@seekrit/cli 2.5.1 → 2.6.0

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { z } from "zod";
+import * as z$1 from "zod";
 import { Command } from "commander";
 import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
 import { basename, dirname, join, parse, resolve } from "node:path";
@@ -17,48 +17,48 @@ const POLICY_DEFAULT_TTL_SECONDS = 604800;
 const POLICY_MIN_TTL_SECONDS = 3600;
 const POLICY_MAX_TTL_SECONDS = 7776e3;
 /** A bare hostname: no scheme, no port, no path, no wildcard. */
-const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
-const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
+const policyHostSchema = z$1.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
+const policyMethodSchema = z$1.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
 /**
 * A path pattern. Must be absolute, because it is matched against a request
 * path — a relative pattern is a mistake that would silently match nothing.
 */
-const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
-const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
+const policyPathSchema = z$1.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
+const policySecretNameSchema = z$1.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
 /** A TCP port. 0 is refused: it never matches a connection, so a rule naming it is a mistake. */
-const policyPortSchema = z.number().int().min(1).max(65535);
-const agentPolicyRuleSchema = z.object({
+const policyPortSchema = z$1.number().int().min(1).max(65535);
+const agentPolicyRuleSchema = z$1.object({
 	host: policyHostSchema,
-	methods: z.array(policyMethodSchema).max(16).default([]),
-	paths: z.array(policyPathSchema).max(64).default([]),
-	allow: z.array(policySecretNameSchema).max(64).default([]),
-	https_ports: z.array(policyPortSchema).max(32).optional(),
-	http_ports: z.array(policyPortSchema).max(32).optional(),
-	label: z.string().trim().max(120).optional()
+	methods: z$1.array(policyMethodSchema).max(16).default([]),
+	paths: z$1.array(policyPathSchema).max(64).default([]),
+	allow: z$1.array(policySecretNameSchema).max(64).default([]),
+	https_ports: z$1.array(policyPortSchema).max(32).optional(),
+	http_ports: z$1.array(policyPortSchema).max(32).optional(),
+	label: z$1.string().trim().max(120).optional()
 });
-z.object({ 
+z$1.object({ 
 /** `ap1.<body>.<signature>` — opaque to the server. */
-bundle: z.string().min(16).max(262144) });
-z.object({
-	name: z.string().trim().min(1).max(120),
-	slug: z.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "slug is lowercase letters, digits, and dashes"),
+bundle: z$1.string().min(16).max(262144) });
+z$1.object({
+	name: z$1.string().trim().min(1).max(120),
+	slug: z$1.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "slug is lowercase letters, digits, and dashes"),
 	/** The environment whose secrets this agent's policy may name. Optional. */
-	environmentId: z.string().trim().min(1).max(64).optional()
+	environmentId: z$1.string().trim().min(1).max(64).optional()
 });
-z.object({
-	name: z.string().trim().min(1).max(120).optional(),
-	enabled: z.boolean().optional(),
-	environmentId: z.string().trim().min(1).max(64).nullish()
+z$1.object({
+	name: z$1.string().trim().min(1).max(120).optional(),
+	enabled: z$1.boolean().optional(),
+	environmentId: z$1.string().trim().min(1).max(64).nullish()
 });
-z.object({
+z$1.object({
 	host: policyHostSchema,
 	/** How the agent reaches the host. Omit for a destination the operator fixed. */
-	transport: z.object({
-		scheme: z.enum(["https", "http"]),
+	transport: z$1.object({
+		scheme: z$1.enum(["https", "http"]),
 		port: policyPortSchema
 	}).optional(),
 	method: policyMethodSchema,
-	path: z.string().trim().min(1).max(2048),
+	path: z$1.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
 /**
@@ -170,7 +170,7 @@ async function policySignerThumbprint(jwk) {
 		y: jwk.y
 	});
 	const digest = await crypto.subtle.digest("SHA-256", utf8(canonical));
-	return base64url(new Uint8Array(digest));
+	return base64url$1(new Uint8Array(digest));
 }
 /**
 * Sign a draft bundle with the publishing admin's key, returning the `ap1.`
@@ -197,8 +197,8 @@ async function signAgentPolicy(privateKey, signerJwk, draft) {
 	}, privateKey, bytes));
 	return [
 		"ap1",
-		base64url(bytes),
-		base64url(sig)
+		base64url$1(bytes),
+		base64url$1(sig)
 	].join(".");
 }
 /** A structurally invalid, unverifiable, or expired bundle. */
@@ -386,7 +386,7 @@ function utf8(text) {
 function utf8Decode$1(bytes) {
 	return new TextDecoder().decode(bytes);
 }
-function base64url(bytes) {
+function base64url$1(bytes) {
 	let binary = "";
 	for (const b of bytes) binary += String.fromCharCode(b);
 	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -399,10 +399,10 @@ function fromBase64url(text) {
 	return out;
 }
 /** One aggregated cell: a dimension tuple and how many times it happened. */
-const activityEntrySchema = z.object({
+const activityEntrySchema = z$1.object({
 	host: policyHostSchema,
 	method: policyMethodSchema,
-	decision: z.enum([
+	decision: z$1.enum([
 		"allow",
 		"no_rule",
 		"port_not_allowed",
@@ -419,27 +419,27 @@ const activityEntrySchema = z.object({
 	* a review, because "rule 3 refused this" and "nothing covered this" call for
 	* opposite changes.
 	*/
-	ruleIndex: z.number().int().min(0).max(255).nullable(),
-	count: z.number().int().min(1).max(1e6),
+	ruleIndex: z$1.number().int().min(0).max(255).nullable(),
+	count: z$1.number().int().min(1).max(1e6),
 	/**
 	* Secret names actually injected, name → count. Only meaningful on `allow`.
 	* This is what lets a review say "rule 2 permits three secrets and the agent
 	* has only ever used one" — the most useful narrowing there is, and impossible
 	* to see from policy alone.
 	*/
-	secrets: z.record(policySecretNameSchema, z.number().int().min(1)).optional()
+	secrets: z$1.record(policySecretNameSchema, z$1.number().int().min(1)).optional()
 });
-z.object({
+z$1.object({
 	/** Start of the window these counts cover (ISO 8601). */
-	windowStart: z.string().trim().min(20).max(40),
+	windowStart: z$1.string().trim().min(20).max(40),
 	/** Policy version in force while they were collected, for the ledger. */
-	policyVersion: z.number().int().min(0).optional(),
+	policyVersion: z$1.number().int().min(0).optional(),
 	/**
 	* Capped so one report cannot be unbounded work. A proxy with more distinct
 	* cells than this in a window has a policy far broader than a review can help
 	* with, and truncating loudly beats accepting anything.
 	*/
-	entries: z.array(activityEntrySchema).min(1).max(500)
+	entries: z$1.array(activityEntrySchema).min(1).max(500)
 });
 // ../../packages/core/src/agent-login.ts
 /** Where each kind of login is stored unless told otherwise. */
@@ -703,38 +703,38 @@ function countApplicable(proposals) {
 */
 const TASK_MAX_TTL_SECONDS = 43200;
 /** An EC P-256 public JWK, for a sender-constraint proof key. */
-const taskProofJwkSchema = z.object({
-	kty: z.literal("EC"),
-	crv: z.literal("P-256"),
-	x: z.string().min(1).max(128),
-	y: z.string().min(1).max(128)
+const taskProofJwkSchema = z$1.object({
+	kty: z$1.literal("EC"),
+	crv: z$1.literal("P-256"),
+	x: z$1.string().min(1).max(128),
+	y: z$1.string().min(1).max(128)
 });
-z.object({
+z$1.object({
 	/**
 	* The public `skd_…` segment of the minted token. Sent because the API never
 	* sees the token at dispatch and still needs a readable handle for the audit
 	* row and for a revoke to name — the id half of a credential, without the
 	* secret half.
 	*/
-	taskRef: z.string().trim().regex(/^skd_[0-9A-Za-z]+$/, "taskRef must be the skd_… segment of the minted token"),
+	taskRef: z$1.string().trim().regex(/^skd_[0-9A-Za-z]+$/, "taskRef must be the skd_… segment of the minted token"),
 	/**
 	* SHA-256 (base64url) of the token the dispatcher minted. The token itself
 	* never reaches this API on the dispatch path — only on introspection, where
 	* it is hashed and discarded.
 	*/
-	tokenHash: z.string().trim().min(16).max(128),
+	tokenHash: z$1.string().trim().min(16).max(128),
 	/**
 	* Secret names this run may use. Omit for "whatever the agent's policy
 	* allows" — mirroring `Session.scopes: Option<BTreeSet<String>>` in the proxy,
 	* so absent means unnarrowed in both places.
 	*/
-	scopes: z.array(policySecretNameSchema).max(64).optional(),
-	ttlSeconds: z.number().int().min(60).max(TASK_MAX_TTL_SECONDS).optional(),
+	scopes: z$1.array(policySecretNameSchema).max(64).optional(),
+	ttlSeconds: z$1.number().int().min(60).max(TASK_MAX_TTL_SECONDS).optional(),
 	/**
 	* What this run is for, for the audit row and the operator's task list. Free
 	* text, and **not** a security input: never put a secret value in it.
 	*/
-	label: z.string().trim().max(200).optional(),
+	label: z$1.string().trim().max(200).optional(),
 	/**
 	* Public half of a proof key the presenter holds, recorded as an RFC 7638
 	* thumbprint. See `AgentTaskSession.proofThumbprint` for what this does and —
@@ -742,9 +742,9 @@ z.object({
 	*/
 	proofJwk: taskProofJwkSchema.optional()
 });
-z.object({ 
+z$1.object({ 
 /** The presented token. In the body, never a URL — it is a credential. */
-token: z.string().trim().min(8).max(512) });
+token: z$1.string().trim().min(8).max(512) });
 // ../../packages/core/src/archive.ts
 /**
 * The **break-glass archive** format: one signed JSON file holding everything
@@ -920,43 +920,43 @@ async function verifySignature(manifest, signature) {
 	const publicKey = await crypto.subtle.importKey("raw", hexToBytes(signature.publicKey), { name: "Ed25519" }, false, ["verify"]);
 	return crypto.subtle.verify({ name: "Ed25519" }, publicKey, hexToBytes(signature.value), signingPayload(manifest));
 }
-const sectionHeaderSchema = z.object({
-	name: z.enum(ARCHIVE_SECTIONS),
-	count: z.number().int().min(0),
-	truncated: z.boolean(),
-	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+const sectionHeaderSchema = z$1.object({
+	name: z$1.enum(ARCHIVE_SECTIONS),
+	count: z$1.number().int().min(0),
+	truncated: z$1.boolean(),
+	digest: z$1.string().regex(/^sha256:[0-9a-f]{64}$/)
 });
-const manifestSchema = z.object({
-	archiveId: z.string().min(1),
-	createdAt: z.string().min(1),
-	org: z.object({
-		id: z.string(),
-		slug: z.string(),
-		name: z.string()
+const manifestSchema = z$1.object({
+	archiveId: z$1.string().min(1),
+	createdAt: z$1.string().min(1),
+	org: z$1.object({
+		id: z$1.string(),
+		slug: z$1.string(),
+		name: z$1.string()
 	}),
-	producer: z.object({
-		service: z.string(),
-		environment: z.string(),
-		formatVersion: z.string()
+	producer: z$1.object({
+		service: z$1.string(),
+		environment: z$1.string(),
+		formatVersion: z$1.string()
 	}),
-	requestedBy: z.object({
-		actorType: z.string(),
-		actorId: z.string(),
-		label: z.string().nullable()
+	requestedBy: z$1.object({
+		actorType: z$1.string(),
+		actorId: z$1.string(),
+		label: z$1.string().nullable()
 	}),
-	options: z.object({
-		includeVersions: z.boolean(),
-		includeAudit: z.boolean(),
-		auditLimit: z.number().int().min(0)
+	options: z$1.object({
+		includeVersions: z$1.boolean(),
+		includeAudit: z$1.boolean(),
+		auditLimit: z$1.number().int().min(0)
 	}),
-	sections: z.array(sectionHeaderSchema),
-	digest: z.string().regex(/^sha256:[0-9a-f]{64}$/)
+	sections: z$1.array(sectionHeaderSchema),
+	digest: z$1.string().regex(/^sha256:[0-9a-f]{64}$/)
 });
-const signatureSchema = z.object({
-	algorithm: z.literal("ed25519"),
-	publicKey: z.string().regex(/^[0-9a-f]{64}$/),
-	keyId: z.string().regex(/^[0-9a-f]{16}$/),
-	value: z.string().regex(/^[0-9a-f]{128}$/)
+const signatureSchema = z$1.object({
+	algorithm: z$1.literal("ed25519"),
+	publicKey: z$1.string().regex(/^[0-9a-f]{64}$/),
+	keyId: z$1.string().regex(/^[0-9a-f]{16}$/),
+	value: z$1.string().regex(/^[0-9a-f]{128}$/)
 });
 /**
 * Envelope schema. `data` is validated only as an object: a v1 verifier must
@@ -965,11 +965,11 @@ const signatureSchema = z.object({
 * `verifyArchive`'s undeclared/declared cross-check rather than by rejecting
 * the file outright.
 */
-const archiveSchema = z.object({
-	format: z.literal(ARCHIVE_FORMAT),
+const archiveSchema = z$1.object({
+	format: z$1.literal(ARCHIVE_FORMAT),
 	manifest: manifestSchema,
 	signature: signatureSchema.nullable(),
-	data: z.record(z.string(), z.unknown())
+	data: z$1.record(z$1.string(), z$1.unknown())
 });
 /** Parse untrusted JSON text into an archive. Throws with a readable message. */
 function parseArchive(text) {
@@ -1238,15 +1238,15 @@ function describeChange(kind, name, restoreFrom) {
 }
 // ../../packages/core/src/connect.ts
 /** Workload authentication is separate from secret-decryption principals. */
-const workloadPublicKeySchema = z.object({
-	kty: z.literal("EC"),
-	crv: z.literal("P-256"),
-	x: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
-	y: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+const workloadPublicKeySchema = z$1.object({
+	kty: z$1.literal("EC"),
+	crv: z$1.literal("P-256"),
+	x: z$1.string().regex(/^[A-Za-z0-9_-]{43}$/),
+	y: z$1.string().regex(/^[A-Za-z0-9_-]{43}$/)
 }).strict();
-const audienceSchema = z.string().min(1).max(256).regex(/^[^\s]+$/);
+const audienceSchema = z$1.string().min(1).max(256).regex(/^[^\s]+$/);
 /** HTTPS endpoint syntax. Resolved-address safety is enforced by the server runtime. */
-const connectUrlSchema = z.string().max(2048).url().refine((value) => {
+const connectUrlSchema = z$1.string().max(2048).url().refine((value) => {
 	try {
 		const u = new URL(value);
 		return u.protocol === "https:" && !u.username && !u.password && !u.hash && !u.search && !u.port && u.hostname.length <= 253 && u.hostname.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) && u.hostname.includes(".") && !/^[0-9.]+$/.test(u.hostname) && !u.hostname.endsWith(".") && !/(^|\.)(localhost|local|localdomain|internal|invalid|home|home\.arpa|onion)$/.test(u.hostname);
@@ -1254,12 +1254,12 @@ const connectUrlSchema = z.string().max(2048).url().refine((value) => {
 		return false;
 	}
 }, "use a public HTTPS hostname without credentials, query, fragment, or port");
-const federationPolicySchema = z.object({
+const federationPolicySchema = z$1.object({
 	issuer: connectUrlSchema,
 	jwksUri: connectUrlSchema,
 	audience: audienceSchema,
-	subject: z.string().min(1).max(512),
-	claims: z.record(z.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/), z.string().min(1).max(512)).refine((claims) => Object.keys(claims).length <= 20 && Object.keys(claims).every((key) => ![
+	subject: z$1.string().min(1).max(512),
+	claims: z$1.record(z$1.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/), z$1.string().min(1).max(512)).refine((claims) => Object.keys(claims).length <= 20 && Object.keys(claims).every((key) => ![
 		"iss",
 		"aud",
 		"sub",
@@ -1268,29 +1268,29 @@ const federationPolicySchema = z.object({
 		"nbf"
 	].includes(key))).default({})
 }).strict();
-z.object({
-	name: z.string().trim().min(1).max(100),
-	environmentId: z.string().min(1).max(128),
+z$1.object({
+	name: z$1.string().trim().min(1).max(100),
+	environmentId: z$1.string().min(1).max(128),
 	publicKey: workloadPublicKeySchema.optional(),
 	federation: federationPolicySchema.optional(),
-	audiences: z.array(audienceSchema).max(20).default([]),
-	maxTtlSeconds: z.number().int().min(60).max(900).default(300)
+	audiences: z$1.array(audienceSchema).max(20).default([]),
+	maxTtlSeconds: z$1.number().int().min(60).max(900).default(300)
 }).strict().refine((v) => !!v.publicKey !== !!v.federation, "choose a public key or a federation policy");
-z.object({
-	enabled: z.boolean().optional(),
+z$1.object({
+	enabled: z$1.boolean().optional(),
 	publicKey: workloadPublicKeySchema.optional()
 }).strict().refine((v) => v.enabled !== void 0 || v.publicKey !== void 0);
-const githubPermissionsSchema = z.record(z.string().regex(/^[a-z_]{1,64}$/), z.enum(["read", "write"])).refine((p) => Object.keys(p).length > 0 && Object.keys(p).length <= 40, "specify between 1 and 40 permissions");
-const githubScopeSchema = z.object({
-	repositoryIds: z.array(z.number().int().positive().max(Number.MAX_SAFE_INTEGER)).min(1).max(100),
+const githubPermissionsSchema = z$1.record(z$1.string().regex(/^[a-z_]{1,64}$/), z$1.enum(["read", "write"])).refine((p) => Object.keys(p).length > 0 && Object.keys(p).length <= 40, "specify between 1 and 40 permissions");
+const githubScopeSchema = z$1.object({
+	repositoryIds: z$1.array(z$1.number().int().positive().max(Number.MAX_SAFE_INTEGER)).min(1).max(100),
 	permissions: githubPermissionsSchema
 }).strict();
 /** Exact paths or explicitly allowed descendants, without URL decoding ambiguity. */
-const connectPathSchema = z.string().min(1).max(1024).refine((path) => /^\/[A-Za-z0-9_./~-]*$/.test(path) && !path.includes("//") && !path.split("/").some((part) => part === "." || part === ".."), "use an absolute API path without encoded characters or dot segments");
-const proxyRuleSchema = z.object({
+const connectPathSchema = z$1.string().min(1).max(1024).refine((path) => /^\/[A-Za-z0-9_./~-]*$/.test(path) && !path.includes("//") && !path.split("/").some((part) => part === "." || part === ".."), "use an absolute API path without encoded characters or dot segments");
+const proxyRuleSchema = z$1.object({
 	path: connectPathSchema,
-	descendants: z.boolean().default(false),
-	methods: z.array(z.enum([
+	descendants: z$1.boolean().default(false),
+	methods: z$1.array(z$1.enum([
 		"GET",
 		"POST",
 		"PUT",
@@ -1299,18 +1299,18 @@ const proxyRuleSchema = z.object({
 		"HEAD"
 	])).min(1).max(6)
 }).strict();
-const staticScopeSchema = z.object({ rules: z.array(proxyRuleSchema).min(1).max(30) }).strict();
-const oauthScopeSchema = z.object({ scopes: z.array(z.string().regex(/^[\x21\x23-\x5b\x5d-\x7e]{1,200}$/)).min(1).max(50).refine((scopes) => new Set(scopes).size === scopes.length, "scopes must be unique") }).strict();
+const staticScopeSchema = z$1.object({ rules: z$1.array(proxyRuleSchema).min(1).max(30) }).strict();
+const oauthScopeSchema = z$1.object({ scopes: z$1.array(z$1.string().regex(/^[\x21\x23-\x5b\x5d-\x7e]{1,200}$/)).min(1).max(50).refine((scopes) => new Set(scopes).size === scopes.length, "scopes must be unique") }).strict();
 const oauthConfigSchema = oauthScopeSchema.extend({
-	provider: z.literal("oauth"),
-	grantType: z.enum(["client_credentials", "authorization_code"]),
-	clientId: z.string().min(1).max(512),
+	provider: z$1.literal("oauth"),
+	grantType: z$1.enum(["client_credentials", "authorization_code"]),
+	clientId: z$1.string().min(1).max(512),
 	tokenEndpoint: connectUrlSchema,
 	authorizationEndpoint: connectUrlSchema.optional(),
-	tokenAuthMethod: z.enum(["client_secret_basic", "client_secret_post"]).default("client_secret_basic")
+	tokenAuthMethod: z$1.enum(["client_secret_basic", "client_secret_post"]).default("client_secret_basic")
 });
 const customApiConfigSchema = staticScopeSchema.extend({
-	provider: z.literal("custom_api"),
+	provider: z$1.literal("custom_api"),
 	origin: connectUrlSchema.refine((value) => {
 		try {
 			return new URL(value).pathname === "/";
@@ -1318,46 +1318,46 @@ const customApiConfigSchema = staticScopeSchema.extend({
 			return false;
 		}
 	}, "use an origin without a path"),
-	headerName: z.string().regex(/^[A-Za-z][A-Za-z0-9-]{0,63}$/).refine((v) => !/^(accept$|user-agent$|host|cookie|content-|proxy-|forwarded|x-forwarded-|cf-|connection|transfer-encoding|upgrade|trailer|te$)/i.test(v)),
-	headerPrefix: z.string().max(64).regex(/^[\x20-\x7e]*$/).default("Bearer ")
+	headerName: z$1.string().regex(/^[A-Za-z][A-Za-z0-9-]{0,63}$/).refine((v) => !/^(accept$|user-agent$|host|cookie|content-|proxy-|forwarded|x-forwarded-|cf-|connection|transfer-encoding|upgrade|trailer|te$)/i.test(v)),
+	headerPrefix: z$1.string().max(64).regex(/^[\x20-\x7e]*$/).default("Bearer ")
 });
-const connectConfigSchema = z.discriminatedUnion("provider", [
+const connectConfigSchema = z$1.discriminatedUnion("provider", [
 	customApiConfigSchema,
 	oauthConfigSchema,
 	githubScopeSchema.extend({
-		provider: z.literal("github_app"),
-		appId: z.string().regex(/^[A-Za-z0-9_.-]{1,128}$/),
-		installationId: z.string().regex(/^[1-9][0-9]{0,19}$/)
+		provider: z$1.literal("github_app"),
+		appId: z$1.string().regex(/^[A-Za-z0-9_.-]{1,128}$/),
+		installationId: z$1.string().regex(/^[1-9][0-9]{0,19}$/)
 	}),
 	staticScopeSchema.extend({
-		provider: z.literal("static_key"),
-		service: z.literal("resend"),
-		rules: z.array(proxyRuleSchema.refine((rule) => rule.path === "/emails" || rule.path.startsWith("/emails/"), "the Resend connector supports only /emails and its descendants")).min(1).max(30)
+		provider: z$1.literal("static_key"),
+		service: z$1.literal("resend"),
+		rules: z$1.array(proxyRuleSchema.refine((rule) => rule.path === "/emails" || rule.path.startsWith("/emails/"), "the Resend connector supports only /emails and its descendants")).min(1).max(30)
 	})
 ]).refine((v) => v.provider !== "oauth" || v.grantType !== "authorization_code" || !!v.authorizationEndpoint, "authorization-code connections require an authorization endpoint");
-const connectGrantPolicySchema = z.discriminatedUnion("provider", [
-	staticScopeSchema.extend({ provider: z.literal("custom_api") }),
-	oauthScopeSchema.extend({ provider: z.literal("oauth") }),
-	githubScopeSchema.extend({ provider: z.literal("github_app") }),
-	staticScopeSchema.extend({ provider: z.literal("static_key") })
+const connectGrantPolicySchema = z$1.discriminatedUnion("provider", [
+	staticScopeSchema.extend({ provider: z$1.literal("custom_api") }),
+	oauthScopeSchema.extend({ provider: z$1.literal("oauth") }),
+	githubScopeSchema.extend({ provider: z$1.literal("github_app") }),
+	staticScopeSchema.extend({ provider: z$1.literal("static_key") })
 ]);
-z.object({
-	name: z.string().trim().min(1).max(100),
+z$1.object({
+	name: z$1.string().trim().min(1).max(100),
 	config: connectConfigSchema,
-	credentialWrapped: z.string().startsWith("wd1.").max(32e3)
+	credentialWrapped: z$1.string().startsWith("wd1.").max(32e3)
 }).strict();
-z.object({
-	enabled: z.boolean().optional(),
-	credentialWrapped: z.string().startsWith("wd1.").max(32e3).optional()
+z$1.object({
+	enabled: z$1.boolean().optional(),
+	credentialWrapped: z$1.string().startsWith("wd1.").max(32e3).optional()
 }).strict().refine((v) => v.enabled !== void 0 || v.credentialWrapped !== void 0);
-z.object({
-	workloadId: z.string().min(1).max(128),
-	connectionId: z.string().min(1).max(128),
+z$1.object({
+	workloadId: z$1.string().min(1).max(128),
+	connectionId: z$1.string().min(1).max(128),
 	policy: connectGrantPolicySchema
 }).strict();
-z.object({
+z$1.object({
 	path: connectPathSchema,
-	method: z.enum([
+	method: z$1.enum([
 		"GET",
 		"POST",
 		"PUT",
@@ -1365,11 +1365,11 @@ z.object({
 		"DELETE",
 		"HEAD"
 	]).default("GET"),
-	query: z.record(z.string().min(1).max(100), z.string().max(2048)).default({}),
+	query: z$1.record(z$1.string().min(1).max(100), z$1.string().max(2048)).default({}),
 	/** JSON only; callers cannot inject authorization or forwarding headers. */
-	body: z.string().max(65536).optional()
+	body: z$1.string().max(65536).optional()
 }).strict().refine((v) => !["GET", "HEAD"].includes(v.method) || v.body === void 0, "GET and HEAD cannot carry a body");
-z.object({ audience: audienceSchema }).strict();
+z$1.object({ audience: audienceSchema }).strict();
 // ../../packages/core/src/dotenv.ts
 /**
 * `.env` parsing and serialization — the canonical definition of what a `.env`
@@ -1752,7 +1752,7 @@ function prettyJsonOrRaw(value) {
 	const inspection = inspectJsonValue(value);
 	return inspection.kind === "json" ? inspection.pretty : value;
 }
-z.enum([
+z$1.enum([
 	"postgres",
 	"mysql",
 	"ssh",
@@ -1761,35 +1761,35 @@ z.enum([
 	"gcp",
 	"mongodb"
 ]);
-const executorModeSchema = z.enum(["in_do", "remote"]);
+const executorModeSchema = z$1.enum(["in_do", "remote"]);
 /**
 * A Postgres role name we are willing to create. Deliberately strict — this
 * value is interpolated into a SQL template, so it must be a bare identifier
 * with no way to break out of quoting (no quotes, whitespace, or semicolons).
 */
-const postgresRoleNameSchema = z.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must be 3–63 chars, lowercase letters/digits/underscore, starting with a letter or underscore");
+const postgresRoleNameSchema = z$1.string().regex(/^[a-z_][a-z0-9_]{2,62}$/, "must be 3–63 chars, lowercase letters/digits/underscore, starting with a letter or underscore");
 /**
 * A SCRAM-SHA-256 verifier string as produced by @seekrit/crypto. Validated so
 * it, too, is safe to interpolate into a quoted SQL literal (the alphabet is
 * base64 + the fixed structural characters, none of which is a single quote).
 */
-const scramVerifierSchema = z.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
+const scramVerifierSchema = z$1.string().regex(/^SCRAM-SHA-256\$\d{3,}:[A-Za-z0-9+/=]+\$[A-Za-z0-9+/=]+:[A-Za-z0-9+/=]+$/, "must be a SCRAM-SHA-256 verifier");
 /**
 * An SSH login principal (a Unix-style username the certificate authorizes).
 * Bounded and restricted to a safe charset — principals are SSH-wire-encoded,
 * not shell-interpolated, so this is sanity/DoS hardening, not an injection gate.
 */
-const sshPrincipalSchema = z.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1–64 chars of letters, digits, dot, dash, underscore");
+const sshPrincipalSchema = z$1.string().regex(/^[A-Za-z0-9._-]{1,64}$/, "must be 1–64 chars of letters, digits, dot, dash, underscore");
 /** An `ssh-ed25519 <base64> [comment]` public key line (deep-validated on sign). */
-const sshPublicKeySchema = z.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
+const sshPublicKeySchema = z$1.string().max(2048).regex(/^ssh-ed25519 [A-Za-z0-9+/=]+( .*)?$/, "must be an ssh-ed25519 public key");
 /** An SSH certificate extension name, e.g. `permit-pty`. */
-const sshExtensionSchema = z.string().regex(/^[a-z0-9-]{1,64}$/);
+const sshExtensionSchema = z$1.string().regex(/^[a-z0-9-]{1,64}$/);
 /**
 * A MySQL/MariaDB user name we are willing to create. Interpolated into a
 * quoted SQL literal (`'{{name}}'@'%'`), so it is kept strict — plain
 * alphanumerics/underscore, no quotes/whitespace/semicolons to break out.
 */
-const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+const mysqlUserNameSchema = z$1.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
 /**
 * A `mysql_native_password` authentication string — `*` followed by 40 upper
 * hex chars (`UPPER(HEX(SHA1(SHA1(password))))`), as produced by
@@ -1797,14 +1797,14 @@ const mysqlUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3
 * `CREATE USER … IDENTIFIED WITH mysql_native_password AS '<str>'`, and its
 * alphabet contains no single quote, so it is safe in a quoted SQL literal.
 */
-const mysqlNativeVerifierSchema = z.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
+const mysqlNativeVerifierSchema = z$1.string().regex(/^\*[0-9A-F]{40}$/, "must be a mysql_native_password hash (*<40 hex>)");
 /**
 * A Redis ACL user name we are willing to create. Interpolated into a Redis
 * command line as a bare token (`ACL SETUSER <name> …`), so it is kept strict —
 * plain alphanumerics/underscore, no whitespace to split the arg or ACL rule
 * characters (`~ + @ # & %`) that could be read as a permission.
 */
-const redisUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
+const redisUserNameSchema = z$1.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3–32 chars, letters/digits/underscore");
 /**
 * A Redis password verifier — the lowercase-hex SHA-256 of the password, as
 * produced by @seekrit/crypto `redisSha256Verifier`. `ACL SETUSER … on #<hex>`
@@ -1813,22 +1813,22 @@ const redisUserNameSchema = z.string().regex(/^[A-Za-z0-9_]{3,32}$/, "must be 3
 * is preimage-resistant (the password is high-entropy and machine-generated).
 * The alphabet is bare hex, so it is a safe bare command token.
 */
-const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase-hex SHA-256 digest (64 chars)");
+const redisSha256VerifierSchema = z$1.string().regex(/^[0-9a-f]{64}$/, "must be a lowercase-hex SHA-256 digest (64 chars)");
 /**
 * An IAM role ARN the broker is allowed to assume. Bounded and structurally
 * validated: `arn:<partition>:iam::<account>:role/<path-and-name>`. Partition
 * covers commercial (`aws`), GovCloud (`aws-us-gov`), and China (`aws-cn`).
 */
-const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
+const awsRoleArnSchema = z$1.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
 /** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
-const awsRegionSchema$1 = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+const awsRegionSchema$1 = z$1.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
 /**
 * An STS external id — the shared string a role's trust policy can require so a
 * confused-deputy can't assume it. AWS allows a broad charset; we keep to the
 * documented safe set and bound the length.
 */
-const awsExternalIdSchema = z.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
-z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
+const awsExternalIdSchema = z$1.string().regex(/^[\w+=,.@:/-]{2,1224}$/, "must be a valid STS external id");
+z$1.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@-]");
 /**
 * A GCP service-account email the broker is allowed to impersonate (or that
 * appears in a delegation chain). Structurally validated and bounded: it is
@@ -1837,21 +1837,21 @@ z.string().regex(/^[\w+=,.@-]{2,64}$/, "must be 2–64 chars of [A-Za-z0-9_+=,.@
 * (`name@<project>.iam.gserviceaccount.com`) and Google-managed
 * (`<project-number>-compute@developer.gserviceaccount.com`) forms.
 */
-const gcpServiceAccountEmailSchema = z.string().max(256).regex(/^[a-z0-9-]+@[a-z0-9.-]+\.gserviceaccount\.com$/, "must be a service-account email (…@….gserviceaccount.com)");
+const gcpServiceAccountEmailSchema = z$1.string().max(256).regex(/^[a-z0-9-]+@[a-z0-9.-]+\.gserviceaccount\.com$/, "must be a service-account email (…@….gserviceaccount.com)");
 /**
 * An OAuth 2.0 scope granted to the minted access token, e.g.
 * `https://www.googleapis.com/auth/cloud-platform`. Bounded and whitespace-free
 * (scopes are space-delimited); passed to the IAM Credentials API in a JSON body
 * array, not a URL, so this is sanity/DoS hardening rather than an injection gate.
 */
-const gcpOauthScopeSchema = z.string().min(1).max(256).regex(/^\S+$/, "must be a single OAuth scope with no whitespace");
+const gcpOauthScopeSchema = z$1.string().min(1).max(256).regex(/^\S+$/, "must be a single OAuth scope with no whitespace");
 /**
 * The consumer's ephemeral P-256 public key (JWK-serialized) that a tier-2
 * credential is wrapped to before it is returned. Validated structurally here;
 * the executor imports it defensively before wrapping. Bounded so a giant blob
 * can't be pushed through the control plane.
 */
-const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
+const p256PublicKeyJwkSchema = z$1.string().max(2048).refine((s) => {
 	try {
 		const jwk = JSON.parse(s);
 		return jwk.kty === "EC" && jwk.crv === "P-256" && !!jwk.x && !!jwk.y;
@@ -1859,23 +1859,23 @@ const p256PublicKeyJwkSchema = z.string().max(2048).refine((s) => {
 		return false;
 	}
 }, "must be a JWK-serialized P-256 public key");
-z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
+z$1.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1–64 chars of [A-Za-z0-9_-]");
 /**
 * A MongoDB database name — the db a preset role is granted on, or the
 * authentication database a leased user is created in. MongoDB forbids
 * `/\. "$*<>:|?` and the empty string in db names; we keep to a safe subset.
 */
-const mongoDatabaseNameSchema = z.string().regex(/^[A-Za-z0-9_-]{1,63}$/, "must be 1–63 chars of [A-Za-z0-9_-]");
+const mongoDatabaseNameSchema = z$1.string().regex(/^[A-Za-z0-9_-]{1,63}$/, "must be 1–63 chars of [A-Za-z0-9_-]");
 /**
 * A single MongoDB role grant `{ role, db }` for a `custom` target — e.g.
 * `{ role: "readWrite", db: "app" }` or a user-defined role. Admin-supplied
 * trusted input, set once at registration; still bounded structurally.
 */
-const mongoRoleSchema = z.object({
-	role: z.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be a role name"),
+const mongoRoleSchema = z$1.object({
+	role: z$1.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be a role name"),
 	db: mongoDatabaseNameSchema
 });
-const postgresAccessLevelSchema = z.enum([
+const postgresAccessLevelSchema = z$1.enum([
 	"readonly",
 	"readwrite",
 	"custom"
@@ -1885,109 +1885,109 @@ const POSTGRES_GROUP_ROLES = {
 	readonly: "seekrit_readonly",
 	readwrite: "seekrit_readwrite"
 };
-const mysqlAccessLevelSchema = z.enum([
+const mysqlAccessLevelSchema = z$1.enum([
 	"readonly",
 	"readwrite",
 	"custom"
 ]);
-const redisAccessLevelSchema = z.enum([
+const redisAccessLevelSchema = z$1.enum([
 	"readonly",
 	"readwrite",
 	"custom"
 ]);
-const mongoAccessLevelSchema = z.enum([
+const mongoAccessLevelSchema = z$1.enum([
 	"readonly",
 	"readwrite",
 	"custom"
 ]);
-const connectionSchema = z.object({
-	host: z.string().min(1),
-	port: z.number().int().min(1).max(65535),
-	database: z.string().min(1)
+const connectionSchema = z$1.object({
+	host: z$1.string().min(1),
+	port: z$1.number().int().min(1).max(65535),
+	database: z$1.string().min(1)
 });
 /** A `{{name}}`/`{{verifier}}`/`{{valid_until}}` templated SQL statement. */
-const statementSchema$1 = z.string().min(1).max(4e3);
+const statementSchema$1 = z$1.string().min(1).max(4e3);
 /** A bare SQL identifier (schema name) — no quotes/whitespace/semicolons. */
-const identifierSchema = z.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
-const postgresTargetConfigSchema = z.object({
-	provider: z.literal("postgres"),
+const identifierSchema = z$1.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/, "must be an identifier");
+const postgresTargetConfigSchema = z$1.object({
+	provider: z$1.literal("postgres"),
 	executor: executorModeSchema,
 	accessLevel: postgresAccessLevelSchema.optional(),
 	schema: identifierSchema.optional(),
 	connection: connectionSchema,
-	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema$1).max(16).optional(),
-	revokeStatements: z.array(statementSchema$1).max(16).optional()
+	provisionerUrl: z$1.url().optional(),
+	createStatements: z$1.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z$1.array(statementSchema$1).max(16).optional()
 });
 /** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
-const mysqlHostSchema$1 = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
-const mysqlTargetConfigSchema = z.object({
-	provider: z.literal("mysql"),
+const mysqlHostSchema$1 = z$1.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const mysqlTargetConfigSchema = z$1.object({
+	provider: z$1.literal("mysql"),
 	executor: executorModeSchema,
 	accessLevel: mysqlAccessLevelSchema.optional(),
 	connection: connectionSchema,
 	userHost: mysqlHostSchema$1.optional(),
-	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema$1).max(16).optional(),
-	revokeStatements: z.array(statementSchema$1).max(16).optional()
+	provisionerUrl: z$1.url().optional(),
+	createStatements: z$1.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z$1.array(statementSchema$1).max(16).optional()
 });
-const redisConnectionSchema = z.object({
-	host: z.string().min(1),
-	port: z.number().int().min(1).max(65535),
+const redisConnectionSchema = z$1.object({
+	host: z$1.string().min(1),
+	port: z$1.number().int().min(1).max(65535),
 	/** Redis logical database index (the `/<n>` in a connection URL). */
-	db: z.number().int().min(0).max(15).optional()
+	db: z$1.number().int().min(0).max(15).optional()
 });
-const redisTargetConfigSchema = z.object({
-	provider: z.literal("redis"),
+const redisTargetConfigSchema = z$1.object({
+	provider: z$1.literal("redis"),
 	executor: executorModeSchema,
 	accessLevel: redisAccessLevelSchema.optional(),
 	connection: redisConnectionSchema,
-	provisionerUrl: z.url().optional(),
-	createStatements: z.array(statementSchema$1).max(16).optional(),
-	revokeStatements: z.array(statementSchema$1).max(16).optional()
+	provisionerUrl: z$1.url().optional(),
+	createStatements: z$1.array(statementSchema$1).max(16).optional(),
+	revokeStatements: z$1.array(statementSchema$1).max(16).optional()
 });
-const sshTargetConfigSchema = z.object({
-	provider: z.literal("ssh"),
-	executor: z.literal("in_do"),
+const sshTargetConfigSchema = z$1.object({
+	provider: z$1.literal("ssh"),
+	executor: z$1.literal("in_do"),
 	caPublicKey: sshPublicKeySchema,
-	allowedPrincipals: z.array(sshPrincipalSchema).max(64).optional(),
-	extensions: z.array(sshExtensionSchema).max(16).optional(),
-	maxTtlSeconds: z.number().int().min(60).max(604800).optional(),
-	connection: z.object({
-		host: z.string().min(1).optional(),
+	allowedPrincipals: z$1.array(sshPrincipalSchema).max(64).optional(),
+	extensions: z$1.array(sshExtensionSchema).max(16).optional(),
+	maxTtlSeconds: z$1.number().int().min(60).max(604800).optional(),
+	connection: z$1.object({
+		host: z$1.string().min(1).optional(),
 		user: sshPrincipalSchema.optional()
 	}).optional()
 });
 const AWS_MAX_TTL_SECONDS = 43200;
-const awsTargetConfigSchema = z.object({
-	provider: z.literal("aws"),
-	executor: z.literal("in_do"),
+const awsTargetConfigSchema = z$1.object({
+	provider: z$1.literal("aws"),
+	executor: z$1.literal("in_do"),
 	roleArn: awsRoleArnSchema,
 	region: awsRegionSchema$1,
 	externalId: awsExternalIdSchema.optional(),
-	sessionPolicy: z.string().min(1).max(4e3).optional(),
-	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
+	sessionPolicy: z$1.string().min(1).max(4e3).optional(),
+	maxTtlSeconds: z$1.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
 });
 const GCP_MAX_TTL_SECONDS = 43200;
-const gcpTargetConfigSchema = z.object({
-	provider: z.literal("gcp"),
-	executor: z.literal("in_do"),
+const gcpTargetConfigSchema = z$1.object({
+	provider: z$1.literal("gcp"),
+	executor: z$1.literal("in_do"),
 	serviceAccount: gcpServiceAccountEmailSchema,
-	scopes: z.array(gcpOauthScopeSchema).min(1).max(32).optional(),
-	delegates: z.array(gcpServiceAccountEmailSchema).max(8).optional(),
-	maxTtlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
+	scopes: z$1.array(gcpOauthScopeSchema).min(1).max(32).optional(),
+	delegates: z$1.array(gcpServiceAccountEmailSchema).max(8).optional(),
+	maxTtlSeconds: z$1.number().int().min(60).max(GCP_MAX_TTL_SECONDS).optional()
 });
-const mongoTargetConfigSchema = z.object({
-	provider: z.literal("mongodb"),
-	executor: z.literal("in_do"),
+const mongoTargetConfigSchema = z$1.object({
+	provider: z$1.literal("mongodb"),
+	executor: z$1.literal("in_do"),
 	accessLevel: mongoAccessLevelSchema.optional(),
 	connection: connectionSchema,
 	authSource: mongoDatabaseNameSchema.optional(),
-	roles: z.array(mongoRoleSchema).min(1).max(32).optional(),
-	tls: z.boolean().optional(),
-	maxTtlSeconds: z.number().int().min(60).max(604800).optional()
+	roles: z$1.array(mongoRoleSchema).min(1).max(32).optional(),
+	tls: z$1.boolean().optional(),
+	maxTtlSeconds: z$1.number().int().min(60).max(604800).optional()
 });
-const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
+const leaseTargetConfigSchema = z$1.discriminatedUnion("provider", [
 	postgresTargetConfigSchema,
 	mysqlTargetConfigSchema,
 	redisTargetConfigSchema,
@@ -1996,26 +1996,26 @@ const leaseTargetConfigSchema = z.discriminatedUnion("provider", [
 	gcpTargetConfigSchema,
 	mongoTargetConfigSchema
 ]);
-z.object({
-	name: z.string().trim().min(1).max(128),
+z$1.object({
+	name: z$1.string().trim().min(1).max(128),
 	config: leaseTargetConfigSchema,
 	/**
 	* The admin/provisioning credential (e.g. a Postgres connection string),
 	* encrypted client-side to the broker's public key (a `wd1.` wrap). The
 	* control plane stores only this ciphertext — it never sees the plaintext.
 	*/
-	wrappedAdminSecret: z.string().min(1)
+	wrappedAdminSecret: z$1.string().min(1)
 });
 /** Requested lease lifetime, shared by all providers. */
-const ttlSecondsSchema = z.number().int().min(60).max(604800);
+const ttlSecondsSchema = z$1.number().int().min(60).max(604800);
 /**
 * Client → API: mint a Postgres lease. The client generates the password and
 * its SCRAM verifier locally and sends only the verifier — the plaintext
 * password never leaves the requesting machine.
 */
-const mintPostgresLeaseSchema = z.object({
-	provider: z.literal("postgres"),
-	targetId: z.string().min(1),
+const mintPostgresLeaseSchema = z$1.object({
+	provider: z$1.literal("postgres"),
+	targetId: z$1.string().min(1),
 	roleName: postgresRoleNameSchema,
 	verifier: scramVerifierSchema,
 	ttlSeconds: ttlSecondsSchema
@@ -2025,9 +2025,9 @@ const mintPostgresLeaseSchema = z.object({
 * and its `mysql_native_password` hash locally and sends only the hash — the
 * plaintext password never leaves the requesting machine.
 */
-const mintMysqlLeaseSchema = z.object({
-	provider: z.literal("mysql"),
-	targetId: z.string().min(1),
+const mintMysqlLeaseSchema = z$1.object({
+	provider: z$1.literal("mysql"),
+	targetId: z$1.string().min(1),
 	roleName: mysqlUserNameSchema,
 	verifier: mysqlNativeVerifierSchema,
 	ttlSeconds: ttlSecondsSchema
@@ -2037,9 +2037,9 @@ const mintMysqlLeaseSchema = z.object({
 * SHA-256 hex digest locally and sends only the digest — the plaintext password
 * never leaves the requesting machine.
 */
-const mintRedisLeaseSchema = z.object({
-	provider: z.literal("redis"),
-	targetId: z.string().min(1),
+const mintRedisLeaseSchema = z$1.object({
+	provider: z$1.literal("redis"),
+	targetId: z$1.string().min(1),
 	roleName: redisUserNameSchema,
 	verifier: redisSha256VerifierSchema,
 	ttlSeconds: ttlSecondsSchema
@@ -2049,11 +2049,11 @@ const mintRedisLeaseSchema = z.object({
 * locally and sends only the public key; the signed certificate comes back in
 * the response. The private key never leaves the requesting machine.
 */
-const mintSshLeaseSchema = z.object({
-	provider: z.literal("ssh"),
-	targetId: z.string().min(1),
+const mintSshLeaseSchema = z$1.object({
+	provider: z$1.literal("ssh"),
+	targetId: z$1.string().min(1),
 	publicKey: sshPublicKeySchema,
-	principals: z.array(sshPrincipalSchema).min(1).max(32),
+	principals: z$1.array(sshPrincipalSchema).min(1).max(32),
 	ttlSeconds: ttlSecondsSchema
 });
 /**
@@ -2065,11 +2065,11 @@ const mintSshLeaseSchema = z.object({
 * TTL bounds are STS's own `DurationSeconds` limits (15 min – 12 h), not the
 * generic lease bounds — STS rejects anything below 900 seconds.
 */
-const mintAwsLeaseSchema = z.object({
-	provider: z.literal("aws"),
-	targetId: z.string().min(1),
+const mintAwsLeaseSchema = z$1.object({
+	provider: z$1.literal("aws"),
+	targetId: z$1.string().min(1),
 	recipientPublicKey: p256PublicKeyJwkSchema,
-	ttlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
+	ttlSeconds: z$1.number().int().min(900).max(AWS_MAX_TTL_SECONDS)
 });
 /**
 * Client → API: mint a GCP lease. Like AWS (tier 2): the client generates an
@@ -2081,11 +2081,11 @@ const mintAwsLeaseSchema = z.object({
 * TTL bounds are GCP's `generateAccessToken` limits (1 min – 12 h); tokens over
 * 1 h require the credential-lifetime-extension org policy.
 */
-const mintGcpLeaseSchema = z.object({
-	provider: z.literal("gcp"),
-	targetId: z.string().min(1),
+const mintGcpLeaseSchema = z$1.object({
+	provider: z$1.literal("gcp"),
+	targetId: z$1.string().min(1),
 	recipientPublicKey: p256PublicKeyJwkSchema,
-	ttlSeconds: z.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
+	ttlSeconds: z$1.number().int().min(60).max(GCP_MAX_TTL_SECONDS)
 });
 /**
 * Client → API: mint a MongoDB lease. Like AWS (tier 2), the client generates
@@ -2094,13 +2094,13 @@ const mintGcpLeaseSchema = z.object({
 * to that key. The private key never leaves the requesting machine, so the
 * plaintext credential is only decryptable there.
 */
-const mintMongoLeaseSchema = z.object({
-	provider: z.literal("mongodb"),
-	targetId: z.string().min(1),
+const mintMongoLeaseSchema = z$1.object({
+	provider: z$1.literal("mongodb"),
+	targetId: z$1.string().min(1),
 	recipientPublicKey: p256PublicKeyJwkSchema,
 	ttlSeconds: ttlSecondsSchema
 });
-z.discriminatedUnion("provider", [
+z$1.discriminatedUnion("provider", [
 	mintPostgresLeaseSchema,
 	mintMysqlLeaseSchema,
 	mintRedisLeaseSchema,
@@ -2234,6 +2234,13 @@ function sshHostSetupInstructions(config) {
 		"sudo systemctl reload sshd"
 	].join("\n");
 }
+// ../../packages/core/src/slug.ts
+/**
+* The slug rule, with no dependencies — so a caller that cannot afford zod (the
+* resolve gateway's bundle, see apps/api/src/gateway) validates with the same
+* pattern `slugSchema` uses rather than a copy of it.
+*/
+const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 // ../../packages/core/src/types.ts
 const AUDIT_ACTIONS = [
 	"workload.created",
@@ -2468,94 +2475,94 @@ const NOTIFICATION_TYPE_META = {
 };
 // ../../packages/core/src/schemas.ts
 /** URL-safe identifier segment: `my-app`, `production`, … */
-const slugSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "must be lowercase alphanumeric with hyphens");
-const nameSchema = z.string().trim().min(1).max(128);
+const slugSchema = z$1.string().min(1).max(64).regex(SLUG_PATTERN, "must be lowercase alphanumeric with hyphens");
+const nameSchema = z$1.string().trim().min(1).max(128);
 /** An email address, normalized to trimmed lowercase before validation. */
-const emailSchema = z.string().trim().toLowerCase().pipe(z.email().max(320));
+const emailSchema = z$1.string().trim().toLowerCase().pipe(z$1.email().max(320));
 /** Env-var style secret name: FOO, DATABASE_URL, apiKey2 … */
-const secretNameSchema = z.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
-const orgRoleSchema = z.enum([
+const secretNameSchema = z$1.string().min(1).max(256).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name");
+const orgRoleSchema = z$1.enum([
 	"owner",
 	"admin",
 	"member"
 ]);
 /** Role a person may be invited at — never `owner` (ownership isn't invitable). */
-const inviteRoleSchema = z.enum(["admin", "member"]);
-const principalTypeSchema = z.enum(["user", "service_token"]);
+const inviteRoleSchema = z$1.enum(["admin", "member"]);
+const principalTypeSchema = z$1.enum(["user", "service_token"]);
 /** Org-level capability a service token can hold (never `owner`). */
-const serviceTokenRoleSchema = z.enum(["admin", "member"]);
-z.object({
+const serviceTokenRoleSchema = z$1.enum(["admin", "member"]);
+z$1.object({
 	/** Include the full append-only ciphertext history of every secret. */
-	includeVersions: z.boolean().optional(),
-	includeAudit: z.boolean().optional(),
+	includeVersions: z$1.boolean().optional(),
+	includeAudit: z$1.boolean().optional(),
 	/** Newest audit rows to keep. Exceeding the server cap is a 400, not a silent trim. */
-	auditLimit: z.number().int().min(0).optional()
+	auditLimit: z$1.number().int().min(0).optional()
 });
-z.object({
+z$1.object({
 	name: nameSchema,
 	slug: slugSchema
 });
-z.object({
+z$1.object({
 	name: nameSchema,
 	slug: slugSchema
 });
-z.object({ name: nameSchema });
-z.object({ name: nameSchema });
-z.object({ name: nameSchema });
-z.object({ name: nameSchema });
-z.object({ name: nameSchema });
-z.object({ required: z.boolean() });
-z.object({
+z$1.object({ name: nameSchema });
+z$1.object({ name: nameSchema });
+z$1.object({ name: nameSchema });
+z$1.object({ name: nameSchema });
+z$1.object({ name: nameSchema });
+z$1.object({ required: z$1.boolean() });
+z$1.object({
 	email: emailSchema,
 	role: inviteRoleSchema.default("member")
 });
-z.object({
+z$1.object({
 	name: nameSchema,
 	slug: slugSchema
 });
 /** Compose a group into an application environment (matched by env slug). */
-const appAccessKeySchema = z.object({
-	environmentId: z.string().min(1),
-	userId: z.string().min(1),
-	wrappedDek: z.string().min(1).max(8192)
+const appAccessKeySchema = z$1.object({
+	environmentId: z$1.string().min(1),
+	userId: z$1.string().min(1),
+	wrappedDek: z$1.string().min(1).max(8192)
 });
-const appAccessGrantsSchema = z.array(appAccessKeySchema).max(5e3).optional();
-z.object({
-	userId: z.string().min(1),
-	grants: z.array(appAccessKeySchema).max(5e3)
+const appAccessGrantsSchema = z$1.array(appAccessKeySchema).max(5e3).optional();
+z$1.object({
+	userId: z$1.string().min(1),
+	grants: z$1.array(appAccessKeySchema).max(5e3)
 });
-z.object({ role: orgRoleSchema });
-z.object({
+z$1.object({ role: orgRoleSchema });
+z$1.object({
 	appAccessGrants: appAccessGrantsSchema,
-	groupId: z.string().min(1),
+	groupId: z$1.string().min(1),
 	/** Precedence among an env's groups (higher wins). Appended if omitted. */
-	position: z.number().int().min(0).optional(),
+	position: z$1.number().int().min(0).optional(),
 	/** Client-wrapped group DEK for each sync connection newly reading this group. */
-	syncGrants: z.array(z.object({
-		connectionId: z.string().min(1),
-		wrappedDek: z.string().min(1)
+	syncGrants: z$1.array(z$1.object({
+		connectionId: z$1.string().min(1),
+		wrappedDek: z$1.string().min(1)
 	})).optional()
 });
-z.object({
+z$1.object({
 	/** Wrap the new DEK to all persistent app recipients. */
-	userGrants: z.array(z.object({
-		userId: z.string().min(1),
-		wrappedDek: z.string().min(1).max(8192)
+	userGrants: z$1.array(z$1.object({
+		userId: z$1.string().min(1),
+		wrappedDek: z$1.string().min(1).max(8192)
 	})).max(5e3).optional(),
 	name: nameSchema,
 	slug: slugSchema,
 	/** Environment DEK wrapped to the creator's public key — created client-side. */
-	wrappedDek: z.string().min(1),
+	wrappedDek: z$1.string().min(1),
 	/**
 	* When the org has recovery enabled, the same DEK additionally wrapped to the
 	* org recovery public key, so the environment is recovery-protected from
 	* creation. Omitted when recovery is off (backfilled later by `recovery sync`).
 	*/
-	recoveryWrappedDek: z.string().min(1).nullish()
+	recoveryWrappedDek: z$1.string().min(1).nullish()
 });
-z.object({
+z$1.object({
 	/** Opaque versioned ciphertext blob from @seekrit/crypto. */
-	ciphertext: z.string().min(1).max(65536),
+	ciphertext: z$1.string().min(1).max(65536),
 	/**
 	* Compare-and-swap: write only if the secret is currently at this version
 	* (`0` = only if it does not exist yet), else 412 `precondition_failed`.
@@ -2563,77 +2570,77 @@ z.object({
 	* changed, and wrote back — a refreshed agent login, say — find out that
 	* someone else wrote in between instead of silently erasing their value.
 	*/
-	expectedVersion: z.number().int().min(0).optional()
+	expectedVersion: z$1.number().int().min(0).optional()
 });
-z.object({ version: z.number().int().positive() });
-z.object({ limit: z.coerce.number().int().min(1).max(200).default(50) });
-z.object({
-	requiredApprovals: z.number().int().min(1).max(10).default(1),
-	allowSelfApproval: z.boolean().default(false)
+z$1.object({ version: z$1.number().int().positive() });
+z$1.object({ limit: z$1.coerce.number().int().min(1).max(200).default(50) });
+z$1.object({
+	requiredApprovals: z$1.number().int().min(1).max(10).default(1),
+	allowSelfApproval: z$1.boolean().default(false)
 });
-z.object({ comment: z.string().trim().max(1e3).optional() });
-z.string().trim().min(1).max(1e3);
-z.object({
-	status: z.enum(CHANGE_REQUEST_STATUSES).optional(),
-	envId: z.string().min(1).optional(),
-	limit: z.coerce.number().int().min(1).max(200).default(50)
+z$1.object({ comment: z$1.string().trim().max(1e3).optional() });
+z$1.string().trim().min(1).max(1e3);
+z$1.object({
+	status: z$1.enum(CHANGE_REQUEST_STATUSES).optional(),
+	envId: z$1.string().min(1).optional(),
+	limit: z$1.coerce.number().int().min(1).max(200).default(50)
 });
-z.object({
-	publicKeyJwk: z.string().min(1),
+z$1.object({
+	publicKeyJwk: z$1.string().min(1),
 	/**
 	* Private key encrypted with a passphrase-derived KEK; opaque to the
 	* server. Self-contained blob (embeds KDF salt + iterations).
 	*/
-	encryptedPrivateKey: z.string().min(1)
+	encryptedPrivateKey: z$1.string().min(1)
 });
-z.object({
+z$1.object({
 	/** Base64url WebAuthn credential id — what `allowCredentials` is built from. */
-	credentialId: z.string().min(1).max(512),
+	credentialId: z$1.string().min(1).max(512),
 	/** Human label for the device, e.g. "MacBook Touch ID". Display only. */
-	label: z.string().min(1).max(64),
+	label: z$1.string().min(1).max(64),
 	/** Base64url PRF evaluation input for this credential; not a secret. */
-	prfInput: z.string().min(1).max(256),
+	prfInput: z$1.string().min(1).max(256),
 	/** The private key wrapped to this passkey's PRF output. */
-	encryptedPrivateKey: z.string().min(1).max(8192).refine((v) => v.startsWith("pk2."), { message: "expected a pk2. passkey wrap" })
+	encryptedPrivateKey: z$1.string().min(1).max(8192).refine((v) => v.startsWith("pk2."), { message: "expected a pk2. passkey wrap" })
 });
-const grantEnvironmentKeySchema = z.object({
+const grantEnvironmentKeySchema = z$1.object({
 	principalType: principalTypeSchema,
-	principalId: z.string().min(1),
-	wrappedDek: z.string().min(1)
+	principalId: z$1.string().min(1),
+	wrappedDek: z$1.string().min(1)
 });
-z.object({
+z$1.object({
 	slug: slugSchema,
 	/** Display name; defaults to the slug. */
 	name: nameSchema.optional(),
-	ttlSeconds: z.number().int().min(60).max(MAX_BRANCH_TTL_SECONDS).nullish(),
+	ttlSeconds: z$1.number().int().min(60).max(MAX_BRANCH_TTL_SECONDS).nullish(),
 	/** The branch's own DEK, wrapped to the creator — generated client-side. */
-	wrappedDek: z.string().min(1),
-	recoveryWrappedDek: z.string().min(1).nullish(),
+	wrappedDek: z$1.string().min(1),
+	recoveryWrappedDek: z$1.string().min(1).nullish(),
 	/** The same DEK wrapped to each of the parent's existing grant-holders. */
-	grants: z.array(grantEnvironmentKeySchema).max(500).default([])
+	grants: z$1.array(grantEnvironmentKeySchema).max(500).default([])
 });
 /**
 * Token creation is client-driven so the server never sees the token secret:
 * the client generates the keypair + token string and submits only the hash
 * and public key.
 */
-const environmentGrantBatchSchema = z.array(z.object({
-	environmentId: z.string().min(1),
-	wrappedDek: z.string().min(1).max(8192)
+const environmentGrantBatchSchema = z$1.array(z$1.object({
+	environmentId: z$1.string().min(1),
+	wrappedDek: z$1.string().min(1).max(8192)
 })).max(5e3);
-z.object({
+z$1.object({
 	principalType: principalTypeSchema,
-	principalId: z.string().min(1),
+	principalId: z$1.string().min(1),
 	grants: environmentGrantBatchSchema
 });
-z.object({
+z$1.object({
 	/** Commit the token and all default resolve keys together, when supplied. */
 	initialGrants: environmentGrantBatchSchema.optional(),
 	name: nameSchema,
-	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	tokenId: z$1.string().regex(/^skt_[0-9A-Za-z]+$/),
 	/** SHA-256 hash (base64url) of the full token string. */
-	tokenHash: z.string().min(1),
-	publicKeyJwk: z.string().min(1),
+	tokenHash: z$1.string().min(1),
+	publicKeyJwk: z$1.string().min(1),
 	/**
 	* Org-level capability. Defaults to `member` (a runtime credential); pass
 	* `admin` to mint a headless provisioning token. Only an admin caller may
@@ -2645,35 +2652,35 @@ z.object({
 	* Optional so org-admin tokens can exist, but required for runtime tokens
 	* that resolve secrets via `GET /v1/resolve`.
 	*/
-	environmentId: z.string().min(1).nullish(),
-	expiresAt: z.iso.datetime().nullish()
+	environmentId: z$1.string().min(1).nullish(),
+	expiresAt: z$1.iso.datetime().nullish()
 });
-z.object({
+z$1.object({
 	name: nameSchema,
-	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	tokenId: z$1.string().regex(/^skt_[0-9A-Za-z]+$/),
 	/** SHA-256 hash (base64url) of the full token string. */
-	tokenHash: z.string().min(1),
+	tokenHash: z$1.string().min(1),
 	/** Where the decoy was planted, as a reminder for whoever reads the alert. */
-	placement: z.string().max(200).nullish()
+	placement: z$1.string().max(200).nullish()
 });
-const kmsKeyPurposeSchema = z.enum(["encrypt", "sign"]);
-const kmsKeySpecSchema = z.enum(["aes-256-gcm", "ecdsa-p256"]);
+const kmsKeyPurposeSchema = z$1.enum(["encrypt", "sign"]);
+const kmsKeySpecSchema = z$1.enum(["aes-256-gcm", "ecdsa-p256"]);
 /** A wrapped key grant supplied by the client (server never sees plaintext material). */
-const kmsGrantInputSchema = z.object({
+const kmsGrantInputSchema = z$1.object({
 	principalType: principalTypeSchema,
-	principalId: z.string().min(1),
+	principalId: z$1.string().min(1),
 	/** Key material wrapped to the principal's public key (`wd1.` blob). */
-	wrappedKey: z.string().min(1)
+	wrappedKey: z$1.string().min(1)
 });
-z.object({
+z$1.object({
 	name: nameSchema,
 	purpose: kmsKeyPurposeSchema,
 	spec: kmsKeySpecSchema,
-	applicationId: z.string().min(1).nullish(),
-	groupId: z.string().min(1).nullish(),
+	applicationId: z$1.string().min(1).nullish(),
+	groupId: z$1.string().min(1).nullish(),
 	/** ECDSA P-256 public key (JWK) for `sign` keys; omit for `encrypt` keys. */
-	publicKeyJwk: z.string().min(1).nullish(),
-	grants: z.array(kmsGrantInputSchema).min(1)
+	publicKeyJwk: z$1.string().min(1).nullish(),
+	grants: z$1.array(kmsGrantInputSchema).min(1)
 }).refine((v) => !(v.applicationId && v.groupId), {
 	message: "a key may be scoped to an application or a group, not both",
 	path: ["groupId"]
@@ -2684,15 +2691,15 @@ z.object({
 	message: "sign keys require a publicKeyJwk; encrypt keys must omit it",
 	path: ["publicKeyJwk"]
 });
-z.object({
+z$1.object({
 	principalType: principalTypeSchema,
-	principalId: z.string().min(1),
+	principalId: z$1.string().min(1),
 	/** Current-version key material wrapped to the principal's public key. */
-	wrappedKey: z.string().min(1)
+	wrappedKey: z$1.string().min(1)
 });
-z.object({
-	publicKeyJwk: z.string().min(1).nullish(),
-	grants: z.array(kmsGrantInputSchema).min(1)
+z$1.object({
+	publicKeyJwk: z$1.string().min(1).nullish(),
+	grants: z$1.array(kmsGrantInputSchema).min(1)
 });
 /**
 * One custodian's wrapped Shamir share of the org recovery private key. The
@@ -2700,25 +2707,25 @@ z.object({
 * wraps each share to a custodian's public key — the server stores only the
 * opaque `wrappedShare` and can reconstruct nothing.
 */
-const recoveryShareInputSchema = z.object({
+const recoveryShareInputSchema = z$1.object({
 	principalType: principalTypeSchema,
-	principalId: z.string().min(1),
+	principalId: z$1.string().min(1),
 	/** Shamir x-coordinate carried by the share (1..255). */
-	shareIndex: z.number().int().min(1).max(255),
+	shareIndex: z$1.number().int().min(1).max(255),
 	/** The recovery-key share wrapped to the custodian's public key (`wd1.`). */
-	wrappedShare: z.string().min(1)
+	wrappedShare: z$1.string().min(1)
 });
 /** An environment DEK additionally wrapped to the org recovery public key. */
-const recoveryEnvGrantSchema = z.object({
-	environmentId: z.string().min(1),
+const recoveryEnvGrantSchema = z$1.object({
+	environmentId: z$1.string().min(1),
 	/** The environment's DEK wrapped to the recovery public key (`wd1.`). */
-	wrappedDek: z.string().min(1)
+	wrappedDek: z$1.string().min(1)
 });
-z.object({
-	recoveryPublicKeyJwk: z.string().min(1),
-	threshold: z.number().int().min(1).max(255),
-	shares: z.array(recoveryShareInputSchema).min(1).max(255),
-	grants: z.array(recoveryEnvGrantSchema).default([])
+z$1.object({
+	recoveryPublicKeyJwk: z$1.string().min(1),
+	threshold: z$1.number().int().min(1).max(255),
+	shares: z$1.array(recoveryShareInputSchema).min(1).max(255),
+	grants: z$1.array(recoveryEnvGrantSchema).default([])
 }).refine((v) => v.threshold <= v.shares.length, {
 	message: "threshold cannot exceed the number of custodians",
 	path: ["threshold"]
@@ -2726,104 +2733,104 @@ z.object({
 	message: "custodians must be distinct",
 	path: ["shares"]
 });
-z.object({ grants: z.array(recoveryEnvGrantSchema).min(1).max(500) });
-z.object({
-	targetPublicKeyJwk: z.string().min(1),
+z$1.object({ grants: z$1.array(recoveryEnvGrantSchema).min(1).max(500) });
+z$1.object({
+	targetPublicKeyJwk: z$1.string().min(1),
 	targetType: principalTypeSchema.nullish(),
-	targetId: z.string().min(1).nullish(),
-	reason: z.string().max(500).nullish()
+	targetId: z$1.string().min(1).nullish(),
+	reason: z$1.string().max(500).nullish()
 });
-z.object({
-	shareIndex: z.number().int().min(1).max(255),
+z$1.object({
+	shareIndex: z$1.number().int().min(1).max(255),
 	/** The custodian's share re-wrapped to the target public key (`wd1.`). */
-	contributedShare: z.string().min(1)
+	contributedShare: z$1.string().min(1)
 });
-z.object({
+z$1.object({
 	principalType: principalTypeSchema,
-	principalId: z.string().min(1),
-	grants: z.array(recoveryEnvGrantSchema).min(1).max(500)
+	principalId: z$1.string().min(1),
+	grants: z$1.array(recoveryEnvGrantSchema).min(1).max(500)
 });
-z.object({ prefs: z.partialRecord(z.enum(NOTIFICATION_TYPES), z.boolean()) });
-z.object({
-	endpoint: z.url().max(2048),
-	headers: z.record(z.string().min(1).max(256), z.string().max(4096)).optional(),
-	enabled: z.boolean().default(true)
+z$1.object({ prefs: z$1.partialRecord(z$1.enum(NOTIFICATION_TYPES), z$1.boolean()) });
+z$1.object({
+	endpoint: z$1.url().max(2048),
+	headers: z$1.record(z$1.string().min(1).max(256), z$1.string().max(4096)).optional(),
+	enabled: z$1.boolean().default(true)
 });
-const planFamilySchema = z.enum(PLAN_FAMILY_IDS);
-const subscriptionStatusSchema = z.enum(SUBSCRIPTION_STATUSES);
-z.enum(ENTITLEMENT_KEYS);
+const planFamilySchema = z$1.enum(PLAN_FAMILY_IDS);
+const subscriptionStatusSchema = z$1.enum(SUBSCRIPTION_STATUSES);
+z$1.enum(ENTITLEMENT_KEYS);
 /** An entitlement value: boolean (features), number or null/unlimited (limits, metered). */
-const entitlementValueSchema = z.union([
-	z.boolean(),
-	z.number(),
-	z.null()
+const entitlementValueSchema = z$1.union([
+	z$1.boolean(),
+	z$1.number(),
+	z$1.null()
 ]);
-z.object({
+z$1.object({
 	family: planFamilySchema,
-	version: z.number().int().positive().optional(),
+	version: z$1.number().int().positive().optional(),
 	status: subscriptionStatusSchema.default("active")
 });
-z.object({
+z$1.object({
 	value: entitlementValueSchema,
-	note: z.string().max(500).nullish(),
-	expiresAt: z.iso.datetime().nullish()
+	note: z$1.string().max(500).nullish(),
+	expiresAt: z$1.iso.datetime().nullish()
 });
-z.object({
-	code: z.string().min(4).max(40),
+z$1.object({
+	code: z$1.string().min(4).max(40),
 	family: planFamilySchema,
-	version: z.number().int().positive().optional(),
-	durationDays: z.number().int().positive().max(3650).nullish(),
-	maxRedemptions: z.number().int().positive().nullish(),
-	startsAt: z.iso.datetime().nullish(),
-	endsAt: z.iso.datetime().nullish(),
-	note: z.string().max(500).nullish()
+	version: z$1.number().int().positive().optional(),
+	durationDays: z$1.number().int().positive().max(3650).nullish(),
+	maxRedemptions: z$1.number().int().positive().nullish(),
+	startsAt: z$1.iso.datetime().nullish(),
+	endsAt: z$1.iso.datetime().nullish(),
+	note: z$1.string().max(500).nullish()
 });
-z.object({
-	maxRedemptions: z.number().int().positive().nullish(),
-	startsAt: z.iso.datetime().nullish(),
-	endsAt: z.iso.datetime().nullish(),
-	note: z.string().max(500).nullish(),
+z$1.object({
+	maxRedemptions: z$1.number().int().positive().nullish(),
+	startsAt: z$1.iso.datetime().nullish(),
+	endsAt: z$1.iso.datetime().nullish(),
+	note: z$1.string().max(500).nullish(),
 	/** Kill switch. Disabling stops new redemptions; live grants are untouched. */
-	disabled: z.boolean().optional()
+	disabled: z$1.boolean().optional()
 });
-z.object({ code: z.string().min(1).max(40) });
-z.object({ family: planFamilySchema });
-z.object({
-	sessionId: z.string().regex(/^skc_[0-9A-Za-z]+$/),
+z$1.object({ code: z$1.string().min(1).max(40) });
+z$1.object({ family: planFamilySchema });
+z$1.object({
+	sessionId: z$1.string().regex(/^skc_[0-9A-Za-z]+$/),
 	/** SHA-256 hash (base64url) of the full session token string. */
-	tokenHash: z.string().min(1).max(128),
+	tokenHash: z$1.string().min(1).max(128),
 	/** Display-only, e.g. `miles@studio.local`. */
-	deviceLabel: z.string().trim().min(1).max(120),
+	deviceLabel: z$1.string().trim().min(1).max(120),
 	/** Display-only, e.g. `cli/0.4.2`. */
-	client: z.string().trim().max(60).optional()
+	client: z$1.string().trim().max(60).optional()
 });
-z.object({ code: z.string().trim().min(1).max(32) });
-z.object({
-	cursor: z.string().optional(),
-	limit: z.coerce.number().int().min(1).max(200).default(50),
-	action: z.string().optional(),
-	resourceType: z.string().optional()
+z$1.object({ code: z$1.string().trim().min(1).max(32) });
+z$1.object({
+	cursor: z$1.string().optional(),
+	limit: z$1.coerce.number().int().min(1).max(200).default(50),
+	action: z$1.string().optional(),
+	resourceType: z$1.string().optional()
 });
-z.enum([
+z$1.enum([
 	"generated",
 	"postgres",
 	"mysql",
 	"redis"
 ]);
-z.enum([
+z$1.enum([
 	"active",
 	"paused",
 	"failed"
 ]);
 /** Statuses an admin may set directly (`failed` is only reached by the sweep). */
-const settableRotationStatusSchema = z.enum(["active", "paused"]);
-const rotationAlphabetSchema = z.enum([
+const settableRotationStatusSchema = z$1.enum(["active", "paused"]);
+const rotationAlphabetSchema = z$1.enum([
 	"alphanumeric",
 	"hex",
 	"base64url",
 	"printable"
 ]);
-const rotationIntervalSchema = z.number().int().min(300).max(31536e3);
+const rotationIntervalSchema = z$1.number().int().min(300).max(31536e3);
 /**
 * A database user name we are willing to *re-key*. Deliberately more permissive
 * than the lease providers' name schemas — those name accounts seekrit creates,
@@ -2836,44 +2843,44 @@ const rotationIntervalSchema = z.number().int().min(300).max(31536e3);
 * `;`, so there is no way out of the surrounding quoting, and no whitespace to
 * split one Redis argument into two.
 */
-const rotationUsernameSchema = z.string().regex(/^[A-Za-z0-9_$.-]{1,63}$/, "must be 1–63 chars of letters, digits, underscore, dollar, dot or dash");
+const rotationUsernameSchema = z$1.string().regex(/^[A-Za-z0-9_$.-]{1,63}$/, "must be 1–63 chars of letters, digits, underscore, dollar, dot or dash");
 /** A `{{name}}`/`{{host}}`/`{{verifier}}` templated statement or command line. */
-const statementSchema = z.string().min(1).max(4e3);
-const passwordLengthSchema = z.number().int().min(16).max(256);
+const statementSchema = z$1.string().min(1).max(4e3);
+const passwordLengthSchema = z$1.number().int().min(16).max(256);
 /** A MySQL account host part (`'name'@'<host>'`) — no quotes/whitespace. */
-const mysqlHostSchema = z.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
-const generatedRotationConfigSchema = z.object({
-	kind: z.literal("generated"),
+const mysqlHostSchema = z$1.string().regex(/^[A-Za-z0-9_.%:-]{1,255}$/, "must be a host pattern");
+const generatedRotationConfigSchema = z$1.object({
+	kind: z$1.literal("generated"),
 	length: passwordLengthSchema.optional(),
 	alphabet: rotationAlphabetSchema.optional()
 });
-const postgresRotationConfigSchema = z.object({
-	kind: z.literal("postgres"),
+const postgresRotationConfigSchema = z$1.object({
+	kind: z$1.literal("postgres"),
 	username: rotationUsernameSchema,
 	passwordLength: passwordLengthSchema.optional(),
-	statements: z.array(statementSchema).max(16).optional()
+	statements: z$1.array(statementSchema).max(16).optional()
 });
-const mysqlRotationConfigSchema = z.object({
-	kind: z.literal("mysql"),
+const mysqlRotationConfigSchema = z$1.object({
+	kind: z$1.literal("mysql"),
 	username: rotationUsernameSchema,
 	userHost: mysqlHostSchema.optional(),
 	passwordLength: passwordLengthSchema.optional(),
-	statements: z.array(statementSchema).max(16).optional()
+	statements: z$1.array(statementSchema).max(16).optional()
 });
-const redisRotationConfigSchema = z.object({
-	kind: z.literal("redis"),
+const redisRotationConfigSchema = z$1.object({
+	kind: z$1.literal("redis"),
 	username: rotationUsernameSchema,
 	passwordLength: passwordLengthSchema.optional(),
-	statements: z.array(statementSchema).max(16).optional()
+	statements: z$1.array(statementSchema).max(16).optional()
 });
-const rotationConfigSchema = z.discriminatedUnion("kind", [
+const rotationConfigSchema = z$1.discriminatedUnion("kind", [
 	generatedRotationConfigSchema,
 	postgresRotationConfigSchema,
 	mysqlRotationConfigSchema,
 	redisRotationConfigSchema
 ]);
-z.object({
-	environmentId: z.string().min(1),
+z$1.object({
+	environmentId: z$1.string().min(1),
 	/** The secret whose value rotates. It must already exist. */
 	secretName: secretNameSchema,
 	config: rotationConfigSchema,
@@ -2882,13 +2889,13 @@ z.object({
 	* The registered lease target supplying the connection, executor mode, and
 	* wrapped admin credential. Required for every kind but `generated`.
 	*/
-	targetId: z.string().min(1).optional(),
+	targetId: z$1.string().min(1).optional(),
 	/** Environment DEK wrapped to the rotator public key (`wd1.` blob). */
-	wrappedDek: z.string().min(1).optional(),
+	wrappedDek: z$1.string().min(1).optional(),
 	/** Rotate once immediately instead of waiting for the first interval. */
-	rotateNow: z.boolean().optional()
+	rotateNow: z$1.boolean().optional()
 });
-z.object({
+z$1.object({
 	intervalSeconds: rotationIntervalSchema.optional(),
 	config: rotationConfigSchema.optional(),
 	/**
@@ -2948,7 +2955,7 @@ const SYNC_PROVIDER_KINDS = [
 	"openai-vault",
 	"claude-managed-agents"
 ];
-z.enum(SYNC_PROVIDER_KINDS);
+z$1.enum(SYNC_PROVIDER_KINDS);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
 * the connection's public key and stored as ciphertext.
@@ -2957,10 +2964,10 @@ z.enum(SYNC_PROVIDER_KINDS);
 * tokens omit it. Vercel rejects team-owned project calls that lack it with a
 * bare 403, so we pass it through as `?teamId=` on every request.
 */
-const vercelConnectionConfigSchema = z.object({
-	provider: z.literal("vercel"),
+const vercelConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("vercel"),
 	/** Vercel Team id (`team_…`). Omit for a personal account. */
-	teamId: z.string().trim().min(1).max(128).optional()
+	teamId: z$1.string().trim().min(1).max(128).optional()
 });
 /**
 * A Cloudflare account id — 32 lowercase hex characters, found in the sidebar
@@ -2971,7 +2978,7 @@ const vercelConnectionConfigSchema = z.object({
 * hours later inside an alarm, with nobody watching. It does not catch pasting
 * a *zone* id, which has the same shape — only the API can tell those apart.
 */
-const cloudflareAccountIdSchema = z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Cloudflare account ID (lowercase hex)");
+const cloudflareAccountIdSchema = z$1.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Cloudflare account ID (lowercase hex)");
 /**
 * Cloudflare account scope, shared by all three Cloudflare providers. The API
 * token is never here — it is wrapped to the connection's public key and
@@ -2982,16 +2989,16 @@ const cloudflareAccountIdSchema = z.string().trim().regex(/^[0-9a-f]{32}$/, "mus
 * destinations, and fail in different ways. Splitting them keeps the
 * exhaustiveness guard in `connectorFor` meaningful.
 */
-const cloudflareWorkersConnectionConfigSchema = z.object({
-	provider: z.literal("cloudflare-workers"),
+const cloudflareWorkersConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("cloudflare-workers"),
 	accountId: cloudflareAccountIdSchema
 });
-const cloudflarePagesConnectionConfigSchema = z.object({
-	provider: z.literal("cloudflare-pages"),
+const cloudflarePagesConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("cloudflare-pages"),
 	accountId: cloudflareAccountIdSchema
 });
-const cloudflareSecretsStoreConnectionConfigSchema = z.object({
-	provider: z.literal("cloudflare-secrets-store"),
+const cloudflareSecretsStoreConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("cloudflare-secrets-store"),
 	accountId: cloudflareAccountIdSchema
 });
 /**
@@ -3000,7 +3007,7 @@ const cloudflareSecretsStoreConnectionConfigSchema = z.object({
 * bare GraphQL "Problem processing request" hours later inside an alarm, with
 * nobody watching.
 */
-const railwayIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a Railway UUID");
+const railwayIdSchema = z$1.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a Railway UUID");
 /**
 * Which kind of Railway API token the connection holds. This is connection
 * scope rather than a destination detail because it decides the *header* the
@@ -3024,9 +3031,9 @@ const RAILWAY_TOKEN_KINDS = ["account", "project"];
 * a destination names its project outright, so the token plus the destination
 * is the whole address.
 */
-const railwayConnectionConfigSchema = z.object({
-	provider: z.literal("railway"),
-	tokenKind: z.enum(RAILWAY_TOKEN_KINDS).default("account")
+const railwayConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("railway"),
+	tokenKind: z$1.enum(RAILWAY_TOKEN_KINDS).default("account")
 });
 /**
 * An AWS region id (`us-east-1`, `eu-central-1`, `us-gov-west-1`).
@@ -3036,7 +3043,7 @@ const railwayConnectionConfigSchema = z.object({
 * would otherwise surface as a DNS failure inside an alarm with nobody
 * watching — which is a much worse place to learn about it than this form.
 */
-const awsRegionSchema = z.string().trim().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "must be an AWS region ID, e.g. us-east-1");
+const awsRegionSchema = z$1.string().trim().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "must be an AWS region ID, e.g. us-east-1");
 /**
 * The IAM access key id seekrit signs with.
 *
@@ -3051,7 +3058,7 @@ const awsRegionSchema = z.string().trim().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "must
 * Long-lived IAM user keys only. `ASIA…` session credentials from STS expire
 * within hours, and a sync connection has to keep working unattended.
 */
-const awsAccessKeyIdSchema = z.string().trim().regex(/^[A-Z0-9]{16,128}$/, "must be an AWS access key ID, e.g. AKIAIOSFODNN7EXAMPLE");
+const awsAccessKeyIdSchema = z$1.string().trim().regex(/^[A-Z0-9]{16,128}$/, "must be an AWS access key ID, e.g. AKIAIOSFODNN7EXAMPLE");
 /**
 * AWS account scope, shared by both AWS providers: which region to call and
 * which key to sign with. There is no account id — every endpoint seekrit calls
@@ -3062,13 +3069,13 @@ const awsAccessKeyIdSchema = z.string().trim().regex(/^[A-Z0-9]{16,128}$/, "must
 * the three Cloudflare kinds are separate: different APIs, different
 * destinations, different IAM actions.
 */
-const awsSecretsManagerConnectionConfigSchema = z.object({
-	provider: z.literal("aws-secrets-manager"),
+const awsSecretsManagerConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("aws-secrets-manager"),
 	region: awsRegionSchema,
 	accessKeyId: awsAccessKeyIdSchema
 });
-const awsParameterStoreConnectionConfigSchema = z.object({
-	provider: z.literal("aws-parameter-store"),
+const awsParameterStoreConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("aws-parameter-store"),
 	region: awsRegionSchema,
 	accessKeyId: awsAccessKeyIdSchema
 });
@@ -3082,7 +3089,7 @@ const awsParameterStoreConnectionConfigSchema = z.object({
 * nothing is stored. The connection's `name` is what tells an operator which Render
 * workspace it belongs to.
 */
-const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
+const renderConnectionConfigSchema = z$1.object({ provider: z$1.literal("render") });
 /**
 * Fly.io account scope — empty, as Render's is.
 *
@@ -3092,7 +3099,7 @@ const renderConnectionConfigSchema = z.object({ provider: z.literal("render") })
 * is — Fly's two token shapes do take different auth schemes, but
 * `flyAuthorization` in the connector reads which one from the token itself.
 */
-const flyConnectionConfigSchema = z.object({ provider: z.literal("fly") });
+const flyConnectionConfigSchema = z$1.object({ provider: z$1.literal("fly") });
 /**
 * A Northflank id — projects and secret groups are both slugs derived from the
 * name they were created with (`default-project`, `example-secret-group`), and
@@ -3100,7 +3107,7 @@ const flyConnectionConfigSchema = z.object({ provider: z.literal("fly") });
 * so the common slip — pasting the *display name*, spaces and all — fails here
 * rather than as a bare 404 inside an alarm with nobody watching.
 */
-const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/, "must be a Northflank ID — the slug in the resource's URL, not its display name");
+const northflankIdSchema = z$1.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/, "must be a Northflank ID — the slug in the resource's URL, not its display name");
 /**
 * Northflank account scope — deliberately empty.
 *
@@ -3110,7 +3117,7 @@ const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]
 * Cloudflare does: the token plus the destination's project is the whole
 * address. The kind exists so the discriminated union stays uniform.
 */
-const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
+const northflankConnectionConfigSchema = z$1.object({ provider: z$1.literal("northflank") });
 /**
 * DigitalOcean account scope — deliberately empty, as Render's and Fly's are.
 *
@@ -3120,7 +3127,7 @@ const northflankConnectionConfigSchema = z.object({ provider: z.literal("northfl
 * disambiguate the way Vercel needs one: the token plus the destination's app
 * id is the whole address.
 */
-const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digitalocean") });
+const digitalOceanConnectionConfigSchema = z$1.object({ provider: z$1.literal("digitalocean") });
 /**
 * Heroku account scope — empty, as Fly's and Render's are.
 *
@@ -3131,7 +3138,7 @@ const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digit
 * `/apps/{app_id_or_name}` against everything the token can see, team-owned or
 * not.
 */
-const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") });
+const herokuConnectionConfigSchema = z$1.object({ provider: z$1.literal("heroku") });
 /**
 * Netlify team scope — the one thing a Netlify token cannot tell us itself.
 *
@@ -3146,10 +3153,10 @@ const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") })
 * can find without an API call — it is in the dashboard URL
 * (`app.netlify.com/teams/<slug>`) and under Team settings → General.
 */
-const netlifyConnectionConfigSchema = z.object({
-	provider: z.literal("netlify"),
+const netlifyConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("netlify"),
 	/** Netlify team slug (`acme`) or account id — `{account_id}` accepts either. */
-	accountId: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
+	accountId: z$1.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
 });
 /**
 * Bunnyshell account scope — empty, as Fly's, Heroku's, and Northflank's are.
@@ -3163,7 +3170,7 @@ const netlifyConnectionConfigSchema = z.object({
 * id is the whole address. The API offers an `organization` filter, but it
 * narrows a listing — it is not part of an address.
 */
-const bunnyshellConnectionConfigSchema = z.object({ provider: z.literal("bunnyshell") });
+const bunnyshellConnectionConfigSchema = z$1.object({ provider: z$1.literal("bunnyshell") });
 /**
 * GitHub account scope — empty for github.com, which is the whole point.
 *
@@ -3177,13 +3184,13 @@ const bunnyshellConnectionConfigSchema = z.object({ provider: z.literal("bunnysh
 * with a different plan behind it). Set only for a self-hosted GHES appliance,
 * where the REST API is at `https://<host>/api/v3`.
 */
-const githubActionsConnectionConfigSchema = z.object({
-	provider: z.literal("github-actions"),
+const githubActionsConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("github-actions"),
 	/**
 	* GitHub Enterprise Server API root, e.g. `https://github.acme.com/api/v3`.
 	* Omit for github.com. Must be `https:` — this URL carries the token.
 	*/
-	baseUrl: z.string().trim().max(300).refine((value) => {
+	baseUrl: z$1.string().trim().max(300).refine((value) => {
 		let parsed;
 		try {
 			parsed = new URL(value);
@@ -3203,7 +3210,7 @@ const githubActionsConnectionConfigSchema = z.object({
 * Manager URL is built from this string, and a typo would otherwise surface as
 * a 403 from Google hours later inside an alarm, with nobody watching.
 */
-const gcpProjectSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(value) || /^\d{1,20}$/.test(value), "must be a Google Cloud project ID (e.g. acme-prod) or project number");
+const gcpProjectSchema = z$1.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(value) || /^\d{1,20}$/.test(value), "must be a Google Cloud project ID (e.g. acme-prod) or project number");
 /**
 * Google Cloud project scope — which project's Secret Manager to write.
 *
@@ -3222,8 +3229,8 @@ const gcpProjectSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,
 * regional secrets live behind. Data residency is expressed instead through the
 * destination's user-managed replication.
 */
-const gcpSecretManagerConnectionConfigSchema = z.object({
-	provider: z.literal("gcp-secret-manager"),
+const gcpSecretManagerConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("gcp-secret-manager"),
 	/** Project ID (`acme-prod`) or project number. */
 	projectId: gcpProjectSchema
 });
@@ -3263,16 +3270,16 @@ const LANGGRAPH_PLATFORM_REGIONS = [
 * Vercel's `teamId` sets — so it is passed through as `X-Tenant-Id` whenever
 * it is present.
 */
-const langgraphPlatformConnectionConfigSchema = z.object({
-	provider: z.literal("langgraph-platform"),
+const langgraphPlatformConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("langgraph-platform"),
 	/** Control-plane region. Omit for `us`. Mutually exclusive with `baseUrl`. */
-	region: z.enum(LANGGRAPH_PLATFORM_REGIONS).optional(),
+	region: z$1.enum(LANGGRAPH_PLATFORM_REGIONS).optional(),
 	/**
 	* Self-hosted LangSmith control-plane root, e.g.
 	* `https://langsmith.acme.com/api-host`. Omit for LangChain's own hosts.
 	* Must be `https:` — this URL carries the API key.
 	*/
-	baseUrl: z.string().trim().max(300).refine((value) => {
+	baseUrl: z$1.string().trim().max(300).refine((value) => {
 		let parsed;
 		try {
 			parsed = new URL(value);
@@ -3282,7 +3289,7 @@ const langgraphPlatformConnectionConfigSchema = z.object({
 		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
 	}, "must be an https:// URL — the self-hosted control-plane root, e.g. https://langsmith.acme.com/api-host").optional(),
 	/** LangSmith workspace (tenant) UUID, sent as `X-Tenant-Id`. */
-	tenantId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangSmith workspace UUID").optional()
+	tenantId: z$1.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangSmith workspace UUID").optional()
 }).refine((c) => !(c.baseUrl !== void 0 && c.region !== void 0), {
 	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
 	path: ["baseUrl"]
@@ -3309,7 +3316,7 @@ const AZURE_CLOUDS = [
 * keeps one rule — a tenant's GUID is on the same admin-center page as the
 * client id it pairs with, so nothing is harder to find.
 */
-const azureGuidSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a GUID, as the Entra admin center shows it");
+const azureGuidSchema = z$1.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a GUID, as the Entra admin center shows it");
 /**
 * Azure account scope: which directory to authenticate against, as which app.
 *
@@ -3326,14 +3333,14 @@ const azureGuidSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-
 * has nowhere to keep, and Entra caps a client secret at 24 months, which is a
 * rotation the connection's `lastError` will make loud.
 */
-const azureKeyVaultConnectionConfigSchema = z.object({
-	provider: z.literal("azure-key-vault"),
+const azureKeyVaultConnectionConfigSchema = z$1.object({
+	provider: z$1.literal("azure-key-vault"),
 	/** Entra directory (tenant) ID. */
 	tenantId: azureGuidSchema,
 	/** Application (client) ID of the service principal seekrit signs in as. */
 	clientId: azureGuidSchema,
 	/** Which Azure cloud the tenant and its vaults live in. */
-	cloud: z.enum(AZURE_CLOUDS).default("public")
+	cloud: z$1.enum(AZURE_CLOUDS).default("public")
 });
 /**
 * Hugging Face account scope — empty, as Render's and Fly's are.
@@ -3349,9 +3356,9 @@ const azureKeyVaultConnectionConfigSchema = z.object({
 * not something a mirror is expected to accept a write on. Adding the field
 * would invite pointing a connection at a host that silently swallows secrets.
 */
-const huggingfaceSpacesConnectionConfigSchema = z.object({ provider: z.literal("huggingface-spaces") });
+const huggingfaceSpacesConnectionConfigSchema = z$1.object({ provider: z$1.literal("huggingface-spaces") });
 /** The wrapped credential is an OpenAI project API key with vault read/write access. */
-const openaiVaultConnectionConfigSchema = z.object({ provider: z.literal("openai-vault") });
+const openaiVaultConnectionConfigSchema = z$1.object({ provider: z$1.literal("openai-vault") });
 /**
 * Claude Managed Agents account scope — empty, for Hugging Face's reason.
 *
@@ -3368,8 +3375,8 @@ const openaiVaultConnectionConfigSchema = z.object({ provider: z.literal("openai
 * credential shape and a different connector (one that would reuse
 * `lib/leases/aws-sigv4.ts`), not a different host for this one.
 */
-const claudeManagedAgentsConnectionConfigSchema = z.object({ provider: z.literal("claude-managed-agents") });
-const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
+const claudeManagedAgentsConnectionConfigSchema = z$1.object({ provider: z$1.literal("claude-managed-agents") });
+const syncConnectionConfigSchema = z$1.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
 	cloudflarePagesConnectionConfigSchema,
@@ -3398,17 +3405,17 @@ const VERCEL_TARGETS = [
 	"preview",
 	"development"
 ];
-const vercelDestinationSchema = z.object({
-	provider: z.literal("vercel"),
+const vercelDestinationSchema = z$1.object({
+	provider: z$1.literal("vercel"),
 	/** Vercel project id (`prj_…`) or project name. */
-	projectId: z.string().trim().min(1).max(128),
+	projectId: z$1.string().trim().min(1).max(128),
 	/** Which deployment targets receive these values. At least one. */
-	targets: z.array(z.enum(VERCEL_TARGETS)).min(1),
+	targets: z$1.array(z$1.enum(VERCEL_TARGETS)).min(1),
 	/**
 	* Restrict `preview` writes to one git branch. Vercel only honors this when
 	* `targets` includes `preview`; ignored otherwise.
 	*/
-	gitBranch: z.string().trim().min(1).max(255).optional()
+	gitBranch: z$1.string().trim().min(1).max(255).optional()
 });
 /**
 * The Worker whose secrets a binding owns. Wrangler *environments* are not a
@@ -3416,19 +3423,19 @@ const vercelDestinationSchema = z.object({
 * `my-api` with `--env staging` creates a Worker literally named
 * `my-api-staging`, so pointing at an environment means naming that script.
 */
-const cloudflareWorkersDestinationSchema = z.object({
-	provider: z.literal("cloudflare-workers"),
+const cloudflareWorkersDestinationSchema = z$1.object({
+	provider: z$1.literal("cloudflare-workers"),
 	/** Worker script name, as shown in the dashboard (`my-api`). */
-	scriptName: z.string().trim().min(1).max(63).regex(/^[A-Za-z0-9_][A-Za-z0-9_-]*$/, "must be a Worker script name")
+	scriptName: z$1.string().trim().min(1).max(63).regex(/^[A-Za-z0-9_][A-Za-z0-9_-]*$/, "must be a Worker script name")
 });
 /** The two deployment configs a Pages project keeps env vars under. */
 const CLOUDFLARE_PAGES_ENVIRONMENTS = ["production", "preview"];
-const cloudflarePagesDestinationSchema = z.object({
-	provider: z.literal("cloudflare-pages"),
+const cloudflarePagesDestinationSchema = z$1.object({
+	provider: z$1.literal("cloudflare-pages"),
 	/** Pages project name (`my-site`) — Pages has no separate project id. */
-	projectName: z.string().trim().min(1).max(58).regex(/^[A-Za-z0-9][A-Za-z0-9-]*$/, "must be a Pages project name"),
+	projectName: z$1.string().trim().min(1).max(58).regex(/^[A-Za-z0-9][A-Za-z0-9-]*$/, "must be a Pages project name"),
 	/** Which deployment configs receive these values. At least one. */
-	environments: z.array(z.enum(CLOUDFLARE_PAGES_ENVIRONMENTS)).min(1)
+	environments: z$1.array(z$1.enum(CLOUDFLARE_PAGES_ENVIRONMENTS)).min(1)
 });
 /**
 * Scopes a Secrets Store secret may be used by. Cloudflare requires at least
@@ -3442,12 +3449,12 @@ const CLOUDFLARE_SECRETS_STORE_SCOPES = [
 	"containers",
 	"websearch"
 ];
-const cloudflareSecretsStoreDestinationSchema = z.object({
-	provider: z.literal("cloudflare-secrets-store"),
+const cloudflareSecretsStoreDestinationSchema = z$1.object({
+	provider: z$1.literal("cloudflare-secrets-store"),
 	/** Store id (32 hex). An account has exactly one store today. */
-	storeId: z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Secrets Store ID (lowercase hex)"),
+	storeId: z$1.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Secrets Store ID (lowercase hex)"),
 	/** Scopes applied to secrets this binding creates. At least one. */
-	scopes: z.array(z.enum(CLOUDFLARE_SECRETS_STORE_SCOPES)).min(1)
+	scopes: z$1.array(z$1.enum(CLOUDFLARE_SECRETS_STORE_SCOPES)).min(1)
 });
 /**
 * Where inside Railway a binding writes.
@@ -3462,8 +3469,8 @@ const cloudflareSecretsStoreDestinationSchema = z.object({
 * genuinely different destination from any one service's variables, so it is an
 * absent field rather than a sentinel.
 */
-const railwayDestinationSchema = z.object({
-	provider: z.literal("railway"),
+const railwayDestinationSchema = z$1.object({
+	provider: z$1.literal("railway"),
 	/** Railway project id (a UUID, from the project's Settings page or URL). */
 	projectId: railwayIdSchema,
 	/** Railway environment id (a UUID) — the deployment environment to write. */
@@ -3479,7 +3486,7 @@ const railwayDestinationSchema = z.object({
 	* gated behind a release process and a secrets push must not start one; the
 	* values then sit staged until the next deploy.
 	*/
-	skipDeploys: z.boolean().optional()
+	skipDeploys: z$1.boolean().optional()
 });
 /**
 * A customer-managed KMS key to encrypt with, as a key id, ARN, or alias
@@ -3490,7 +3497,7 @@ const railwayDestinationSchema = z.object({
 * cross-account ARNs, and rejecting a valid one here would be worse than
 * letting KMS give its own (very clear) error.
 */
-const awsKmsKeyIdSchema = z.string().trim().min(1).max(2048);
+const awsKmsKeyIdSchema = z$1.string().trim().min(1).max(2048);
 /**
 * How a binding lays its secrets out in Secrets Manager.
 *
@@ -3510,18 +3517,18 @@ const AWS_SECRETS_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
 * *variable name* (`[A-Za-z0-9_]`, no slashes), while this produces a
 * *namespace* — `prod/storefront/` — and slashes are the whole point of it.
 */
-const awsSecretsManagerDestinationSchema = z.object({
-	provider: z.literal("aws-secrets-manager"),
-	layout: z.enum(AWS_SECRETS_MANAGER_LAYOUTS).default("secret-per-name"),
+const awsSecretsManagerDestinationSchema = z$1.object({
+	provider: z$1.literal("aws-secrets-manager"),
+	layout: z$1.enum(AWS_SECRETS_MANAGER_LAYOUTS).default("secret-per-name"),
 	/**
 	* `secret-per-name` only: prepended to every secret's name, e.g.
 	* `prod/storefront/`. Optional, but strongly advised in an account that
 	* holds anything else — without it a binding writes at the root of a
 	* namespace it does not own.
 	*/
-	pathPrefix: z.string().trim().max(400).regex(/^[A-Za-z0-9/_+=.@-]*$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	pathPrefix: z$1.string().trim().max(400).regex(/^[A-Za-z0-9/_+=.@-]*$/, "may contain letters, digits, and / _ + = . @ -").optional(),
 	/** `json-bundle` only: the one secret that holds every value, e.g. `prod/storefront/env`. */
-	secretName: z.string().trim().min(1).max(512).regex(/^[A-Za-z0-9/_+=.@-]+$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	secretName: z$1.string().trim().min(1).max(512).regex(/^[A-Za-z0-9/_+=.@-]+$/, "may contain letters, digits, and / _ + = . @ -").optional(),
 	kmsKeyId: awsKmsKeyIdSchema.optional()
 }).refine((d) => d.layout !== "json-bundle" || d.secretName !== void 0, {
 	message: "a json-bundle destination needs the name of the secret to write",
@@ -3544,17 +3551,17 @@ const AWS_PARAMETER_TIERS = [
 * and trailing slashes are required so the binding's names concatenate
 * unambiguously — `/prod/storefront/` + `DB_URL`.
 */
-const awsParameterStoreDestinationSchema = z.object({
-	provider: z.literal("aws-parameter-store"),
+const awsParameterStoreDestinationSchema = z$1.object({
+	provider: z$1.literal("aws-parameter-store"),
 	/** Must start and end with `/`. `aws`/`ssm` are reserved by AWS as the first segment. */
-	path: z.string().trim().max(1011).regex(/^\/([A-Za-z0-9_.-]+\/)*$/, "must be a parameter path like /prod/storefront/"),
-	type: z.enum(AWS_PARAMETER_TYPES).default("SecureString"),
+	path: z$1.string().trim().max(1011).regex(/^\/([A-Za-z0-9_.-]+\/)*$/, "must be a parameter path like /prod/storefront/"),
+	type: z$1.enum(AWS_PARAMETER_TYPES).default("SecureString"),
 	/**
 	* Standard caps a value at 4KB and costs nothing; Advanced raises that to 8KB
 	* and is billed per parameter per month. `Intelligent-Tiering` lets AWS pick,
 	* upgrading only the parameters that need it.
 	*/
-	tier: z.enum(AWS_PARAMETER_TIERS).default("Standard"),
+	tier: z$1.enum(AWS_PARAMETER_TIERS).default("Standard"),
 	kmsKeyId: awsKmsKeyIdSchema.optional()
 });
 /**
@@ -3569,12 +3576,12 @@ const awsParameterStoreDestinationSchema = z.object({
 * the day Render introduces a new resource prefix, which is not our call to
 * make.
 */
-const renderServiceIdSchema = z.string().trim().regex(/^(?!evg-)[A-Za-z0-9_-]{1,64}$/, "must be a Render service ID (`srv-…` or `crn-…`), not an environment group");
-const renderEnvGroupIdSchema = z.string().trim().regex(/^(?!srv-|crn-)[A-Za-z0-9_-]{1,64}$/, "must be a Render environment group ID (`evg-…`), not a service");
+const renderServiceIdSchema = z$1.string().trim().regex(/^(?!evg-)[A-Za-z0-9_-]{1,64}$/, "must be a Render service ID (`srv-…` or `crn-…`), not an environment group");
+const renderEnvGroupIdSchema = z$1.string().trim().regex(/^(?!srv-|crn-)[A-Za-z0-9_-]{1,64}$/, "must be a Render environment group ID (`evg-…`), not a service");
 /** Environment variables set directly on one service. */
-const renderServiceDestinationSchema = z.object({
-	provider: z.literal("render"),
-	kind: z.literal("service"),
+const renderServiceDestinationSchema = z$1.object({
+	provider: z$1.literal("render"),
+	kind: z$1.literal("service"),
 	/** Service id (`srv-…`, or `crn-…` for a cron job), from its dashboard URL. */
 	serviceId: renderServiceIdSchema
 });
@@ -3584,13 +3591,13 @@ const renderServiceDestinationSchema = z.object({
 * worth thinking about twice: its blast radius is the link list, not one
 * service.
 */
-const renderEnvGroupDestinationSchema = z.object({
-	provider: z.literal("render"),
-	kind: z.literal("env-group"),
+const renderEnvGroupDestinationSchema = z$1.object({
+	provider: z$1.literal("render"),
+	kind: z$1.literal("env-group"),
 	/** Environment group id (`evg-…`), from its dashboard URL. */
 	envGroupId: renderEnvGroupIdSchema
 });
-const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
+const renderDestinationSchema = z$1.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
 /**
 * The Fly app whose secret set a binding owns.
 *
@@ -3607,10 +3614,10 @@ const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDesti
 * after the push get them straight away. The connector deliberately restarts
 * nothing — see the note in `apps/api/src/lib/sync/connectors/fly.ts`.
 */
-const flyDestinationSchema = z.object({
-	provider: z.literal("fly"),
+const flyDestinationSchema = z$1.object({
+	provider: z$1.literal("fly"),
 	/** Fly app name, as `fly apps list` prints it. */
-	appName: z.string().trim().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*$/, "must be a Fly app name (lowercase letters, numbers, and dashes)")
+	appName: z$1.string().trim().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*$/, "must be a Fly app name (lowercase letters, numbers, and dashes)")
 });
 /**
 * Where inside Northflank a binding writes: one **secret group** in one
@@ -3627,8 +3634,8 @@ const flyDestinationSchema = z.object({
 * separate environments are separate projects (or separate groups restricted to
 * a stage), so the binding's seekrit environment maps to a group, one to one.
 */
-const northflankDestinationSchema = z.object({
-	provider: z.literal("northflank"),
+const northflankDestinationSchema = z$1.object({
+	provider: z$1.literal("northflank"),
 	/** Project id — the slug in the project URL (`default-project`). */
 	projectId: northflankIdSchema,
 	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
@@ -3660,13 +3667,13 @@ const DIGITALOCEAN_ENV_SCOPES = [
 * from a typo: pasting the app's *name* (`storefront`), which `GET /v2/apps/{id}`
 * answers with a flat 404 hours later inside an alarm, with nobody watching.
 */
-const digitalOceanAppIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a DigitalOcean app ID (the UUID in the app's URL), not its name");
+const digitalOceanAppIdSchema = z$1.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a DigitalOcean app ID (the UUID in the app's URL), not its name");
 /**
 * A component name, matching App Platform's own pattern for one. Names are
 * unique within an app, which is what makes a name — rather than an index into
 * `services` — the stable way to address a component's variables.
 */
-const digitalOceanComponentNameSchema = z.string().trim().regex(/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/, "must be an App Platform component name (lowercase letters, numbers, and dashes)");
+const digitalOceanComponentNameSchema = z$1.string().trim().regex(/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/, "must be an App Platform component name (lowercase letters, numbers, and dashes)");
 /**
 * Where inside a DigitalOcean app a binding writes.
 *
@@ -3693,27 +3700,27 @@ const digitalOceanComponentNameSchema = z.string().trim().regex(/^[a-z][a-z0-9-]
 * about to write is already there — see
 * `apps/api/src/lib/sync/connectors/digitalocean.ts`.
 */
-const digitalOceanAppDestinationSchema = z.object({
-	provider: z.literal("digitalocean"),
-	kind: z.literal("app"),
+const digitalOceanAppDestinationSchema = z$1.object({
+	provider: z$1.literal("digitalocean"),
+	kind: z$1.literal("app"),
 	/** App id — the UUID in `cloud.digitalocean.com/apps/<id>`. */
 	appId: digitalOceanAppIdSchema,
-	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+	scope: z$1.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
 });
 /**
 * One component's own environment variables. Narrower than the app-level list:
 * only this service, worker, job, static site, or function sees them, and a key
 * here wins over the same key at app level.
 */
-const digitalOceanComponentDestinationSchema = z.object({
-	provider: z.literal("digitalocean"),
-	kind: z.literal("component"),
+const digitalOceanComponentDestinationSchema = z$1.object({
+	provider: z$1.literal("digitalocean"),
+	kind: z$1.literal("component"),
 	appId: digitalOceanAppIdSchema,
 	/** Component name, as it appears in the app spec — not its type. */
 	componentName: digitalOceanComponentNameSchema,
-	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+	scope: z$1.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
 });
-const digitalOceanDestinationSchema = z.discriminatedUnion("kind", [digitalOceanAppDestinationSchema, digitalOceanComponentDestinationSchema]);
+const digitalOceanDestinationSchema = z$1.discriminatedUnion("kind", [digitalOceanAppDestinationSchema, digitalOceanComponentDestinationSchema]);
 /**
 * A Heroku app, named the way `/apps/{app_id_or_name}` names one: either the
 * app name or its UUID id. Both are accepted because both work, and the id is
@@ -3726,7 +3733,7 @@ const digitalOceanDestinationSchema = z.discriminatedUnion("kind", [digitalOcean
 * capitals — into a message at the form rather than a bare 404 from an alarm
 * with nobody watching.
 */
-const herokuAppSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value), "must be a Heroku app name (lowercase letters, numbers, and dashes) or its UUID");
+const herokuAppSchema = z$1.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value), "must be a Heroku app name (lowercase letters, numbers, and dashes) or its UUID");
 /**
 * The Heroku app whose config vars a binding owns.
 *
@@ -3740,8 +3747,8 @@ const herokuAppSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,2
 * release and restarts the app's dynos, which is why a run sends exactly one
 * request — see the note in `apps/api/src/lib/sync/connectors/heroku.ts`.
 */
-const herokuDestinationSchema = z.object({
-	provider: z.literal("heroku"),
+const herokuDestinationSchema = z$1.object({
+	provider: z$1.literal("heroku"),
 	/** App name as `heroku apps` prints it, or the app's UUID. */
 	app: herokuAppSchema
 });
@@ -3779,7 +3786,7 @@ const NETLIFY_CONTEXTS = [
 * by every site in it. Refusing anything but the UUID keeps a slip from turning
 * into a much wider blast radius than the operator asked for.
 */
-const netlifySiteIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be the site's API ID (a UUID), not its name or URL");
+const netlifySiteIdSchema = z$1.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be the site's API ID (a UUID), not its name or URL");
 /**
 * The Netlify site, and which of its deploy contexts a binding owns.
 *
@@ -3801,16 +3808,16 @@ const netlifySiteIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0
 * existing variable, or removed from one ever — and it needs a plan that
 * includes Secrets Controller.
 */
-const netlifyDestinationSchema = z.object({
-	provider: z.literal("netlify"),
+const netlifyDestinationSchema = z$1.object({
+	provider: z$1.literal("netlify"),
 	/** Site API ID (a UUID), from Project configuration → General. */
 	siteId: netlifySiteIdSchema,
 	/** Which deploy contexts receive these values. At least one. */
-	contexts: z.array(z.enum(NETLIFY_CONTEXTS)).min(1),
+	contexts: z$1.array(z$1.enum(NETLIFY_CONTEXTS)).min(1),
 	/** Branch name, required when `contexts` includes `branch`; ignored otherwise. */
-	branch: z.string().trim().min(1).max(255).optional(),
+	branch: z$1.string().trim().min(1).max(255).optional(),
 	/** Create variables as Netlify secrets (default true). */
-	secret: z.boolean().optional()
+	secret: z$1.boolean().optional()
 }).refine((d) => !d.contexts.includes("branch") || d.branch !== void 0, {
 	message: "a branch context needs the branch name it applies to",
 	path: ["branch"]
@@ -3832,7 +3839,7 @@ const netlifyDestinationSchema = z.object({
 * before it touches it, so a filter that failed to bite cannot turn into an
 * edit of a neighbouring environment's variables.
 */
-const bunnyshellIdSchema = z.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Bunnyshell ID — no slashes or spaces");
+const bunnyshellIdSchema = z$1.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Bunnyshell ID — no slashes or spaces");
 /**
 * Variables on one Bunnyshell **environment** — the set every component in it
 * inherits, and the closest match to a seekrit environment.
@@ -3840,13 +3847,13 @@ const bunnyshellIdSchema = z.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][
 * This is the destination for an environment that already exists and stays
 * around: a primary environment, or a long-lived ephemeral one.
 */
-const bunnyshellEnvironmentDestinationSchema = z.object({
-	provider: z.literal("bunnyshell"),
-	kind: z.literal("environment"),
+const bunnyshellEnvironmentDestinationSchema = z$1.object({
+	provider: z$1.literal("bunnyshell"),
+	kind: z$1.literal("environment"),
 	/** Environment ID, as `bns environments list` prints it. */
 	environmentId: bunnyshellIdSchema,
 	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
-	secret: z.boolean().optional()
+	secret: z$1.boolean().optional()
 });
 /**
 * Variables on a Bunnyshell **project** — inherited by every environment
@@ -3863,13 +3870,13 @@ const bunnyshellEnvironmentDestinationSchema = z.object({
 * overridden at its own scope — so a project binding does not fight an
 * environment binding pointed at the same name, it loses to it.
 */
-const bunnyshellProjectDestinationSchema = z.object({
-	provider: z.literal("bunnyshell"),
-	kind: z.literal("project"),
+const bunnyshellProjectDestinationSchema = z$1.object({
+	provider: z$1.literal("bunnyshell"),
+	kind: z$1.literal("project"),
 	/** Project ID, as `bns projects list` prints it. */
 	projectId: bunnyshellIdSchema,
 	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
-	secret: z.boolean().optional()
+	secret: z$1.boolean().optional()
 });
 /**
 * Where in Bunnyshell a binding writes.
@@ -3889,7 +3896,7 @@ const bunnyshellProjectDestinationSchema = z.object({
 * variables seekrit **creates**: an update never sends the flag, so a variable
 * an operator deliberately un-secreted stays that way.
 */
-const bunnyshellDestinationSchema = z.discriminatedUnion("kind", [bunnyshellEnvironmentDestinationSchema, bunnyshellProjectDestinationSchema]);
+const bunnyshellDestinationSchema = z$1.discriminatedUnion("kind", [bunnyshellEnvironmentDestinationSchema, bunnyshellProjectDestinationSchema]);
 /**
 * Which repositories in an organization can read an org-level secret.
 *
@@ -3912,14 +3919,14 @@ const GITHUB_ACTIONS_VISIBILITIES = [
 * owner field — fails at the form rather than as a 404 from an alarm with nobody
 * watching.
 */
-const githubOwnerSchema = z.string().trim().min(1).max(39).regex(/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/, "must be a GitHub user or organization login — not a URL or an owner/repo pair");
+const githubOwnerSchema = z$1.string().trim().min(1).max(39).regex(/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/, "must be a GitHub user or organization login — not a URL or an owner/repo pair");
 /**
 * A repository name. GitHub's rules are looser than an owner's: letters,
 * numbers, hyphens, underscores, and periods, up to 100 characters. `.` and `..`
 * are refused outright — they would traverse the API path rather than name a
 * repository.
 */
-const githubRepoSchema = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "must be a repository name alone (`api`), not `owner/repo` or a URL").refine((value) => value !== "." && value !== "..", "is not a repository name");
+const githubRepoSchema = z$1.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "must be a repository name alone (`api`), not `owner/repo` or a URL").refine((value) => value !== "." && value !== "..", "is not a repository name");
 /**
 * A deployment environment name.
 *
@@ -3928,7 +3935,7 @@ const githubRepoSchema = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-
 * break the request are refused — an empty name, and the path separators that
 * would let a name escape its URL segment. Everything else is GitHub's to reject.
 */
-const githubEnvironmentSchema = z.string().trim().min(1).max(255).refine((value) => !value.includes("/") && !value.includes("\\"), "cannot contain a slash — that is a path separator, not part of an environment name");
+const githubEnvironmentSchema = z$1.string().trim().min(1).max(255).refine((value) => !value.includes("/") && !value.includes("\\"), "cannot contain a slash — that is a path separator, not part of an environment name");
 /**
 * One repository's Actions secrets.
 *
@@ -3937,9 +3944,9 @@ const githubEnvironmentSchema = z.string().trim().min(1).max(255).refine((value)
 * choice this connector makes — but it is the reason `environment` exists below,
 * and the reason to prefer it for anything that touches production.
 */
-const githubActionsRepoDestinationSchema = z.object({
-	provider: z.literal("github-actions"),
-	kind: z.literal("repo"),
+const githubActionsRepoDestinationSchema = z$1.object({
+	provider: z$1.literal("github-actions"),
+	kind: z$1.literal("repo"),
 	/** Repository owner — a user or organization login. */
 	owner: githubOwnerSchema,
 	/** Repository name, without the owner. */
@@ -3959,9 +3966,9 @@ const githubActionsRepoDestinationSchema = z.object({
 * because a name was misspelled would quietly remove the protection the operator
 * was relying on.
 */
-const githubActionsEnvironmentDestinationSchema = z.object({
-	provider: z.literal("github-actions"),
-	kind: z.literal("environment"),
+const githubActionsEnvironmentDestinationSchema = z$1.object({
+	provider: z$1.literal("github-actions"),
+	kind: z$1.literal("environment"),
 	owner: githubOwnerSchema,
 	repo: githubRepoSchema,
 	/** Environment name, exactly as the repository's Settings → Environments shows it. */
@@ -3981,15 +3988,15 @@ const githubActionsEnvironmentDestinationSchema = z.object({
 * resolution would mean this connector picking which repository an ambiguous
 * name meant, and getting that wrong widens a secret's reach silently.
 */
-const githubActionsOrgDestinationSchema = z.object({
-	provider: z.literal("github-actions"),
-	kind: z.literal("org"),
+const githubActionsOrgDestinationSchema = z$1.object({
+	provider: z$1.literal("github-actions"),
+	kind: z$1.literal("org"),
 	/** Organization login. */
 	org: githubOwnerSchema,
 	/** Which repositories may read these secrets. Stated, never defaulted. */
-	visibility: z.enum(GITHUB_ACTIONS_VISIBILITIES),
+	visibility: z$1.enum(GITHUB_ACTIONS_VISIBILITIES),
 	/** Numeric repository ids, required when `visibility` is `selected`. */
-	selectedRepositoryIds: z.array(z.number().int().positive()).max(500).optional()
+	selectedRepositoryIds: z$1.array(z$1.number().int().positive()).max(500).optional()
 }).refine((dest) => dest.visibility !== "selected" || dest.selectedRepositoryIds !== void 0 && dest.selectedRepositoryIds.length > 0, {
 	message: "selected visibility needs at least one repository id",
 	path: ["selectedRepositoryIds"]
@@ -3997,7 +4004,7 @@ const githubActionsOrgDestinationSchema = z.object({
 	message: "repository ids only apply to selected visibility — remove them, or select it",
 	path: ["selectedRepositoryIds"]
 });
-const githubActionsDestinationSchema = z.discriminatedUnion("kind", [
+const githubActionsDestinationSchema = z$1.discriminatedUnion("kind", [
 	githubActionsRepoDestinationSchema,
 	githubActionsEnvironmentDestinationSchema,
 	githubActionsOrgDestinationSchema
@@ -4036,14 +4043,14 @@ const GCP_REPLICATION_POLICIES = ["automatic", "user-managed"];
 * Manager namespace is spelled `prod-storefront-DB_URL`, not
 * `prod/storefront/DB_URL`.
 */
-const gcpSecretIdSchema = z.string().trim().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/, "may contain letters, digits, hyphens, and underscores");
+const gcpSecretIdSchema = z$1.string().trim().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/, "may contain letters, digits, hyphens, and underscores");
 /**
 * A GCP region for a user-managed replica (`us-east1`, `europe-west4`,
 * `northamerica-northeast1`). Validated by shape rather than against a list,
 * because Google adds regions faster than we ship — a name Secret Manager does
 * not know is refused by Google with a clear message at creation.
 */
-const gcpLocationSchema = z.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be a GCP region ID, e.g. us-east1");
+const gcpLocationSchema = z$1.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be a GCP region ID, e.g. us-east1");
 /**
 * A Cloud KMS key, as its full resource name — the only form the API accepts:
 * `projects/p/locations/l/keyRings/r/cryptoKeys/k`.
@@ -4053,7 +4060,7 @@ const gcpLocationSchema = z.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be
 * rejected at creation: an automatic-replication secret needs a `global` key,
 * and a user-managed replica needs one in its own region.
 */
-const gcpKmsKeyNameSchema = z.string().trim().max(1024).regex(/^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+$/, "must be a full Cloud KMS key name (projects/…/locations/…/keyRings/…/cryptoKeys/…)");
+const gcpKmsKeyNameSchema = z$1.string().trim().max(1024).regex(/^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+$/, "must be a full Cloud KMS key name (projects/…/locations/…/keyRings/…/cryptoKeys/…)");
 /**
 * Where inside a project's Secret Manager a binding writes.
 *
@@ -4072,25 +4079,25 @@ const gcpKmsKeyNameSchema = z.string().trim().max(1024).regex(/^projects\/[^/]+\
 * on, the version a push supersedes is destroyed as soon as the new one lands,
 * so a secret keeps exactly one active version.
 */
-const gcpSecretManagerDestinationSchema = z.object({
-	provider: z.literal("gcp-secret-manager"),
-	layout: z.enum(GCP_SECRET_MANAGER_LAYOUTS).default("secret-per-name"),
+const gcpSecretManagerDestinationSchema = z$1.object({
+	provider: z$1.literal("gcp-secret-manager"),
+	layout: z$1.enum(GCP_SECRET_MANAGER_LAYOUTS).default("secret-per-name"),
 	/**
 	* `secret-per-name` only: prepended to every secret ID, e.g.
 	* `prod-storefront-`. Optional, but strongly advised in a project that holds
 	* anything else — without it a binding writes at the root of a namespace it
 	* does not own, and Secret Manager has no folders to hide behind.
 	*/
-	idPrefix: z.string().trim().max(200).regex(/^[A-Za-z0-9_-]*$/, "may contain letters, digits, hyphens, and underscores").optional(),
+	idPrefix: z$1.string().trim().max(200).regex(/^[A-Za-z0-9_-]*$/, "may contain letters, digits, hyphens, and underscores").optional(),
 	/** `json-bundle` only: the one secret that holds every value, e.g. `prod-storefront-env`. */
 	secretId: gcpSecretIdSchema.optional(),
-	replication: z.enum(GCP_REPLICATION_POLICIES).default("automatic"),
+	replication: z$1.enum(GCP_REPLICATION_POLICIES).default("automatic"),
 	/** `user-managed` only: the regions to replicate to. At least one. */
-	locations: z.array(gcpLocationSchema).min(1).max(16).optional(),
+	locations: z$1.array(gcpLocationSchema).min(1).max(16).optional(),
 	/** Customer-managed encryption key. Omitted means Google-managed keys. */
 	kmsKeyName: gcpKmsKeyNameSchema.optional(),
 	/** Destroy the version each push supersedes, keeping one active version. */
-	pruneVersions: z.boolean().optional()
+	pruneVersions: z$1.boolean().optional()
 }).refine((d) => d.layout !== "json-bundle" || d.secretId !== void 0, {
 	message: "a json-bundle destination needs the ID of the secret to write",
 	path: ["secretId"]
@@ -4117,10 +4124,10 @@ const gcpSecretManagerDestinationSchema = z.object({
 * the `id` from `GET /v2/deployments`, and the UUID in the deployment's
 * dashboard URL.
 */
-const langgraphPlatformDestinationSchema = z.object({
-	provider: z.literal("langgraph-platform"),
+const langgraphPlatformDestinationSchema = z$1.object({
+	provider: z$1.literal("langgraph-platform"),
 	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
-	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
+	deploymentId: z$1.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
 });
 /**
 * A Key Vault's name — the leftmost label of its DNS name, so the vault
@@ -4136,7 +4143,7 @@ const langgraphPlatformDestinationSchema = z.object({
 * any host, and the whole address seekrit needs is this label plus the cloud
 * already named on the connection.
 */
-const azureVaultNameSchema = z.string().trim().regex(/^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/, "must be a Key Vault name: 3–24 letters, digits, and single hyphens, starting with a letter");
+const azureVaultNameSchema = z$1.string().trim().regex(/^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/, "must be a Key Vault name: 3–24 letters, digits, and single hyphens, starting with a letter");
 /**
 * What to do with a name Key Vault cannot store.
 *
@@ -4167,8 +4174,8 @@ const AZURE_KEY_VAULT_NAME_MODES = ["dash", "reject"];
 * charges per *operation*, so fifty names cost the same stored fifty ways. One
 * secret per name is simply correct here.
 */
-const azureKeyVaultDestinationSchema = z.object({
-	provider: z.literal("azure-key-vault"),
+const azureKeyVaultDestinationSchema = z$1.object({
+	provider: z$1.literal("azure-key-vault"),
 	/** Vault name, e.g. `acme-prod` for `acme-prod.vault.azure.net`. */
 	vault: azureVaultNameSchema,
 	/**
@@ -4177,9 +4184,9 @@ const azureKeyVaultDestinationSchema = z.object({
 	* accepts — so unlike Parameter Store's `path` this is a naming convention
 	* and nothing more. Worth setting in a vault that holds anything else.
 	*/
-	prefix: z.string().trim().max(64).regex(/^[A-Za-z0-9-]*$/, "may contain letters, digits, and hyphens").optional(),
+	prefix: z$1.string().trim().max(64).regex(/^[A-Za-z0-9-]*$/, "may contain letters, digits, and hyphens").optional(),
 	/** What to do with a name Key Vault cannot store — see {@link AZURE_KEY_VAULT_NAME_MODES}. */
-	nameMode: z.enum(AZURE_KEY_VAULT_NAME_MODES).default("dash")
+	nameMode: z$1.enum(AZURE_KEY_VAULT_NAME_MODES).default("dash")
 });
 /**
 * The Space whose secrets a binding owns, addressed the way the Hub addresses
@@ -4198,7 +4205,7 @@ const azureKeyVaultDestinationSchema = z.object({
 * leading character is held to alphanumeric, which is also what rejects the
 * `.` and `..` that no repository may be called.
 */
-const huggingfaceRepoIdSchema = z.string().trim().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/, "must be a Space ID as owner/name, e.g. acme/support-demo — not a URL");
+const huggingfaceRepoIdSchema = z$1.string().trim().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/, "must be a Space ID as owner/name, e.g. acme/support-demo — not a URL");
 /**
 * One Hugging Face **Space**, whose secrets arrive in the app's container as
 * environment variables.
@@ -4210,16 +4217,16 @@ const huggingfaceRepoIdSchema = z.string().trim().regex(/^[A-Za-z0-9][A-Za-z0-9.
 * it, so this connector has no variables mode — a binding that wants one is
 * asking for the wrong thing.
 */
-const huggingfaceSpacesDestinationSchema = z.object({
-	provider: z.literal("huggingface-spaces"),
+const huggingfaceSpacesDestinationSchema = z$1.object({
+	provider: z$1.literal("huggingface-spaces"),
 	/** Space ID as `owner/name`, e.g. `acme/support-demo`. */
 	repoId: huggingfaceRepoIdSchema
 });
 /** One existing OpenAI vault; every credential in this binding gets the same host boundary. */
-const openaiVaultDestinationSchema = z.object({
-	provider: z.literal("openai-vault"),
-	vaultId: z.string().trim().regex(/^vault_[A-Za-z0-9_-]+$/, "must be an OpenAI vault ID"),
-	allowedHosts: z.array(z.string().trim().toLowerCase().max(253).regex(/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/, "must be an exact hostname without scheme, port, path, or wildcard")).min(1).max(100).refine((hosts) => new Set(hosts).size === hosts.length, "hostnames must be unique")
+const openaiVaultDestinationSchema = z$1.object({
+	provider: z$1.literal("openai-vault"),
+	vaultId: z$1.string().trim().regex(/^vault_[A-Za-z0-9_-]+$/, "must be an OpenAI vault ID"),
+	allowedHosts: z$1.array(z$1.string().trim().toLowerCase().max(253).regex(/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/, "must be an exact hostname without scheme, port, path, or wildcard")).min(1).max(100).refine((hosts) => new Set(hosts).size === hosts.length, "hostnames must be unique")
 });
 /**
 * A vault ID as the Claude Console and API show it: `vlt_` and an opaque
@@ -4227,7 +4234,7 @@ const openaiVaultDestinationSchema = z.object({
 * vault's display name — is a 404 from inside an alarm, which says nothing
 * about which half of the address was wrong.
 */
-const claudeVaultIdSchema = z.string().trim().regex(/^vlt_[A-Za-z0-9]{1,128}$/, "must be a vault ID, e.g. vlt_01ABC… — not its display name");
+const claudeVaultIdSchema = z$1.string().trim().regex(/^vlt_[A-Za-z0-9]{1,128}$/, "must be a vault ID, e.g. vlt_01ABC… — not its display name");
 /** Ceiling on per-name host rules; a vault itself holds at most 20 credentials. */
 const CLAUDE_VAULT_MAX_HOST_RULES = 100;
 /** A hostname of two or more labels whose last label starts with a letter. */
@@ -4244,14 +4251,14 @@ const CLAUDE_VAULT_IPV4 = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2
 * `stripe.com` **but not `stripe.com` itself**, so a service reached at its apex
 * needs both entries. A bare TLD wildcard (`*.com`) is refused by shape.
 */
-const claudeVaultHostSchema = z.string().trim().toLowerCase().max(253).refine((host) => CLAUDE_VAULT_HOSTNAME.test(host) || CLAUDE_VAULT_IPV4.test(host), "must be a bare hostname (api.example.com), a *.example.com wildcard, or an IPv4 address — not a URL");
+const claudeVaultHostSchema = z$1.string().trim().toLowerCase().max(253).refine((host) => CLAUDE_VAULT_HOSTNAME.test(host) || CLAUDE_VAULT_IPV4.test(host), "must be a bare hostname (api.example.com), a *.example.com wildcard, or an IPv4 address — not a URL");
 /**
 * Where one secret's value may be substituted: a list of hosts, or the literal
 * `"unrestricted"`, which lets it reach any host the agent's *environment*
 * permits. The literal is spelled out rather than implied by an empty list, so
 * the widest setting is never something a binding arrives at by omission.
 */
-const claudeVaultHostRuleSchema = z.union([z.literal("unrestricted"), z.array(claudeVaultHostSchema).min(1).max(16)]);
+const claudeVaultHostRuleSchema = z$1.union([z$1.literal("unrestricted"), z$1.array(claudeVaultHostSchema).min(1).max(16)]);
 /**
 * Which parts of an outbound request a secret's placeholder is swapped in. The
 * API's own default when the field is omitted is both; seekrit's is `header`,
@@ -4284,15 +4291,15 @@ const CLAUDE_VAULT_INJECTION_LOCATIONS = [
 * flow. Both levels apply beside the agent environment's own network policy,
 * which must also let the host through; this shape cannot see that policy.
 */
-const claudeManagedAgentsDestinationSchema = z.object({
-	provider: z.literal("claude-managed-agents"),
+const claudeManagedAgentsDestinationSchema = z$1.object({
+	provider: z$1.literal("claude-managed-agents"),
 	/** The vault's ID, e.g. `vlt_01ABC…`. */
 	vaultId: claudeVaultIdSchema,
 	/** Hosts for every name without its own entry in `allowedHostsByName`. */
 	allowedHosts: claudeVaultHostRuleSchema.optional(),
 	/** Destination name → the hosts that one value may be substituted on. */
-	allowedHostsByName: z.record(secretNameSchema, claudeVaultHostRuleSchema).optional(),
-	injectionLocation: z.enum(CLAUDE_VAULT_INJECTION_LOCATIONS).default("header")
+	allowedHostsByName: z$1.record(secretNameSchema, claudeVaultHostRuleSchema).optional(),
+	injectionLocation: z$1.enum(CLAUDE_VAULT_INJECTION_LOCATIONS).default("header")
 }).refine((d) => d.allowedHosts !== void 0 || Object.keys(d.allowedHostsByName ?? {}).length > 0, {
 	message: "name the hosts each secret may be used on — allowedHosts for all of them, allowedHostsByName per name, or \"unrestricted\"",
 	path: ["allowedHosts"]
@@ -4300,7 +4307,7 @@ const claudeManagedAgentsDestinationSchema = z.object({
 	message: `at most ${CLAUDE_VAULT_MAX_HOST_RULES} per-name host rules`,
 	path: ["allowedHostsByName"]
 });
-const syncDestinationSchema = z.discriminatedUnion("provider", [
+const syncDestinationSchema = z$1.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
 	cloudflarePagesDestinationSchema,
@@ -4327,59 +4334,59 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 * How seekrit secret names become destination key names. Applied in order:
 * explicit `rename` (wins outright), then `prefix`/`suffix`, then `case`.
 */
-const nameTransformSchema = z.object({
-	prefix: z.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
-	suffix: z.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
-	case: z.enum([
+const nameTransformSchema = z$1.object({
+	prefix: z$1.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
+	suffix: z$1.string().max(64).regex(/^[A-Za-z0-9_]*$/, "must be alphanumeric or underscore").optional(),
+	case: z$1.enum([
 		"preserve",
 		"upper",
 		"lower"
 	]).optional(),
 	/** Exact per-secret overrides, seekrit name → destination name. */
-	rename: z.record(secretNameSchema, secretNameSchema).optional()
+	rename: z$1.record(secretNameSchema, secretNameSchema).optional()
 });
-z.object({
+z$1.object({
 	/**
 	* The id the client already fetched a public key for. Connections are a
 	* two-step dance — mint the key, wrap the credential to it, then create the
 	* row — so the id has to be chosen before the row exists. Omit it and the
 	* server generates one (only useful when there is no credential to wrap yet).
 	*/
-	id: z.string().regex(/^syc_[A-Za-z0-9]{24}$/, "must be a connection id from the public-key call").optional(),
-	name: z.string().trim().min(1).max(128),
+	id: z$1.string().regex(/^syc_[A-Za-z0-9]{24}$/, "must be a connection id from the public-key call").optional(),
+	name: z$1.string().trim().min(1).max(128),
 	config: syncConnectionConfigSchema,
 	/**
 	* The destination's API credential (a Vercel token), encrypted client-side to
 	* the connection's public key (a `wd1.` wrap). The control plane stores only
 	* this ciphertext; it is unwrapped transiently inside the sync engine DO.
 	*/
-	wrappedCredential: z.string().min(1)
+	wrappedCredential: z$1.string().min(1)
 });
-z.object({ destination: syncDestinationSchema });
-const globListSchema = z.array(z.string().trim().min(1).max(256)).max(100);
-z.object({
-	connectionId: z.string().min(1),
-	environmentId: z.string().min(1),
+z$1.object({ destination: syncDestinationSchema });
+const globListSchema = z$1.array(z$1.string().trim().min(1).max(256)).max(100);
+z$1.object({
+	connectionId: z$1.string().min(1),
+	environmentId: z$1.string().min(1),
 	destination: syncDestinationSchema,
 	nameTransform: nameTransformSchema.optional(),
 	include: globListSchema.optional(),
 	exclude: globListSchema.optional(),
-	onDelete: z.enum(["delete", "retain"]).default("delete"),
-	mode: z.enum(["auto", "manual"]).default("auto"),
-	wrappedDeks: z.array(z.object({
-		environmentId: z.string().min(1),
-		wrappedDek: z.string().min(1)
+	onDelete: z$1.enum(["delete", "retain"]).default("delete"),
+	mode: z$1.enum(["auto", "manual"]).default("auto"),
+	wrappedDeks: z$1.array(z$1.object({
+		environmentId: z$1.string().min(1),
+		wrappedDek: z$1.string().min(1)
 	})).min(1),
-	acknowledgedDecryption: z.literal(true)
+	acknowledgedDecryption: z$1.literal(true)
 });
-z.object({
+z$1.object({
 	destination: syncDestinationSchema.optional(),
 	nameTransform: nameTransformSchema.nullable().optional(),
 	include: globListSchema.nullable().optional(),
 	exclude: globListSchema.nullable().optional(),
-	onDelete: z.enum(["delete", "retain"]).optional(),
-	mode: z.enum(["auto", "manual"]).optional(),
-	enabled: z.boolean().optional()
+	onDelete: z$1.enum(["delete", "retain"]).optional(),
+	mode: z$1.enum(["auto", "manual"]).optional(),
+	enabled: z$1.boolean().optional()
 });
 // ../../packages/core/src/vault.ts
 /** One encrypted credential within a connection. */
@@ -4411,73 +4418,73 @@ const VAULT_WEBHOOK_EVENTS = [
 	"connection.reauth_required",
 	"connection.revoked"
 ];
-const base64urlMember = z.string().regex(/^[A-Za-z0-9_-]{43}$/, "not a P-256 coordinate");
-const vaultPublicJwkSchema = z.object({
-	kty: z.literal("EC"),
-	crv: z.literal("P-256"),
+const base64urlMember = z$1.string().regex(/^[A-Za-z0-9_-]{43}$/, "not a P-256 coordinate");
+const vaultPublicJwkSchema = z$1.object({
+	kty: z$1.literal("EC"),
+	crv: z$1.literal("P-256"),
 	x: base64urlMember,
 	y: base64urlMember
 });
-const isoInstant = z.iso.datetime({ offset: true });
-z.object({
-	v: z.literal(1),
-	accessToken: z.string().min(1).max(16384),
-	tokenType: z.literal("Bearer"),
+const isoInstant = z$1.iso.datetime({ offset: true });
+z$1.object({
+	v: z$1.literal(1),
+	accessToken: z$1.string().min(1).max(16384),
+	tokenType: z$1.literal("Bearer"),
 	accessTokenExpiresAt: isoInstant.optional(),
-	refreshToken: z.string().min(1).max(16384).optional(),
+	refreshToken: z$1.string().min(1).max(16384).optional(),
 	refreshTokenExpiresAt: isoInstant.optional(),
-	scope: z.array(z.string().max(512)).max(128),
+	scope: z$1.array(z$1.string().max(512)).max(128),
 	obtainedAt: isoInstant
 });
-z.object({
-	v: z.literal(1),
-	key: z.string().min(1).max(8192)
+z$1.object({
+	v: z$1.literal(1),
+	key: z$1.string().min(1).max(8192)
 });
 /** RFC 6238 parameters, as an authenticator app would hold them. */
-const vaultTotpSchema = z.object({
+const vaultTotpSchema = z$1.object({
 	/** Base32 (RFC 4648), upper case, no padding, no separators. */
-	secret: z.string().regex(/^[A-Z2-7]{16,128}$/, "TOTP secret must be base32"),
-	digits: z.union([z.literal(6), z.literal(8)]),
-	period: z.number().int().min(15).max(120),
-	algorithm: z.enum([
+	secret: z$1.string().regex(/^[A-Z2-7]{16,128}$/, "TOTP secret must be base32"),
+	digits: z$1.union([z$1.literal(6), z$1.literal(8)]),
+	period: z$1.number().int().min(15).max(120),
+	algorithm: z$1.enum([
 		"SHA1",
 		"SHA256",
 		"SHA512"
 	])
 });
-z.object({
-	v: z.literal(1),
-	username: z.string().min(1).max(512),
-	password: z.string().min(1).max(4096),
+z$1.object({
+	v: z$1.literal(1),
+	username: z$1.string().min(1).max(512),
+	password: z$1.string().min(1).max(4096),
 	totp: vaultTotpSchema.optional()
 });
-const vaultSessionCookieSchema = z.object({
-	name: z.string().min(1).max(4096),
-	value: z.string().max(16384),
+const vaultSessionCookieSchema = z$1.object({
+	name: z$1.string().min(1).max(4096),
+	value: z$1.string().max(16384),
 	/** Kept exactly as captured — parent-domain cookies restore to their parent. */
-	domain: z.string().min(1).max(253),
-	path: z.string().min(1).max(4096),
+	domain: z$1.string().min(1).max(253),
+	path: z$1.string().min(1).max(4096),
 	/** Unix seconds; -1 ⇒ a session cookie. */
-	expires: z.number(),
-	httpOnly: z.boolean(),
-	secure: z.boolean(),
-	sameSite: z.enum([
+	expires: z$1.number(),
+	httpOnly: z$1.boolean(),
+	secure: z$1.boolean(),
+	sameSite: z$1.enum([
 		"Strict",
 		"Lax",
 		"None"
 	]).optional(),
-	partitionKey: z.unknown().optional()
+	partitionKey: z$1.unknown().optional()
 });
-z.object({
-	v: z.literal(1),
-	siteId: z.string().min(1).max(64),
+z$1.object({
+	v: z$1.literal(1),
+	siteId: z$1.string().min(1).max(64),
 	capturedAt: isoInstant,
-	userAgent: z.string().max(1024),
-	cookies: z.array(vaultSessionCookieSchema).max(4096),
+	userAgent: z$1.string().max(1024),
+	cookies: z$1.array(vaultSessionCookieSchema).max(4096),
 	/** origin → key → value. */
-	localStorage: z.record(z.string(), z.record(z.string(), z.string()))
+	localStorage: z$1.record(z$1.string(), z$1.record(z$1.string(), z$1.string()))
 });
-const vaultProviderIdSchema = z.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/, "provider ids are lowercase letters, digits, dots and dashes");
+const vaultProviderIdSchema = z$1.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/, "provider ids are lowercase letters, digits, dots and dashes");
 /**
 * What the dashboard, Connect and the SDK may know about a provider: its name,
 * its method, and — for the consent screen — a plain sentence about what the
@@ -4485,90 +4492,90 @@ const vaultProviderIdSchema = z.string().trim().min(1).max(64).regex(/^[a-z0-9][
 * those are compiled into the executor and the API must not be able to serve a
 * different version of them.
 */
-const vaultCatalogProviderSchema = z.object({
+const vaultCatalogProviderSchema = z$1.object({
 	id: vaultProviderIdSchema,
-	displayName: z.string().trim().min(1).max(80),
-	method: z.enum(["oauth2", "api_key"]),
+	displayName: z$1.string().trim().min(1).max(80),
+	method: z$1.enum(["oauth2", "api_key"]),
 	/** The one sentence Connect shows: "read and send email as you". */
-	consentSummary: z.string().trim().min(1).max(240),
+	consentSummary: z$1.string().trim().min(1).max(240),
 	/** Hosts the executor will forward to, for display. */
-	hosts: z.array(z.string().trim().min(1).max(253)).max(64).default([]),
+	hosts: z$1.array(z$1.string().trim().min(1).max(253)).max(64).default([]),
 	/** Where the end user finds the key (api_key providers). */
-	helpUrl: z.url().max(2048).optional(),
+	helpUrl: z$1.url().max(2048).optional(),
 	/** Label for the key field (api_key providers), e.g. "API key". */
-	keyLabel: z.string().trim().min(1).max(60).optional(),
+	keyLabel: z$1.string().trim().min(1).max(60).optional(),
 	/** OAuth scopes the provider will be asked for (oauth2 providers), for display. */
-	scopes: z.array(z.string().trim().min(1).max(512)).max(64).optional()
+	scopes: z$1.array(z$1.string().trim().min(1).max(512)).max(64).optional()
 });
-const vaultCatalogSiteSchema = z.object({
+const vaultCatalogSiteSchema = z$1.object({
 	id: vaultProviderIdSchema,
-	displayName: z.string().trim().min(1).max(80),
-	consentSummary: z.string().trim().min(1).max(240),
+	displayName: z$1.string().trim().min(1).max(80),
+	consentSummary: z$1.string().trim().min(1).max(240),
 	/** Origins the login form must live on (shown so the person can check). */
-	loginOrigins: z.array(z.url().max(2048)).max(16).default([]),
+	loginOrigins: z$1.array(z$1.url().max(2048)).max(16).default([]),
 	/** Where a restored session lands, for display. */
-	startUrl: z.url().max(2048).optional()
+	startUrl: z$1.url().max(2048).optional()
 });
-const vaultCatalogSchema = z.object({
-	v: z.literal(1),
-	providers: z.array(vaultCatalogProviderSchema).max(200).default([]),
-	sites: z.array(vaultCatalogSiteSchema).max(200).default([])
+const vaultCatalogSchema = z$1.object({
+	v: z$1.literal(1),
+	providers: z$1.array(vaultCatalogProviderSchema).max(200).default([]),
+	sites: z$1.array(vaultCatalogSiteSchema).max(200).default([])
 });
-const vaultDisplaySchema = z.object({
+const vaultDisplaySchema = z$1.object({
 	/** The platform's name as its users know it: "Instinct", not "instinct-prod". */
-	name: z.string().trim().min(1).max(80),
-	logoUrl: z.url().max(2048).startsWith("https://").optional(),
+	name: z$1.string().trim().min(1).max(80),
+	logoUrl: z$1.url().max(2048).startsWith("https://").optional(),
 	/** `#rrggbb`. */
-	accent: z.string().regex(/^#[0-9a-fA-F]{6}$/, "accent must be a #rrggbb colour").optional(),
+	accent: z$1.string().regex(/^#[0-9a-fA-F]{6}$/, "accent must be a #rrggbb colour").optional(),
 	/** Origins a `returnUrl` may point at. Exact-match, scheme + host (+ port). */
-	returnOrigins: z.array(z.url().max(2048)).max(16).default([])
+	returnOrigins: z$1.array(z$1.url().max(2048)).max(16).default([])
 });
-z.object({
+z$1.object({
 	name: nameSchema,
 	display: vaultDisplaySchema.optional()
 });
-z.object({
+z$1.object({
 	name: nameSchema.optional(),
 	display: vaultDisplaySchema.optional(),
-	status: z.enum(["active", "disabled"]).optional()
+	status: z$1.enum(["active", "disabled"]).optional()
 });
-z.object({ name: nameSchema });
+z$1.object({ name: nameSchema });
 /**
 * The platform's opaque identifier for its end user. Stored as given and
 * returned as given. It must not be an email address or anything else that
 * identifies the person outside the platform: the person has no seekrit
 * account, and this is the one field about them Vault holds in the clear.
 */
-const vaultUserRefSchema = z.string().trim().min(1).max(200).refine((v) => !/\s/.test(v), { message: "userRef must not contain whitespace" }).refine((v) => !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v), { message: "userRef must be an opaque identifier, not an email address" });
-z.object({
+const vaultUserRefSchema = z$1.string().trim().min(1).max(200).refine((v) => !/\s/.test(v), { message: "userRef must not contain whitespace" }).refine((v) => !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v), { message: "userRef must be an opaque identifier, not an email address" });
+z$1.object({
 	userRef: vaultUserRefSchema,
 	providerId: vaultProviderIdSchema,
-	purpose: z.enum(["connect", "reconnect"]).default("connect"),
+	purpose: z$1.enum(["connect", "reconnect"]).default("connect"),
 	/** Required for `reconnect`: the connection being repaired. */
-	connectionId: z.string().trim().min(1).max(64).optional(),
+	connectionId: z$1.string().trim().min(1).max(64).optional(),
 	/** Where the done screen may send the person. Must match a registered origin. */
-	returnUrl: z.url().max(2048).optional(),
-	expiresInSeconds: z.number().int().min(60).max(VAULT_CONNECT_SESSION_MAX_TTL_SECONDS).optional()
+	returnUrl: z$1.url().max(2048).optional(),
+	expiresInSeconds: z$1.number().int().min(60).max(VAULT_CONNECT_SESSION_MAX_TTL_SECONDS).optional()
 });
-z.object({
+z$1.object({
 	userRef: vaultUserRefSchema,
-	returnUrl: z.url().max(2048).optional(),
-	expiresInSeconds: z.number().int().min(60).max(VAULT_CONNECT_SESSION_MAX_TTL_SECONDS).optional()
+	returnUrl: z$1.url().max(2048).optional(),
+	expiresInSeconds: z$1.number().int().min(60).max(VAULT_CONNECT_SESSION_MAX_TTL_SECONDS).optional()
 });
-z.object({
-	url: z.url().max(2048).refine((u) => u.startsWith("https://"), "webhook URLs must be https"),
+z$1.object({
+	url: z$1.url().max(2048).refine((u) => u.startsWith("https://"), "webhook URLs must be https"),
 	/** Defaults to every event. */
-	events: z.array(z.enum(VAULT_WEBHOOK_EVENTS)).min(1).max(VAULT_WEBHOOK_EVENTS.length).optional(),
-	description: z.string().trim().max(200).optional()
+	events: z$1.array(z$1.enum(VAULT_WEBHOOK_EVENTS)).min(1).max(VAULT_WEBHOOK_EVENTS.length).optional(),
+	description: z$1.string().trim().max(200).optional()
 });
-z.object({
+z$1.object({
 	userRef: vaultUserRefSchema.optional(),
-	status: z.enum(VAULT_CONNECTION_STATUSES).optional(),
-	cursor: z.string().max(200).optional(),
-	limit: z.coerce.number().int().min(1).max(200).default(50)
+	status: z$1.enum(VAULT_CONNECTION_STATUSES).optional(),
+	cursor: z$1.string().max(200).optional(),
+	limit: z$1.coerce.number().int().min(1).max(200).default(50)
 });
 /** An `https://host[:port]` origin with nothing after it; `http://localhost` in dev. */
-const vaultOriginSchema = z.string().trim().max(2048).refine((v) => {
+const vaultOriginSchema = z$1.string().trim().max(2048).refine((v) => {
 	let url;
 	try {
 		url = new URL(v);
@@ -4583,85 +4590,85 @@ const vaultOriginSchema = z.string().trim().max(2048).refine((v) => {
 		"[::1]"
 	].includes(url.hostname);
 }, { message: "must be an https origin (scheme + host, nothing else)" });
-const vaultWrappingKeySchema = z.object({
+const vaultWrappingKeySchema = z$1.object({
 	jwk: vaultPublicJwkSchema,
-	thumbprint: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+	thumbprint: z$1.string().regex(/^[A-Za-z0-9_-]{43}$/)
 });
-z.object({
-	code: z.string().trim().min(16).max(200),
+z$1.object({
+	code: z$1.string().trim().min(16).max(200),
 	origin: vaultOriginSchema,
 	wrappingKey: vaultWrappingKeySchema,
 	catalog: vaultCatalogSchema,
-	sdkVersion: z.string().trim().min(1).max(40)
+	sdkVersion: z$1.string().trim().min(1).max(40)
 });
-z.object({
+z$1.object({
 	catalog: vaultCatalogSchema,
-	sdkVersion: z.string().trim().min(1).max(40)
+	sdkVersion: z$1.string().trim().min(1).max(40)
 });
-z.object({ wrappingKey: vaultWrappingKeySchema });
+z$1.object({ wrappingKey: vaultWrappingKeySchema });
 /** One encrypted slot, as produced by Connect or the executor. */
-const vaultEncryptedSlotSchema = z.object({
-	slot: z.enum(VAULT_SLOTS),
-	revision: z.number().int().min(1),
-	ciphertext: z.string().startsWith("sc1.").max(VAULT_CIPHERTEXT_MAX_CHARS),
-	wrappedDek: z.string().startsWith("wd1.").max(2048),
-	keyThumbprint: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+const vaultEncryptedSlotSchema = z$1.object({
+	slot: z$1.enum(VAULT_SLOTS),
+	revision: z$1.number().int().min(1),
+	ciphertext: z$1.string().startsWith("sc1.").max(VAULT_CIPHERTEXT_MAX_CHARS),
+	wrappedDek: z$1.string().startsWith("wd1.").max(2048),
+	keyThumbprint: z$1.string().regex(/^[A-Za-z0-9_-]{43}$/)
 });
-z.object({
-	slots: z.array(vaultEncryptedSlotSchema).min(1).max(2),
+z$1.object({
+	slots: z$1.array(vaultEncryptedSlotSchema).min(1).max(2),
 	/** "ava@example.com" / "@ava" — shown to the platform and the org, never used for auth. */
-	accountLabel: z.string().trim().min(1).max(200).optional()
+	accountLabel: z$1.string().trim().min(1).max(200).optional()
 });
-z.object({
+z$1.object({
 	/** The revision the writer read; the write lands as `expectedRevision + 1`. */
-	expectedRevision: z.number().int().min(0),
-	ciphertext: z.string().startsWith("sc1.").max(VAULT_CIPHERTEXT_MAX_CHARS),
-	wrappedDek: z.string().startsWith("wd1.").max(2048),
-	keyThumbprint: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+	expectedRevision: z$1.number().int().min(0),
+	ciphertext: z$1.string().startsWith("sc1.").max(VAULT_CIPHERTEXT_MAX_CHARS),
+	wrappedDek: z$1.string().startsWith("wd1.").max(2048),
+	keyThumbprint: z$1.string().regex(/^[A-Za-z0-9_-]{43}$/)
 });
-z.discriminatedUnion("status", [z.object({
-	status: z.literal("reauth_required"),
-	reason: z.string().trim().min(1).max(120)
-}), z.object({ status: z.literal("active") })]);
-z.object({ claimToken: z.string().min(16).max(200) });
-z.object({ token: z.string().min(16).max(200) });
-z.object({ consentVersion: z.literal(1) });
-z.object({ connectionId: z.string().trim().min(1).max(64) });
-z.object({
+z$1.discriminatedUnion("status", [z$1.object({
+	status: z$1.literal("reauth_required"),
+	reason: z$1.string().trim().min(1).max(120)
+}), z$1.object({ status: z$1.literal("active") })]);
+z$1.object({ claimToken: z$1.string().min(16).max(200) });
+z$1.object({ token: z$1.string().min(16).max(200) });
+z$1.object({ consentVersion: z$1.literal(1) });
+z$1.object({ connectionId: z$1.string().trim().min(1).max(64) });
+z$1.object({
 	login: vaultEncryptedSlotSchema.refine((slot) => slot.slot === "login", "must be the login slot").optional(),
-	accountLabel: z.string().trim().min(1).max(200).optional()
+	accountLabel: z$1.string().trim().min(1).max(200).optional()
 });
-z.object({
+z$1.object({
 	userRef: vaultUserRefSchema,
-	connectionId: z.string().trim().min(1).max(64),
-	request: z.object({
-		method: z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/),
-		url: z.url().max(8192),
-		headers: z.record(z.string().max(256), z.string().max(16384)).optional(),
+	connectionId: z$1.string().trim().min(1).max(64),
+	request: z$1.object({
+		method: z$1.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/),
+		url: z$1.url().max(8192),
+		headers: z$1.record(z$1.string().max(256), z$1.string().max(16384)).optional(),
 		/** UTF-8 text. Binary bodies are out of scope for V1. */
-		body: z.string().max(4194304).optional()
+		body: z$1.string().max(4194304).optional()
 	})
 });
-const connectionIdSchema = z.string().trim().min(1).max(64);
-const leaseIdSchema = z.string().trim().min(1).max(64);
-z.object({
+const connectionIdSchema = z$1.string().trim().min(1).max(64);
+const leaseIdSchema = z$1.string().trim().min(1).max(64);
+z$1.object({
 	userRef: vaultUserRefSchema,
 	connectionId: connectionIdSchema,
 	/** How long the agent may hold the browser. Clamped to the site's ceiling. */
-	keepAliveMs: z.number().int().min(VAULT_LEASE_MIN_MS).max(VAULT_LEASE_MAX_MS).optional()
+	keepAliveMs: z$1.number().int().min(VAULT_LEASE_MIN_MS).max(VAULT_LEASE_MAX_MS).optional()
 });
-z.object({
+z$1.object({
 	userRef: vaultUserRefSchema,
 	leaseId: leaseIdSchema,
-	field: z.enum(VAULT_FILL_FIELDS)
+	field: z$1.enum(VAULT_FILL_FIELDS)
 });
-z.object({
+z$1.object({
 	userRef: vaultUserRefSchema,
 	leaseId: leaseIdSchema,
 	/** Write the rotated session back (default). `false` drops the browser without saving. */
-	save: z.boolean().default(true)
+	save: z$1.boolean().default(true)
 });
-z.object({
+z$1.object({
 	userRef: vaultUserRefSchema,
 	leaseId: leaseIdSchema
 });
@@ -5887,7 +5894,7 @@ async function createAgentTaskToken() {
 	};
 }
 // package.json
-var version = "2.5.1";
+var version = "2.6.0";
 // ../../packages/api-client/src/index.ts
 /**
 * The proposer's note travels as a header, not a body field: an unprotected
@@ -7052,13 +7059,13 @@ const CLI_CLIENT = `cli/${version}`;
 * bearer of nothing: a 401 where the honest answer is "you have no
 * credentials", pointing at the API instead of at the missing variable.
 */
-function present(value) {
+function present$1(value) {
 	const trimmed = value?.trim();
 	return trimmed ? trimmed : void 0;
 }
 function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
-	const fromEnv = (key) => present(process.env[key]) ?? present(dotenvVars[key]);
+	const fromEnv = (key) => present$1(process.env[key]) ?? present$1(dotenvVars[key]);
 	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
 	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token ?? config.sessionToken;
 	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
@@ -7103,7 +7110,7 @@ function describeError(err) {
 	if (!(err instanceof Error)) return String(err);
 	if (err.message !== "fetch failed") return err.message;
 	const config = readGlobalConfig();
-	const apiUrl = present(process.env.SEEKRIT_API_URL) ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const apiUrl = present$1(process.env.SEEKRIT_API_URL) ?? config.apiUrl ?? "https://api.seekrit.dev";
 	const cause = err.cause;
 	const reason = cause instanceof Error ? cause.code ?? cause.message : void 0;
 	return `cannot reach the seekrit API at ${apiUrl}${reason ? ` (${reason})` : ""} — check SEEKRIT_API_URL, your network, and that the API is up`;
@@ -7658,7 +7665,7 @@ function defaultIsAlive(pid) {
 	}
 }
 /** Write a file so a reader sees the old bytes or the new ones, never half of each. */
-function writeAtomic(path, content) {
+function writeAtomic$1(path, content) {
 	mkdirSync(dirname(path), {
 		recursive: true,
 		mode: 448
@@ -7725,7 +7732,7 @@ var AgentLoginSession = class {
 		await this.recoverLeftover();
 		await this.acquire();
 		this.registerHolder();
-		writeAtomic(this.o.path, this.synced);
+		writeAtomic$1(this.o.path, this.synced);
 		this.placed = true;
 		this.lastRemotePoll = this.o.now();
 		this.timer = setInterval(() => void this.tick(), this.o.localPollMs);
@@ -7899,7 +7906,7 @@ var AgentLoginSession = class {
 				this.version = snapshot.version;
 				continue;
 			}
-			writeAtomic(this.o.path, remote.content);
+			writeAtomic$1(this.o.path, remote.content);
 			this.adopt(snapshot, remote);
 			this.o.log(`another sandbox refreshed the ${this.o.adapter.label} login at the same moment; switched to its copy. If ${this.o.adapter.label} reports a sign-in error, run \`seekrit agent-login ${this.o.adapter.id}\` again.`);
 			return;
@@ -7925,7 +7932,7 @@ var AgentLoginSession = class {
 		const local = readIfExists(this.o.path);
 		if (local !== null && local !== this.synced) return;
 		if (remote.content !== this.synced && !this.fresher(this.synced, remote.content)) {
-			writeAtomic(this.o.path, remote.content);
+			writeAtomic$1(this.o.path, remote.content);
 			this.o.log(`picked up a ${this.o.adapter.label} login another sandbox refreshed`);
 		}
 		if (remote.claim?.holder !== this.o.holder) this.claimUntil = null;
@@ -7976,7 +7983,7 @@ var AgentLoginSession = class {
 			secret: this.o.secretName,
 			holders
 		};
-		writeAtomic(this.markerPath, `${JSON.stringify(marker, null, 2)}\n`);
+		writeAtomic$1(this.markerPath, `${JSON.stringify(marker, null, 2)}\n`);
 	}
 	/** Several runs on one machine can share a home; the last one out cleans up. */
 	registerHolder() {
@@ -9560,7 +9567,7 @@ async function syncGrantsForGroupLink(ctx, orgId, envId, envSlug, groupId) {
 }
 // src/kms.ts
 /** Collect a repeatable option into a list. */
-function collect$9(value, acc = []) {
+function collect$10(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -9628,7 +9635,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$9, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$9, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$10, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$10, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -9849,7 +9856,7 @@ function registerKmsCommands(program) {
 }
 // src/recovery.ts
 /** Collect a repeatable option into a list. */
-function collect$8(value, acc = []) {
+function collect$9(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -9946,7 +9953,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$8, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$9, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -9964,7 +9971,7 @@ function registerRecoveryCommands(program) {
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$8, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$9, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -11103,7 +11110,7 @@ function formatSecrets(values, format) {
 * `buildContext()` in any of them silently breaks the promise the feature makes.
 */
 /** Collect a repeatable option into a list. */
-function collect$7(value, acc = []) {
+function collect$8(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -11380,7 +11387,7 @@ function registerArchiveCommands(program) {
 		} catch {}
 		fail("none of the recovery shares in this archive unwrap with that key");
 	});
-	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$7).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$8).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
 		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
 		if (![
 			"dotenv",
@@ -13123,6 +13130,644 @@ function registerHoneyTokenCommands(program) {
 		console.error(`${honeyTokenId} deleted`);
 	});
 }
+// src/run-command.ts
+/** Keep signal handlers installed from provisioning through asynchronous cleanup. */
+async function runCommand(cmd, args, prepare, cleanup) {
+	let child;
+	let forwarded;
+	let result = { code: 1 };
+	const stragglers = /* @__PURE__ */ new Set();
+	const collect = () => {
+		if (process.platform === "win32" || !child?.pid) return;
+		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
+	};
+	const forward = (signal) => {
+		forwarded ??= signal;
+		if (!child || child.exitCode !== null || child.signalCode !== null) return;
+		collect();
+		child.kill(signal);
+		for (const pid of stragglers) try {
+			process.kill(pid, signal);
+		} catch {}
+	};
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	for (const signal of signals) process.on(signal, forward);
+	try {
+		const env = await prepare(() => forwarded !== void 0);
+		if (!forwarded) {
+			const running = spawn(cmd, args, {
+				stdio: "inherit",
+				env
+			});
+			child = running;
+			result = await new Promise((resolve, reject) => {
+				running.once("exit", (code, signal) => resolve({
+					code: code ?? 1,
+					signal: signal ?? void 0
+				}));
+				running.once("error", (err) => reject(/* @__PURE__ */ new Error(`failed to start ${cmd}: ${err.message}`)));
+			});
+		}
+	} finally {
+		try {
+			if (forwarded) {
+				collect();
+				await reapStragglers(stragglers, forwarded);
+			}
+		} finally {
+			try {
+				if (!await cleanup() && result.code === 0) result.code = 1;
+			} finally {
+				for (const signal of signals) process.off(signal, forward);
+			}
+		}
+	}
+	if (!child && forwarded) result.signal = forwarded;
+	return result;
+}
+/**
+* Every live process `seekrit run` is responsible for tearing down, from a
+* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
+* own process group — every other member of that group.
+*
+* Two mechanisms, because each covers the other's blind spot:
+*
+* - The parent-chain walk reaches a process that left our group via
+*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
+*   can touch. But it loses anything whose chain up to `root` has already
+*   broken — teardown kills the middle layers first, and an orphan reparents to
+*   init, out of reach of any walk down from `root`.
+* - Group membership survives exactly that: a pgid outlives the parent that
+*   passed it down. But it misses the ones that left the group.
+*
+* The group half applies only when our pid *is* our pgid, which is the shell-job
+* case: the shell put this command in a new group, so every other member of it
+* descends from us. Nested inside a shell script or a CI runner we are not the
+* leader and the group holds processes we did not start, so there we use the
+* walk alone.
+*
+* Zombies are skipped: they are already dead and waiting to be reaped, so
+* counting them would stall teardown for the full grace period and then report
+* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
+* back to signalling the immediate child.
+*/
+function teardownTargets(root) {
+	const ps = spawnSync("ps", [
+		"-A",
+		"-o",
+		"pid=,ppid=,pgid=,stat="
+	], { encoding: "utf8" });
+	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
+	const childrenOf = /* @__PURE__ */ new Map();
+	const groupOf = /* @__PURE__ */ new Map();
+	const isId = (value) => value !== void 0 && Number.isInteger(value);
+	for (const line of ps.stdout.split("\n")) {
+		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
+		const [id, parent, group] = [
+			pid,
+			ppid,
+			pgid
+		].map(Number);
+		if (!isId(id) || !isId(parent) || !isId(group)) continue;
+		if (stat?.startsWith("Z")) continue;
+		const siblings = childrenOf.get(parent);
+		if (siblings) siblings.push(id);
+		else childrenOf.set(parent, [id]);
+		groupOf.set(id, group);
+	}
+	const found = /* @__PURE__ */ new Set();
+	const queue = [root];
+	const seen = new Set(queue);
+	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
+		if (seen.has(kid)) continue;
+		seen.add(kid);
+		found.add(kid);
+		queue.push(kid);
+	}
+	if (groupOf.get(process.pid) === process.pid) {
+		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
+	}
+	found.delete(process.pid);
+	found.delete(root);
+	return [...found];
+}
+/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** How long a straggler gets to finish shutting down before SIGKILL. */
+const STRAGGLER_GRACE_MS = 2e3;
+/**
+* Once the command has exited, make sure nothing it started outlives us.
+*
+* Anything still alive here has ignored the signal we forwarded *and* lost the
+* parent that launched it, and we are the last process that knows its pid:
+* the tty won't hang it up (it is no longer in the foreground group, and the
+* shell has moved on), so it survives until the machine reboots. That is how
+* `tsx` and the server under it stacked up for days.
+*
+* So escalate rather than trust. SIGTERM first — it costs no extra time and is
+* a rung the SIGINT-only handlers common in dev servers don't catch — then
+* SIGKILL whatever is left after the grace period. Nothing is killed unless it
+* was asked to stop first and declined, and this runs only when we forwarded a
+* termination signal: a command that exits on its own having deliberately left a
+* daemon behind keeps working.
+*/
+async function reapStragglers(pids, signal) {
+	let live = [...pids].filter(isAlive);
+	if (live.length === 0) return;
+	for (const pid of live) try {
+		process.kill(pid, "SIGTERM");
+	} catch {}
+	const deadline = Date.now() + STRAGGLER_GRACE_MS;
+	while (live.length > 0 && Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, 50));
+		live = live.filter(isAlive);
+	}
+	if (live.length === 0) return;
+	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
+	for (const pid of live) try {
+		process.kill(pid, "SIGKILL");
+	} catch {}
+}
+// src/identity.ts
+/**
+* `seekrit identity` — keyless access to AWS, Google Cloud, OpenAI and Anthropic
+* from a seekrit workload identity, the way a hosting platform's OIDC
+* integration works.
+*
+* The workload authenticates to seekrit (an enrolled P-256 key, or a platform
+* JWT it already has), asks for a short-lived identity token addressed to each
+* provider, and writes it to the token file that provider's own SDK already
+* knows how to read. The provider verifies the token against the org's issuer
+* (`https://oidc.seekrit.dev/<orgId>`) and its own trust policy, and mints its own short-lived
+* credential. No provider key is stored anywhere — not here, not in seekrit.
+*
+* Identity, not secrets: nothing on this path decrypts anything, and the API
+* signs these tokens with its own issuer key, so the zero-knowledge invariant is
+* untouched.
+*/
+const DEFAULT_ISSUER = "https://api.seekrit.dev";
+const CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+const TOKEN_EXCHANGE_GRANT = "urn:ietf:params:oauth:grant-type:token-exchange";
+const JWT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:jwt";
+function present(value) {
+	return value?.trim() ? value.trim() : void 0;
+}
+function httpsOrigin(value, what) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`${what} must be an HTTPS origin, got "${value}"`);
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) throw new Error(`${what} must be an HTTPS origin, got "${value}"`);
+	return url.origin;
+}
+/**
+* Where the workload's credential comes from: the file the dashboard downloads
+* at enrollment (`SEEKRIT_WORKLOAD_FILE`), or — for a platform-federated
+* workload — its id plus the platform token's path.
+*/
+function loadWorkloadCredentials(opts, env = process.env) {
+	const file = present(opts.workloadFile) ?? present(env.SEEKRIT_WORKLOAD_FILE);
+	let fromFile = {};
+	if (file) {
+		let parsed;
+		try {
+			parsed = JSON.parse(readFileSync(file, "utf8"));
+		} catch (err) {
+			throw new Error(`cannot read workload credentials from ${file}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (!parsed || typeof parsed !== "object") throw new Error(`${file} is not a workload credential file`);
+		fromFile = parsed;
+	}
+	const workloadId = present(opts.workloadId) ?? present(fromFile.workloadId) ?? present(env.SEEKRIT_WORKLOAD_ID);
+	if (!workloadId) throw new Error("no workload identity: set SEEKRIT_WORKLOAD_FILE (or --workload-file) to the credentials downloaded at enrollment, or --workload-id with --platform-token-file");
+	if (!/^wli_[A-Za-z0-9_-]{1,128}$/.test(workloadId)) throw new Error(`"${workloadId}" is not a workload id (expected wli_…)`);
+	const issuer = httpsOrigin(present(opts.issuer) ?? present(fromFile.issuer) ?? present(env.SEEKRIT_ISSUER) ?? DEFAULT_ISSUER, "the seekrit issuer");
+	const platformTokenFile = present(opts.platformTokenFile) ?? present(fromFile.platformTokenFile) ?? present(env.SEEKRIT_PLATFORM_TOKEN_FILE);
+	const signingKey = fromFile.signingKey;
+	if (!!signingKey === !!platformTokenFile) throw new Error(signingKey ? "the workload file holds an enrollment key; do not also pass a platform token" : "this workload needs an enrollment key (in its credential file) or --platform-token-file");
+	if (signingKey && (signingKey.kty !== "EC" || signingKey.crv !== "P-256" || !signingKey.d || !signingKey.x)) throw new Error("the workload file's signingKey is not a private P-256 key");
+	return {
+		workloadId,
+		issuer,
+		signingKey,
+		platformTokenFile
+	};
+}
+function base64url(bytes) {
+	return Buffer.from(bytes).toString("base64url");
+}
+/** A one-use, 60-second ES256 client assertion, the shape `/oauth/token` verifies. */
+async function signClientAssertion(creds, key, nowSeconds) {
+	const unsigned = `${base64url(new TextEncoder().encode(JSON.stringify({
+		alg: "ES256",
+		typ: "JWT"
+	})))}.${base64url(new TextEncoder().encode(JSON.stringify({
+		iss: creds.workloadId,
+		sub: creds.workloadId,
+		aud: `${creds.issuer}/oauth/token`,
+		iat: nowSeconds,
+		exp: nowSeconds + 60,
+		jti: crypto.randomUUID()
+	})))}`;
+	const signature = await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, key, new TextEncoder().encode(unsigned));
+	return `${unsigned}.${base64url(new Uint8Array(signature))}`;
+}
+async function errorText(response) {
+	try {
+		const body = await response.json();
+		if (body.error_description) return body.error_description;
+		if (typeof body.error === "object" && body.error?.message) return body.error.message;
+		if (typeof body.error === "string") return body.error;
+	} catch {}
+	return `HTTP ${response.status}`;
+}
+/** Session exchange + identity-token requests against one seekrit deployment. */
+var WorkloadClient = class {
+	creds;
+	fetcher;
+	now;
+	session;
+	key;
+	constructor(creds, fetcher = (input, init) => fetch(input, init), now = Date.now) {
+		this.creds = creds;
+		this.fetcher = fetcher;
+		this.now = now;
+	}
+	signingKey() {
+		this.key ??= crypto.subtle.importKey("jwk", this.creds.signingKey, {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		}, false, ["sign"]);
+		return this.key;
+	}
+	async exchange() {
+		const form = new URLSearchParams({
+			client_id: this.creds.workloadId,
+			scope: "connect"
+		});
+		if (this.creds.platformTokenFile) {
+			const platformToken = readFileSync(this.creds.platformTokenFile, "utf8").trim();
+			form.set("grant_type", TOKEN_EXCHANGE_GRANT);
+			form.set("subject_token_type", JWT_TOKEN_TYPE);
+			form.set("subject_token", platformToken);
+		} else {
+			form.set("grant_type", "client_credentials");
+			form.set("client_assertion_type", CLIENT_ASSERTION_TYPE);
+			form.set("client_assertion", await signClientAssertion(this.creds, await this.signingKey(), Math.floor(this.now() / 1e3)));
+		}
+		const response = await this.fetcher(`${this.creds.issuer}/oauth/token`, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: form
+		});
+		if (!response.ok) throw new Error(`workload sign-in failed: ${await errorText(response)}`);
+		const body = await response.json();
+		this.session = {
+			token: body.access_token,
+			expiresAt: this.now() + body.expires_in * 1e3
+		};
+		return body.access_token;
+	}
+	async accessToken() {
+		if (this.session && this.session.expiresAt - 3e4 > this.now()) return this.session.token;
+		return this.exchange();
+	}
+	/** An identity token for one enrolled audience. */
+	async identityToken(audience) {
+		for (let attempt = 0;; attempt++) {
+			const response = await this.fetcher(`${this.creds.issuer}/v1/connect/identity-token`, {
+				method: "POST",
+				headers: {
+					authorization: `Bearer ${await this.accessToken()}`,
+					"content-type": "application/json"
+				},
+				body: JSON.stringify({ audience })
+			});
+			if (response.status === 401 && attempt === 0) {
+				this.session = void 0;
+				continue;
+			}
+			if (!response.ok) throw new Error(`identity token for "${audience}" refused: ${await errorText(response)}`);
+			return await response.json();
+		}
+	}
+};
+/** The audience each provider's own docs use; any enrolled audience can override it. */
+const DEFAULT_AUDIENCES = {
+	aws: "sts.amazonaws.com",
+	openai: "https://api.openai.com/v1",
+	anthropic: "https://api.anthropic.com"
+};
+/**
+* Credentials that outrank web identity in each provider's default chain. An
+* explicit `--aws`/`--anthropic`/… means "use the federated identity", so a
+* long-lived key left in the shell must not quietly win — the same rule as
+* `seekrit run --lease`.
+*/
+const SHADOWING = {
+	aws: [
+		"AWS_ACCESS_KEY_ID",
+		"AWS_SECRET_ACCESS_KEY",
+		"AWS_SESSION_TOKEN",
+		"AWS_PROFILE"
+	],
+	gcp: [],
+	openai: ["OPENAI_API_KEY"],
+	anthropic: [
+		"ANTHROPIC_API_KEY",
+		"ANTHROPIC_AUTH_TOKEN",
+		"ANTHROPIC_PROFILE",
+		"ANTHROPIC_IDENTITY_TOKEN"
+	]
+};
+/** `projects/N/locations/global/workloadIdentityPools/P/providers/R`, from any of its spellings. */
+function normalizeGcpProvider(input) {
+	const resource = input.trim().replace(/^https:\/\/iam\.googleapis\.com\//, "").replace(/^\/\/iam\.googleapis\.com\//, "");
+	if (!/^projects\/\d+\/locations\/global\/workloadIdentityPools\/[a-z0-9-]{4,32}\/providers\/[a-z0-9-]{4,32}$/.test(resource)) throw new Error(`--gcp must name a workload identity pool provider by project number: projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider> (got "${input}")`);
+	return resource;
+}
+function parseAudienceOverrides(values = []) {
+	const out = {};
+	for (const value of values) {
+		const at = value.indexOf("=");
+		const id = value.slice(0, at);
+		const audience = value.slice(at + 1).trim();
+		if (at < 1 || ![
+			"aws",
+			"gcp",
+			"openai",
+			"anthropic"
+		].includes(id) || !audience) throw new Error(`--audience takes provider=audience, e.g. anthropic=api.anthropic.com`);
+		if (out[id]) throw new Error(`--audience given twice for ${id}`);
+		out[id] = audience;
+	}
+	return out;
+}
+/**
+* What to write and export for each requested provider. Pure: paths are inside
+* `dir`, which the caller creates (mode 0700) and removes.
+*/
+function planProviders(opts, dir, workloadId, env = process.env) {
+	const audiences = parseAudienceOverrides(opts.audience);
+	const plans = [];
+	if (opts.aws !== void 0) {
+		if (!/^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]+$/.test(opts.aws.trim())) throw new Error(`--aws must be an IAM role ARN, got "${opts.aws}"`);
+		const tokenFile = join(dir, "aws-token");
+		plans.push({
+			id: "aws",
+			audience: audiences.aws ?? DEFAULT_AUDIENCES.aws,
+			tokenFile,
+			env: {
+				AWS_ROLE_ARN: opts.aws.trim(),
+				AWS_WEB_IDENTITY_TOKEN_FILE: tokenFile,
+				AWS_ROLE_SESSION_NAME: present(env.AWS_ROLE_SESSION_NAME) ?? `seekrit-${workloadId}`.slice(0, 64)
+			},
+			unset: SHADOWING.aws,
+			files: []
+		});
+	}
+	if (opts.gcp !== void 0) {
+		const resource = normalizeGcpProvider(opts.gcp);
+		const tokenFile = join(dir, "gcp-token");
+		const configFile = join(dir, "gcp-credentials.json");
+		const sa = present(opts.gcpServiceAccount);
+		if (sa && !/^[a-z0-9-]+@[a-z0-9.-]+\.gserviceaccount\.com$/.test(sa)) throw new Error(`--gcp-service-account must be a service account email, got "${sa}"`);
+		const config = {
+			type: "external_account",
+			audience: `//iam.googleapis.com/${resource}`,
+			subject_token_type: JWT_TOKEN_TYPE,
+			token_url: "https://sts.googleapis.com/v1/token",
+			credential_source: {
+				file: tokenFile,
+				format: { type: "text" }
+			},
+			...sa ? { service_account_impersonation_url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${sa}:generateAccessToken` } : {}
+		};
+		plans.push({
+			id: "gcp",
+			audience: audiences.gcp ?? `https://iam.googleapis.com/${resource}`,
+			tokenFile,
+			env: {
+				GOOGLE_APPLICATION_CREDENTIALS: configFile,
+				CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE: configFile
+			},
+			unset: SHADOWING.gcp,
+			files: [{
+				path: configFile,
+				content: `${JSON.stringify(config, null, 2)}\n`
+			}]
+		});
+	} else if (opts.gcpServiceAccount) throw new Error("--gcp-service-account needs --gcp");
+	if (opts.openai) {
+		const tokenFile = join(dir, "openai-token");
+		plans.push({
+			id: "openai",
+			audience: audiences.openai ?? DEFAULT_AUDIENCES.openai,
+			tokenFile,
+			env: { OPENAI_IDENTITY_TOKEN_FILE: tokenFile },
+			unset: SHADOWING.openai,
+			files: []
+		});
+	}
+	if (opts.anthropic) {
+		const tokenFile = join(dir, "anthropic-token");
+		plans.push({
+			id: "anthropic",
+			audience: audiences.anthropic ?? DEFAULT_AUDIENCES.anthropic,
+			tokenFile,
+			env: { ANTHROPIC_IDENTITY_TOKEN_FILE: tokenFile },
+			unset: SHADOWING.anthropic,
+			files: []
+		});
+	}
+	for (const id of Object.keys(audiences)) if (!plans.some((p) => p.id === id)) throw new Error(`--audience ${id}=… without --${id}`);
+	if (plans.length === 0) throw new Error("name at least one provider: --aws <role-arn>, --gcp <provider>, --openai, --anthropic");
+	return plans;
+}
+/**
+* The child's environment: shadowing credentials removed, provider variables
+* set. Returns the names it removed (never values) so the caller can say so.
+*/
+function childEnvironment(base, plans) {
+	const env = { ...base };
+	const removed = [];
+	for (const plan of plans) for (const name of plan.unset) if (env[name] !== void 0) {
+		delete env[name];
+		removed.push(name);
+	}
+	for (const plan of plans) Object.assign(env, plan.env);
+	return {
+		env,
+		removed
+	};
+}
+/** Variables a provider SDK needs from the operator before it will federate at all. */
+function missingProviderSettings(plans, env) {
+	const missing = [];
+	if (plans.some((p) => p.id === "anthropic")) {
+		for (const name of ["ANTHROPIC_FEDERATION_RULE_ID", "ANTHROPIC_ORGANIZATION_ID"]) if (!present(env[name])) missing.push(name);
+	}
+	return missing;
+}
+/** Write-then-rename, so a reader never sees half a token. */
+function writeAtomic(path, content) {
+	const tmp = `${path}.${crypto.randomUUID()}.tmp`;
+	writeFileSync(tmp, content, { mode: 384 });
+	renameSync(tmp, path);
+}
+/**
+* Keeps each provider's token file current. Refreshes at half the token's
+* lifetime, so a provider SDK rereading the file always finds a token with
+* plenty of life left — and, for Anthropic, which accepts each token's `jti`
+* only once, a fresh one by the time it next exchanges.
+*/
+var TokenFileRefresher = class {
+	client;
+	plans;
+	timers = /* @__PURE__ */ new Map();
+	expiries = /* @__PURE__ */ new Map();
+	stopped = false;
+	log;
+	minIntervalMs;
+	setTimer;
+	clearTimer;
+	now;
+	constructor(client, plans, opts = {}) {
+		this.client = client;
+		this.plans = plans;
+		this.log = opts.log ?? ((m) => console.error(m));
+		this.minIntervalMs = opts.minIntervalMs ?? 3e4;
+		this.setTimer = opts.setTimer ?? ((fn, ms) => setTimeout(fn, ms));
+		this.clearTimer = opts.clearTimer ?? ((t) => clearTimeout(t));
+		this.now = opts.now ?? Date.now;
+	}
+	/** Fetch every token once. Throws if any provider's first token cannot be had. */
+	async start() {
+		for (const plan of this.plans) for (const file of plan.files) writeAtomic(file.path, file.content);
+		await Promise.all(this.plans.map((plan) => this.refresh(plan, true)));
+	}
+	async refresh(plan, first = false) {
+		if (this.stopped) return;
+		try {
+			const issued = await this.client.identityToken(plan.audience);
+			if (this.stopped) return;
+			writeAtomic(plan.tokenFile, issued.token);
+			this.expiries.set(plan.id, this.now() + issued.expiresIn * 1e3);
+			this.schedule(plan, Math.max(this.minIntervalMs, issued.expiresIn * 1e3 / 2));
+		} catch (err) {
+			if (first) throw err;
+			const left = (this.expiries.get(plan.id) ?? 0) - this.now();
+			this.log(`seekrit: could not refresh the ${plan.id} identity token (${err instanceof Error ? err.message : String(err)}); ${left > 0 ? `the current one is valid for ${Math.round(left / 1e3)}s more, retrying` : "the current one has expired, retrying"}`);
+			this.schedule(plan, Math.min(this.minIntervalMs, Math.max(1e3, left / 4)));
+		}
+	}
+	schedule(plan, ms) {
+		if (this.stopped) return;
+		const timer = this.setTimer(() => void this.refresh(plan), ms);
+		timer.unref?.();
+		this.timers.set(plan.id, timer);
+	}
+	stop() {
+		this.stopped = true;
+		for (const timer of this.timers.values()) this.clearTimer(timer);
+		this.timers.clear();
+	}
+};
+/**
+* Run `cmd` with provider token files kept fresh for as long as it lives. The
+* token directory is private (0700, files 0600) and removed afterwards.
+*/
+async function runWithIdentity(cmd, args, client, opts) {
+	const log = opts.log ?? ((m) => console.error(m));
+	const dir = mkdtempSync(join(tmpdir(), "seekrit-identity-"));
+	let refresher;
+	try {
+		const plans = planProviders(opts, dir, opts.workloadId);
+		for (const name of missingProviderSettings(plans, process.env)) log(`seekrit: ${name} is not set; the provider SDK will not use the federated token without it`);
+		return await runCommand(cmd, args, async () => {
+			refresher = new TokenFileRefresher(client, plans, { log });
+			await refresher.start();
+			const { env, removed } = childEnvironment(process.env, plans);
+			if (removed.length > 0) log(`seekrit: unset ${removed.join(", ")} for the command so the federated identity is used`);
+			return env;
+		}, async () => {
+			refresher?.stop();
+			rmSync(dir, {
+				recursive: true,
+				force: true
+			});
+			return true;
+		});
+	} catch (err) {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		throw err;
+	}
+}
+function collect$7(value, previous = []) {
+	return [...previous, value];
+}
+function clientFrom(options) {
+	try {
+		const creds = loadWorkloadCredentials(options);
+		return {
+			client: new WorkloadClient(creds),
+			workloadId: creds.workloadId
+		};
+	} catch (err) {
+		fail(err instanceof Error ? err.message : String(err));
+	}
+}
+function credentialFlags(command) {
+	return command.option("--workload-file <path>", "credentials downloaded at enrollment (default: $SEEKRIT_WORKLOAD_FILE)").option("--workload-id <id>", "workload id, for a platform-federated workload").option("--platform-token-file <path>", "platform JWT to exchange, reread on every sign-in (default: $SEEKRIT_PLATFORM_TOKEN_FILE)").option("--issuer <origin>", `seekrit API origin (default: the credential file's, or ${DEFAULT_ISSUER})`);
+}
+function registerIdentityCommands(program) {
+	const identity = program.command("identity").description("keyless AWS, Google Cloud, OpenAI and Anthropic access from a seekrit workload identity");
+	credentialFlags(identity.command("token").description("print a signed identity token for one enrolled audience").requiredOption("--audience <aud>", "an audience enrolled on the workload").option("--json", "print {token, expiresIn, issuer, subject} instead of the bare token")).action(async (options) => {
+		const { client } = clientFrom(options);
+		try {
+			const issued = await client.identityToken(options.audience);
+			console.log(options.json ? JSON.stringify(issued, null, 2) : issued.token);
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err));
+		}
+	});
+	credentialFlags(identity.command("run").description("run a command with provider identity-token files kept fresh and the provider SDK variables set").passThroughOptions().option("--aws <role-arn>", "assume this IAM role via web identity").option("--gcp <provider>", "workload identity pool provider: projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<id>").option("--gcp-service-account <email>", "impersonate this service account after federating").option("--openai", "write OPENAI_IDENTITY_TOKEN_FILE").option("--anthropic", "write ANTHROPIC_IDENTITY_TOKEN_FILE").option("--audience <provider=aud>", "override a provider's default audience (repeatable)", collect$7).argument("<command...>", "command to run (prefix with -- to pass flags)")).action(async (commandParts, options) => {
+		const [cmd, ...args] = commandParts;
+		if (!cmd) fail("no command given");
+		const { client, workloadId } = clientFrom(options);
+		let result;
+		try {
+			result = await runWithIdentity(cmd, args, client, {
+				...options,
+				workloadId
+			});
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err));
+		}
+		if (result.signal) process.kill(process.pid, result.signal);
+		else process.exit(result.code);
+	});
+}
 // src/m2m.ts
 /**
 * Resolve M2M client credentials from (in order) the process environment, a
@@ -16171,176 +16816,6 @@ function registerRotationCommands(program) {
 		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
 	});
 }
-// src/run-command.ts
-/** Keep signal handlers installed from provisioning through asynchronous cleanup. */
-async function runCommand(cmd, args, prepare, cleanup) {
-	let child;
-	let forwarded;
-	let result = { code: 1 };
-	const stragglers = /* @__PURE__ */ new Set();
-	const collect = () => {
-		if (process.platform === "win32" || !child?.pid) return;
-		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
-	};
-	const forward = (signal) => {
-		forwarded ??= signal;
-		if (!child || child.exitCode !== null || child.signalCode !== null) return;
-		collect();
-		child.kill(signal);
-		for (const pid of stragglers) try {
-			process.kill(pid, signal);
-		} catch {}
-	};
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	for (const signal of signals) process.on(signal, forward);
-	try {
-		const env = await prepare(() => forwarded !== void 0);
-		if (!forwarded) {
-			const running = spawn(cmd, args, {
-				stdio: "inherit",
-				env
-			});
-			child = running;
-			result = await new Promise((resolve, reject) => {
-				running.once("exit", (code, signal) => resolve({
-					code: code ?? 1,
-					signal: signal ?? void 0
-				}));
-				running.once("error", (err) => reject(/* @__PURE__ */ new Error(`failed to start ${cmd}: ${err.message}`)));
-			});
-		}
-	} finally {
-		try {
-			if (forwarded) {
-				collect();
-				await reapStragglers(stragglers, forwarded);
-			}
-		} finally {
-			try {
-				if (!await cleanup() && result.code === 0) result.code = 1;
-			} finally {
-				for (const signal of signals) process.off(signal, forward);
-			}
-		}
-	}
-	if (!child && forwarded) result.signal = forwarded;
-	return result;
-}
-/**
-* Every live process `seekrit run` is responsible for tearing down, from a
-* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
-* own process group — every other member of that group.
-*
-* Two mechanisms, because each covers the other's blind spot:
-*
-* - The parent-chain walk reaches a process that left our group via
-*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
-*   can touch. But it loses anything whose chain up to `root` has already
-*   broken — teardown kills the middle layers first, and an orphan reparents to
-*   init, out of reach of any walk down from `root`.
-* - Group membership survives exactly that: a pgid outlives the parent that
-*   passed it down. But it misses the ones that left the group.
-*
-* The group half applies only when our pid *is* our pgid, which is the shell-job
-* case: the shell put this command in a new group, so every other member of it
-* descends from us. Nested inside a shell script or a CI runner we are not the
-* leader and the group holds processes we did not start, so there we use the
-* walk alone.
-*
-* Zombies are skipped: they are already dead and waiting to be reaped, so
-* counting them would stall teardown for the full grace period and then report
-* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
-* back to signalling the immediate child.
-*/
-function teardownTargets(root) {
-	const ps = spawnSync("ps", [
-		"-A",
-		"-o",
-		"pid=,ppid=,pgid=,stat="
-	], { encoding: "utf8" });
-	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
-	const childrenOf = /* @__PURE__ */ new Map();
-	const groupOf = /* @__PURE__ */ new Map();
-	const isId = (value) => value !== void 0 && Number.isInteger(value);
-	for (const line of ps.stdout.split("\n")) {
-		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
-		const [id, parent, group] = [
-			pid,
-			ppid,
-			pgid
-		].map(Number);
-		if (!isId(id) || !isId(parent) || !isId(group)) continue;
-		if (stat?.startsWith("Z")) continue;
-		const siblings = childrenOf.get(parent);
-		if (siblings) siblings.push(id);
-		else childrenOf.set(parent, [id]);
-		groupOf.set(id, group);
-	}
-	const found = /* @__PURE__ */ new Set();
-	const queue = [root];
-	const seen = new Set(queue);
-	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
-		if (seen.has(kid)) continue;
-		seen.add(kid);
-		found.add(kid);
-		queue.push(kid);
-	}
-	if (groupOf.get(process.pid) === process.pid) {
-		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
-	}
-	found.delete(process.pid);
-	found.delete(root);
-	return [...found];
-}
-/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
-function isAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** How long a straggler gets to finish shutting down before SIGKILL. */
-const STRAGGLER_GRACE_MS = 2e3;
-/**
-* Once the command has exited, make sure nothing it started outlives us.
-*
-* Anything still alive here has ignored the signal we forwarded *and* lost the
-* parent that launched it, and we are the last process that knows its pid:
-* the tty won't hang it up (it is no longer in the foreground group, and the
-* shell has moved on), so it survives until the machine reboots. That is how
-* `tsx` and the server under it stacked up for days.
-*
-* So escalate rather than trust. SIGTERM first — it costs no extra time and is
-* a rung the SIGINT-only handlers common in dev servers don't catch — then
-* SIGKILL whatever is left after the grace period. Nothing is killed unless it
-* was asked to stop first and declined, and this runs only when we forwarded a
-* termination signal: a command that exits on its own having deliberately left a
-* daemon behind keeps working.
-*/
-async function reapStragglers(pids, signal) {
-	let live = [...pids].filter(isAlive);
-	if (live.length === 0) return;
-	for (const pid of live) try {
-		process.kill(pid, "SIGTERM");
-	} catch {}
-	const deadline = Date.now() + STRAGGLER_GRACE_MS;
-	while (live.length > 0 && Date.now() < deadline) {
-		await new Promise((resolve) => setTimeout(resolve, 50));
-		live = live.filter(isAlive);
-	}
-	if (live.length === 0) return;
-	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
-	for (const pid of live) try {
-		process.kill(pid, "SIGKILL");
-	} catch {}
-}
 // src/run-leases.ts
 /** Validate all flags before contacting the API or creating any database roles. */
 function parseRunLeaseOptions(bindings = [], ttl) {
@@ -18000,6 +18475,7 @@ registerHermesCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);
+registerIdentityCommands(program);
 registerMongoCommands(program);
 registerKmsCommands(program);
 registerRotationCommands(program);