@wizzlethorpe/vaults 0.1.0

package/dist/commands/role.js

@@ -0,0 +1,122 @@
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { hashPassword } from "../auth.js";
+import { loadConfig, saveConfig } from "../config.js";
+export async function roleAdd(name, vaultPath) {
+    if (!/^[a-z][a-z0-9_-]*$/i.test(name)) {
+        throw new Error(`Invalid role name '${name}'. Use letters, digits, '_' or '-' (must start with a letter).`);
+    }
+    const cfg = await loadConfig(vaultPath, {});
+    if (cfg.roles.includes(name))
+        throw new Error(`Role '${name}' already exists.`);
+    // First role added (or first ever role) is the default — no password.
+    // Subsequent roles need a password to gate access.
+    const isDefault = cfg.roles.length === 0;
+    cfg.roles.push(name);
+    if (!isDefault) {
+        console.log(`Adding role '${name}'. Set a password to gate access:`);
+        const pw = await readPassword();
+        cfg.rolePasswords[name] = await hashPassword(pw);
+    }
+    await saveConfig(vaultPath, cfg);
+    console.log(`Added role '${name}'${isDefault ? " (default)" : ""}.`);
+    console.log(`  Mark pages with 'role: ${name}' frontmatter or callouts with '> [!${name}]' to gate them.`);
+}
+export async function roleRemove(name, vaultPath) {
+    const cfg = await loadConfig(vaultPath, {});
+    if (!cfg.roles.includes(name)) {
+        throw new Error(`Role '${name}' is not configured (${cfg.roles.join(", ") || "empty"}).`);
+    }
+    if (cfg.roles[0] === name && cfg.roles.length > 1) {
+        throw new Error(`Can't remove '${name}' — it's the default role. Remove the other roles first.`);
+    }
+    cfg.roles = cfg.roles.filter((r) => r !== name);
+    delete cfg.rolePasswords[name];
+    await saveConfig(vaultPath, cfg);
+    console.log(`Removed role '${name}'.`);
+    console.log(`  Pages tagged 'role: ${name}' will fall back to the default role on next build.`);
+}
+export async function rolePromote(name, vaultPath) {
+    await reorderRole(name, vaultPath, +1);
+}
+export async function roleDemote(name, vaultPath) {
+    await reorderRole(name, vaultPath, -1);
+}
+async function reorderRole(name, vaultPath, delta) {
+    const cfg = await loadConfig(vaultPath, {});
+    const roles = cfg.roles;
+    const i = roles.indexOf(name);
+    if (i === -1)
+        throw new Error(`Role '${name}' is not configured (${roles.join(", ") || "empty"}).`);
+    if (i === 0)
+        throw new Error(`Can't reorder '${name}' — it's the default role.`);
+    const j = i + delta;
+    if (j < 1 || j >= roles.length) {
+        throw new Error(`'${name}' is already at the ${delta > 0 ? "highest" : "lowest non-default"} rank.`);
+    }
+    [roles[i], roles[j]] = [roles[j], roles[i]];
+    await saveConfig(vaultPath, cfg);
+    const action = delta > 0 ? "Promoted" : "Demoted";
+    console.log(`${action} '${name}' to rank ${j} of ${roles.length - 1}.`);
+    console.log(`  New order: ${roles.join(" < ")}`);
+}
+export async function roleList(vaultPath) {
+    const cfg = await loadConfig(vaultPath, {});
+    if (cfg.roles.length === 0) {
+        console.log("No roles configured. Run `vaults role add <name>` to add one.");
+        return;
+    }
+    console.log("Roles (lowest → highest):");
+    cfg.roles.forEach((r, i) => {
+        const isDefault = i === 0;
+        const hasPw = cfg.rolePasswords[r] != null;
+        const tag = isDefault ? " (default, public)" : hasPw ? "" : " (no password set!)";
+        console.log(`  ${r}${tag}`);
+    });
+}
+async function readPassword() {
+    const isTty = !!stdin.isTTY;
+    if (!isTty) {
+        const chunks = [];
+        for await (const chunk of stdin)
+            chunks.push(chunk);
+        const lines = Buffer.concat(chunks).toString("utf8").split(/\r?\n/);
+        const pw = lines[0] ?? "";
+        const confirm = lines[1] ?? "";
+        if (!pw)
+            throw new Error("Empty password.");
+        if (pw !== confirm)
+            throw new Error("Passwords don't match.");
+        return pw;
+    }
+    const rl = createInterface({ input: stdin, output: stdout });
+    try {
+        const pw = await maskedRead(rl, "Password: ");
+        if (!pw)
+            throw new Error("Empty password.");
+        const confirm = await maskedRead(rl, "Confirm:  ");
+        if (pw !== confirm)
+            throw new Error("Passwords don't match.");
+        return pw;
+    }
+    finally {
+        rl.close();
+    }
+}
+async function maskedRead(rl, prompt) {
+    stdout.write(prompt);
+    const realWrite = stdout.write.bind(stdout);
+    let muted = true;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    stdout.write = ((chunk, ...rest) => muted ? true : realWrite(chunk, ...rest));
+    try {
+        return await rl.question("");
+    }
+    finally {
+        muted = false;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        stdout.write = realWrite;
+        stdout.write("\n");
+    }
+}
+//# sourceMappingURL=role.js.map

package/dist/commands/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../src/commands/role.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,SAAiB;IAC3D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,gEAAgE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;IAEhF,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACzC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,mCAAmC,CAAC,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QAChC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,uCAAuC,IAAI,kBAAkB,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB;IAC9D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,wBAAwB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,0DAA0D,CAAC,CAAC;IACnG,CAAC;IAED,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,qDAAqD,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IAC/D,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB;IAC9D,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAa;IACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC;IACpG,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,4BAA4B,CAAC,CAAC;IAEjF,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,uBAAuB,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,QAAQ,CAAC,CAAC;IACvG,CAAC;IACD,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,EAAE,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,EAAE,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9D,OAAO,EAAE,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EAAsC,EAAE,MAAc;IAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,8DAA8D;IAC7D,MAAc,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE,CAC9D,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAc,EAAE,GAAG,IAAU,CAAC,CAAqB,CAAC;IAC/E,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,KAAK,GAAG,KAAK,CAAC;QACd,8DAA8D;QAC7D,MAAc,CAAC,KAAK,GAAG,SAAS,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/config.js

@@ -0,0 +1,79 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+const DEFAULT_CONFIG = {
+    imageQuality: 85,
+    maxFileBytes: 25 * 1024 * 1024,
+    roles: ["public"],
+    authType: "password",
+    rolePasswords: {},
+};
+const CONFIG_FILE = ".vaultrc.json";
+export async function loadConfig(vaultPath, overrides) {
+    const fileConfig = await readFileConfig(vaultPath);
+    const envConfig = readEnvConfig();
+    const merged = {
+        ...DEFAULT_CONFIG,
+        ...fileConfig,
+        ...envConfig,
+        ...overrides,
+    };
+    // Deep-clone the mutable fields so callers can mutate (push to roles,
+    // assign to rolePasswords) without mutating DEFAULT_CONFIG by reference.
+    return {
+        ...merged,
+        roles: [...merged.roles],
+        rolePasswords: { ...merged.rolePasswords },
+    };
+}
+/**
+ * Persist the full config back to .vaultrc.json. The CLI uses this whenever
+ * it mutates auth state (role add/remove/promote/demote, password reset,
+ * sessionSecret generation, projectName saved on first push).
+ */
+export async function saveConfig(vaultPath, cfg) {
+    // Strip default-equal fields so the on-disk file stays minimal.
+    const out = {};
+    for (const k of Object.keys(cfg)) {
+        const v = cfg[k];
+        if (deepEqual(v, DEFAULT_CONFIG[k]))
+            continue;
+        out[k] = v;
+    }
+    await writeFile(join(vaultPath, CONFIG_FILE), JSON.stringify(out, null, 2) + "\n");
+}
+export async function saveSessionSecret(vaultPath, secret) {
+    const cfg = await loadConfig(vaultPath, {});
+    cfg.sessionSecret = secret;
+    await saveConfig(vaultPath, cfg);
+}
+async function readFileConfig(vaultPath) {
+    try {
+        const raw = await readFile(join(vaultPath, CONFIG_FILE), "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+function readEnvConfig() {
+    const out = {};
+    if (process.env.VAULT_PROJECT_NAME)
+        out.projectName = process.env.VAULT_PROJECT_NAME;
+    return out;
+}
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (Array.isArray(a) && Array.isArray(b)) {
+        return a.length === b.length && a.every((x, i) => deepEqual(x, b[i]));
+    }
+    if (a && b && typeof a === "object" && typeof b === "object") {
+        const ak = Object.keys(a);
+        const bk = Object.keys(b);
+        if (ak.length !== bk.length)
+            return false;
+        return ak.every((k) => deepEqual(a[k], b[k]));
+    }
+    return false;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyBjC,MAAM,cAAc,GAAgB;IAClC,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC9B,KAAK,EAAE,CAAC,QAAQ,CAAC;IACjB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,SAA+B;IACjF,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG;QACb,GAAG,cAAc;QACjB,GAAG,UAAU;QACb,GAAG,SAAS;QACZ,GAAG,SAAS;KACb,CAAC;IACF,sEAAsE;IACtE,yEAAyE;IACzE,OAAO;QACL,GAAG,MAAM;QACT,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QACxB,aAAa,EAAE,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE;KAC3C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,GAAgB;IAClE,gEAAgE;IAChE,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAA0B,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAsB,CAAY,CAAC;YAAE,SAAS;QAC7E,GAA+B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC5C,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC;IAC3B,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAiB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,GAAG,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC;QACrD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAC7B,CAA6B,CAAC,CAAC,CAAC,EAChC,CAA6B,CAAC,CAAC,CAAC,CAClC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/favicon.js

@@ -0,0 +1,91 @@
+import { readFile } from "node:fs/promises";
+import { join, isAbsolute } from "node:path";
+import sharp from "sharp";
+const ICON_SIZE = 32;
+/**
+ * Render the favicon for a vault to an ICO buffer. If the user pointed
+ * `settings.favicon` at a real file, we resize that image; otherwise we
+ * generate a default — a rounded square in the vault's accent colour with
+ * a single uppercase letter centred on it.
+ */
+export async function buildFavicon(opts) {
+    const png = opts.faviconPath
+        ? await renderUserImage(opts.vaultPath, opts.faviconPath)
+        : await renderDefaultIcon(opts.letter, opts.accentColor);
+    return wrapPngAsIco(png, ICON_SIZE);
+}
+async function renderUserImage(vaultPath, faviconPath) {
+    const abs = isAbsolute(faviconPath) ? faviconPath : join(vaultPath, faviconPath);
+    const source = await readFile(abs);
+    return sharp(source).resize(ICON_SIZE, ICON_SIZE, { fit: "cover" }).png().toBuffer();
+}
+async function renderDefaultIcon(letter, accent) {
+    const fg = bestForeground(accent);
+    // Round-cornered square with a single letter centred. Embedded as an
+    // SVG so sharp rasterises it cleanly at the target size.
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+  <rect width="32" height="32" rx="5" fill="${escAttr(accent)}"/>
+  <text x="16" y="22" font-family="Iowan Old Style, Palatino Linotype, Georgia, serif"
+        font-size="22" font-weight="700" text-anchor="middle"
+        fill="${escAttr(fg)}">${escText(letter)}</text>
+</svg>`;
+    return sharp(Buffer.from(svg)).resize(ICON_SIZE, ICON_SIZE).png().toBuffer();
+}
+/**
+ * Wrap a PNG buffer in an ICO container. Modern browsers accept PNG-in-ICO
+ * for any size; the dirent's width/height bytes are advisory.
+ *
+ * Layout:
+ *   ICONDIR     (6 bytes)   reserved=0, type=1, count=1
+ *   ICONDIRENTRY (16 bytes) width, height, ..., size, offset
+ *   <PNG bytes>
+ */
+function wrapPngAsIco(png, size) {
+    const HEADER = 6 + 16;
+    const buf = Buffer.alloc(HEADER + png.length);
+    buf.writeUInt16LE(0, 0); // reserved
+    buf.writeUInt16LE(1, 2); // type: icon
+    buf.writeUInt16LE(1, 4); // image count
+    buf.writeUInt8(size === 256 ? 0 : size, 6); // width  (0 = 256)
+    buf.writeUInt8(size === 256 ? 0 : size, 7); // height
+    buf.writeUInt8(0, 8); // palette
+    buf.writeUInt8(0, 9); // reserved
+    buf.writeUInt16LE(1, 10); // colour planes
+    buf.writeUInt16LE(32, 12); // bits per pixel
+    buf.writeUInt32LE(png.length, 14); // bytes of image data
+    buf.writeUInt32LE(HEADER, 18); // offset to image data
+    png.copy(buf, HEADER);
+    return buf;
+}
+/**
+ * Pick black or white as the letter colour against `accent` so the icon
+ * stays readable for whatever colour the user picked. Uses W3C relative
+ * luminance.
+ */
+function bestForeground(accent) {
+    const rgb = parseColor(accent);
+    if (!rgb)
+        return "#ffffff";
+    const lin = (c) => {
+        const s = c / 255;
+        return s <= 0.03928 ? s / 12.92 : Math.pow((s + 0.055) / 1.055, 2.4);
+    };
+    const L = 0.2126 * lin(rgb[0]) + 0.7152 * lin(rgb[1]) + 0.0722 * lin(rgb[2]);
+    return L > 0.5 ? "#1d1a17" : "#ffffff";
+}
+function parseColor(s) {
+    const hex = /^#?([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(s.trim());
+    if (!hex)
+        return null;
+    let h = hex[1];
+    if (h.length === 3)
+        h = h.split("").map((c) => c + c).join("");
+    return [parseInt(h.slice(0, 2), 16), parseInt(h.slice(2, 4), 16), parseInt(h.slice(4, 6), 16)];
+}
+function escAttr(s) {
+    return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+}
+function escText(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+//# sourceMappingURL=favicon.js.map

package/dist/favicon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"favicon.js","sourceRoot":"","sources":["../src/favicon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAKlC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW;QAC1B,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;QACzD,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,OAAO,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,WAAmB;IACnE,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvF,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC7D,MAAM,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,qEAAqE;IACrE,yDAAyD;IACzD,MAAM,GAAG,GAAG;8CACgC,OAAO,CAAC,MAAM,CAAC;;;gBAG7C,OAAO,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC;OACxC,CAAC;IACN,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY;IAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAuB,WAAW;IAC1D,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAuB,aAAa;IAC5D,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAuB,cAAc;IAC7D,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAI,mBAAmB;IAClE,GAAG,CAAC,UAAU,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAI,SAAS;IACxD,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAA0B,UAAU;IACzD,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAA0B,WAAW;IAC1D,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAsB,gBAAgB;IAC/D,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAqB,iBAAiB;IAChE,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAa,sBAAsB;IACrE,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAiB,uBAAuB;IACtE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAClB,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,GAAG,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;IAChB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC"}

package/dist/images.js

@@ -0,0 +1,47 @@
+import { readFile } from "node:fs/promises";
+import sharp from "sharp";
+export const COMPRESSIBLE_EXT_RE = /\.(png|jpe?g|webp|gif|tiff?|avif)$/i;
+/**
+ * Reads an image from disk, converts to webp at the given quality, and returns
+ * the new buffer + path. Animated GIFs are preserved as animated webp.
+ */
+export async function compressImage(absolutePath, vaultRelPath, quality) {
+    const input = await readFile(absolutePath);
+    const isAnimated = /\.gif$/i.test(absolutePath);
+    const body = await sharp(input, { animated: isAnimated })
+        .webp({ quality })
+        .toBuffer();
+    const outputPath = vaultRelPath.replace(COMPRESSIBLE_EXT_RE, ".webp");
+    return { body, contentType: "image/webp", outputPath };
+}
+/**
+ * Best-effort content-type lookup by extension. Falls back to octet-stream.
+ */
+export function contentTypeFor(path) {
+    const ext = path.split(".").pop()?.toLowerCase() ?? "";
+    const map = {
+        md: "text/markdown; charset=utf-8",
+        markdown: "text/markdown; charset=utf-8",
+        txt: "text/plain; charset=utf-8",
+        json: "application/json",
+        yaml: "application/yaml",
+        yml: "application/yaml",
+        html: "text/html; charset=utf-8",
+        css: "text/css; charset=utf-8",
+        png: "image/png",
+        jpg: "image/jpeg",
+        jpeg: "image/jpeg",
+        webp: "image/webp",
+        gif: "image/gif",
+        svg: "image/svg+xml",
+        avif: "image/avif",
+        mp3: "audio/mpeg",
+        wav: "audio/wav",
+        ogg: "audio/ogg",
+        m4a: "audio/mp4",
+        mp4: "video/mp4",
+        pdf: "application/pdf",
+    };
+    return map[ext] ?? "application/octet-stream";
+}
+//# sourceMappingURL=images.js.map

package/dist/images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"images.js","sourceRoot":"","sources":["../src/images.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,CAAC,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AASzE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAoB,EAAE,YAAoB,EAAE,OAAe;IAC7F,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;SACtD,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;SACjB,QAAQ,EAAE,CAAC;IAEd,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACtE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,GAAG,GAA2B;QAClC,EAAE,EAAE,8BAA8B;QAClC,QAAQ,EAAE,8BAA8B;QACxC,GAAG,EAAE,2BAA2B;QAChC,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,kBAAkB;QACxB,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,0BAA0B;QAChC,GAAG,EAAE,yBAAyB;QAC9B,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,YAAY;QACjB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,iBAAiB;KACvB,CAAC;IACF,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAChD,CAAC"}

package/dist/index.js

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { push } from "./commands/push.js";
+import { build } from "./commands/build.js";
+import { preview } from "./commands/preview.js";
+import { init } from "./commands/init.js";
+import { password } from "./commands/password.js";
+import { roleAdd, roleDemote, roleList, rolePromote, roleRemove } from "./commands/role.js";
+const program = new Command();
+// Default vault path: honour $VAULT_PATH first so users can drop
+// `export VAULT_PATH=~/Documents/MyVault` in their shell rc and not pass it
+// to every command. Falls back to cwd.
+const VAULT_PATH_DEFAULT = process.env.VAULT_PATH ?? process.cwd();
+program
+    .name("vaults")
+    .description("Sync an Obsidian vault to a Cloudflare-hosted wiki")
+    .version("0.1.0");
+const role = program
+    .command("role")
+    .description("Manage roles (access tiers) in the vault");
+role
+    .command("add")
+    .description("Add a role and (for non-default roles) set its password")
+    .argument("<name>", "Role name")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .action(async (name, vaultPath) => {
+    try {
+        await roleAdd(name, vaultPath);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+role
+    .command("remove")
+    .description("Remove a role and its password")
+    .argument("<name>", "Role name")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .action(async (name, vaultPath) => {
+    try {
+        await roleRemove(name, vaultPath);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+role
+    .command("list")
+    .description("Show roles configured for this vault")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .action(async (vaultPath) => {
+    try {
+        await roleList(vaultPath);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+role
+    .command("promote")
+    .description("Increase a role's rank by one (move toward the highest tier)")
+    .argument("<name>", "Role name")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .action(async (name, vaultPath) => {
+    try {
+        await rolePromote(name, vaultPath);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+role
+    .command("demote")
+    .description("Decrease a role's rank by one (move toward the default)")
+    .argument("<name>", "Role name")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .action(async (name, vaultPath) => {
+    try {
+        await roleDemote(name, vaultPath);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+program
+    .command("password")
+    .description("Reset the password for an existing role")
+    .argument("<role>", "Role name (must already exist)")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .action(async (role, vaultPath) => {
+    try {
+        await password(vaultPath, role, {});
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+});
+program
+    .command("init")
+    .description("Initialise a vault with a settings.md file")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .option("-f, --force", "Overwrite an existing settings.md")
+    .action(wrap(init));
+program
+    .command("build")
+    .description("Render the vault to a local output directory")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .option("-o, --output <dir>", "Output directory (default: <vault>/.vault-cache/rendered)")
+    .option("-q, --image-quality <n>", "WebP image quality (0 = no compression)", (v) => parseInt(v, 10))
+    .option("-n, --vault-name <name>", "Display name for the vault", "Vault")
+    .option("--all-warnings", "Print every page with warnings instead of truncating at 20")
+    .action(wrap(build));
+program
+    .command("preview")
+    .description("Render the vault and serve it locally via `wrangler pages dev` (Functions run)")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .option("-o, --output <dir>", "Output directory (default: <vault>/.vault-cache/rendered)")
+    .option("-p, --port <n>", "Port for the preview server", (v) => parseInt(v, 10), 4173)
+    .option("-q, --image-quality <n>", "WebP image quality (0 = no compression)", (v) => parseInt(v, 10))
+    .option("-n, --vault-name <name>", "Display name for the vault", "Vault")
+    .action(wrap(preview));
+program
+    .command("push")
+    .description("Render and deploy the vault to Cloudflare Pages")
+    .argument("[vault-path]", "Path to the Obsidian vault", VAULT_PATH_DEFAULT)
+    .option("-p, --project-name <name>", "Cloudflare Pages project name")
+    .option("-q, --image-quality <n>", "WebP image quality (0 = no compression)", (v) => parseInt(v, 10))
+    .option("-n, --vault-name <name>", "Display name for the vault", "Vault")
+    .option("--dry-run", "Render without deploying")
+    .option("--rotate-secret", "Generate a fresh SESSION_SECRET, invalidating all issued tokens")
+    .option("--all-warnings", "Print every page with warnings instead of truncating at 20")
+    .action(wrap(push));
+program.parseAsync().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+function wrap(fn) {
+    return async (...args) => {
+        try {
+            await fn(...args);
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : err);
+            process.exit(1);
+        }
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE5F,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,iEAAiE;AACjE,4EAA4E;AAC5E,uCAAuC;AACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAEnE,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oDAAoD,CAAC;KACjE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,MAAM,IAAI,GAAG,OAAO;KACjB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE3D,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACvC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gCAAgC,CAAC;KAC7C,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sCAAsC,CAAC;KACnD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAClC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC3C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,yDAAyD,CAAC;KACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,yCAAyC,CAAC;KACtD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;KACpD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4CAA4C,CAAC;KACzD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;KAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtB,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;KACzF,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;KACtF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gFAAgF,CAAC;KAC7F,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;KACzF,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;KACrF,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,iDAAiD,CAAC;KAC9D,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,2BAA2B,EAAE,+BAA+B,CAAC;KACpE,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,iEAAiE,CAAC;KAC5F,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;KACtF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtB,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,IAAI,CAAgD,EAAK;IAChE,OAAO,KAAK,EAAE,GAAG,IAAmB,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/obsidian.js

@@ -0,0 +1,47 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Load Obsidian CSS snippets from <vault>/.obsidian/snippets/*.css.
+ *
+ * If .obsidian/appearance.json exists, only snippets listed in
+ * `enabledCssSnippets` are included. If it's missing, all snippets are
+ * included — matches Obsidian's behaviour when the user hasn't configured
+ * anything, and gives users a "drop a CSS file in and it works" workflow.
+ *
+ * Returns a single concatenated CSS string, or empty if no snippets.
+ */
+export async function loadObsidianSnippets(vaultPath) {
+    const snippetsDir = join(vaultPath, ".obsidian", "snippets");
+    let files;
+    try {
+        files = (await readdir(snippetsDir)).filter((f) => f.endsWith(".css"));
+    }
+    catch {
+        return "";
+    }
+    if (files.length === 0)
+        return "";
+    const enabled = await readEnabledList(vaultPath);
+    const include = enabled
+        ? files.filter((f) => enabled.includes(f.replace(/\.css$/i, "")))
+        : files;
+    if (include.length === 0)
+        return "";
+    const parts = [];
+    for (const file of include.sort()) {
+        const body = await readFile(join(snippetsDir, file), "utf8");
+        parts.push(`/* === ${file} === */\n${body}\n`);
+    }
+    return parts.join("\n");
+}
+async function readEnabledList(vaultPath) {
+    try {
+        const raw = await readFile(join(vaultPath, ".obsidian", "appearance.json"), "utf8");
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed.enabledCssSnippets) ? parsed.enabledCssSnippets : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=obsidian.js.map

package/dist/obsidian.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obsidian.js","sourceRoot":"","sources":["../src/obsidian.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAMjC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC7D,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,KAAK,CAAC;IAEV,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,YAAY,IAAI,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;QACjD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}