+            throw new ConfigInvalidError('Field "cloud_telemetry.enabled" invalid: Must be boolean');
+        }
+        if (t.ingest_url !== undefined && t.ingest_url !== null) {
+            if (typeof t.ingest_url !== 'string' || !isSecureIngestUrl(t.ingest_url)) {
+                throw new ConfigInvalidError('Field "cloud_telemetry.ingest_url" invalid: Must be an https:// URL with an explicit authority (http:// is not accepted)');
+            }
+        }
+    }
+    // Optional transport-security overrides. Absent keys keep the secure default,
+    // so a hand-edited block can only ever be as permissive as its own values.
+    const security = data.security;
+    if (security !== undefined && security !== null) {
+        if (typeof security !== 'object' || Array.isArray(security)) {
+            throw new ConfigInvalidError('Field "security" invalid: Must be an object');
+        }
+        const s = security;
+        if (s.envelope_mac_required !== undefined && s.envelope_mac_required !== null) {
+            if (typeof s.envelope_mac_required !== 'boolean') {
+                throw new ConfigInvalidError('Field "security.envelope_mac_required" invalid: Must be boolean');
+            }
+        }
+        if (s.max_negotiable_role !== undefined && s.max_negotiable_role !== null) {
+            if (!isRole(s.max_negotiable_role)) {
+                throw new ConfigInvalidError('Field "security.max_negotiable_role" invalid: Must be a known role');
+            }
+        }
+    }
+    const created = data.created_at;
+    if (typeof created !== 'string' || !isValidIso8601(created)) {
+        throw new ConfigInvalidError('Field "created_at" invalid: Must be a valid ISO 8601 string');
+    }
+    const updated = data.updated_at;
+    if (typeof updated !== 'string' || !isValidIso8601(updated)) {
+        throw new ConfigInvalidError('Field "updated_at" invalid: Must be a valid ISO 8601 string');
+    }
+    return raw;
+}
+/**
+ * Checks if the sw-agent.config.json file exists.
+ */
+export function machineConfigExists() {
+    try {
+        return fs.existsSync(getMachineConfigPath());
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Loads and validates the machine config file.
+ */
+export function loadMachineConfig() {
+    const p = getMachineConfigPath();
+    if (!fs.existsSync(p)) {
+        throw new ConfigNotFoundError(p);
+    }
+    let fileContent;
+    try {
+        fileContent = fs.readFileSync(p, 'utf8');
+    }
+    catch (err) {
+        throw new ConfigError('invalid', `Failed to read config file: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let json;
+    try {
+        json = JSON.parse(stripBom(fileContent));
+    }
+    catch (err) {
+        throw new ConfigInvalidError(`Config file is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return validateMachineConfig(json);
+}
+function stripBom(content) {
+    return content.charCodeAt(0) === 0xfeff ? content.slice(1) : content;
+}
+/**
+ * Saves the machine config to disk with 0o600 permissions on POSIX, written
+ * atomically and with the mode repaired if a pre-existing file is readable by
+ * group or other.
+ */
+export function saveMachineConfig(config) {
+    const p = getMachineConfigPath();
+    config.updated_at = new Date().toISOString();
+    validateMachineConfig(config);
+    try {
+        atomicWriteFile(p, JSON.stringify(config, null, 2), CONFIG_FILE_MODE);
+    }
+    catch (err) {
+        throw new ConfigError('write_failed', `Failed to write machine config: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Runs a load → mutate → save cycle over sw-agent.config.json under an advisory
+ * lock, so a concurrent `config set` cannot be lost to a read-modify-write
+ * race. `mutate` edits the config in place; its return value is passed back.
+ */
+export function mutateMachineConfig(mutate) {
+    return withFileLock(getMachineConfigPath(), () => {
+        const config = loadMachineConfig();
+        const result = mutate(config);
+        saveMachineConfig(config);
+        return result;
+    });
+}
+//# sourceMappingURL=machine-config.js.map

package/dist/esm/config/machine-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-config.js","sourceRoot":"","sources":["../../../src/config/machine-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAa,MAAM,sBAAsB,CAAC;AAGzD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAElB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AA8C/B,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,SAAS,EAAE,4BAA4B;IACvC,kBAAkB,EAAE,WAAW;IAC/B,aAAa,EAAE,SAAS;IACxB,SAAS,EAAE,MAAM;CAClB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAoB,WAAW,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAK1C;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,4BAA4B,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,OAAO;QACL,cAAc,EAAE,CAAC;QACjB,SAAS,EAAE,QAAQ;QACnB,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,UAAU;QAC9B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,GAA8B,CAAC;IAE5C,IAAI,IAAI,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,CAAC,CAAC;IAC5E,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,kBAAkB,CAC1B,4JAA4J,CAC7J,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,kBAAkB,CAC1B,yEAAyE,SAAS,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,kBAAkB,CAC1B,kEAAkE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACrC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5F,MAAM,IAAI,kBAAkB,CAC1B,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,kBAAkB,CAC1B,+HAA+H,CAChI,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;IAC7B,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACnF,MAAM,IAAI,kBAAkB,CAAC,gEAAgE,CAAC,CAAC;IACjG,CAAC;IAED,mCAAmC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,kBAAkB,CAAC,oDAAoD,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,GAAG,SAAoC,CAAC;QAC/C,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,kBAAkB,CAAC,0DAA0D,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACxD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,kBAAkB,CAC1B,0HAA0H,CAC3H,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,GAAG,QAAmC,CAAC;QAC9C,IAAI,CAAC,CAAC,qBAAqB,KAAK,SAAS,IAAI,CAAC,CAAC,qBAAqB,KAAK,IAAI,EAAE,CAAC;YAC9E,IAAI,OAAO,CAAC,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,kBAAkB,CAC1B,iEAAiE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,mBAAmB,KAAK,SAAS,IAAI,CAAC,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,kBAAkB,CAC1B,oEAAoE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;IAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,kBAAkB,CAAC,6DAA6D,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC;IAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,kBAAkB,CAAC,6DAA6D,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,SAAS,EACT,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACrF,CAAC;IACJ,CAAC;IAED,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;IACjC,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CACnB,cAAc,EACd,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAI,MAAoC;IACzE,OAAO,YAAY,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/config/paths.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The environment variables that relocate the agent home, in precedence order.
+ * `AGENT_HOME` is deliberately absent: nothing reads it, and the startup banner
+ * used to print it as if it did, which invited an operator to "move the token
+ * store" by setting a variable that is silently ignored.
+ */
+export declare const AGENT_HOME_ENV_VARS: readonly ["PG_CONNECTOR_HOME", "SW_AGENT_HOME"];
+/**
+ * Returns the agent home directory.
+ * If PG_CONNECTOR_HOME or SW_AGENT_HOME is set, uses that. Otherwise uses
+ * ~/.sw-agent.
+ * Created with 0o700 on POSIX; a pre-existing directory is chmod'ed back to
+ * 0o700 rather than trusted, since a 0o755 home exposes the token and the
+ * database config inside it. mkdir is attempted and only EEXIST is ignored:
+ * an existsSync check followed by mkdirSync is a race, and it skips the repair
+ * for a directory that already exists.
+ */
+export declare function getAgentHome(): string;
+export declare function getSwAgentDir(): string;
+/**
+ * Returns the path to the machine config file sw-agent.config.json.
+ */
+export declare function getMachineConfigPath(): string;
+/**
+ * Returns the path to the database config file databases.config.json.
+ */
+export declare function getDbConfigPath(): string;
+/**
+ * Returns the path to the machine-local credential key file that encrypts
+ * database passwords at rest.
+ *
+ * Deliberately placed outside the agent home directory: a copy of the agent
+ * home (backup, sync folder, snapshot, EDR upload) must never carry the key
+ * that decrypts the credentials sitting next to it. The key file is created
+ * with mode 0400 and is only ever readable by its owner.
+ */
+export declare function getCredentialKeyPath(): string;
+/**
+ * Returns the path to the audit log directory audit/.
+ */
+export declare function getAuditDirPath(): string;
+/**
+ * Returns the path to the active audit log file, audit/audit.jsonl.
+ * Archives (audit-1.jsonl …) live next to it; the sink rolls them.
+ */
+export declare function getAuditLogPath(): string;
+/**
+ * Returns the path to the daemon PID file sw-agent.pid.
+ */
+export declare function getPidFilePath(): string;
+/**
+ * Returns the path to the daemon status file sw-agent.status.
+ */
+export declare function getStatusFilePath(): string;
+/**
+ * Returns the path to the daemon diagnostic log file daemon.log.
+ */
+export declare function getDaemonLogPath(): string;
+/**
+ * Returns the path to the active daemon error log errors.jsonl.
+ * Archives (errors-1.jsonl …) live next to it; the error tracker rolls them.
+ */
+export declare function getErrorsPath(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/esm/config/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/config/paths.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,iDAAkD,CAAC;AAEnF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAerC;AAMD,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/esm/config/paths.js

@@ -0,0 +1,108 @@
+import * as path from 'path';
+import * as os from 'os';
+import * as fs from 'fs';
+/**
+ * The environment variables that relocate the agent home, in precedence order.
+ * `AGENT_HOME` is deliberately absent: nothing reads it, and the startup banner
+ * used to print it as if it did, which invited an operator to "move the token
+ * store" by setting a variable that is silently ignored.
+ */
+export const AGENT_HOME_ENV_VARS = ['PG_CONNECTOR_HOME', 'SW_AGENT_HOME'];
+/**
+ * Returns the agent home directory.
+ * If PG_CONNECTOR_HOME or SW_AGENT_HOME is set, uses that. Otherwise uses
+ * ~/.sw-agent.
+ * Created with 0o700 on POSIX; a pre-existing directory is chmod'ed back to
+ * 0o700 rather than trusted, since a 0o755 home exposes the token and the
+ * database config inside it. mkdir is attempted and only EEXIST is ignored:
+ * an existsSync check followed by mkdirSync is a race, and it skips the repair
+ * for a directory that already exists.
+ */
+export function getAgentHome() {
+    const envHome = process.env.PG_CONNECTOR_HOME || process.env.SW_AGENT_HOME;
+    const homeDir = envHome ? envHome : path.join(os.homedir(), '.sw-agent');
+    try {
+        fs.mkdirSync(homeDir, { recursive: true, mode: 0o700 });
+    }
+    catch (err) {
+        if (!isErrnoCode(err, 'EEXIST'))
+            throw err;
+    }
+    try {
+        fs.chmodSync(homeDir, 0o700);
+    }
+    catch {
+        // Not the owner, or a filesystem without POSIX modes: the caller still
+        // gets the path, and every config write re-asserts 0o600 on the file.
+    }
+    return homeDir;
+}
+function isErrnoCode(err, code) {
+    return typeof err === 'object' && err !== null && err.code === code;
+}
+export function getSwAgentDir() {
+    return getAgentHome();
+}
+/**
+ * Returns the path to the machine config file sw-agent.config.json.
+ */
+export function getMachineConfigPath() {
+    return path.join(getAgentHome(), 'sw-agent.config.json');
+}
+/**
+ * Returns the path to the database config file databases.config.json.
+ */
+export function getDbConfigPath() {
+    return path.join(getAgentHome(), 'databases.config.json');
+}
+/**
+ * Returns the path to the machine-local credential key file that encrypts
+ * database passwords at rest.
+ *
+ * Deliberately placed outside the agent home directory: a copy of the agent
+ * home (backup, sync folder, snapshot, EDR upload) must never carry the key
+ * that decrypts the credentials sitting next to it. The key file is created
+ * with mode 0400 and is only ever readable by its owner.
+ */
+export function getCredentialKeyPath() {
+    return path.join(os.homedir(), '.sw-agent-credential.key');
+}
+/**
+ * Returns the path to the audit log directory audit/.
+ */
+export function getAuditDirPath() {
+    return path.join(getAgentHome(), 'audit');
+}
+/**
+ * Returns the path to the active audit log file, audit/audit.jsonl.
+ * Archives (audit-1.jsonl …) live next to it; the sink rolls them.
+ */
+export function getAuditLogPath() {
+    return path.join(getAuditDirPath(), 'audit.jsonl');
+}
+/**
+ * Returns the path to the daemon PID file sw-agent.pid.
+ */
+export function getPidFilePath() {
+    return path.join(getAgentHome(), 'sw-agent.pid');
+}
+/**
+ * Returns the path to the daemon status file sw-agent.status.
+ */
+export function getStatusFilePath() {
+    return path.join(getAgentHome(), 'sw-agent.status');
+}
+/**
+ * Returns the path to the daemon diagnostic log file daemon.log.
+ */
+export function getDaemonLogPath() {
+    return path.join(getAgentHome(), 'daemon.log');
+}
+/**
+ * Returns the path to the active daemon error log errors.jsonl.
+ * Archives (errors-1.jsonl …) live next to it; the error tracker rolls them.
+ */
+export function getErrorsPath() {
+    return path.join(getAgentHome(), 'errors.jsonl');
+}
+//# sourceMappingURL=paths.js.map

package/dist/esm/config/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/config/paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,mBAAmB,EAAE,eAAe,CAAU,CAAC;AAEnF;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC;YAAE,MAAM,GAAG,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,sEAAsE;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,IAAY;IAC7C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAK,GAA6B,CAAC,IAAI,KAAK,IAAI,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,iBAAiB,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC"}

package/dist/esm/config/schema.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Config errors and hand-rolled validators for machine and database config files.
+ */
+export declare class ConfigError extends Error {
+    code: 'not_found' | 'invalid' | 'write_failed';
+    constructor(code: 'not_found' | 'invalid' | 'write_failed', message: string);
+}
+export declare class ConfigInvalidError extends ConfigError {
+    constructor(message: string);
+}
+export declare class ConfigNotFoundError extends ConfigError {
+    constructor(path: string);
+}
+/**
+ * Checks if a string is a valid hostname.
+ */
+export declare function isValidHostname(s: string): boolean;
+/**
+ * Checks if a string is a valid IPv4 address.
+ */
+export declare function isValidIpv4(s: string): boolean;
+/**
+ * Checks if a string is a valid IPv6 address.
+ */
+export declare function isValidIpv6(s: string): boolean;
+/**
+ * Checks if a string is a valid environment variable name.
+ */
+export declare function isValidEnvVarName(s: string): boolean;
+/**
+ * Checks if a string is a valid ISO 8601 timestamp.
+ */
+export declare function isValidIso8601(s: string): boolean;
+/**
+ * Checks if a string contains only letters, numbers, hyphens, and underscores, up to maxLen.
+ */
+export declare function isValidIdentifier(s: string, maxLen: number): boolean;
+/** URL schemes accepted for transport that carries a bearer token. */
+export type SecureScheme = 'wss:' | 'https:';
+/**
+ * Strictly parses a URL that is required to use `scheme` with an explicit
+ * "//" authority separator.
+ *
+ * The scheme is matched against the raw string with a case-sensitive prefix
+ * check *and* against the parsed URL, because the WHATWG parser normalises
+ * several downgrade shapes that must be rejected: "WSS://host" lower-cases to
+ * the "wss:" scheme, and "wss:/host" (single slash) is happily parsed as the
+ * host. Either one alone would be a bypassable transport check.
+ */
+export declare function parseSecureUrl(raw: unknown, scheme: SecureScheme): URL | null;
+/**
+ * True only for a wss: URL with an explicit lowercase "//" authority.
+ * ws:, http:, WSS: and "wss:/x" are all rejected.
+ */
+export declare function isSecureCloudUrl(raw: unknown): boolean;
+/**
+ * True only for an https: URL with an explicit lowercase "//" authority.
+ * http: is rejected.
+ */
+export declare function isSecureIngestUrl(raw: unknown): boolean;
+/**
+ * Writes a config file atomically with the given owner-only mode: a
+ * create-only mode option is not a control, so the mode is applied explicitly
+ * to both the temporary file and, through the rename, the final file.
+ */
+export declare function writeConfigFileAtomic(filePath: string, contents: string, mode: number): void;
+/**
+ * Redacts secret material from text that is about to be printed or logged.
+ * Replaces each known secret and any URL userinfo password with "***".
+ */
+export declare function redactSecrets(text: string, ...secrets: (string | undefined)[]): string;
+//# sourceMappingURL=schema.d.ts.map

package/dist/esm/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,qBAAa,WAAY,SAAQ,KAAK;IAE3B,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,cAAc;gBAA9C,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,cAAc,EACrD,OAAO,EAAE,MAAM;CAKlB;AAED,qBAAa,kBAAmB,SAAQ,WAAW;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,WAAW;gBACtC,IAAI,EAAE,MAAM;CAIzB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CASlD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAS9C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAK9C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAMjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAa7C;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,GAAG,GAAG,IAAI,CAqB7E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE5F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,CAQtF"}