@wizzlethorpe/vaults 0.6.1 → 0.8.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAElH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,iEAAiE;AACjE,4EAA4E;AAC5E,uCAAuC;AACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAEnE,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oDAAoD,CAAC;KACjE,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,MAAM,IAAI,GAAG,OAAO;KACjB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE3D,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACvC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gCAAgC,CAAC;KAC7C,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sCAAsC,CAAC;KACnD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAClC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC3C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,yDAAyD,CAAC;KACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,yCAAyC,CAAC;KACtD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;KACpD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,8DAA8D,CAAC,CAAC;AAE/E,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,2DAA2D,CAAC;KACxE,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qFAAqF,CAAC;KAClG,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;KACpD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;KAClD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,MAAc,EAAE,SAAiB,EAAE,EAAE;IAChE,IAAI,CAAC;QAAC,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACnD,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC7C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,yCAAyC,CAAC;KACtD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACtC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oDAAoD,CAAC;KACjE,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACvC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4CAA4C,CAAC;KACzD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;KAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtB,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;KACzF,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;KACtF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gFAAgF,CAAC;KAC7F,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;KACzF,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;KACrF,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,iDAAiD,CAAC;KAC9D,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,2BAA2B,EAAE,+BAA+B,CAAC;KACpE,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,iEAAiE,CAAC;KAC5F,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;KACtF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtB,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,IAAI,CAAgD,EAAK;IAChE,OAAO,KAAK,EAAE,GAAG,IAAmB,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAClH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,iEAAiE;AACjE,4EAA4E;AAC5E,uCAAuC;AACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAEnE,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oDAAoD,CAAC;KACjE,OAAO,CAAC,WAAW,CAAC,CAAC;AAExB,MAAM,IAAI,GAAG,OAAO;KACjB,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAE3D,IAAI;KACD,OAAO,CAAC,KAAK,CAAC;KACd,WAAW,CAAC,yDAAyD,CAAC;KACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACvC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,gCAAgC,CAAC;KAC7C,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,sCAAsC,CAAC;KACnD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAClC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC3C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,IAAI;KACD,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,yDAAyD,CAAC;KACtE,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,yCAAyC,CAAC;KACtD,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;KACpD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IACxC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,OAAO;KACpB,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,8DAA8D,CAAC,CAAC;AAE/E,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,2DAA2D,CAAC;KACxE,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAC1C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qFAAqF,CAAC;KAClG,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;KACpD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;KAClD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,MAAc,EAAE,SAAiB,EAAE,EAAE;IAChE,IAAI,CAAC;QAAC,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACnD,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,8DAA8D,CAAC;KAC3E,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC/B,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,SAAiB,EAAE,EAAE;IAChD,IAAI,CAAC;QAAC,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IAC7C,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,yCAAyC,CAAC;KACtD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACtC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oDAAoD,CAAC;KACjE,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;IAClC,IAAI,CAAC;QAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACvC,OAAO,GAAG,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,4CAA4C,CAAC;KACzD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,aAAa,EAAE,mCAAmC,CAAC;KAC1D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtB,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,oBAAoB,EAAE,4DAA4D,CAAC;KAC1F,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;KACtF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAEvB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gFAAgF,CAAC;KAC7F,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,oBAAoB,EAAE,4DAA4D,CAAC;KAC1F,MAAM,CAAC,gBAAgB,EAAE,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;KACrF,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAEzB,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,WAAW,EAAE,mDAAmD,CAAC;KACxE,MAAM,CAAC,aAAa,EAAE,qCAAqC,CAAC;KAC5D,MAAM,CAAC,QAAQ,EAAE,oCAAoC,CAAC;KACtD,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,IAAyD,EAAE,EAAE;IAC7F,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,iDAAiD,CAAC;KAC9D,QAAQ,CAAC,cAAc,EAAE,4BAA4B,EAAE,kBAAkB,CAAC;KAC1E,MAAM,CAAC,2BAA2B,EAAE,+BAA+B,CAAC;KACpE,MAAM,CAAC,yBAAyB,EAAE,yCAAyC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACpG,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;KAC/C,MAAM,CAAC,iBAAiB,EAAE,iEAAiE,CAAC;KAC5F,MAAM,CAAC,gBAAgB,EAAE,4DAA4D,CAAC;KACtF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtB,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACjC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,SAAS,IAAI,CAAgD,EAAK;IAChE,OAAO,KAAK,EAAE,GAAG,IAAmB,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/migrate/0.6-legacy-auth-settings.js

@@ -0,0 +1,96 @@
+// Migration: copy legacy auth fields out of settings.md frontmatter into
+// the CLI-managed config (formerly .vaultrc.json, now .vaults/config.json).
+//
+// Earlier versions stored `roles`, `auth_type`, and `role_passwords` in
+// settings.md. The settings canonicaliser strips unknown keys, so if we
+// don't lift them out before settings.md is rewritten, they're silently
+// dropped. This migration copies anything we still see in settings.md
+// over to the config — but only when the destination is empty / default,
+// so re-running on an already-migrated vault is a no-op.
+//
+// This was previously inline in build.ts as migrateLegacyAuthFromSettings();
+// moved here so all migrations live in one registry.
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import matter from "gray-matter";
+import { loadConfig, saveConfig } from "../config.js";
+import { SETTINGS_FILE } from "../paths.js";
+export const legacyAuthSettingsMigration = {
+    id: "0.6-legacy-auth-settings",
+    description: "settings.md roles/auth_type/role_passwords → CLI-managed config",
+    async needs(vaultPath) {
+        const fm = await readSettingsFrontmatter(vaultPath);
+        if (!fm)
+            return false;
+        if (!hasAnyLegacyKey(fm))
+            return false;
+        const cfg = await loadConfig(vaultPath, {});
+        return liftLegacyAuth(fm, cfg, { dryRun: true }).length > 0;
+    },
+    async apply(vaultPath) {
+        const fm = await readSettingsFrontmatter(vaultPath);
+        if (!fm)
+            return;
+        const cfg = await loadConfig(vaultPath, {});
+        const moved = liftLegacyAuth(fm, cfg, { dryRun: false });
+        if (moved.length === 0)
+            return;
+        await saveConfig(vaultPath, cfg);
+        console.log(`    moved ${moved.join(", ")} from settings.md → config`);
+    },
+};
+async function readSettingsFrontmatter(vaultPath) {
+    try {
+        const raw = await readFile(join(vaultPath, SETTINGS_FILE), "utf8");
+        return (matter(raw).data ?? {});
+    }
+    catch {
+        return null;
+    }
+}
+function hasAnyLegacyKey(fm) {
+    return "roles" in fm || "auth_type" in fm || "role_passwords" in fm;
+}
+/**
+ * Single source of truth for which legacy fields qualify for lift, what
+ * they get moved to, and (when `dryRun=false`) the actual mutation.
+ *
+ * Returns the names of fields that qualified (= would move when not a dry
+ * run). `needs()` runs this dry; `apply()` runs it for real.
+ */
+function liftLegacyAuth(fm, cfg, opts) {
+    const moved = [];
+    if (Array.isArray(fm.roles)) {
+        const list = fm.roles.filter((r) => typeof r === "string");
+        const isDefault = cfg.roles.length === 0 || (cfg.roles.length === 1 && cfg.roles[0] === "public");
+        if (list.length > 0 && isDefault && !arraysEqual(list, ["public"])) {
+            if (!opts.dryRun)
+                cfg.roles = list;
+            moved.push("roles");
+        }
+    }
+    // `auth_type` was a forward-looking knob (password vs cloudflare-access vs
+    // oauth-jwt) that nothing has ever read. The field was removed from
+    // VaultConfig; lifting it would be a no-op, so we don't bother.
+    if (fm.role_passwords && typeof fm.role_passwords === "object" && !Array.isArray(fm.role_passwords)
+        && Object.keys(cfg.rolePasswords).length === 0) {
+        const cleaned = filterStringValues(fm.role_passwords);
+        if (Object.keys(cleaned).length > 0) {
+            if (!opts.dryRun)
+                cfg.rolePasswords = cleaned;
+            moved.push("role_passwords");
+        }
+    }
+    return moved;
+}
+function filterStringValues(map) {
+    const out = {};
+    for (const [k, v] of Object.entries(map))
+        if (typeof v === "string")
+            out[k] = v;
+    return out;
+}
+function arraysEqual(a, b) {
+    return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+//# sourceMappingURL=0.6-legacy-auth-settings.js.map

package/dist/migrate/0.6-legacy-auth-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0.6-legacy-auth-settings.js","sourceRoot":"","sources":["../../src/migrate/0.6-legacy-auth-settings.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,qDAAqD;AAErD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAoB,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,2BAA2B,GAAc;IACpD,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,iEAAiE;IAE9E,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACzE,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,uBAAuB,CAAC,SAAiB;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,EAA2B;IAClD,OAAO,OAAO,IAAI,EAAE,IAAI,WAAW,IAAI,EAAE,IAAI,gBAAgB,IAAI,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,EAA2B,EAC3B,GAAgB,EAChB,IAAyB;IAEzB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,oEAAoE;IACpE,gEAAgE;IAEhE,IAAI,EAAE,CAAC,cAAc,IAAI,OAAO,EAAE,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC;WAC5F,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,cAAyC,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,GAAG,CAAC,aAAa,GAAG,OAAO,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA4B;IACtD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAY,EAAE,CAAY;IAC7C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/migrate/0.7-vaults-dir.js

@@ -0,0 +1,70 @@
+// Migration: consolidate vaults-cli internals into .vaults/.
+//
+//   .vaultrc.json  →  .vaults/config.json
+//   .vault-cache/  →  .vaults/cache/
+//
+// Also writes .vaults/.gitignore so the cache + config (the latter holds
+// hashed passwords and session secret pointers) stay out of git when the
+// vault later becomes a git repo.
+//
+// settings.md stays at the vault root: it's user-edited from Obsidian, and
+// dotfolders are hidden from Obsidian's file pane by default.
+import { mkdir, rename, stat, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { configPath, cacheDir, vaultsGitignore, legacyConfigPath, legacyCacheDir, CACHE_DIR, CONFIG_FILE, } from "../paths.js";
+export const vaultsDirMigration = {
+    id: "0.7-vaults-dir",
+    description: ".vaultrc.json → .vaults/config.json, .vault-cache/ → .vaults/cache/",
+    async needs(vaultPath) {
+        return (await exists(legacyConfigPath(vaultPath))) || (await exists(legacyCacheDir(vaultPath)));
+    },
+    async apply(vaultPath) {
+        const newConfig = configPath(vaultPath);
+        const newCache = cacheDir(vaultPath);
+        await mkdir(dirname(newConfig), { recursive: true });
+        if (await exists(legacyConfigPath(vaultPath))) {
+            // Skip move if dest already exists; the legacy file is then likely
+            // a leftover the user can delete by hand.
+            if (!(await exists(newConfig))) {
+                await rename(legacyConfigPath(vaultPath), newConfig);
+            }
+        }
+        if (await exists(legacyCacheDir(vaultPath))) {
+            if (!(await exists(newCache))) {
+                await rename(legacyCacheDir(vaultPath), newCache);
+            }
+        }
+        await ensureVaultsGitignore(vaultPath);
+    },
+};
+/**
+ * Write a default .vaults/.gitignore if one doesn't already exist. Listed
+ * from .vaults/ so the entries are relative — works whether or not the
+ * containing vault is a git repo.
+ */
+export async function ensureVaultsGitignore(vaultPath) {
+    const path = vaultsGitignore(vaultPath);
+    if (await exists(path))
+        return;
+    const lines = [
+        "# vaults-cli internal state — do not edit by hand.",
+        "# These entries are forward-compat: if this vault becomes a git repo,",
+        "# the cache and config (which holds hashed passwords) stay out.",
+        `${CACHE_DIR}/`,
+        CONFIG_FILE,
+        "",
+    ].join("\n");
+    await writeFile(path, lines);
+}
+async function exists(path) {
+    try {
+        await stat(path);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+//# sourceMappingURL=0.7-vaults-dir.js.map

package/dist/migrate/0.7-vaults-dir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0.7-vaults-dir.js","sourceRoot":"","sources":["../../src/migrate/0.7-vaults-dir.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,0CAA0C;AAC1C,qCAAqC;AACrC,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,kCAAkC;AAClC,EAAE;AACF,2EAA2E;AAC3E,8DAA8D;AAE9D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,EAAE,EAAE,gBAAgB;IACpB,WAAW,EAAE,qEAAqE;IAElF,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,OAAO,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAiB;QAC3B,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAErD,IAAI,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC9C,mEAAmE;YACnE,0CAA0C;YAC1C,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC/B,MAAM,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,IAAI,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC9B,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IAC3D,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO;IAC/B,MAAM,KAAK,GAAG;QACZ,oDAAoD;QACpD,uEAAuE;QACvE,iEAAiE;QACjE,GAAG,SAAS,GAAG;QACf,WAAW;QACX,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/migrate/registry.js

@@ -0,0 +1,6 @@
+// Ordered list of migrations. Newer migrations append at the end.
+import { vaultsDirMigration } from "./0.7-vaults-dir.js";
+export const MIGRATIONS = [
+    vaultsDirMigration,
+];
+//# sourceMappingURL=registry.js.map

package/dist/migrate/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/migrate/registry.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAGlE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,UAAU,GAA6B;IAClD,kBAAkB;CACnB,CAAC"}

package/dist/migrate/run.js

@@ -0,0 +1,38 @@
+// Migration orchestrator. Walks the registry, runs each migration whose
+// needs() returns true, and reports what happened.
+//
+// Called automatically at the top of every command that touches a vault.
+// Migrations are designed to be cheap to skip (stat a file, compare two
+// strings) so the overhead on already-migrated vaults is negligible.
+import { MIGRATIONS } from "./registry.js";
+export async function runMigrations(vaultPath, opts = {}) {
+    const candidates = opts.only
+        ? MIGRATIONS.filter((m) => m.id === opts.only)
+        : MIGRATIONS;
+    if (opts.only && candidates.length === 0) {
+        throw new Error(`unknown migration id: ${opts.only}`);
+    }
+    const applied = [];
+    const skipped = [];
+    for (const m of candidates) {
+        if (!(await m.needs(vaultPath))) {
+            skipped.push(m.id);
+            continue;
+        }
+        if (opts.dryRun) {
+            if (!opts.silent)
+                console.log(`  would migrate: ${m.id} — ${m.description}`);
+            applied.push(m.id);
+            continue;
+        }
+        if (!opts.silent)
+            console.log(`  migrating: ${m.id} — ${m.description}`);
+        await m.apply(vaultPath);
+        applied.push(m.id);
+    }
+    return { applied, skipped };
+}
+export function listMigrations() {
+    return MIGRATIONS;
+}
+//# sourceMappingURL=run.js.map

package/dist/migrate/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/migrate/run.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,wEAAwE;AACxE,qEAAqE;AAGrE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAW3C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,OAA0B,EAAE;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI;QAC1B,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,UAAU,CAAC;IACf,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/migrate/types.js

@@ -0,0 +1,8 @@
+// Migration framework: stateless, idempotent, forward-only schema and
+// layout migrations for vaults.
+//
+// Each migration knows how to detect (from on-disk reality) whether it
+// still needs to apply, and how to apply itself. Running a migration twice
+// is a no-op. There is no version file: needs() reads the disk directly.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/migrate/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/migrate/types.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE"}

package/dist/paths.js

@@ -0,0 +1,66 @@
+// Centralised vault-internal path constants.
+//
+// The single source of truth for where vaults-cli keeps its own state
+// inside a vault. Migrations rely on these to move files from old to new
+// locations; runtime code should always use the helpers below rather than
+// hardcoding strings.
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+/** Top-level dotfolder owning all vaults-cli state. */
+export const VAULTS_DIR = ".vaults";
+/** Settings.md stays at the vault root (Obsidian-editable). */
+export const SETTINGS_FILE = "settings.md";
+/** Config (CLI-managed: roles, password hashes, project name, patreon, …). */
+export const CONFIG_FILE = "config.json";
+/** Build artifact directory (rendered HTML, image webp cache). */
+export const CACHE_DIR = "cache";
+/** Internal .gitignore so cache + secrets stay out of git when the vault becomes a git repo. */
+export const VAULTS_GITIGNORE = ".gitignore";
+/** Fully-qualified config file path. */
+export function configPath(vaultPath) {
+    return join(vaultPath, VAULTS_DIR, CONFIG_FILE);
+}
+/** Fully-qualified cache directory path. */
+export function cacheDir(vaultPath) {
+    return join(vaultPath, VAULTS_DIR, CACHE_DIR);
+}
+/** Fully-qualified rendered output directory (default for build/preview/push). */
+export function defaultOutputDir(vaultPath) {
+    return join(cacheDir(vaultPath), "rendered");
+}
+/** Fully-qualified .vaults/.gitignore path. */
+export function vaultsGitignore(vaultPath) {
+    return join(vaultPath, VAULTS_DIR, VAULTS_GITIGNORE);
+}
+/**
+ * Throw with a friendly error if `vaultPath` doesn't look like an
+ * initialised vault. The marker is `settings.md` at the vault root —
+ * `vaults init` writes it; the rest of the CLI (build / preview / push /
+ * role / patreon / password) reads it.
+ *
+ * Catches the common confused-cwd case — `vaults preview` from $HOME or
+ * a parent directory — with a clear next step instead of an opaque
+ * "wrangler exited 1" / blank build a few seconds later.
+ */
+export async function requireInitialisedVault(vaultPath) {
+    const marker = join(vaultPath, SETTINGS_FILE);
+    try {
+        await stat(marker);
+    }
+    catch {
+        throw new Error(`Not a vaults-initialised directory: ${vaultPath}\n` +
+            `Missing ${SETTINGS_FILE}. Run \`vaults init\` here first, or pass the vault path as the first argument.`);
+    }
+}
+// ── Legacy paths (pre-migration) ─────────────────────────────────────────
+// Kept exported so migrations can detect old layouts and move files.
+// Runtime code must NOT read from these.
+export const LEGACY_CONFIG_FILE = ".vaultrc.json";
+export const LEGACY_CACHE_DIR = ".vault-cache";
+export function legacyConfigPath(vaultPath) {
+    return join(vaultPath, LEGACY_CONFIG_FILE);
+}
+export function legacyCacheDir(vaultPath) {
+    return join(vaultPath, LEGACY_CACHE_DIR);
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,sBAAsB;AAEtB,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC;AAEpC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC,kEAAkE;AAClE,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AAEjC,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,wCAAwC;AACxC,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,QAAQ,CAAC,SAAiB;IACxC,OAAO,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAC3B,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CACb,uCAAuC,SAAS,IAAI;YACpD,WAAW,aAAa,iFAAiF,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,qEAAqE;AACrE,yCAAyC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAC3C,CAAC"}

package/dist/render/auth-template.js

@@ -321,19 +321,7 @@ function encodeVariantPath(p) {
 
 async function handleConnectGet(request, env) {
   const url = new URL(request.url);
-  const returnTo = url.searchParams.get("return_to") || "";
   const app = url.searchParams.get("app") || "an external app";
-  const state = url.searchParams.get("state") || "";
-  const delivery = url.searchParams.get("delivery") === "copy" ? "copy" : "redirect";
-
-  // The "redirect" delivery mode (legacy iframe/popup flow) round-trips a
-  // token to a host app via return_to. The "copy" delivery mode is the
-  // GitHub-CLI-style device flow: the user copy-pastes the token themselves,
-  // so return_to is irrelevant and Patreon login works because we're never
-  // inside an iframe.
-  if (delivery === "redirect" && (!returnTo || !isValidReturnTo(returnTo))) {
-    return new Response("Invalid or missing return_to. Must be an http(s) URL.", { status: 400 });
-  }
 
   // Require login first; the user's role is what we're authorising.
   const role = await readRole(request, env);
@@ -347,23 +335,14 @@ async function handleConnectGet(request, env) {
     });
   }
 
-  const returnHost = delivery === "copy" ? "" : (() => {
-    try { return new URL(returnTo).host; } catch { return returnTo; }
-  })();
-  const html = renderApprovePage({ app, role, returnTo, returnHost, state, delivery });
+  const html = renderApprovePage({ app, role });
   return new Response(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
 }
 
 async function handleConnectApprove(request, env) {
   const form = await request.formData();
-  const returnTo = String(form.get("return_to") || "");
-  const state = String(form.get("state") || "");
-  const delivery = String(form.get("delivery") || "") === "copy" ? "copy" : "redirect";
   const app = String(form.get("app") || "an external app");
 
-  if (delivery === "redirect" && (!returnTo || !isValidReturnTo(returnTo))) {
-    return new Response("Invalid return_to.", { status: 400 });
-  }
   const role = await readRole(request, env);
   if (role === ROLES[0]) {
     // User is anonymous; reject (shouldn't reach here via normal UI flow).
@@ -371,92 +350,14 @@ async function handleConnectApprove(request, env) {
   }
 
   const token = await signToken(role, env.SESSION_SECRET, BEARER_MAX_AGE);
-  const html = delivery === "copy"
-    ? renderConnectCopyPage({ token, role, app })
-    // Legacy delivery: postMessage to parent/opener; falls back to top-
-    // level redirect with the token in the query string. Kept for any
-    // existing iframe-based clients; new clients should use delivery=copy.
-    : renderConnectDeliveryPage({ token, state, returnTo });
+  const html = renderConnectCopyPage({ token, role, app });
   return new Response(html, { headers: { "Content-Type": "text/html; charset=utf-8" } });
 }
 
-function renderConnectDeliveryPage({ token, state, returnTo }) {
-  const returnOrigin = (() => { try { return new URL(returnTo).origin; } catch { return ""; } })();
-  const tokenAttr = escAttr(token);
-  const stateAttr = escAttr(state);
-  const originAttr = escAttr(returnOrigin);
-  const returnAttr = escAttr(returnTo);
-  return \`<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<title>Connecting…</title>
-<link rel="stylesheet" href="/styles.css">
-<style>
-  body { display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; font-family: inherit; }
-  .card { max-width: 24rem; padding: 2rem; text-align: center; color: var(--muted); }
-  .card h1 { margin: 0 0 0.5rem; font-size: 1.1rem; color: var(--fg); }
-  .card a { color: var(--accent); }
-</style>
-</head>
-<body>
-<div class="card">
-  <h1>Authorising…</h1>
-  <p id="status">You can close this window.</p>
-  <p><a id="manual" href="#">Continue manually</a> if it doesn't close on its own.</p>
-</div>
-<script>
-(function () {
-  var token = "\${tokenAttr}";
-  var state = "\${stateAttr}";
-  var origin = "\${originAttr}";
-  var returnTo = "\${returnAttr}";
-
-  // Iframe flow: parent window is the host (Foundry inside DialogV2).
-  // Popup flow: opener is the host. In both cases we postMessage to the
-  // host's origin (not '*') so the token can't be intercepted by anything
-  // else with a window reference.
-  var target = null;
-  if (window.parent && window.parent !== window) target = window.parent;
-  else if (window.opener && !window.opener.closed) target = window.opener;
-  if (target && origin) {
-    try {
-      target.postMessage({ type: "vaults-connect", token: token, state: state }, origin);
-      // Popup self-closes; iframe is dismissed by the host on receipt.
-      if (target === window.opener) { try { window.close(); } catch (e) {} }
-      return;
-    } catch (e) { /* fall through to redirect */ }
-  }
-
-  // No parent or opener; fall back to the original redirect flow.
-  var sep = returnTo.indexOf("?") === -1 ? "?" : "&";
-  var target = returnTo + sep + "token=" + encodeURIComponent(token)
-    + (state ? "&state=" + encodeURIComponent(state) : "");
-  document.getElementById("manual").href = target;
-  document.getElementById("status").textContent = "Redirecting back…";
-  window.location.replace(target);
-})();
-</script>
-</body>
-</html>\`;
-}
-
-function isValidReturnTo(s) {
-  try {
-    const u = new URL(s);
-    return u.protocol === "http:" || u.protocol === "https:";
-  } catch { return false; }
-}
-
-function renderApprovePage({ app, role, returnTo, returnHost, state, delivery }) {
+function renderApprovePage({ app, role }) {
   const escapedApp = escHtml(app);
   const escapedRole = escHtml(role);
-  const escapedHost = escHtml(returnHost);
-  const escapedReturnTo = escAttr(returnTo);
-  const escapedState = escAttr(state);
-  const escapedDelivery = escAttr(delivery);
   const escapedAppAttr = escAttr(app);
-  const isCopy = delivery === "copy";
   return \`<!doctype html>
 <html lang="en">
 <head>
@@ -473,13 +374,6 @@ function renderApprovePage({ app, role, returnTo, returnHost, state, delivery })
   .approve-card h1 { margin: 0 0 1rem; font-size: 1.4rem; }
   .approve-card .info { color: var(--muted); font-size: 0.9rem; margin: 0 0 0.75rem; }
   .approve-card .info strong { color: var(--accent); }
-  .approve-card .return-host {
-    display: block; margin: 0.75rem 0 1.25rem;
-    padding: 0.5rem 0.75rem; background: var(--wikilink-bg);
-    border: 1px solid var(--rule); border-radius: 4px;
-    font-family: ui-monospace, monospace; font-size: 0.85rem;
-    word-break: break-all;
-  }
   .approve-card .actions { display: flex; gap: 0.75rem; margin-top: 1.25rem; }
   .approve-card button, .approve-card .deny {
     flex: 1; padding: 0.55rem 1rem; font: inherit; font-size: 0.95rem;
@@ -488,7 +382,6 @@ function renderApprovePage({ app, role, returnTo, returnHost, state, delivery })
   }
   .approve-card button { background: var(--accent); color: var(--accent-fg); border-color: var(--accent); }
   .approve-card .deny { background: var(--bg); color: var(--muted); }
-  .approve-card .warning { color: #b94a3a; font-size: 0.78rem; margin-top: 1rem; }
 </style>
 </head>
 <body>
@@ -498,14 +391,7 @@ function renderApprovePage({ app, role, returnTo, returnHost, state, delivery })
     <strong>\${escapedApp}</strong> wants access to your vault as
     <strong>\${escapedRole}</strong>.
   </p>
-  \${isCopy
-    ? \`<p class="info">After approval, this page will display a token to copy and paste back into <strong>\${escapedApp}</strong>.</p>\`
-    : \`<p class="info">After approval, you'll be redirected to:</p>
-       <code class="return-host">\${escapedHost}</code>
-       <p class="warning">⚠ Verify the destination above looks right. If you didn't initiate this request, click Deny.</p>\`}
-  <input type="hidden" name="return_to" value="\${escapedReturnTo}">
-  <input type="hidden" name="state" value="\${escapedState}">
-  <input type="hidden" name="delivery" value="\${escapedDelivery}">
+  <p class="info">After approval, this page will display a token to copy and paste back into <strong>\${escapedApp}</strong>.</p>
   <input type="hidden" name="app" value="\${escapedAppAttr}">
   <div class="actions">
     <a class="deny" href="/">Deny</a>
@@ -598,6 +484,12 @@ function renderConnectCopyPage({ token, role, app }) {
 </html>\`;
 }
 
+// These two helpers are intentionally inline and not imported: this file
+// generates a Cloudflare Pages Function as a string template, so the
+// emitted worker can't \`import\` from cli/src/escape.ts at runtime. Keep the
+// behaviour in sync with the canonical helpers in cli/src/escape.ts; the
+// \`auth-template escape helpers stay in sync\` test in
+// cli/test/handlers.test.ts asserts the source strings match.
 function escHtml(s) { return String(s).replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c])); }
 function escAttr(s) { return String(s).replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" }[c])); }
 
@@ -929,12 +821,24 @@ function isSharedAsset(pathname) {
   // ROOT (vs. into _variants/<role>/) must be listed here, otherwise it
   // 404s for every visitor. Build code that places root-level files:
   //   - styles.css / user.css        — build.ts (writeFile join(outputDir, ...))
+  //   - _handlers.js / _handlers.css — build.ts (handler asset bundles, root)
+  //   - _foundry/importer.js + version.json — build.ts (foundry-importer bundle)
   //   - login.html                   — build.ts (multi-role only)
   //   - favicon.ico                  — build.ts (buildFavicon)
   //   - functions/_middleware.js     — build.ts (multi-role only; not served)
   // If you add another, add it both here AND in build.ts.
+  //
+  // _handlers.foundry.{js,css} is *deliberately not* listed: it lives in
+  // each variant directory so the middleware rewrites root requests to
+  // /_variants/<role>/_handlers.foundry.* per the requester's role,
+  // gating higher-tier handler assets behind authentication the same way
+  // page bodies are.
   if (pathname === "/styles.css") return true;
   if (pathname === "/user.css") return true;
+  if (pathname === "/_handlers.js") return true;
+  if (pathname === "/_handlers.css") return true;
+  if (pathname === "/_foundry/importer.js") return true;
+  if (pathname === "/_foundry/version.json") return true;
   if (pathname === "/login.html") return true;
   if (pathname === "/favicon.ico" || pathname === "/favicon.svg") return true;
   if (pathname === "/robots.txt") return true;
@@ -984,11 +888,6 @@ export const LOGIN_HTML = `<!doctype html>
   }
   .patreon-btn:hover { filter: brightness(1.05); }
   .patreon-hint { color: var(--muted); font-size: 0.78rem; margin-top: 0.6rem; text-align: center; }
-  .patreon-iframe-note {
-    color: var(--muted); font-size: 0.78rem; line-height: 1.45;
-    margin-top: 0.6rem; padding: 0.6rem 0.7rem;
-    border: 1px dashed var(--rule); border-radius: 4px;
-  }
 </style>
 </head>
 <body>
@@ -1016,12 +915,6 @@ export const LOGIN_HTML = `<!doctype html>
       Active patrons of the configured tiers can sign in directly. The role
       selector above only matters for password sign-in.
     </p>
-    <p class="patreon-iframe-note" hidden>
-      Patreon refuses to be embedded in iframes, so its sign-in button is
-      hidden when this page is loaded in one (e.g. a Foundry connect
-      dialog). Use a password here, or open the wiki in a normal browser
-      tab to sign in with Patreon.
-    </p>
   </div>
 </div>
 <script>
@@ -1047,22 +940,11 @@ export const LOGIN_HTML = `<!doctype html>
   }
   // Show the Patreon button only if the build emitted a roles list for it
   // (i.e. patreon is configured AND at least one role has a tier mapping).
-  // The Foundry module's connect flow now uses delivery=copy (paste-token),
-  // not an iframe, so Patreon's X-Frame-Options is no longer a problem in
-  // the supported flow. The iframe-detection note still fires defensively
-  // for any third-party that embeds /login.html directly.
   const card = document.querySelector(".login-card");
   if (card.dataset.patreonRoles) {
     const section = document.getElementById("patreon-section");
     section.hidden = false;
-    const inIframe = window.parent !== window;
-    if (inIframe) {
-      document.getElementById("patreon-btn").hidden = true;
-      document.querySelector(".patreon-hint").hidden = true;
-      document.querySelector(".patreon-iframe-note").hidden = false;
-    } else {
-      document.getElementById("patreon-btn").href = "/auth/patreon/start?next=" + encodeURIComponent(next);
-    }
+    document.getElementById("patreon-btn").href = "/auth/patreon/start?next=" + encodeURIComponent(next);
   }
   // Autofocus moved here so it picks the right field whether the password
   // form is visible or the user is going for the Patreon button.

package/dist/render/auth-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-template.js","sourceRoot":"","sources":["../../src/render/auth-template.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAsBnE,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAE3D,OAAO;;;;;;gBAMO,YAAY;oBACR,gBAAgB;kBAClB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA85B/B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAgIlB,CAAC"}
+{"version":3,"file":"auth-template.js","sourceRoot":"","sources":["../../src/render/auth-template.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,mEAAmE;AAsBnE,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAE3D,OAAO;;;;;;gBAMO,YAAY;oBACR,gBAAgB;kBAClB,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8zB/B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0GlB,CAAC"}