create-noy-db 0.9.0 → 0.10.0-pre.1

package/dist/bin/noy-db.js

@@ -1,7 +1,149 @@
 #!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/wizard/augment.ts
+var augment_exports = {};
+__export(augment_exports, {
+  augmentNuxtConfig: () => augmentNuxtConfig,
+  writeAugmentedConfig: () => writeAugmentedConfig
+});
+import { promises as fs4 } from "fs";
+import { loadFile, generateCode, builders } from "magicast";
+import { createPatch } from "diff";
+async function augmentNuxtConfig(options) {
+  const originalCode = await fs4.readFile(options.configPath, "utf8");
+  const mod = await loadFile(options.configPath);
+  const exported = mod.exports.default;
+  if (exported === void 0 || exported === null) {
+    return {
+      kind: "unsupported-shape",
+      configPath: options.configPath,
+      reason: `${options.configPath} has no default export. Expected \`export default defineNuxtConfig({...})\` or \`export default {...}\`.`
+    };
+  }
+  const config = resolveConfigObject(exported);
+  if (!config) {
+    return {
+      kind: "unsupported-shape",
+      configPath: options.configPath,
+      reason: `Could not find the config object in ${options.configPath}. Expected \`export default defineNuxtConfig({ modules: [], ... })\` or a plain object literal.`
+    };
+  }
+  const skipReasons = [];
+  const modulesRaw = config.modules;
+  let modulesWasMissing = false;
+  if (modulesRaw === void 0) {
+    modulesWasMissing = true;
+    config.modules = [];
+  } else if (typeof modulesRaw !== "object" || !isProxyArray(modulesRaw)) {
+    return {
+      kind: "unsupported-shape",
+      configPath: options.configPath,
+      reason: `\`modules\` in ${options.configPath} is not an array literal. Edit it manually and re-run the wizard if you want to continue.`
+    };
+  }
+  const modules = config.modules;
+  const alreadyHasModule = Array.from(modules).some((m) => String(m) === "@noy-db/in-nuxt");
+  if (alreadyHasModule) {
+    skipReasons.push("`@noy-db/in-nuxt` already in modules");
+  } else {
+    modules.push("@noy-db/in-nuxt");
+  }
+  const noydbRaw = config.noydb;
+  if (noydbRaw !== void 0) {
+    skipReasons.push("`noydb` key already set");
+  } else {
+    config.noydb = builders.raw(
+      `{ adapter: '${options.adapter}', pinia: true, devtools: true }`
+    );
+  }
+  if (skipReasons.length === 2 && !modulesWasMissing) {
+    return {
+      kind: "already-configured",
+      configPath: options.configPath,
+      reason: skipReasons.join("; ")
+    };
+  }
+  const generated = generateCode(mod).code;
+  const diff = createPatch(
+    options.configPath,
+    originalCode,
+    generated,
+    "",
+    "",
+    { context: 3 }
+  );
+  return {
+    kind: "proposed-change",
+    configPath: options.configPath,
+    originalCode,
+    newCode: generated,
+    diff,
+    dryRun: options.dryRun === true
+  };
+}
+async function writeAugmentedConfig(configPath, newCode) {
+  await fs4.writeFile(configPath, newCode, "utf8");
+}
+function resolveConfigObject(exported) {
+  if (!exported || typeof exported !== "object") return null;
+  const proxy = exported;
+  if (proxy.$type === "function-call" && proxy.$args) {
+    const firstArg = proxy.$args[0];
+    if (firstArg && typeof firstArg === "object") {
+      return firstArg;
+    }
+    return null;
+  }
+  if (proxy.$type === "object" || proxy.$type === void 0) {
+    return proxy;
+  }
+  return null;
+}
+function isProxyArray(value) {
+  if (!value || typeof value !== "object") return false;
+  const proxy = value;
+  return proxy.$type === "array";
+}
+var init_augment = __esm({
+  "src/wizard/augment.ts"() {
+    "use strict";
+  }
+});
 
 // src/bin/noy-db.ts
-import pc from "picocolors";
+import { spawnSync as spawnSync2 } from "child_process";
+import pc2 from "picocolors";
+
+// src/commands/resolve-bin.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+function resolveBin(pkg, binName, from = process.cwd()) {
+  let dir = from;
+  for (; ; ) {
+    const manifestPath = join(dir, "node_modules", ...pkg.split("/"), "package.json");
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+        const rel = typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.[binName];
+        return rel ? join(dirname(manifestPath), rel) : null;
+      } catch {
+        return null;
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
 
 // src/commands/add.ts
 import { promises as fs } from "fs";
@@ -307,36 +449,1490 @@ async function backup(options) {
   }
 }
 
+// src/commands/pod/inspect.ts
+import { readPodHeader } from "@noy-db/hub";
+import { readFile } from "fs/promises";
+async function inspect(filePath) {
+  const bytes = await readFile(filePath);
+  const header = readPodHeader(new Uint8Array(bytes));
+  return {
+    formatVersion: header.formatVersion,
+    handle: header.handle,
+    bodyBytes: header.bodyBytes,
+    bodySha256: header.bodySha256
+  };
+}
+async function runInspect(argv) {
+  const file = argv[0];
+  if (!file) {
+    process.stderr.write("usage: noy-db pod inspect <file.noydb>\n");
+    return 2;
+  }
+  try {
+    const info = await inspect(file);
+    process.stdout.write(JSON.stringify(info, null, 2) + "\n");
+    return 0;
+  } catch (err) {
+    process.stderr.write(`inspect failed: ${err.message}
+`);
+    return 1;
+  }
+}
+
+// src/commands/pod/verify.ts
+import { readPod, readPodHeader as readPodHeader2 } from "@noy-db/hub";
+import { readFile as readFile2 } from "fs/promises";
+async function verify(filePath) {
+  const bytes = new Uint8Array(await readFile2(filePath));
+  const checks = { magic: false, header: false, bodyHash: false };
+  let handle = "";
+  let bodyBytes = 0;
+  try {
+    const header = readPodHeader2(bytes);
+    checks.magic = true;
+    checks.header = true;
+    handle = header.handle;
+    bodyBytes = header.bodyBytes;
+    await readPod(bytes);
+    checks.bodyHash = true;
+    return { ok: true, file: filePath, handle, bodyBytes, checks };
+  } catch (err) {
+    return {
+      ok: false,
+      file: filePath,
+      handle,
+      bodyBytes,
+      checks,
+      error: err.message
+    };
+  }
+}
+async function runVerify(argv) {
+  const file = argv[0];
+  if (!file) {
+    process.stderr.write("usage: noy-db pod verify <file.noydb>\n");
+    return 2;
+  }
+  const report = await verify(file);
+  process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+  return report.ok ? 0 : 1;
+}
+
+// src/commands/pod/describe.ts
+import { readFile as readFile3, writeFile, mkdir } from "fs/promises";
+import { dirname as dirname2, basename, join as join2 } from "path";
+import { createHash } from "crypto";
+import { stringify as yamlStringify } from "yaml";
+import { createNoydb as createNoydb5, readPod as readPod2, loadPersistedSchema } from "@noy-db/hub";
+import { ConflictError } from "@noy-db/hub/to";
+var VERSION = "0.1.0";
+function memoryStore2() {
+  const data = /* @__PURE__ */ new Map();
+  const getColl = (v, c) => {
+    let vm = data.get(v);
+    if (!vm) {
+      vm = /* @__PURE__ */ new Map();
+      data.set(v, vm);
+    }
+    let cm = vm.get(c);
+    if (!cm) {
+      cm = /* @__PURE__ */ new Map();
+      vm.set(c, cm);
+    }
+    return cm;
+  };
+  return {
+    async get(v, c, id) {
+      return data.get(v)?.get(c)?.get(id) ?? null;
+    },
+    async put(v, c, id, env, ev) {
+      const coll = getColl(v, c);
+      const ex = coll.get(id);
+      if (ev !== void 0 && ex && ex._v !== ev) throw new ConflictError(ex._v);
+      coll.set(id, env);
+    },
+    async delete(v, c, id) {
+      data.get(v)?.get(c)?.delete(id);
+    },
+    async list(v, c) {
+      return [...data.get(v)?.get(c)?.keys() ?? []];
+    },
+    async loadAll(v) {
+      const vm = data.get(v);
+      const snap = {};
+      if (vm) for (const [cn, cm] of vm) {
+        if (cn.startsWith("_")) continue;
+        const r = {};
+        for (const [id, e] of cm) r[id] = e;
+        snap[cn] = r;
+      }
+      return snap;
+    },
+    async saveAll(v, snap) {
+      for (const [cn, recs] of Object.entries(snap)) {
+        const coll = getColl(v, cn);
+        for (const [id, env] of Object.entries(recs)) coll.set(id, env);
+      }
+    }
+  };
+}
+async function describeBundle(opts) {
+  const bytes = await readFile3(opts.bundlePath);
+  const sourceSha256 = createHash("sha256").update(bytes).digest("hex");
+  const { dumpJson } = await readPod2(new Uint8Array(bytes));
+  const backup2 = JSON.parse(dumpJson);
+  const compartmentName = backup2._compartment ?? "vault";
+  const db = await createNoydb5({
+    store: memoryStore2(),
+    user: opts.user,
+    secret: opts.secret
+  });
+  const vault = await db.openVault(compartmentName);
+  await vault.load(dumpJson);
+  const collectionNames = await vault.collections();
+  for (const name of collectionNames) {
+    if (!name.startsWith("_")) vault.collection(name);
+  }
+  const snapshot = await vault.dumpSchema({
+    withStats: opts.withStats,
+    sampleSize: opts.sampleSize
+  });
+  const enriched = opts.schemas === "full" ? await enrichWithFullSchemas(snapshot, vault, collectionNames) : snapshot;
+  const { _noydb_snapshot: _ignore, ...rest } = enriched;
+  void _ignore;
+  const withProvenance = {
+    _noydb_snapshot: 2,
+    // #1447 — carried through from the snapshot rather than restated, so a CLI
+    // dump reports the same emitter capabilities the vault did. Restating it
+    // here would let the two drift, and a reader cannot tell which is right.
+    reports: rest.reports,
+    _provenance: {
+      generatedBy: `noy-db describe v${VERSION}`,
+      source: basename(opts.bundlePath),
+      sourceSha256,
+      emittedAt: enriched.emittedAt
+    },
+    vault: rest.vault,
+    emittedAt: rest.emittedAt,
+    subsystems: rest.subsystems,
+    collections: rest.collections,
+    materializedViews: rest.materializedViews,
+    overlayViews: rest.overlayViews,
+    derivations: rest.derivations,
+    ...rest.internal !== void 0 ? { internal: rest.internal } : {}
+  };
+  if (opts.schemas === "sidecar" && opts.outPath) {
+    await writeSidecarSchemas(opts.outPath, vault, collectionNames);
+  }
+  const emitted = emit(withProvenance, opts.format);
+  if (opts.outPath) {
+    await mkdir(dirname2(opts.outPath), { recursive: true });
+    await writeFile(opts.outPath, emitted);
+  }
+  return emitted;
+}
+async function enrichWithFullSchemas(snapshot, vault, collectionNames) {
+  const state = vault._introspectState();
+  const collections = {};
+  for (const name of Object.keys(snapshot.collections)) {
+    const base = snapshot.collections[name];
+    if (!base) continue;
+    if (!collectionNames.includes(name)) {
+      collections[name] = base;
+      continue;
+    }
+    try {
+      const dek = await state.getDEK(name);
+      const persisted = await loadPersistedSchema(state.adapter, state.name, name, dek);
+      if (persisted?.jsonSchema) {
+        collections[name] = { ...base, jsonSchema: persisted.jsonSchema };
+      } else {
+        collections[name] = base;
+      }
+    } catch {
+      collections[name] = base;
+    }
+  }
+  return { ...snapshot, collections };
+}
+async function writeSidecarSchemas(outPath, vault, collectionNames) {
+  const state = vault._introspectState();
+  const sidecarDir = `${outPath}.schemas`;
+  await mkdir(sidecarDir, { recursive: true });
+  for (const name of collectionNames) {
+    if (name.startsWith("_")) continue;
+    try {
+      const dek = await state.getDEK(name);
+      const persisted = await loadPersistedSchema(state.adapter, state.name, name, dek);
+      if (persisted?.jsonSchema) {
+        await writeFile(
+          join2(sidecarDir, `${name}.schema.json`),
+          JSON.stringify(persisted.jsonSchema, null, 2)
+        );
+      }
+    } catch {
+    }
+  }
+}
+function emit(snapshot, format) {
+  if (format === "json") {
+    return JSON.stringify(snapshot, null, 2) + "\n";
+  }
+  return yamlStringify(snapshot, {
+    aliasDuplicateObjects: false,
+    indent: 2,
+    lineWidth: 0
+    // never wrap; preserves long strings
+  });
+}
+function parseArgs(argv) {
+  const out = {
+    bundlePath: "",
+    format: "yaml",
+    withStats: false,
+    schemas: "none",
+    sampleSize: 50
+  };
+  let i = 0;
+  while (i < argv.length) {
+    const arg = argv[i];
+    if (arg === "--format") {
+      const v = argv[++i];
+      if (v !== "yaml" && v !== "json") return { error: `--format must be yaml or json (got: ${v ?? "<none>"})` };
+      out.format = v;
+    } else if (arg === "--with-stats") {
+      out.withStats = true;
+    } else if (arg === "--schemas") {
+      const v = argv[++i];
+      if (v !== "none" && v !== "full" && v !== "sidecar") {
+        return { error: `--schemas must be none|full|sidecar (got: ${v ?? "<none>"})` };
+      }
+      out.schemas = v;
+    } else if (arg === "-o" || arg === "--out") {
+      const v = argv[++i];
+      if (v === void 0) return { error: "-o requires a value" };
+      out.outPath = v;
+    } else if (arg === "--secret") {
+      const v = argv[++i];
+      if (v === void 0) return { error: "--secret requires a value" };
+      out.secret = v;
+    } else if (arg === "--user") {
+      const v = argv[++i];
+      if (v === void 0) return { error: "--user requires a value" };
+      out.user = v;
+    } else if (arg === "--sample") {
+      const n = parseInt(argv[++i] ?? "", 10);
+      if (Number.isNaN(n) || n < 0) return { error: `--sample must be a non-negative integer` };
+      out.sampleSize = n;
+    } else if (arg === "-h" || arg === "--help") {
+      return { error: "help" };
+    } else if (arg?.startsWith("-")) {
+      return { error: `unknown option: ${arg}` };
+    } else if (!out.bundlePath) {
+      out.bundlePath = arg ?? "";
+    } else {
+      return { error: `unexpected positional arg: ${arg}` };
+    }
+    i++;
+  }
+  if (!out.bundlePath) return { error: "missing bundle path" };
+  return out;
+}
+function usage() {
+  return [
+    "usage: noy-db describe <bundle-path> [options]",
+    "",
+    "  --format <yaml|json>     output format (default: yaml)",
+    "  --with-stats             include records / bytes / oldest / newest per collection",
+    "  --schemas <mode>         JSON Schema body inclusion (default: none)",
+    "                           - none:    summary only",
+    "                           - full:    inline complete JSON Schema per collection",
+    "                           - sidecar: write `<out>.schemas/<col>.schema.json` siblings",
+    "  -o, --out <file>         write to file instead of stdout",
+    "  --user <userId>          keyring user identifier (required)",
+    "  --secret <p>         decryption secret (or via NOYDB_SECRET env)",
+    "  --sample <n>             max records sampled when no persisted/live schema (default: 50)",
+    "",
+    "Exit codes: 0 ok, 1 internal error, 2 usage error, 3 auth failure"
+  ].join("\n");
+}
+async function runDescribe(argv) {
+  const parsed = parseArgs(argv);
+  if ("error" in parsed) {
+    if (parsed.error === "help") {
+      process.stdout.write(usage() + "\n");
+      return 0;
+    }
+    process.stderr.write(`describe: ${parsed.error}
+
+${usage()}
+`);
+    return 2;
+  }
+  const secret = parsed.secret ?? process.env.NOYDB_SECRET;
+  if (!secret) {
+    process.stderr.write("describe: secret required \u2014 pass --secret or set NOYDB_SECRET env\n");
+    return 3;
+  }
+  if (parsed.secret) {
+    process.stderr.write(
+      "[noy-db] warning: --secret appears in shell history; consider NOYDB_SECRET env instead\n"
+    );
+  }
+  if (!parsed.user) {
+    process.stderr.write("describe: --user <userId> is required to unlock the bundle\n");
+    return 2;
+  }
+  try {
+    const out = await describeBundle({
+      bundlePath: parsed.bundlePath,
+      user: parsed.user,
+      secret,
+      format: parsed.format,
+      withStats: parsed.withStats,
+      schemas: parsed.schemas,
+      ...parsed.outPath !== void 0 ? { outPath: parsed.outPath } : {},
+      sampleSize: parsed.sampleSize
+    });
+    if (!parsed.outPath) process.stdout.write(out);
+    return 0;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/decrypt|tamper|wrong key|invalid/i.test(msg)) {
+      process.stderr.write(`describe: decryption failed \u2014 check --user and --secret
+  ${msg}
+`);
+      return 3;
+    }
+    process.stderr.write(`describe: ${msg}
+`);
+    return 1;
+  }
+}
+
+// src/commands/pod/config.ts
+import { pathToFileURL } from "url";
+import { resolve } from "path";
+function safeStringify(v) {
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean" || v === null || v === void 0) {
+    return String(v);
+  }
+  try {
+    return JSON.stringify(v);
+  } catch {
+    return "<unserializable>";
+  }
+}
+function validateOptions(opts) {
+  const issues = [];
+  if (!isRecord(opts)) {
+    issues.push({
+      severity: "error",
+      code: "not-object",
+      path: "<root>",
+      message: "NoydbOptions must be an object"
+    });
+    return { ok: false, issues };
+  }
+  if (!opts.store) {
+    issues.push({
+      severity: "error",
+      code: "missing-store",
+      path: "store",
+      message: "`store` is required"
+    });
+  } else if (!isStoreShape(opts.store)) {
+    issues.push({
+      severity: "error",
+      code: "bad-store-shape",
+      path: "store",
+      message: "`store` does not expose the 6-method NoydbStore contract"
+    });
+  }
+  if (opts.sync !== void 0) {
+    const targets = normalizeSync(opts.sync);
+    targets.forEach((t, i) => validateTarget(t, `sync[${i}]`, issues));
+  }
+  if (opts.syncPolicy !== void 0 && opts.sync === void 0) {
+    issues.push({
+      severity: "warn",
+      code: "policy-without-sync",
+      path: "syncPolicy",
+      message: "`syncPolicy` has no effect without a `sync` target"
+    });
+  }
+  if (typeof opts.user !== "string" || !opts.user) {
+    issues.push({
+      severity: "warn",
+      code: "missing-user",
+      path: "user",
+      message: '`user` identifier is recommended \u2014 audit entries default to "anonymous" without it'
+    });
+  }
+  if (opts.secret === void 0 && opts.secret === void 0 && opts.encrypt !== false) {
+    issues.push({
+      severity: "warn",
+      code: "no-secret",
+      path: "secret",
+      message: "`secret` / `secret` missing and `encrypt` not explicitly false \u2014 vault open will fail"
+    });
+  }
+  const hasError = issues.some((i) => i.severity === "error");
+  return { ok: !hasError, issues };
+}
+async function loadOptionsFromFile(filePath) {
+  const abs = resolve(filePath);
+  if (abs.endsWith(".ts") || abs.endsWith(".mts") || abs.endsWith(".cts")) {
+    throw new Error(
+      `TypeScript config files are not directly loadable \u2014 Node has no native .ts loader.
+  Options:
+    (a) compile first:  tsc ${filePath} && noy-db config validate ${filePath.replace(/\.[mc]?ts$/, ".js")}
+    (b) run via tsx:    npx tsx $(which noy-db) config validate ${filePath}
+    (c) rename to .mjs/.js if your config has no TS-only syntax`
+    );
+  }
+  const mod = await import(pathToFileURL(abs).href);
+  const value = mod.default ?? mod;
+  if (typeof value === "function") {
+    return await value();
+  }
+  return value;
+}
+async function runConfigValidate(argv) {
+  const file = argv[0];
+  if (!file) {
+    process.stderr.write("usage: noy-db config validate <file.ts|js>\n");
+    return 2;
+  }
+  let opts;
+  try {
+    opts = await loadOptionsFromFile(file);
+  } catch (err) {
+    process.stderr.write(`failed to load ${file}: ${err.message}
+`);
+    return 1;
+  }
+  const report = validateOptions(opts);
+  process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+  return report.ok ? 0 : 1;
+}
+var PROFILE_IDS = ["A", "B", "C", "D", "E", "F", "G", "H", "I", "J"];
+function scaffold(profile) {
+  switch (profile) {
+    case "A":
+      return {
+        profile,
+        notes: "Local-only single-user. No cloud.",
+        code: [
+          `import { createNoydb } from '@noy-db/hub'`,
+          `import { toFile } from '@noy-db/to-file'`,
+          ``,
+          `export default {`,
+          `  store:  toFile({ dir: process.env.NOYDB_DATA_DIR ?? './data' }),`,
+          `  user:   process.env.NOYDB_USER ?? 'owner',`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=owner
+NOYDB_SECRET=
+NOYDB_DATA_DIR=./data
+`
+      };
+    case "B":
+      return {
+        profile,
+        notes: "Offline-first + cloud mirror. Local authoritative, sync opportunistically.",
+        code: [
+          `import { createNoydb, INDEXED_STORE_POLICY } from '@noy-db/hub'`,
+          `import { toBrowserIdb } from '@noy-db/to-browser-idb'`,
+          `import { toAwsDynamo } from '@noy-db/to-aws-dynamo'`,
+          ``,
+          `export default {`,
+          `  store: toBrowserIdb({ prefix: process.env.NOYDB_APP ?? 'myapp' }),`,
+          `  sync: [{`,
+          `    store: toAwsDynamo({`,
+          `      table:  process.env.NOYDB_DYNAMO_TABLE!,`,
+          `      region: process.env.AWS_REGION ?? 'us-east-1',`,
+          `    }),`,
+          `    role:  'sync-peer',`,
+          `    label: 'dynamo-live',`,
+          `  }],`,
+          `  syncPolicy: INDEXED_STORE_POLICY,`,
+          `  user:   process.env.NOYDB_USER ?? 'owner',`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=owner
+NOYDB_SECRET=
+NOYDB_APP=myapp
+NOYDB_DYNAMO_TABLE=myapp-live
+AWS_REGION=us-east-1
+`
+      };
+    case "C":
+      return {
+        profile,
+        notes: "Records + blobs split (routeStore). Dynamo for records, S3 for blobs.",
+        code: [
+          `import { createNoydb, routeStore } from '@noy-db/hub'`,
+          `import { toAwsDynamo } from '@noy-db/to-aws-dynamo'`,
+          `import { toAwsS3 } from '@noy-db/to-aws-s3'`,
+          ``,
+          `export default {`,
+          `  store: routeStore({`,
+          `    default: toAwsDynamo({`,
+          `      table:  process.env.NOYDB_DYNAMO_TABLE!,`,
+          `      region: process.env.AWS_REGION ?? 'us-east-1',`,
+          `    }),`,
+          `    blobs:   toAwsS3({`,
+          `      bucket: process.env.NOYDB_S3_BUCKET!,`,
+          `      region: process.env.AWS_REGION ?? 'us-east-1',`,
+          `    }),`,
+          `  }),`,
+          `  user:   process.env.NOYDB_USER ?? 'owner',`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=owner
+NOYDB_SECRET=
+NOYDB_DYNAMO_TABLE=myapp-records
+NOYDB_S3_BUCKET=myapp-blobs
+AWS_REGION=us-east-1
+`
+      };
+    case "G":
+      return {
+        profile,
+        notes: "Middleware-hardened production: retry + breaker + cache + metrics.",
+        code: [
+          `import { createNoydb, wrapStore, withRetry, withCircuitBreaker, withCache, withHealthCheck, withMetrics } from '@noy-db/hub'`,
+          `import { toAwsDynamo } from '@noy-db/to-aws-dynamo'`,
+          ``,
+          `export default {`,
+          `  store: wrapStore(`,
+          `    toAwsDynamo({ table: process.env.NOYDB_DYNAMO_TABLE! }),`,
+          `    withRetry({ maxRetries: 3 }),`,
+          `    withCircuitBreaker({ failureThreshold: 5, resetTimeoutMs: 30_000 }),`,
+          `    withCache({ ttlMs: 60_000 }),`,
+          `    withHealthCheck(),`,
+          `    withMetrics({ onOperation: op => console.log(op) }),`,
+          `  ),`,
+          `  user:   process.env.NOYDB_USER ?? 'owner',`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=owner
+NOYDB_SECRET=
+NOYDB_DYNAMO_TABLE=myapp-prod
+`
+      };
+    case "D":
+      return {
+        profile,
+        notes: "Hot + cold tiered. Records age out to archive after N days.",
+        code: [
+          `import { createNoydb, routeStore } from '@noy-db/hub'`,
+          `import { toAwsDynamo } from '@noy-db/to-aws-dynamo'`,
+          `import { toAwsS3 } from '@noy-db/to-aws-s3'`,
+          ``,
+          `export default {`,
+          `  store: routeStore({`,
+          `    default: toAwsDynamo({ table: process.env.NOYDB_DYNAMO_TABLE! }),`,
+          `    age: {`,
+          `      cold:          toAwsS3({ bucket: process.env.NOYDB_S3_COLD! }),`,
+          `      coldAfterDays: Number(process.env.NOYDB_COLD_AFTER_DAYS ?? '90'),`,
+          `    },`,
+          `  }),`,
+          `  user:   process.env.NOYDB_USER ?? 'owner',`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=owner
+NOYDB_SECRET=
+NOYDB_DYNAMO_TABLE=myapp-hot
+NOYDB_S3_COLD=myapp-archive
+NOYDB_COLD_AFTER_DAYS=90
+`
+      };
+    case "E":
+      return {
+        profile,
+        notes: "Multi-peer team sync. Primary + peer + backup + archive.",
+        code: [
+          `import { createNoydb } from '@noy-db/hub'`,
+          `import { toBrowserIdb } from '@noy-db/to-browser-idb'`,
+          `import { toAwsDynamo } from '@noy-db/to-aws-dynamo'`,
+          `import { toAwsS3 } from '@noy-db/to-aws-s3'`,
+          ``,
+          `export default {`,
+          `  store: toBrowserIdb({ prefix: process.env.NOYDB_APP ?? 'team' }),`,
+          `  sync: [`,
+          `    { store: toAwsDynamo({ table: process.env.NOYDB_DYNAMO_TABLE! }), role: 'sync-peer', label: 'team-hot' },`,
+          `    { store: toAwsS3({ bucket: process.env.NOYDB_S3_BACKUP! }),       role: 'backup',    label: 'team-backup' },`,
+          `    { store: toAwsS3({ bucket: process.env.NOYDB_S3_ARCHIVE! }),      role: 'archive',   label: 'team-archive' },`,
+          `  ],`,
+          `  user:   process.env.NOYDB_USER ?? 'member',`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=member
+NOYDB_SECRET=
+NOYDB_APP=team
+NOYDB_DYNAMO_TABLE=team-hot
+NOYDB_S3_BACKUP=team-backup
+NOYDB_S3_ARCHIVE=team-archive
+`
+      };
+    case "F":
+      return {
+        profile,
+        notes: "CRDT collaboration \u2014 Yjs-backed shared records over the encrypted envelope.",
+        code: [
+          `import { createNoydb } from '@noy-db/hub'`,
+          `import { toBrowserIdb } from '@noy-db/to-browser-idb'`,
+          `import { toAwsDynamo } from '@noy-db/to-aws-dynamo'`,
+          `// import { yjsCollection } from '@noy-db/in-yjs'   // use inside your app`,
+          ``,
+          `export default {`,
+          `  store: toBrowserIdb({ prefix: 'collab' }),`,
+          `  sync: [{ store: toAwsDynamo({ table: process.env.NOYDB_DYNAMO_TABLE! }), role: 'sync-peer' }],`,
+          `  user:   process.env.NOYDB_USER!,`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`,
+          ``,
+          `// After createNoydb(), replace normal collections with yjsCollection() for CRDT fields.`
+        ].join("\n"),
+        env: `NOYDB_USER=
+NOYDB_SECRET=
+NOYDB_DYNAMO_TABLE=collab-live
+`
+      };
+    case "H":
+      return {
+        profile,
+        notes: "USB-portable \u2014 everything on a single file store, no cloud.",
+        code: [
+          `import { createNoydb } from '@noy-db/hub'`,
+          `import { toFile } from '@noy-db/to-file'`,
+          ``,
+          `export default {`,
+          `  store:  toFile({ dir: process.env.NOYDB_DATA_DIR ?? '/Volumes/MY_USB/data' }),`,
+          `  user:   process.env.NOYDB_USER!,`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=
+NOYDB_SECRET=
+NOYDB_DATA_DIR=/Volumes/MY_USB/data
+`
+      };
+    case "I":
+      return {
+        profile,
+        notes: "Multi-tenant geographic sharding \u2014 per-vault primary per region.",
+        code: [
+          `import { createNoydb } from '@noy-db/hub'`,
+          `import { toAwsDynamo } from '@noy-db/to-aws-dynamo'`,
+          ``,
+          `// Pick the nearest region at init time based on tenant config.`,
+          `const region = process.env.NOYDB_REGION ?? 'ap-southeast-1'`,
+          `const table  = \`myapp-\${region}\``,
+          ``,
+          `export default {`,
+          `  store:  toAwsDynamo({ table, region }),`,
+          `  user:   process.env.NOYDB_USER!,`,
+          `  secret: process.env.NOYDB_SECRET,`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=
+NOYDB_SECRET=
+NOYDB_REGION=ap-southeast-1
+`
+      };
+    case "J":
+      return {
+        profile,
+        notes: "Authentication bridge (secret-less unlock via OIDC or WebAuthn).",
+        code: [
+          `import { createNoydb } from '@noy-db/hub'`,
+          `import { toBrowserIdb } from '@noy-db/to-browser-idb'`,
+          `// import { unlockWebAuthn } from '@noy-db/on-webauthn'   // in the browser`,
+          `// import { unlockOidc } from '@noy-db/on-oidc'         // in a server app`,
+          ``,
+          `export default {`,
+          `  store: toBrowserIdb({ prefix: process.env.NOYDB_APP ?? 'app' }),`,
+          `  user:  process.env.NOYDB_USER!,`,
+          `  // secret supplied by the unlock method at openVault() time, not here.`,
+          `}`
+        ].join("\n"),
+        env: `NOYDB_USER=
+NOYDB_APP=app
+`
+      };
+  }
+}
+function listProfiles() {
+  return PROFILE_IDS.map((id) => `  ${id}  ${scaffold(id).notes}`).join("\n");
+}
+function runConfigProfiles() {
+  process.stdout.write(`Topology profiles for \`noy-db config scaffold --profile=<id>\`:
+${listProfiles()}
+`);
+  return 0;
+}
+async function runConfigScaffold(argv) {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(`Usage: noy-db config scaffold [--profile=<id>]   (default A)
+
+${listProfiles()}
+
+The config goes to stdout; the .env template goes to stderr.
+`);
+    return 0;
+  }
+  const profileArg = argv.find((a) => a.startsWith("--profile="));
+  const profile = profileArg?.split("=")[1] ?? "A";
+  if (!PROFILE_IDS.includes(profile)) {
+    process.stderr.write(`unknown profile: ${profile}. Valid: ${PROFILE_IDS.join(" ")} \u2014 run \`noy-db config profiles\`
+`);
+    return 2;
+  }
+  const out = scaffold(profile);
+  process.stdout.write(`// \u2500\u2500 noy-db config (profile ${out.profile}) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`);
+  process.stdout.write(`// ${out.notes}
+
+`);
+  process.stdout.write(out.code + "\n");
+  if (out.env) {
+    process.stderr.write(`
+# \u2500\u2500 .env template (profile ${out.profile}) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`);
+    process.stderr.write(out.env);
+  }
+  return 0;
+}
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStoreShape(v) {
+  if (!isRecord(v)) return false;
+  return ["get", "put", "delete", "list", "loadAll", "saveAll"].every((m) => typeof v[m] === "function");
+}
+function normalizeSync(v) {
+  if (Array.isArray(v)) return v;
+  return [v];
+}
+function validateTarget(t, path4, issues) {
+  if (!isRecord(t)) {
+    issues.push({
+      severity: "error",
+      code: "bad-target",
+      path: path4,
+      message: "sync target must be an object with { store, role }"
+    });
+    return;
+  }
+  if (t["role"] === void 0) {
+    if (!isStoreShape(t)) {
+      issues.push({
+        severity: "error",
+        code: "bad-store-shape",
+        path: path4,
+        message: "sync target store does not expose the 6-method contract"
+      });
+    }
+    return;
+  }
+  const validRoles = ["sync-peer", "backup", "archive"];
+  if (!validRoles.includes(safeStringify(t["role"]))) {
+    issues.push({
+      severity: "error",
+      code: "bad-role",
+      path: `${path4}.role`,
+      message: `role must be one of ${validRoles.join(", ")}; got ${safeStringify(t["role"])}`
+    });
+  }
+  if (!t["store"] || !isStoreShape(t["store"])) {
+    issues.push({
+      severity: "error",
+      code: "bad-store-shape",
+      path: `${path4}.store`,
+      message: "sync target store does not expose the 6-method contract"
+    });
+  }
+  if (t["role"] === "archive" && isRecord(t["policy"]) && isRecord(t["policy"]["pull"])) {
+    issues.push({
+      severity: "error",
+      code: "archive-pull-configured",
+      path: `${path4}.policy.pull`,
+      message: "archive targets are push-only \u2014 pull policy is invalid"
+    });
+  }
+}
+
+// src/commands/pod/monitor.ts
+async function runMonitor(argv) {
+  const file = argv[0];
+  if (!file) {
+    process.stderr.write("usage: noy-db monitor <config.ts> [--interval=ms]\n");
+    return 2;
+  }
+  const intervalArg = argv.find((a) => a.startsWith("--interval="));
+  const intervalMs = intervalArg ? parseInt(intervalArg.split("=")[1] ?? "5000", 10) : 5e3;
+  let opts;
+  try {
+    const loaded = await loadOptionsFromFile(file);
+    if (typeof loaded !== "object" || loaded === null) {
+      process.stderr.write(`config file must export a NoydbOptions-shaped object
+`);
+      return 1;
+    }
+    opts = loaded;
+  } catch (err) {
+    process.stderr.write(`failed to load ${file}: ${err.message}
+`);
+    return 1;
+  }
+  const innerStore = opts["store"];
+  if (!innerStore || typeof innerStore !== "object") {
+    process.stderr.write("config has no `store` \u2014 nothing to monitor\n");
+    return 1;
+  }
+  const meter = innerStore.meter;
+  if (!meter || typeof meter.snapshot !== "function") {
+    process.stderr.write(
+      "config `store` carries no meter handle \u2014 wrap it in the config file:\n  import { toMeter } from '@noy-db/to-meter'\n  export default { store: toMeter(inner, { degradedMs: 500 }), ... }\nonDegraded / onRestored belong there too.\n"
+    );
+    return 1;
+  }
+  const hub = await import("@noy-db/hub");
+  await hub.createNoydb(opts);
+  process.stdout.write(`monitoring ${file} \u2014 interval ${intervalMs}ms \u2014 Ctrl-C to stop
+
+`);
+  const stop = installSigintHandler(meter);
+  return new Promise((resolveP) => {
+    const timer = setInterval(() => {
+      if (stop.signalled) {
+        clearInterval(timer);
+        meter.close();
+        resolveP(0);
+        return;
+      }
+      const snap = meter.snapshot();
+      process.stdout.write(formatSnapshot(snap) + "\n");
+    }, intervalMs);
+  });
+}
+function installSigintHandler(meter) {
+  const state = { signalled: false };
+  const handler = () => {
+    state.signalled = true;
+    meter.close();
+  };
+  process.on("SIGINT", handler);
+  process.on("SIGTERM", handler);
+  return state;
+}
+function formatSnapshot(snap) {
+  const lines = [];
+  const ts = new Date(snap.collectedAt).toISOString().slice(11, 19);
+  lines.push(`[${ts}] status=${snap.status} calls=${snap.totalCalls} casConflicts=${snap.casConflicts} windowMs=${snap.windowMs}`);
+  for (const m of ["get", "put", "delete", "list", "loadAll", "saveAll"]) {
+    const s = snap.byMethod[m];
+    if (s.count === 0) continue;
+    lines.push(`  ${m.padEnd(7)} count=${s.count} errors=${s.errors} p50=${s.p50}ms p99=${s.p99}ms max=${s.max}ms avg=${s.avg}ms`);
+  }
+  return lines.join("\n");
+}
+
+// src/commands/doctor.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname as dirname3, join as join3, resolve as resolve2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+var f = (id, level, message, fix, where) => where === void 0 ? { id, level, message, fix } : { id, level, message, fix, where };
+var isRecord2 = (v) => typeof v === "object" && v !== null;
+function gitignores(root, name) {
+  const p = join3(root, ".gitignore");
+  if (!existsSync2(p)) return false;
+  return readFileSync2(p, "utf8").split("\n").some((l) => {
+    const t = l.trim();
+    return t === name || t === `/${name}` || t === `${name}*` || t === ".env*" && name.startsWith(".env");
+  });
+}
+async function listSafely(store, vault, collection) {
+  try {
+    return await store.list(vault, collection);
+  } catch {
+    return null;
+  }
+}
+var secretChecks = {
+  id: "NOY-S",
+  run: ({ options, configPath, mode }) => {
+    if (!options) return [];
+    const out = [];
+    const secret = options["secret"];
+    if (typeof secret === "string" && secret.length > 0) {
+      out.push(f(
+        "NOY-S001",
+        "error",
+        "the secret is a literal string in the config \u2014 it ships with your source",
+        "read it from the environment (`secret: process.env.NOYDB_SECRET`) or prompt for it; keep `.env` out of git (see NOY-H001)",
+        configPath
+      ));
+    } else if (secret === void 0 && options["getKeyring"] === void 0 && options["secretMode"] !== "managed") {
+      out.push(f(
+        "NOY-S002",
+        mode === "prod" ? "warn" : "info",
+        "no secret and no getKeyring in the config \u2014 the app must supply one at runtime",
+        "that is fine for an app that prompts; set `secret: process.env.NOYDB_SECRET` for a headless process",
+        configPath
+      ));
+    }
+    if (options["secretMode"] === "managed" && options["sealingKey"] === void 0) {
+      out.push(f(
+        "NOY-S003",
+        "error",
+        '`secretMode: "managed"` without a `sealingKey` \u2014 managed mode has nothing to seal with',
+        "pass a sealer from an `@noy-db/at-*` package (`sealingKey: awsKms({...})`), or drop managed mode",
+        configPath
+      ));
+    }
+    return out;
+  }
+};
+var capsuleChecks = {
+  id: "NOY-C",
+  run: ({ options, configPath, mode, manifest }) => {
+    const out = [];
+    if (options?.["encrypt"] === false) {
+      out.push(f(
+        "NOY-C001",
+        mode === "prod" ? "error" : "warn",
+        "`encrypt: false` \u2014 records are stored as plaintext; this is not zero-knowledge",
+        'remove `encrypt: false` for anything that leaves your machine; it exists for the "see the ciphertext" control and tests',
+        configPath
+      ));
+    }
+    const deps = { ...manifest.dependencies, ...manifest.devDependencies };
+    if ("@noy-db/exclave-plain" in deps) {
+      out.push(f(
+        "NOY-C002",
+        mode === "prod" ? "error" : "warn",
+        "`@noy-db/exclave-plain` is installed \u2014 when bound (`noy-db:exclave-plain` condition) the vault stores readable rows",
+        "keep it to builds whose access control lives in the store (IAM, a DB grant); never in a build that serves untrusted readers"
+      ));
+    }
+    return out;
+  }
+};
+var topologyChecks = {
+  id: "NOY-T",
+  run: ({ options, configPath, mode }) => {
+    if (!options) return [];
+    const out = [];
+    const store = options["store"];
+    const storeName = isRecord2(store) && typeof store["name"] === "string" ? store["name"] : void 0;
+    if (storeName === "memory" || storeName === "memoryStore") {
+      out.push(f(
+        "NOY-T001",
+        mode === "prod" ? "error" : "info",
+        "the store is in-memory \u2014 data does not survive a reload",
+        "pick a persistent store: `noy-db add @noy-db/to-browser-idb` (browser) or `@noy-db/to-file` (Node)",
+        configPath
+      ));
+    }
+    const sync = options["sync"];
+    const hasSync = Array.isArray(sync) ? sync.length > 0 : sync !== void 0 && sync !== null;
+    if (!hasSync) {
+      out.push(f(
+        "NOY-T002",
+        "info",
+        "no sync target \u2014 this vault lives in one store only; lose it and the data is gone",
+        "add a second store as a sync target (a cloud bucket, a file on a USB stick): `noy-db config profiles` shows the shapes",
+        configPath
+      ));
+    }
+    return out;
+  }
+};
+var recoveryChecks = {
+  id: "NOY-R",
+  run: async ({ store, vaults, options, mode }) => {
+    if (!store || vaults.length === 0) return [];
+    const out = [];
+    for (const vault of vaults) {
+      const users = await listSafely(store, vault, "_keyring");
+      if (users === null) continue;
+      if (users.length === 0) continue;
+      const entries = async (id) => {
+        try {
+          const env = await store.get(vault, "_meta", id);
+          if (!env) return 0;
+          const doc = JSON.parse(env._data ?? "");
+          return Array.isArray(doc.entries) ? doc.entries.length : 0;
+        } catch {
+          return 0;
+        }
+      };
+      const paper = await entries("recovery-paper");
+      const shamir = await entries("recovery-shamir");
+      if (paper + shamir === 0) {
+        out.push(f(
+          "NOY-R001",
+          mode === "prod" ? "error" : "warn",
+          `vault "${vault}" has no recovery enrolled \u2014 a forgotten secret means the data is gone`,
+          "enrol one: `noy-db add @noy-db/on-recovery` (printable codes) or `@noy-db/on-shamir` (k-of-n shares), then `db.team.enrollRecovery(...)`",
+          vault
+        ));
+      } else if (shamir === 0 && options?.["secretMode"] === "managed") {
+        out.push(f(
+          "NOY-R002",
+          "error",
+          `vault "${vault}" is managed-mode with only paper recovery \u2014 managed mode requires a strong (Shamir) profile`,
+          "enrol Shamir: `noy-db add @noy-db/on-shamir`",
+          vault
+        ));
+      }
+      let owners = 0;
+      for (const uid of users) {
+        try {
+          const env = await store.get(vault, "_keyring", uid);
+          const file = env ? JSON.parse(env._data ?? "") : null;
+          if (file?.role === "owner") owners++;
+        } catch {
+        }
+      }
+      if (owners === 1 && users.length > 1) {
+        out.push(f(
+          "NOY-R003",
+          "info",
+          `vault "${vault}" has one owner among ${users.length} users`,
+          "a second owner can recover members and rotate keys when the first is unavailable: `noy-db user add <id> owner \u2026`",
+          vault
+        ));
+      }
+    }
+    return out;
+  }
+};
+var dependencyChecks = {
+  id: "NOY-D",
+  run: ({ root, manifest, configPath }) => {
+    const out = [];
+    const deps = { ...manifest.dependencies, ...manifest.devDependencies };
+    const hub = deps["@noy-db/hub"];
+    if (!hub) {
+      out.push(f("NOY-D001", "error", "`@noy-db/hub` is not a dependency of this project", "add it: `pnpm add @noy-db/hub`", join3(root, "package.json")));
+    }
+    if (configPath && existsSync2(configPath)) {
+      const src = readFileSync2(configPath, "utf8");
+      const named = new Set([...src.matchAll(/from\s+['"](@noy-db\/[a-z0-9-]+)/g)].map((m) => m[1]));
+      for (const pkg of named) {
+        if (!(pkg in deps)) {
+          out.push(f("NOY-D002", "error", `the config imports \`${pkg}\`, which is not in package.json`, `install it: \`pnpm add ${pkg}\``, configPath));
+        }
+      }
+    }
+    return out;
+  }
+};
+var hygieneChecks = {
+  id: "NOY-H",
+  run: ({ root }) => {
+    const out = [];
+    const hasEnv = existsSync2(join3(root, ".env")) || existsSync2(join3(root, ".env.local"));
+    if (hasEnv && !gitignores(root, ".env")) {
+      out.push(f(
+        "NOY-H001",
+        "error",
+        "a `.env` file exists and `.gitignore` does not ignore it \u2014 one `git add .` away from committing secrets",
+        "add `.env` and `.env.*` to .gitignore (`noy-db doctor --fix` does this)",
+        join3(root, ".gitignore")
+      ));
+    }
+    return out;
+  }
+};
+var BUILTIN_CHECKS = [secretChecks, capsuleChecks, topologyChecks, recoveryChecks, dependencyChecks, hygieneChecks];
+async function satelliteChecks(root, manifest) {
+  const checks = [];
+  const findings = [];
+  const names = Object.keys({ ...manifest.dependencies, ...manifest.devDependencies }).filter((n) => n.startsWith("@noy-db/") && n !== "@noy-db/hub");
+  for (const name of names) {
+    const manifestPath = join3(root, "node_modules", ...name.split("/"), "package.json");
+    if (!existsSync2(manifestPath)) continue;
+    try {
+      const pkg = JSON.parse(readFileSync2(manifestPath, "utf8"));
+      const entry = isRecord2(pkg.exports) && "." in pkg.exports ? (() => {
+        const dot = pkg.exports["."];
+        return typeof dot === "string" ? dot : isRecord2(dot) ? dot["default"] ?? dot["import"] : void 0;
+      })() : pkg.module ?? pkg.main;
+      if (!entry) continue;
+      const mod = await import(pathToFileURL2(join3(dirname3(manifestPath), entry)).href);
+      if (Array.isArray(mod.noydbDoctorChecks)) {
+        for (const c of mod.noydbDoctorChecks) if (c && typeof c.id === "string" && typeof c.run === "function") checks.push(c);
+      }
+    } catch (err) {
+      findings.push(f("NOY-D003", "warn", `\`${name}\` is installed but failed to import: ${err.message.split("\n")[0]}`, "reinstall it, or check its peer dependencies", name));
+    }
+  }
+  return { checks, findings };
+}
+async function doctor(opts = {}) {
+  const root = resolve2(opts.root ?? process.cwd());
+  const mode = opts.mode ?? (process.env["NODE_ENV"] === "production" ? "prod" : "dev");
+  const manifestPath = join3(root, "package.json");
+  const manifest = existsSync2(manifestPath) ? JSON.parse(readFileSync2(manifestPath, "utf8")) : {};
+  const configPath = opts.configPath ?? ["noydb.config.mjs", "noydb.config.js"].map((n) => join3(root, n)).find((p) => existsSync2(p));
+  let options;
+  let store;
+  const findings = [];
+  if (configPath) {
+    try {
+      const loaded = await loadOptionsFromFile(configPath);
+      if (isRecord2(loaded)) {
+        options = loaded;
+        const s = loaded["store"];
+        if (isRecord2(s) && typeof s["get"] === "function" && typeof s["list"] === "function") store = s;
+      }
+    } catch (err) {
+      findings.push(f("NOY-D004", "error", `the config file did not load: ${err.message.split("\n")[0]}`, "run `noy-db config validate <file>` for the details", configPath));
+    }
+  }
+  let vaults = opts.vaults ?? [];
+  if (vaults.length === 0 && store && typeof store.listVaults === "function") {
+    try {
+      vaults = await store.listVaults();
+    } catch {
+      vaults = [];
+    }
+  }
+  const ctx = { mode, root, manifest, vaults, ...configPath ? { configPath } : {}, ...options ? { options } : {}, ...store ? { store } : {} };
+  const sat = opts.noSatellites ? { checks: [], findings: [] } : await satelliteChecks(root, manifest);
+  findings.push(...sat.findings);
+  const checks = [...BUILTIN_CHECKS, ...sat.checks];
+  const ran = [];
+  for (const c of checks) {
+    ran.push(c.id);
+    try {
+      findings.push(...await c.run(ctx));
+    } catch (err) {
+      findings.push(f("NOY-D005", "warn", `check ${c.id} threw: ${err.message.split("\n")[0]}`, "report this against the package that registered the check"));
+    }
+  }
+  const counts = { error: 0, warn: 0, info: 0 };
+  for (const x of findings) counts[x.level]++;
+  return { mode, findings, counts, ran };
+}
+function applyFixes(root, report) {
+  const done = [];
+  if (report.findings.some((x) => x.id === "NOY-H001")) {
+    const p = join3(root, ".gitignore");
+    const cur = existsSync2(p) ? readFileSync2(p, "utf8") : "";
+    const add = [".env", ".env.*"].filter((l) => !cur.split("\n").some((x) => x.trim() === l));
+    if (add.length) {
+      const next = cur + (cur.endsWith("\n") || cur === "" ? "" : "\n") + "# noy-db doctor (NOY-H001): never commit secrets\n" + add.join("\n") + "\n";
+      writeFileSync(p, next);
+      done.push(`.gitignore += ${add.join(", ")}`);
+    }
+  }
+  return done;
+}
+var LEVEL_RANK = { error: 0, warn: 1, info: 2 };
+var ICON = { error: "\u2717", warn: "!", info: "\xB7" };
+function formatReport(r) {
+  const lines = [`noy-db doctor \u2014 mode ${r.mode}, ${r.ran.length} check group(s)`];
+  if (r.findings.length === 0) lines.push("  \u2713 nothing to report");
+  for (const x of [...r.findings].sort((a, b) => LEVEL_RANK[a.level] - LEVEL_RANK[b.level] || a.id.localeCompare(b.id))) {
+    lines.push(`  ${ICON[x.level]} ${x.id}  ${x.message}${x.where ? `  (${x.where})` : ""}`);
+    lines.push(`      \u2192 ${x.fix}`);
+  }
+  lines.push(`  ${r.counts.error} error \xB7 ${r.counts.warn} warn \xB7 ${r.counts.info} info`);
+  return lines.join("\n");
+}
+async function runDoctor(argv) {
+  const flag = (n) => argv.find((a) => a.startsWith(`--${n}=`))?.slice(n.length + 3);
+  if (argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write([
+      "Usage: noy-db doctor [config.mjs] [--mode=dev|prod] [--vault=<name>] [--json] [--fix] [--fail-level=error|warn|info]",
+      "",
+      "Readiness checks that need no secret. Ids are stable (NOY-S secret \xB7 NOY-R recovery \xB7 NOY-T topology \xB7",
+      "NOY-C capsule \xB7 NOY-D dependencies \xB7 NOY-H hygiene); every finding carries a fix.",
+      "",
+      "  --mode        dev (default unless NODE_ENV=production) or prod \u2014 the same finding can be a warn in dev and an error in prod",
+      "  --fail-level  exit 1 at or above this level. DEFAULT: error. Pass --fail-level=warn to gate a CI job on warnings too.",
+      "  --fix         apply the idempotent fixes (today: gitignore .env)",
+      "  --json        machine-readable report",
+      "  crypto        the in-memory crypto round-trip (formerly `noy-db verify`)"
+    ].join("\n") + "\n");
+    return 0;
+  }
+  const configArg = argv.find((a) => !a.startsWith("--"));
+  const modeArg = flag("mode");
+  if (modeArg !== void 0 && modeArg !== "dev" && modeArg !== "prod") {
+    process.stderr.write(`--mode must be dev or prod (got ${modeArg})
+`);
+    return 2;
+  }
+  const failArg = flag("fail-level") ?? "error";
+  if (!(failArg in LEVEL_RANK)) {
+    process.stderr.write(`--fail-level must be error, warn or info (got ${failArg})
+`);
+    return 2;
+  }
+  const vault = flag("vault");
+  const report = await doctor({
+    ...configArg ? { configPath: resolve2(configArg) } : {},
+    ...modeArg ? { mode: modeArg } : {},
+    ...vault ? { vaults: [vault] } : {}
+  });
+  let fixed = [];
+  if (argv.includes("--fix")) fixed = applyFixes(process.cwd(), report);
+  if (argv.includes("--json")) process.stdout.write(JSON.stringify({ ...report, fixed }, null, 2) + "\n");
+  else {
+    process.stdout.write(formatReport(report) + "\n");
+    for (const d of fixed) process.stdout.write(`  fixed: ${d}
+`);
+    process.stdout.write(`  (exit is non-zero at --fail-level=${failArg}; default error)
+`);
+  }
+  const worst = Math.min(...report.findings.map((x) => LEVEL_RANK[x.level]), 99);
+  return worst <= LEVEL_RANK[failArg] ? 1 : 0;
+}
+
+// src/commands/add-package.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
+import { spawnSync } from "child_process";
+import pc from "picocolors";
+
+// src/wizard/render.ts
+import { promises as fs3 } from "fs";
+import path3 from "path";
+import { fileURLToPath } from "url";
+function templateDir(name) {
+  const here = fileURLToPath(import.meta.url);
+  const packageRoot = path3.resolve(path3.dirname(here), "..", "..");
+  return path3.join(packageRoot, "templates", name);
+}
+
+// src/commands/add-package.ts
+var CATALOG_URL = "https://noy-db.lanna.ai/catalog.json";
+function bundledCatalog() {
+  return JSON.parse(readFileSync3(templateDir("catalog.json"), "utf8"));
+}
+async function loadCatalog(opts = {}) {
+  if (!opts.offline) {
+    try {
+      const ctl = new AbortController();
+      const t = setTimeout(() => ctl.abort(), opts.timeoutMs ?? 3e3);
+      const res = await (opts.fetchImpl ?? fetch)(CATALOG_URL, { signal: ctl.signal });
+      clearTimeout(t);
+      if (res.ok) {
+        const catalog = await res.json();
+        if (catalog.schemaVersion === 1 && Array.isArray(catalog.packages)) return { catalog, source: "live" };
+      }
+    } catch {
+    }
+  }
+  return { catalog: bundledCatalog(), source: "bundled" };
+}
+function normalisePrefix(input) {
+  if (!input) return void 0;
+  const s = input.replace(/^@noy-db\//, "").replace(/-$/, "");
+  return /^(to|in|on|as|by|at)$/.test(s) ? `${s}-` : void 0;
+}
+function formatList(catalog, prefix) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const p of catalog.packages) {
+    if (prefix && p.prefix !== prefix) continue;
+    (groups.get(p.prefix) ?? groups.set(p.prefix, []).get(p.prefix)).push(p);
+  }
+  const out = [];
+  for (const [pfx, pkgs] of groups) {
+    const g = catalog.prefixes[pfx];
+    out.push(`${pc.bold(pfx)}  ${g?.reads ?? ""}  ${pc.dim(`\xB7 plaintext: ${g?.plaintext ?? "?"}`)}`);
+    for (const p of pkgs) out.push(`  ${p.package.padEnd(30)} ${p.name}${p.status !== "stable" ? pc.dim(`  (${p.status})`) : ""}`);
+    out.push("");
+  }
+  out.push(pc.dim(`noy-db add <package> installs one and tells you what trust boundary it crosses.`));
+  return out.join("\n");
+}
+function findPackage(catalog, input) {
+  const full = input.startsWith("@noy-db/") ? input : `@noy-db/${input}`;
+  return catalog.packages.find((p) => p.package === full) ?? catalog.packages.find((p) => p.package.endsWith(`-${input}`));
+}
+function detectPackageManager(root) {
+  if (existsSync3(join4(root, "bun.lockb")) || existsSync3(join4(root, "bun.lock"))) return "bun";
+  if (existsSync3(join4(root, "yarn.lock"))) return "yarn";
+  if (existsSync3(join4(root, "package-lock.json"))) return "npm";
+  return "pnpm";
+}
+function installArgv(pm, pkg, dev) {
+  switch (pm) {
+    case "npm":
+      return ["npm", "install", ...dev ? ["--save-dev"] : [], pkg];
+    case "yarn":
+      return ["yarn", "add", ...dev ? ["--dev"] : [], pkg];
+    case "bun":
+      return ["bun", "add", ...dev ? ["--dev"] : [], pkg];
+    default:
+      return ["pnpm", "add", ...dev ? ["-D"] : [], pkg];
+  }
+}
+function snippetFor(p) {
+  const name = p.package.replace("@noy-db/", "");
+  const camel = name.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+  switch (p.prefix) {
+    case "to-":
+      return `import { ${camel} } from '${p.package}'
+// createNoydb({ store: ${camel}({ /* \u2026 */ }), user, secret })  \u2014 or as a sync target: sync: [{ store: ${camel}(...), role: 'backup' }]`;
+    case "as-":
+      return `import { ${camel.replace(/^as/, "to")} } from '${p.package}'
+// await vault.export(${camel.replace(/^as/, "to")}(), { collections: ['\u2026'] })   \u26A0\uFE0F the output is plaintext`;
+    case "on-":
+      return `import \u2026 from '${p.package}'
+// an unlock method is enrolled per user; see the package README for enroll*/unlock* and \`noy-db doctor\` for what is enrolled`;
+    case "by-":
+      return `import \u2026 from '${p.package}'
+// a session-share transport; pair it on both peers that already hold the secret`;
+    case "at-":
+      return `import \u2026 from '${p.package}'
+// createNoydb({ secretMode: 'managed', sealingKey: <provider>(\u2026) })   \u26A0\uFE0F the host you name can decrypt the slice it unseals`;
+    default:
+      return `import \u2026 from '${p.package}'`;
+  }
+}
+async function addPackage(input, opts = {}) {
+  const root = opts.root ?? process.cwd();
+  const { catalog } = await loadCatalog({ ...opts.offline !== void 0 ? { offline: opts.offline } : {}, ...opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {} });
+  const pkg = findPackage(catalog, input);
+  if (!pkg) {
+    const near = catalog.packages.filter((p) => p.package.includes(input.replace(/^@noy-db\//, ""))).map((p) => p.package).slice(0, 5);
+    throw new Error(`no package named "${input}" in the catalog${near.length ? ` \u2014 did you mean: ${near.join(", ")}` : ""}. \`noy-db add --list\` shows them all.`);
+  }
+  const pm = detectPackageManager(root);
+  const command = installArgv(pm, pkg.package, opts.dev ?? false);
+  let installed = false;
+  if (!opts.dryRun) {
+    const r = spawnSync(command[0], command.slice(1), { cwd: root, stdio: "inherit" });
+    if (r.status !== 0) throw new Error(`${command.join(" ")} exited ${r.status ?? "with a signal"}`);
+    installed = true;
+  }
+  let wired = null;
+  if (pkg.prefix === "in-" && pkg.package === "@noy-db/in-nuxt") {
+    const cfg = ["nuxt.config.ts", "nuxt.config.js", "nuxt.config.mjs"].map((n) => join4(root, n)).find((p) => existsSync3(p));
+    if (cfg && !opts.dryRun) {
+      const { augmentNuxtConfig: augmentNuxtConfig2, writeAugmentedConfig: writeAugmentedConfig2 } = await Promise.resolve().then(() => (init_augment(), augment_exports));
+      const res = await augmentNuxtConfig2({ configPath: cfg, adapter: "browser" });
+      if (res.kind === "proposed-change") {
+        await writeAugmentedConfig2(cfg, res.newCode);
+        wired = "nuxt-module";
+      } else if (res.kind === "already-configured") wired = "nuxt-module";
+    }
+  }
+  const trust = catalog.prefixes[pkg.prefix]?.trust ?? "";
+  return { pkg, installed, command, wired, trust, snippet: snippetFor(pkg) };
+}
+async function runAddPackage(argv) {
+  const flags = new Set(argv.filter((a) => a.startsWith("--")));
+  const positional = argv.filter((a) => !a.startsWith("--"));
+  if (flags.has("--help") || flags.has("-h")) {
+    process.stdout.write([
+      "Usage: noy-db add <package> [--dev] [--dry-run] [--offline]",
+      "       noy-db add --list [to|in|on|as|by|at]",
+      "",
+      "Installs a @noy-db package with your package manager, wires it where a config can be edited",
+      "(a Nuxt module), prints the import to paste otherwise, and says what trust boundary the layer crosses.",
+      `The list comes from ${CATALOG_URL}, falling back to the copy this version ships.`
+    ].join("\n") + "\n");
+    return 0;
+  }
+  if (flags.has("--list")) {
+    const prefix = normalisePrefix(positional[0]);
+    if (positional[0] && !prefix) {
+      process.stderr.write(`unknown prefix "${positional[0]}" \u2014 one of to in on as by at
+`);
+      return 2;
+    }
+    const { catalog, source } = await loadCatalog({ offline: flags.has("--offline") });
+    process.stdout.write(formatList(catalog, prefix) + "\n" + pc.dim(`(catalog: ${source}${source === "bundled" ? ", " + catalog.packages.length + " packages" : ""})`) + "\n");
+    return 0;
+  }
+  const input = positional[0];
+  if (!input) {
+    process.stderr.write("usage: noy-db add <package>   (or `noy-db add --list`)\n");
+    return 2;
+  }
+  try {
+    const r = await addPackage(input, { dev: flags.has("--dev"), dryRun: flags.has("--dry-run"), offline: flags.has("--offline") });
+    process.stdout.write(`${r.installed ? pc.green("\u2714") : pc.dim("dry:")} ${r.command.join(" ")}
+`);
+    if (r.wired) process.stdout.write(`${pc.green("\u2714")} wired into nuxt.config (${r.wired})
+`);
+    process.stdout.write(`
+${pc.bold(r.pkg.prefix)} ${r.trust}
+
+${r.snippet}
+`);
+    return 0;
+  } catch (err) {
+    process.stderr.write(`${pc.red("error:")} ${err.message}
+`);
+    return 1;
+  }
+}
+
 // src/bin/noy-db.ts
 var HELP = `Usage: noy-db <command> [args]
 
-Commands:
+Project
   add <collection>                             Scaffold a new collection store + page
-  add user <userId> <role> [options]           Grant a new user access to a vault
-  verify                                       In-memory crypto integrity check
-  rotate [options]                             Rotate DEKs for a vault
+  add <@noy-db/package> [--dev] [--dry-run]    Install a package, wire it, print the trust boundary
+  add --list [to|in|on|as|by|at]               The landscape \u2014 every package, by layer
+  user add <userId> <role> [options]           Grant a new user access to a vault
+  user rotate [options]                        Rotate DEKs for a vault
   backup <target> [options]                    Dump a vault to a file
-  help                                         Show this message
+  doctor [config] [--mode=prod] [--fix]        Readiness checks: secret, recovery, topology, capsule, deps, hygiene
+  doctor crypto                                In-memory crypto round-trip check
+
+Pods (.noydb files)
+  pod inspect <file.noydb>                     Print the bundle header (no secret)
+  pod verify  <file.noydb>                     Verify bundle integrity (no secret)
+  describe <file.noydb> [options]              YAML/JSON schema audit (needs the secret)
 
-Common options for rotate / add user / backup:
+Configuration
+  config validate <file.js|mjs>                Sanity-check a NoydbOptions file
+  config scaffold [--profile=<id>]             Topology skeleton \u2192 stdout, .env template \u2192 stderr
+  config profiles                              List the ten topology profiles
+
+Running
+  monitor <file.js|mjs> [--interval=ms]        Live store metrics (the store must be metered)
+  inspect <file.js|mjs> --vault=<name> [...]   Terminal inspector (installs on demand)
+
+Common options for user add / user rotate / backup:
   --dir <path>               Data directory (file adapter). Default: ./data
-  --vault <name>       Vault (tenant) name. Required.
+  --vault <name>             Vault (tenant) name. Required.
   --user <id>                Your user id in the vault. Required.
-  --collections <list>       Comma-separated collection list. Format:
-                               rotate:  invoices,clients
-                               add user: invoices:rw,clients:ro (operator/client only)
+  --collections <list>       rotate: invoices,clients \xB7 user add: invoices:rw,clients:ro
 
 Examples:
   noy-db add invoices
-  noy-db add user accountant-ann operator --dir ./data --vault demo-co --user owner-alice --collections invoices:rw,clients:ro
-  noy-db verify
-  noy-db rotate --dir ./data --vault demo-co --user owner-alice
-  noy-db backup ./backups/demo-co-2026-04-07.json --dir ./data --vault demo-co --user owner-alice
-
-Run from the root of a project that already has a noy-db file
-adapter directory in place. For new projects, use
-\`npm create noy-db\` instead.
+  noy-db user add ann operator --dir ./data --vault demo-co --user owner-alice --collections invoices:rw
+  noy-db config profiles
+  noy-db config scaffold --profile=B > noydb.config.mjs
+  noy-db doctor --mode=prod --fail-level=warn
+
+New project? \`npm create noy-db@latest\`.
 `;
+function renamed(from, to) {
+  process.stderr.write(`${pc2.dim(`(\`noy-db ${from}\` is now \`noy-db ${to}\`)`)}
+`);
+}
 async function main() {
   const [, , command, ...rest] = process.argv;
   switch (command) {
@@ -346,71 +1942,145 @@ async function main() {
     case "--help":
       process.stdout.write(HELP);
       return;
-    case "add":
+    case "add": {
+      if (rest[0] === "user") {
+        renamed("add user", "user add");
+        await runAddUser(rest.slice(1));
+        return;
+      }
+      const first = rest[0];
+      if (rest.some((a) => a === "--list" || a === "--help") || first && /^(@noy-db\/|to-|in-|on-|as-|by-|at-)/.test(first)) {
+        process.exit(await runAddPackage(rest));
+      }
       await runAdd(rest);
       return;
-    case "verify":
-      await runVerify();
+    }
+    case "user": {
+      const [sub, ...subRest] = rest;
+      if (sub === "add") {
+        await runAddUser(subRest);
+        return;
+      }
+      if (sub === "rotate") {
+        await runRotate(subRest);
+        return;
+      }
+      fail2(`\`noy-db user\` takes \`add\` or \`rotate\``);
       return;
+    }
     case "rotate":
+      renamed("rotate", "user rotate");
       await runRotate(rest);
       return;
     case "backup":
       await runBackup(rest);
       return;
+    case "verify":
+      renamed("verify", "doctor crypto");
+      await runCryptoCheck();
+      return;
+    case "doctor": {
+      if (rest[0] === "crypto") {
+        await runCryptoCheck();
+        return;
+      }
+      process.exit(await runDoctor(rest));
+      return;
+    }
+    case "pod": {
+      const [sub, ...subRest] = rest;
+      if (sub === "inspect") process.exit(await runInspect(subRest));
+      if (sub === "verify") process.exit(await runVerify(subRest));
+      fail2(`\`noy-db pod\` takes \`inspect\` or \`verify\``);
+      return;
+    }
+    case "describe":
+      process.exit(await runDescribe(rest));
+      return;
+    case "config": {
+      const [sub, ...subRest] = rest;
+      if (sub === "validate") process.exit(await runConfigValidate(subRest));
+      if (sub === "scaffold") process.exit(await runConfigScaffold(subRest));
+      if (sub === "profiles") process.exit(runConfigProfiles());
+      fail2(`\`noy-db config\` takes \`validate\`, \`scaffold\` or \`profiles\``);
+      return;
+    }
+    case "monitor":
+      process.exit(await runMonitor(rest));
+      return;
+    case "inspect":
+      process.exit(runTuiInspect(rest));
+      return;
     default:
-      process.stderr.write(`${pc.red("error:")} unknown command '${command}'
+      process.stderr.write(`${pc2.red("error:")} unknown command '${command}'
 
 ${HELP}`);
       process.exit(2);
   }
 }
+function fail2(message) {
+  process.stderr.write(`${pc2.red("error:")} ${message}
+`);
+  process.exit(2);
+}
+function runTuiInspect(args) {
+  const bin = resolveBin("@noy-db/in-devtools-tui", "noydb-inspect");
+  if (!bin) {
+    process.stderr.write(
+      `${pc2.red("error:")} the terminal inspector is not installed in this project.
+
+  ${pc2.bold("pnpm add -D @noy-db/in-devtools-tui")}   ${pc2.dim("(or npm/yarn/bun)")}
+
+then re-run \`noy-db inspect\`. It needs a config file, --vault=<name>, and a secret (--secret or NOYDB_SECRET).
+`
+    );
+    return 2;
+  }
+  const r = spawnSync2(process.execPath, [bin, ...args], { stdio: "inherit" });
+  return r.status ?? 1;
+}
 async function runAdd(args) {
   const first = args[0];
-  if (first === "user") {
-    await runAddUser(args.slice(1));
-    return;
-  }
   if (!first) {
     process.stderr.write(
-      `${pc.red("error:")} \`noy-db add\` requires either a collection name or the \`user\` subcommand
+      `${pc2.red("error:")} \`noy-db add\` requires a collection name
 
 Examples:
   noy-db add invoices
-  noy-db add user alice operator ...
+  noy-db user add alice operator ...
 `
     );
     process.exit(2);
   }
   try {
     const result = await addCollection({ name: first });
-    process.stdout.write(`${pc.green("\u2714")} Created:
+    process.stdout.write(`${pc2.green("\u2714")} Created:
 `);
     for (const file of result.files) {
-      process.stdout.write(`  ${pc.dim("\u2192")} ${file}
+      process.stdout.write(`  ${pc2.dim("\u2192")} ${file}
 `);
     }
     process.stdout.write(
       `
-Next: visit ${pc.cyan(`/${first}`)} in your dev server, then edit ${pc.bold(`app/stores/${first}.ts`)} to match your domain.
+Next: visit ${pc2.cyan(`/${first}`)} in your dev server, then edit ${pc2.bold(`app/stores/${first}.ts`)} to match your domain.
 `
     );
   } catch (err) {
-    process.stderr.write(`${pc.red("error:")} ${err.message}
+    process.stderr.write(`${pc2.red("error:")} ${err.message}
 `);
     process.exit(1);
   }
 }
-async function runVerify() {
-  process.stdout.write(`${pc.dim("\u25B8 Running noy-db integrity check\u2026")}
+async function runCryptoCheck() {
+  process.stdout.write(`${pc2.dim("\u25B8 Running noy-db crypto round-trip\u2026")}
 `);
   const result = await verifyIntegrity();
   if (result.ok) {
-    process.stdout.write(`${pc.green("\u2714")} ${result.message} ${pc.dim(`(${result.durationMs}ms)`)}
+    process.stdout.write(`${pc2.green("\u2714")} ${result.message} ${pc2.dim(`(${result.durationMs}ms)`)}
 `);
     return;
   }
-  process.stderr.write(`${pc.red("\u2718")} ${result.message} ${pc.dim(`(${result.durationMs}ms)`)}
+  process.stderr.write(`${pc2.red("\u2718")} ${result.message} ${pc2.dim(`(${result.durationMs}ms)`)}
 `);
   process.exit(1);
 }
@@ -419,9 +2089,9 @@ async function runAddUser(args) {
   const roleInput = args[1];
   if (!userId || !roleInput) {
     process.stderr.write(
-      `${pc.red("error:")} \`noy-db add user\` requires <userId> <role>
+      `${pc2.red("error:")} \`noy-db user add\` requires <userId> <role>
 
-Example: noy-db add user ann operator --dir ./data --vault demo-co --user owner-alice --collections invoices:rw
+Example: noy-db user add ann operator --dir ./data --vault demo-co --user owner-alice --collections invoices:rw
 `
     );
     process.exit(2);
@@ -430,7 +2100,7 @@ Example: noy-db add user ann operator --dir ./data --vault demo-co --user owner-
   try {
     role = assertRole(roleInput);
   } catch (err) {
-    process.stderr.write(`${pc.red("error:")} ${err.message}
+    process.stderr.write(`${pc2.red("error:")} ${err.message}
 `);
     process.exit(2);
     return;
@@ -452,11 +2122,11 @@ Example: noy-db add user ann operator --dir ./data --vault demo-co --user owner-
   try {
     const result = await addUser(opts);
     process.stdout.write(
-      `${pc.green("\u2714")} Granted ${pc.bold(result.role)} access to ${pc.cyan(result.userId)} in vault ${pc.cyan(vault)}.
+      `${pc2.green("\u2714")} Granted ${pc2.bold(result.role)} access to ${pc2.cyan(result.userId)} in vault ${pc2.cyan(vault)}.
 `
     );
   } catch (err) {
-    process.stderr.write(`${pc.red("error:")} ${err.message}
+    process.stderr.write(`${pc2.red("error:")} ${err.message}
 `);
     process.exit(1);
   }
@@ -472,15 +2142,15 @@ async function runRotate(args) {
   try {
     const result = await rotate(opts);
     process.stdout.write(
-      `${pc.green("\u2714")} Rotated ${pc.bold(String(result.rotated.length))} collection(s) in ${pc.cyan(vault)}:
+      `${pc2.green("\u2714")} Rotated ${pc2.bold(String(result.rotated.length))} collection(s) in ${pc2.cyan(vault)}:
 `
     );
     for (const name of result.rotated) {
-      process.stdout.write(`  ${pc.dim("\u2192")} ${name}
+      process.stdout.write(`  ${pc2.dim("\u2192")} ${name}
 `);
     }
   } catch (err) {
-    process.stderr.write(`${pc.red("error:")} ${err.message}
+    process.stderr.write(`${pc2.red("error:")} ${err.message}
 `);
     process.exit(1);
   }
@@ -489,7 +2159,7 @@ async function runBackup(args) {
   const target = args[0];
   if (!target) {
     process.stderr.write(
-      `${pc.red("error:")} \`noy-db backup\` requires a target path
+      `${pc2.red("error:")} \`noy-db backup\` requires a target path
 
 Example: noy-db backup ./backups/demo.json --dir ./data --vault demo-co --user owner-alice
 `
@@ -503,11 +2173,11 @@ Example: noy-db backup ./backups/demo.json --dir ./data --vault demo-co --user o
   try {
     const result = await backup({ dir, vault, user, target });
     process.stdout.write(
-      `${pc.green("\u2714")} Wrote backup: ${pc.cyan(result.path)} ${pc.dim(`(${result.bytes} bytes)`)}
+      `${pc2.green("\u2714")} Wrote backup: ${pc2.cyan(result.path)} ${pc2.dim(`(${result.bytes} bytes)`)}
 `
     );
   } catch (err) {
-    process.stderr.write(`${pc.red("error:")} ${err.message}
+    process.stderr.write(`${pc2.red("error:")} ${err.message}
 `);
     process.exit(1);
   }
@@ -531,10 +2201,8 @@ function parseFlags(args) {
 function requireFlag(flags, name) {
   const value = flags[name];
   if (!value) {
-    process.stderr.write(
-      `${pc.red("error:")} missing required flag --${name}
-`
-    );
+    process.stderr.write(`${pc2.red("error:")} missing required flag --${name}
+`);
     process.exit(2);
   }
   return value;
@@ -545,17 +2213,18 @@ function parsePermissions(input) {
   for (const pair of input.split(",").map((s) => s.trim()).filter(Boolean)) {
     const [name, mode] = pair.split(":");
     if (!name || !mode || mode !== "rw" && mode !== "ro") {
-      throw new Error(
-        `Invalid --collections entry "${pair}" \u2014 expected "name:rw" or "name:ro"`
-      );
+      throw new Error(`Invalid --collections entry "${pair}" \u2014 expected "name:rw" or "name:ro"`);
     }
     out[name] = mode;
   }
   return Object.keys(out).length > 0 ? out : null;
 }
 main().catch((err) => {
-  process.stderr.write(`${pc.red("fatal:")} ${err.message}
+  process.stderr.write(`${pc2.red("fatal:")} ${err.message}
 `);
   process.exit(1);
 });
+export {
+  runTuiInspect
+};
 //# sourceMappingURL=noy-db.js.map