enclave-link 0.1.0 → 0.2.1

package/dist/{chunk-LUHJCCBX.js → chunk-RHLID3KU.js}

@@ -1,8 +1,17 @@
 import {
   __commonJS,
   __export,
-  __toESM
-} from "./chunk-U67V476Y.js";
+  __toESM,
+  _enum,
+  array,
+  number,
+  object,
+  record,
+  string,
+  tuple,
+  union,
+  unknown
+} from "./chunk-7QIF4PCL.js";
 
 // node_modules/@msgpack/msgpack/dist.cjs/utils/utf8.cjs
 var require_utf8 = __commonJS({
@@ -92,26 +101,26 @@ var require_utf8 = __commonJS({
       }
     }
     var CHUNK_SIZE = 4096;
-    function utf8DecodeJs(bytes, inputOffset, byteLength2) {
+    function utf8DecodeJs(bytes2, inputOffset, byteLength2) {
       let offset = inputOffset;
       const end = offset + byteLength2;
       const units = [];
       let result = "";
       while (offset < end) {
-        const byte1 = bytes[offset++];
+        const byte1 = bytes2[offset++];
         if ((byte1 & 128) === 0) {
           units.push(byte1);
         } else if ((byte1 & 224) === 192) {
-          const byte2 = bytes[offset++] & 63;
+          const byte2 = bytes2[offset++] & 63;
           units.push((byte1 & 31) << 6 | byte2);
         } else if ((byte1 & 240) === 224) {
-          const byte2 = bytes[offset++] & 63;
-          const byte3 = bytes[offset++] & 63;
+          const byte2 = bytes2[offset++] & 63;
+          const byte3 = bytes2[offset++] & 63;
           units.push((byte1 & 31) << 12 | byte2 << 6 | byte3);
         } else if ((byte1 & 248) === 240) {
-          const byte2 = bytes[offset++] & 63;
-          const byte3 = bytes[offset++] & 63;
-          const byte4 = bytes[offset++] & 63;
+          const byte2 = bytes2[offset++] & 63;
+          const byte3 = bytes2[offset++] & 63;
+          const byte4 = bytes2[offset++] & 63;
           let unit = (byte1 & 7) << 18 | byte2 << 12 | byte3 << 6 | byte4;
           if (unit > 65535) {
             unit -= 65536;
@@ -134,15 +143,15 @@ var require_utf8 = __commonJS({
     }
     var sharedTextDecoder = new TextDecoder();
     var TEXT_DECODER_THRESHOLD = 200;
-    function utf8DecodeTD(bytes, inputOffset, byteLength2) {
-      const stringBytes = bytes.subarray(inputOffset, inputOffset + byteLength2);
+    function utf8DecodeTD(bytes2, inputOffset, byteLength2) {
+      const stringBytes = bytes2.subarray(inputOffset, inputOffset + byteLength2);
       return sharedTextDecoder.decode(stringBytes);
     }
-    function utf8Decode(bytes, inputOffset, byteLength2) {
+    function utf8Decode(bytes2, inputOffset, byteLength2) {
       if (byteLength2 > TEXT_DECODER_THRESHOLD) {
-        return utf8DecodeTD(bytes, inputOffset, byteLength2);
+        return utf8DecodeTD(bytes2, inputOffset, byteLength2);
       } else {
-        return utf8DecodeJs(bytes, inputOffset, byteLength2);
+        return utf8DecodeJs(bytes2, inputOffset, byteLength2);
       }
     }
   }
@@ -274,9 +283,9 @@ var require_timestamp = __commonJS({
         nsec: nsec - nsecInSec * 1e9
       };
     }
-    function encodeTimestampExtension(object) {
-      if (object instanceof Date) {
-        const timeSpec = encodeDateToTimeSpec(object);
+    function encodeTimestampExtension(object2) {
+      if (object2 instanceof Date) {
+        const timeSpec = encodeDateToTimeSpec(object2);
         return encodeTimeSpecToTimestamp(timeSpec);
       } else {
         return null;
@@ -351,11 +360,11 @@ var require_ExtensionCodec = __commonJS({
           this.builtInDecoders[index] = decode2;
         }
       }
-      tryToEncode(object, context) {
+      tryToEncode(object2, context) {
         for (let i = 0; i < this.builtInEncoders.length; i++) {
           const encodeExt = this.builtInEncoders[i];
           if (encodeExt != null) {
-            const data = encodeExt(object, context);
+            const data = encodeExt(object2, context);
             if (data != null) {
               const type = -1 - i;
               return new ExtData_ts_1.ExtData(type, data);
@@ -365,15 +374,15 @@ var require_ExtensionCodec = __commonJS({
         for (let i = 0; i < this.encoders.length; i++) {
           const encodeExt = this.encoders[i];
           if (encodeExt != null) {
-            const data = encodeExt(object, context);
+            const data = encodeExt(object2, context);
             if (data != null) {
               const type = i;
               return new ExtData_ts_1.ExtData(type, data);
             }
           }
         }
-        if (object instanceof ExtData_ts_1.ExtData) {
-          return object;
+        if (object2 instanceof ExtData_ts_1.ExtData) {
+          return object2;
         }
         return null;
       }
@@ -474,15 +483,15 @@ var require_Encoder = __commonJS({
        *
        * @returns Encodes the object and returns a shared reference the encoder's internal buffer.
        */
-      encodeSharedRef(object) {
+      encodeSharedRef(object2) {
         if (this.entered) {
           const instance = this.clone();
-          return instance.encodeSharedRef(object);
+          return instance.encodeSharedRef(object2);
         }
         try {
           this.entered = true;
           this.reinitializeState();
-          this.doEncode(object, 1);
+          this.doEncode(object2, 1);
           return this.bytes.subarray(0, this.pos);
         } finally {
           this.entered = false;
@@ -491,40 +500,40 @@ var require_Encoder = __commonJS({
       /**
        * @returns Encodes the object and returns a copy of the encoder's internal buffer.
        */
-      encode(object) {
+      encode(object2) {
         if (this.entered) {
           const instance = this.clone();
-          return instance.encode(object);
+          return instance.encode(object2);
         }
         try {
           this.entered = true;
           this.reinitializeState();
-          this.doEncode(object, 1);
+          this.doEncode(object2, 1);
           return this.bytes.slice(0, this.pos);
         } finally {
           this.entered = false;
         }
       }
-      doEncode(object, depth) {
+      doEncode(object2, depth) {
         if (depth > this.maxDepth) {
           throw new Error(`Too deep objects in depth ${depth}`);
         }
-        if (object == null) {
+        if (object2 == null) {
           this.encodeNil();
-        } else if (typeof object === "boolean") {
-          this.encodeBoolean(object);
-        } else if (typeof object === "number") {
+        } else if (typeof object2 === "boolean") {
+          this.encodeBoolean(object2);
+        } else if (typeof object2 === "number") {
           if (!this.forceIntegerToFloat) {
-            this.encodeNumber(object);
+            this.encodeNumber(object2);
           } else {
-            this.encodeNumberAsFloat(object);
+            this.encodeNumberAsFloat(object2);
           }
-        } else if (typeof object === "string") {
-          this.encodeString(object);
-        } else if (this.useBigInt64 && typeof object === "bigint") {
-          this.encodeBigInt64(object);
+        } else if (typeof object2 === "string") {
+          this.encodeString(object2);
+        } else if (this.useBigInt64 && typeof object2 === "bigint") {
+          this.encodeBigInt64(object2);
         } else {
-          this.encodeObject(object, depth);
+          this.encodeObject(object2, depth);
         }
       }
       ensureBufferSizeToWrite(sizeToWrite) {
@@ -544,72 +553,72 @@ var require_Encoder = __commonJS({
       encodeNil() {
         this.writeU8(192);
       }
-      encodeBoolean(object) {
-        if (object === false) {
+      encodeBoolean(object2) {
+        if (object2 === false) {
           this.writeU8(194);
         } else {
           this.writeU8(195);
         }
       }
-      encodeNumber(object) {
-        if (!this.forceIntegerToFloat && Number.isSafeInteger(object)) {
-          if (object >= 0) {
-            if (object < 128) {
-              this.writeU8(object);
-            } else if (object < 256) {
+      encodeNumber(object2) {
+        if (!this.forceIntegerToFloat && Number.isSafeInteger(object2)) {
+          if (object2 >= 0) {
+            if (object2 < 128) {
+              this.writeU8(object2);
+            } else if (object2 < 256) {
               this.writeU8(204);
-              this.writeU8(object);
-            } else if (object < 65536) {
+              this.writeU8(object2);
+            } else if (object2 < 65536) {
               this.writeU8(205);
-              this.writeU16(object);
-            } else if (object < 4294967296) {
+              this.writeU16(object2);
+            } else if (object2 < 4294967296) {
               this.writeU8(206);
-              this.writeU32(object);
+              this.writeU32(object2);
             } else if (!this.useBigInt64) {
               this.writeU8(207);
-              this.writeU64(object);
+              this.writeU64(object2);
             } else {
-              this.encodeNumberAsFloat(object);
+              this.encodeNumberAsFloat(object2);
             }
           } else {
-            if (object >= -32) {
-              this.writeU8(224 | object + 32);
-            } else if (object >= -128) {
+            if (object2 >= -32) {
+              this.writeU8(224 | object2 + 32);
+            } else if (object2 >= -128) {
               this.writeU8(208);
-              this.writeI8(object);
-            } else if (object >= -32768) {
+              this.writeI8(object2);
+            } else if (object2 >= -32768) {
               this.writeU8(209);
-              this.writeI16(object);
-            } else if (object >= -2147483648) {
+              this.writeI16(object2);
+            } else if (object2 >= -2147483648) {
               this.writeU8(210);
-              this.writeI32(object);
+              this.writeI32(object2);
             } else if (!this.useBigInt64) {
               this.writeU8(211);
-              this.writeI64(object);
+              this.writeI64(object2);
             } else {
-              this.encodeNumberAsFloat(object);
+              this.encodeNumberAsFloat(object2);
             }
           }
         } else {
-          this.encodeNumberAsFloat(object);
+          this.encodeNumberAsFloat(object2);
         }
       }
-      encodeNumberAsFloat(object) {
+      encodeNumberAsFloat(object2) {
         if (this.forceFloat32) {
           this.writeU8(202);
-          this.writeF32(object);
+          this.writeF32(object2);
         } else {
           this.writeU8(203);
-          this.writeF64(object);
+          this.writeF64(object2);
         }
       }
-      encodeBigInt64(object) {
-        if (object >= BigInt(0)) {
+      encodeBigInt64(object2) {
+        if (object2 >= BigInt(0)) {
           this.writeU8(207);
-          this.writeBigUint64(object);
+          this.writeBigUint64(object2);
         } else {
           this.writeU8(211);
-          this.writeBigInt64(object);
+          this.writeBigInt64(object2);
         }
       }
       writeStringHeader(byteLength2) {
@@ -628,30 +637,30 @@ var require_Encoder = __commonJS({
           throw new Error(`Too long string: ${byteLength2} bytes in UTF-8`);
         }
       }
-      encodeString(object) {
+      encodeString(object2) {
         const maxHeaderSize = 1 + 4;
-        const byteLength2 = (0, utf8_ts_1.utf8Count)(object);
+        const byteLength2 = (0, utf8_ts_1.utf8Count)(object2);
         this.ensureBufferSizeToWrite(maxHeaderSize + byteLength2);
         this.writeStringHeader(byteLength2);
-        (0, utf8_ts_1.utf8Encode)(object, this.bytes, this.pos);
+        (0, utf8_ts_1.utf8Encode)(object2, this.bytes, this.pos);
         this.pos += byteLength2;
       }
-      encodeObject(object, depth) {
-        const ext = this.extensionCodec.tryToEncode(object, this.context);
+      encodeObject(object2, depth) {
+        const ext = this.extensionCodec.tryToEncode(object2, this.context);
         if (ext != null) {
           this.encodeExtension(ext);
-        } else if (Array.isArray(object)) {
-          this.encodeArray(object, depth);
-        } else if (ArrayBuffer.isView(object)) {
-          this.encodeBinary(object);
-        } else if (typeof object === "object") {
-          this.encodeMap(object, depth);
+        } else if (Array.isArray(object2)) {
+          this.encodeArray(object2, depth);
+        } else if (ArrayBuffer.isView(object2)) {
+          this.encodeBinary(object2);
+        } else if (typeof object2 === "object") {
+          this.encodeMap(object2, depth);
         } else {
-          throw new Error(`Unrecognized object: ${Object.prototype.toString.apply(object)}`);
+          throw new Error(`Unrecognized object: ${Object.prototype.toString.apply(object2)}`);
         }
       }
-      encodeBinary(object) {
-        const size = object.byteLength;
+      encodeBinary(object2) {
+        const size = object2.byteLength;
         if (size < 256) {
           this.writeU8(196);
           this.writeU8(size);
@@ -664,11 +673,11 @@ var require_Encoder = __commonJS({
         } else {
           throw new Error(`Too large binary: ${size}`);
         }
-        const bytes = (0, typedArrays_ts_1.ensureUint8Array)(object);
-        this.writeU8a(bytes);
+        const bytes2 = (0, typedArrays_ts_1.ensureUint8Array)(object2);
+        this.writeU8a(bytes2);
       }
-      encodeArray(object, depth) {
-        const size = object.length;
+      encodeArray(object2, depth) {
+        const size = object2.length;
         if (size < 16) {
           this.writeU8(144 + size);
         } else if (size < 65536) {
@@ -680,25 +689,25 @@ var require_Encoder = __commonJS({
         } else {
           throw new Error(`Too large array: ${size}`);
         }
-        for (const item of object) {
+        for (const item of object2) {
           this.doEncode(item, depth + 1);
         }
       }
-      countWithoutUndefined(object, keys) {
+      countWithoutUndefined(object2, keys) {
         let count = 0;
         for (const key of keys) {
-          if (object[key] !== void 0) {
+          if (object2[key] !== void 0) {
             count++;
           }
         }
         return count;
       }
-      encodeMap(object, depth) {
-        const keys = Object.keys(object);
+      encodeMap(object2, depth) {
+        const keys = Object.keys(object2);
         if (this.sortKeys) {
           keys.sort();
         }
-        const size = this.ignoreUndefined ? this.countWithoutUndefined(object, keys) : keys.length;
+        const size = this.ignoreUndefined ? this.countWithoutUndefined(object2, keys) : keys.length;
         if (size < 16) {
           this.writeU8(128 + size);
         } else if (size < 65536) {
@@ -711,7 +720,7 @@ var require_Encoder = __commonJS({
           throw new Error(`Too large map object: ${size}`);
         }
         for (const key of keys) {
-          const value = object[key];
+          const value = object2[key];
           if (!(this.ignoreUndefined && value === void 0)) {
             this.encodeString(key);
             this.doEncode(value, depth + 1);
@@ -880,37 +889,37 @@ var require_CachedKeyDecoder = __commonJS({
       canBeCached(byteLength2) {
         return byteLength2 > 0 && byteLength2 <= this.maxKeyLength;
       }
-      find(bytes, inputOffset, byteLength2) {
+      find(bytes2, inputOffset, byteLength2) {
         const records = this.caches[byteLength2 - 1];
-        FIND_CHUNK: for (const record of records) {
-          const recordBytes = record.bytes;
+        FIND_CHUNK: for (const record2 of records) {
+          const recordBytes = record2.bytes;
           for (let j = 0; j < byteLength2; j++) {
-            if (recordBytes[j] !== bytes[inputOffset + j]) {
+            if (recordBytes[j] !== bytes2[inputOffset + j]) {
               continue FIND_CHUNK;
             }
           }
-          return record.str;
+          return record2.str;
         }
         return null;
       }
-      store(bytes, value) {
-        const records = this.caches[bytes.length - 1];
-        const record = { bytes, str: value };
+      store(bytes2, value) {
+        const records = this.caches[bytes2.length - 1];
+        const record2 = { bytes: bytes2, str: value };
         if (records.length >= this.maxLengthPerKey) {
-          records[Math.random() * records.length | 0] = record;
+          records[Math.random() * records.length | 0] = record2;
         } else {
-          records.push(record);
+          records.push(record2);
         }
       }
-      decode(bytes, inputOffset, byteLength2) {
-        const cachedValue = this.find(bytes, inputOffset, byteLength2);
+      decode(bytes2, inputOffset, byteLength2) {
+        const cachedValue = this.find(bytes2, inputOffset, byteLength2);
         if (cachedValue != null) {
           this.hit++;
           return cachedValue;
         }
         this.miss++;
-        const str = (0, utf8_ts_1.utf8DecodeJs)(bytes, inputOffset, byteLength2);
-        const slicedCopyOfBytes = Uint8Array.prototype.slice.call(bytes, inputOffset, inputOffset + byteLength2);
+        const str = (0, utf8_ts_1.utf8DecodeJs)(bytes2, inputOffset, byteLength2);
+        const slicedCopyOfBytes = Uint8Array.prototype.slice.call(bytes2, inputOffset, inputOffset + byteLength2);
         this.store(slicedCopyOfBytes, str);
         return str;
       }
@@ -1070,9 +1079,9 @@ var require_Decoder = __commonJS({
         this.stack.reset();
       }
       setBuffer(buffer) {
-        const bytes = (0, typedArrays_ts_1.ensureUint8Array)(buffer);
-        this.bytes = bytes;
-        this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+        const bytes2 = (0, typedArrays_ts_1.ensureUint8Array)(buffer);
+        this.bytes = bytes2;
+        this.view = new DataView(bytes2.buffer, bytes2.byteOffset, bytes2.byteLength);
         this.pos = 0;
       }
       appendBuffer(buffer) {
@@ -1107,11 +1116,11 @@ var require_Decoder = __commonJS({
           this.entered = true;
           this.reinitializeState();
           this.setBuffer(buffer);
-          const object = this.doDecodeSync();
+          const object2 = this.doDecodeSync();
           if (this.hasRemaining(1)) {
             throw this.createExtraByteError(this.pos);
           }
-          return object;
+          return object2;
         } finally {
           this.entered = false;
         }
@@ -1141,7 +1150,7 @@ var require_Decoder = __commonJS({
         try {
           this.entered = true;
           let decoded = false;
-          let object;
+          let object2;
           for await (const buffer of stream) {
             if (decoded) {
               this.entered = false;
@@ -1149,7 +1158,7 @@ var require_Decoder = __commonJS({
             }
             this.appendBuffer(buffer);
             try {
-              object = this.doDecodeSync();
+              object2 = this.doDecodeSync();
               decoded = true;
             } catch (e) {
               if (!(e instanceof RangeError)) {
@@ -1162,7 +1171,7 @@ var require_Decoder = __commonJS({
             if (this.hasRemaining(1)) {
               throw this.createExtraByteError(this.totalPos);
             }
-            return object;
+            return object2;
           }
           const { headByte, pos, totalPos } = this;
           throw new RangeError(`Insufficient data in parsing ${(0, prettyByte_ts_1.prettyByte)(headByte)} at ${totalPos} (${pos} in the current buffer)`);
@@ -1217,12 +1226,12 @@ var require_Decoder = __commonJS({
       doDecodeSync() {
         DECODE: while (true) {
           const headByte = this.readHeadByte();
-          let object;
+          let object2;
           if (headByte >= 224) {
-            object = headByte - 256;
+            object2 = headByte - 256;
           } else if (headByte < 192) {
             if (headByte < 128) {
-              object = headByte;
+              object2 = headByte;
             } else if (headByte < 144) {
               const size = headByte - 128;
               if (size !== 0) {
@@ -1230,7 +1239,7 @@ var require_Decoder = __commonJS({
                 this.complete();
                 continue DECODE;
               } else {
-                object = {};
+                object2 = {};
               }
             } else if (headByte < 160) {
               const size = headByte - 144;
@@ -1239,55 +1248,55 @@ var require_Decoder = __commonJS({
                 this.complete();
                 continue DECODE;
               } else {
-                object = [];
+                object2 = [];
               }
             } else {
               const byteLength2 = headByte - 160;
-              object = this.decodeString(byteLength2, 0);
+              object2 = this.decodeString(byteLength2, 0);
             }
           } else if (headByte === 192) {
-            object = null;
+            object2 = null;
           } else if (headByte === 194) {
-            object = false;
+            object2 = false;
           } else if (headByte === 195) {
-            object = true;
+            object2 = true;
           } else if (headByte === 202) {
-            object = this.readF32();
+            object2 = this.readF32();
           } else if (headByte === 203) {
-            object = this.readF64();
+            object2 = this.readF64();
           } else if (headByte === 204) {
-            object = this.readU8();
+            object2 = this.readU8();
           } else if (headByte === 205) {
-            object = this.readU16();
+            object2 = this.readU16();
           } else if (headByte === 206) {
-            object = this.readU32();
+            object2 = this.readU32();
           } else if (headByte === 207) {
             if (this.useBigInt64) {
-              object = this.readU64AsBigInt();
+              object2 = this.readU64AsBigInt();
             } else {
-              object = this.readU64();
+              object2 = this.readU64();
             }
           } else if (headByte === 208) {
-            object = this.readI8();
+            object2 = this.readI8();
           } else if (headByte === 209) {
-            object = this.readI16();
+            object2 = this.readI16();
           } else if (headByte === 210) {
-            object = this.readI32();
+            object2 = this.readI32();
           } else if (headByte === 211) {
             if (this.useBigInt64) {
-              object = this.readI64AsBigInt();
+              object2 = this.readI64AsBigInt();
             } else {
-              object = this.readI64();
+              object2 = this.readI64();
             }
           } else if (headByte === 217) {
             const byteLength2 = this.lookU8();
-            object = this.decodeString(byteLength2, 1);
+            object2 = this.decodeString(byteLength2, 1);
           } else if (headByte === 218) {
             const byteLength2 = this.lookU16();
-            object = this.decodeString(byteLength2, 2);
+            object2 = this.decodeString(byteLength2, 2);
           } else if (headByte === 219) {
             const byteLength2 = this.lookU32();
-            object = this.decodeString(byteLength2, 4);
+            object2 = this.decodeString(byteLength2, 4);
           } else if (headByte === 220) {
             const size = this.readU16();
             if (size !== 0) {
@@ -1295,7 +1304,7 @@ var require_Decoder = __commonJS({
               this.complete();
               continue DECODE;
             } else {
-              object = [];
+              object2 = [];
             }
           } else if (headByte === 221) {
             const size = this.readU32();
@@ -1304,7 +1313,7 @@ var require_Decoder = __commonJS({
               this.complete();
               continue DECODE;
             } else {
-              object = [];
+              object2 = [];
             }
           } else if (headByte === 222) {
             const size = this.readU16();
@@ -1313,7 +1322,7 @@ var require_Decoder = __commonJS({
               this.complete();
               continue DECODE;
             } else {
-              object = {};
+              object2 = {};
             }
           } else if (headByte === 223) {
             const size = this.readU32();
@@ -1322,36 +1331,36 @@ var require_Decoder = __commonJS({
               this.complete();
               continue DECODE;
             } else {
-              object = {};
+              object2 = {};
             }
           } else if (headByte === 196) {
             const size = this.lookU8();
-            object = this.decodeBinary(size, 1);
+            object2 = this.decodeBinary(size, 1);
           } else if (headByte === 197) {
             const size = this.lookU16();
-            object = this.decodeBinary(size, 2);
+            object2 = this.decodeBinary(size, 2);
           } else if (headByte === 198) {
             const size = this.lookU32();
-            object = this.decodeBinary(size, 4);
+            object2 = this.decodeBinary(size, 4);
           } else if (headByte === 212) {
-            object = this.decodeExtension(1, 0);
+            object2 = this.decodeExtension(1, 0);
           } else if (headByte === 213) {
-            object = this.decodeExtension(2, 0);
+            object2 = this.decodeExtension(2, 0);
           } else if (headByte === 214) {
-            object = this.decodeExtension(4, 0);
+            object2 = this.decodeExtension(4, 0);
           } else if (headByte === 215) {
-            object = this.decodeExtension(8, 0);
+            object2 = this.decodeExtension(8, 0);
           } else if (headByte === 216) {
-            object = this.decodeExtension(16, 0);
+            object2 = this.decodeExtension(16, 0);
           } else if (headByte === 199) {
             const size = this.lookU8();
-            object = this.decodeExtension(size, 1);
+            object2 = this.decodeExtension(size, 1);
           } else if (headByte === 200) {
             const size = this.lookU16();
-            object = this.decodeExtension(size, 2);
+            object2 = this.decodeExtension(size, 2);
           } else if (headByte === 201) {
             const size = this.lookU32();
-            object = this.decodeExtension(size, 4);
+            object2 = this.decodeExtension(size, 4);
           } else {
             throw new DecodeError_ts_1.DecodeError(`Unrecognized type byte: ${(0, prettyByte_ts_1.prettyByte)(headByte)}`);
           }
@@ -1360,26 +1369,26 @@ var require_Decoder = __commonJS({
           while (stack.length > 0) {
             const state = stack.top();
             if (state.type === STATE_ARRAY) {
-              state.array[state.position] = object;
+              state.array[state.position] = object2;
               state.position++;
               if (state.position === state.size) {
-                object = state.array;
+                object2 = state.array;
                 stack.release(state);
               } else {
                 continue DECODE;
               }
             } else if (state.type === STATE_MAP_KEY) {
-              if (object === "__proto__") {
+              if (object2 === "__proto__") {
                 throw new DecodeError_ts_1.DecodeError("The key __proto__ is not allowed");
               }
-              state.key = this.mapKeyConverter(object);
+              state.key = this.mapKeyConverter(object2);
               state.type = STATE_MAP_VALUE;
               continue DECODE;
             } else {
-              state.map[state.key] = object;
+              state.map[state.key] = object2;
               state.readCount++;
               if (state.readCount === state.size) {
-                object = state.map;
+                object2 = state.map;
                 stack.release(state);
               } else {
                 state.key = null;
@@ -1388,7 +1397,7 @@ var require_Decoder = __commonJS({
               }
             }
           }
-          return object;
+          return object2;
         }
       }
       readHeadByte() {
@@ -1445,14 +1454,14 @@ var require_Decoder = __commonJS({
           throw MORE_DATA;
         }
         const offset = this.pos + headerOffset;
-        let object;
+        let object2;
         if (this.stateIsMapKey() && this.keyDecoder?.canBeCached(byteLength2)) {
-          object = this.keyDecoder.decode(this.bytes, offset, byteLength2);
+          object2 = this.keyDecoder.decode(this.bytes, offset, byteLength2);
         } else {
-          object = (0, utf8_ts_1.utf8Decode)(this.bytes, offset, byteLength2);
+          object2 = (0, utf8_ts_1.utf8Decode)(this.bytes, offset, byteLength2);
         }
         this.pos += headerOffset + byteLength2;
-        return object;
+        return object2;
       }
       stateIsMapKey() {
         if (this.stack.length > 0) {
@@ -1472,9 +1481,9 @@ var require_Decoder = __commonJS({
           throw MORE_DATA;
         }
         const offset = this.pos + headOffset;
-        const object = this.bytes.subarray(offset, offset + byteLength2);
+        const object2 = this.bytes.subarray(offset, offset + byteLength2);
         this.pos += headOffset + byteLength2;
-        return object;
+        return object2;
       }
       decodeExtension(size, headOffset) {
         if (size > this.maxExtLength) {
@@ -1589,8 +1598,8 @@ var require_stream2 = __commonJS({
     exports.isAsyncIterable = isAsyncIterable;
     exports.asyncIterableFromStream = asyncIterableFromStream;
     exports.ensureAsyncIterable = ensureAsyncIterable;
-    function isAsyncIterable(object) {
-      return object[Symbol.asyncIterator] != null;
+    function isAsyncIterable(object2) {
+      return object2[Symbol.asyncIterator] != null;
     }
     async function* asyncIterableFromStream(stream) {
       const reader = stream.getReader();
@@ -1713,8 +1722,203 @@ var require_dist = __commonJS({
   }
 });
 
+// src/passkey.ts
+import { createHash, createPrivateKey, sign } from "node:crypto";
+var signRequest = object({
+  origin: string(),
+  rpId: string().optional(),
+  challenge: string(),
+  allowCredentials: array(string()).optional()
+});
+var userPresentVerifiedAndSynced = 1 | 4 | 8 | 16;
+function relyingParty({ origin, rpId }) {
+  const host = new URL(origin).hostname;
+  const id = rpId ?? host;
+  if (host !== id && !host.endsWith(`.${id}`)) throw new Error(`${origin} can't use passkeys for ${id}`);
+  return id;
+}
+function accepts(passkey, request) {
+  const credentialId = Buffer.from(passkey.credentialId, "base64").toString("base64url");
+  return passkey.rpId === relyingParty(request) && (!request.allowCredentials?.length || request.allowCredentials.includes(credentialId));
+}
+function signAssertion(passkey, request) {
+  const rpId = relyingParty(request);
+  const clientDataJSON = Buffer.from(
+    JSON.stringify({ type: "webauthn.get", challenge: request.challenge, origin: request.origin, crossOrigin: false })
+  );
+  const authenticatorData = Buffer.concat([
+    sha256(Buffer.from(rpId)),
+    Buffer.from([userPresentVerifiedAndSynced]),
+    Buffer.alloc(4)
+  ]);
+  const key = createPrivateKey({ key: Buffer.from(passkey.privateKey, "base64"), format: "der", type: "pkcs8" });
+  const signed = Buffer.concat([authenticatorData, sha256(clientDataJSON)]);
+  return {
+    id: Buffer.from(passkey.credentialId, "base64").toString("base64url"),
+    authenticatorData: authenticatorData.toString("base64url"),
+    clientDataJSON: clientDataJSON.toString("base64url"),
+    signature: sign(key.asymmetricKeyType === "ed25519" ? null : "sha256", signed, key).toString("base64url"),
+    userHandle: Buffer.from(passkey.userHandle, "base64").toString("base64url")
+  };
+}
+function sha256(data) {
+  return createHash("sha256").update(data).digest();
+}
+
+// src/store.ts
+import { randomUUID } from "node:crypto";
+import { link, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+// src/base64url.ts
+function encode(bytes2) {
+  return btoa(String.fromCharCode(...bytes2)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function decode(text5) {
+  return Uint8Array.from(atob(text5.replaceAll("-", "+").replaceAll("_", "/")), (char) => char.charCodeAt(0));
+}
+
+// src/hpke.ts
+var X25519 = { name: "X25519" };
+var text = new TextEncoder();
+var empty = new Uint8Array();
+var version = text.encode("HPKE-v1");
+var kemSuite = concat(text.encode("KEM"), [0, 32]);
+var hpkeSuite = concat(text.encode("HPKE"), [0, 32, 0, 1, 0, 1]);
+var pkcs8 = [48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32];
+async function generateKeyPair() {
+  const pair = await crypto.subtle.generateKey(X25519, true, ["deriveBits"]);
+  return {
+    publicKey: new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey)),
+    privateKey: new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey)).slice(pkcs8.length)
+  };
+}
+async function seal(publicKey, info3, aad, plaintext) {
+  const ephemeral = await crypto.subtle.generateKey(X25519, true, ["deriveBits"]);
+  const enc = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+  const { key, iv } = await setup(await diffieHellman(ephemeral.privateKey, publicKey), enc, publicKey, info3);
+  return concat(
+    enc,
+    new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: aad }, key, plaintext))
+  );
+}
+async function open(privateKey, info3, aad, sealed) {
+  const recipient = await crypto.subtle.importKey("pkcs8", concat(pkcs8, privateKey), X25519, true, ["deriveBits"]);
+  const { x } = await crypto.subtle.exportKey("jwk", recipient);
+  const enc = sealed.subarray(0, 32);
+  const { key, iv } = await setup(await diffieHellman(recipient, enc), enc, decode(x), info3);
+  return new Uint8Array(
+    await crypto.subtle.decrypt({ name: "AES-GCM", iv, additionalData: aad }, key, sealed.subarray(32))
+  );
+}
+async function diffieHellman(privateKey, publicKey) {
+  const peer = await crypto.subtle.importKey("raw", publicKey, X25519, false, []);
+  return new Uint8Array(await crypto.subtle.deriveBits({ name: "X25519", public: peer }, privateKey, 256));
+}
+async function setup(dh, enc, recipient, info3) {
+  const prk = await labeledExtract(kemSuite, empty, "eae_prk", dh);
+  const sharedSecret = await labeledExpand(kemSuite, prk, "shared_secret", concat(enc, recipient), 32);
+  const context = concat(
+    [0],
+    await labeledExtract(hpkeSuite, empty, "psk_id_hash", empty),
+    await labeledExtract(hpkeSuite, empty, "info_hash", info3)
+  );
+  const secret = await labeledExtract(hpkeSuite, sharedSecret, "secret", empty);
+  const key = await labeledExpand(hpkeSuite, secret, "key", context, 16);
+  return {
+    key: await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["encrypt", "decrypt"]),
+    iv: await labeledExpand(hpkeSuite, secret, "base_nonce", context, 12)
+  };
+}
+function labeledExtract(suite, salt, label, ikm) {
+  return hmac(salt.length ? salt : new Uint8Array(32), concat(version, suite, text.encode(label), ikm));
+}
+async function labeledExpand(suite, prk, label, info3, length) {
+  const block = await hmac(prk, concat([0, length], version, suite, text.encode(label), info3, [1]));
+  return block.slice(0, length);
+}
+async function hmac(key, data) {
+  const hmacKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", hmacKey, data));
+}
+function concat(...parts) {
+  const bytes2 = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    bytes2.set(part, offset);
+    offset += part.length;
+  }
+  return bytes2;
+}
+
+// src/store.ts
+var text2 = new TextEncoder();
+var info = text2.encode("enclave item");
+var extension = ".enclave";
+var Store = class {
+  dir;
+  keys;
+  constructor(dir) {
+    this.dir = dir;
+  }
+  async get(name) {
+    const sealed = await readFile(this.path(name)).catch(missing);
+    if (!sealed) return void 0;
+    const { privateKey } = await this.key();
+    return JSON.parse(new TextDecoder().decode(await open(privateKey, info, text2.encode(name), new Uint8Array(sealed))));
+  }
+  async put(name, item) {
+    const { publicKey } = await this.key();
+    const sealed = await seal(publicKey, info, text2.encode(name), text2.encode(JSON.stringify(item)));
+    const temporary = await this.temporary(sealed);
+    await rename(temporary, this.path(name));
+  }
+  async remove(name) {
+    await rm(this.path(name), { force: true });
+  }
+  async names() {
+    const files = await readdir(join(this.dir, "items")).catch(missing) ?? [];
+    return files.filter((file) => file.endsWith(extension)).map((file) => decodeURIComponent(file.slice(0, -extension.length)));
+  }
+  path(name) {
+    return join(this.dir, "items", encodeURIComponent(name) + extension);
+  }
+  key() {
+    this.keys ??= this.load().catch((error) => {
+      this.keys = void 0;
+      throw error;
+    });
+    return this.keys;
+  }
+  async load() {
+    const path = join(this.dir, "key.json");
+    const saved = await readFile(path, "utf8").catch(missing);
+    if (saved) {
+      const { publicKey: publicKey2, privateKey: privateKey2 } = JSON.parse(saved);
+      return { publicKey: decode(publicKey2), privateKey: decode(privateKey2) };
+    }
+    const { publicKey, privateKey } = await generateKeyPair();
+    const temporary = await this.temporary(
+      JSON.stringify({ publicKey: encode(publicKey), privateKey: encode(privateKey) })
+    );
+    await link(temporary, path).catch((error) => {
+      if (error.code !== "EEXIST") throw error;
+    }).finally(() => rm(temporary));
+    return this.load();
+  }
+  async temporary(data) {
+    const path = join(this.dir, "items", `${randomUUID()}.tmp`);
+    await mkdir(join(this.dir, "items"), { recursive: true, mode: 448 });
+    await writeFile(path, data, { mode: 384 });
+    return path;
+  }
+};
+function missing(error) {
+  if (error.code !== "ENOENT") throw error;
+}
+
 // node_modules/convex/dist/esm/index.js
-var version = "1.46.0";
+var version2 = "1.46.0";
 
 // node_modules/convex/dist/esm/values/base64.js
 var base64_exports = {};
@@ -1908,13 +2112,13 @@ function slowBigIntToBase64(value) {
   }
   let hex = value.toString(16);
   if (hex.length % 2 === 1) hex = "0" + hex;
-  const bytes = new Uint8Array(new ArrayBuffer(8));
+  const bytes2 = new Uint8Array(new ArrayBuffer(8));
   let i = 0;
   for (const hexByte of hex.match(/.{2}/g).reverse()) {
-    bytes.set([parseInt(hexByte, 16)], i++);
+    bytes2.set([parseInt(hexByte, 16)], i++);
     value >>= EIGHT;
   }
-  return fromByteArray(bytes);
+  return fromByteArray(bytes2);
 }
 function slowBase64ToBigInt(encoded) {
   const integerBytes = toByteArray(encoded);
@@ -3866,10 +4070,10 @@ var Long = class _Long {
     return (obj && obj.__isUnsignedLong__) === true;
   }
   // prettier-ignore
-  static fromBytesLE(bytes) {
+  static fromBytesLE(bytes2) {
     return new _Long(
-      bytes[0] | bytes[1] << 8 | bytes[2] << 16 | bytes[3] << 24,
-      bytes[4] | bytes[5] << 8 | bytes[6] << 16 | bytes[7] << 24
+      bytes2[0] | bytes2[1] << 8 | bytes2[2] << 16 | bytes2[3] << 24,
+      bytes2[4] | bytes2[5] << 8 | bytes2[6] << 16 | bytes2[7] << 24
     );
   }
   // prettier-ignore
@@ -5255,7 +5459,7 @@ var BaseConvexClient = class {
     } else {
       throw new Error(`Unknown parent protocol ${protocol}`);
     }
-    const wsUri = `${wsProtocol}://${origin}/api/${version}/sync`;
+    const wsUri = `${wsProtocol}://${origin}/api/${version2}/sync`;
     this.state = new LocalSyncState();
     this.remoteQuerySet = new RemoteQuerySet(
       (queryId) => this.state.queryPath(queryId),
@@ -5867,7 +6071,7 @@ var BaseConvexClient = class {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        "Convex-Client": `npm-${version}`
+        "Convex-Client": `npm-${version2}`
       },
       body: JSON.stringify({ event: "LongWebsocketDisconnect" })
     }).then((response) => {
@@ -6761,9 +6965,9 @@ var require_node_gyp_build = __commonJS2({
       throw new Error("No native build was found for " + target + "\n    loaded from: " + dir + "\n");
       function resolve(dir2) {
         var tuples = readdirSync(path.join(dir2, "prebuilds")).map(parseTuple);
-        var tuple = tuples.filter(matchTuple(platform, arch)).sort(compareTuples)[0];
-        if (!tuple) return;
-        var prebuilds = path.join(dir2, "prebuilds", tuple.name);
+        var tuple2 = tuples.filter(matchTuple(platform, arch)).sort(compareTuples)[0];
+        if (!tuple2) return;
+        var prebuilds = path.join(dir2, "prebuilds", tuple2.name);
         var parsed = readdirSync(prebuilds).map(parseTags);
         var candidates = parsed.filter(matchTags(runtime, abi));
         var winner = candidates.sort(compareTags(runtime))[0];
@@ -6795,10 +6999,10 @@ var require_node_gyp_build = __commonJS2({
       return { name, platform: platform2, architectures };
     }
     function matchTuple(platform2, arch2) {
-      return function(tuple) {
-        if (tuple == null) return false;
-        if (tuple.platform !== platform2) return false;
-        return tuple.architectures.includes(arch2);
+      return function(tuple2) {
+        if (tuple2 == null) return false;
+        if (tuple2.platform !== platform2) return false;
+        return tuple2.architectures.includes(arch2);
       };
     }
     function compareTuples(a, b) {
@@ -10651,8 +10855,8 @@ var ConvexHttpClient = class {
   setAdminAuth(token, actingAsIdentity) {
     this.clearAuth();
     if (actingAsIdentity !== void 0) {
-      const bytes = new TextEncoder().encode(JSON.stringify(actingAsIdentity));
-      const actingAsIdentityEncoded = btoa(String.fromCodePoint(...bytes));
+      const bytes2 = new TextEncoder().encode(JSON.stringify(actingAsIdentity));
+      const actingAsIdentityEncoded = btoa(String.fromCodePoint(...bytes2));
       this.adminAuth = `${token}:${actingAsIdentityEncoded}`;
     } else {
       this.adminAuth = token;
@@ -10715,7 +10919,7 @@ var ConvexHttpClient = class {
     const localFetch = this.fetch || specifiedFetch || fetch;
     const headers = {
       "Content-Type": "application/json",
-      "Convex-Client": `npm-${version}`
+      "Convex-Client": `npm-${version2}`
     };
     const response = await localFetch(`${this.address}/api/query_ts`, {
       ...this.fetchOptions,
@@ -10745,7 +10949,7 @@ var ConvexHttpClient = class {
     const args = [convexToJson(queryArgs)];
     const headers = {
       "Content-Type": "application/json",
-      "Convex-Client": `npm-${version}`
+      "Convex-Client": `npm-${version2}`
     };
     if (this.adminAuth) {
       headers["Authorization"] = `Convex ${this.adminAuth}`;
@@ -10800,7 +11004,7 @@ var ConvexHttpClient = class {
     });
     const headers = {
       "Content-Type": "application/json",
-      "Convex-Client": `npm-${version}`
+      "Convex-Client": `npm-${version2}`
     };
     if (this.adminAuth) {
       headers["Authorization"] = `Convex ${this.adminAuth}`;
@@ -10897,7 +11101,7 @@ var ConvexHttpClient = class {
     });
     const headers = {
       "Content-Type": "application/json",
-      "Convex-Client": `npm-${version}`
+      "Convex-Client": `npm-${version2}`
     };
     if (this.adminAuth) {
       headers["Authorization"] = `Convex ${this.adminAuth}`;
@@ -10956,7 +11160,7 @@ var ConvexHttpClient = class {
     });
     const headers = {
       "Content-Type": "application/json",
-      "Convex-Client": `npm-${version}`
+      "Convex-Client": `npm-${version2}`
     };
     if (this.adminAuth) {
       headers["Authorization"] = `Convex ${this.adminAuth}`;
@@ -11330,123 +11534,16 @@ var _systemSchema = defineSchema({
 });
 
 // src/vault.ts
-import { watch } from "node:fs";
-import { mkdir as mkdir2, readdir as readdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { mkdir as mkdir2, readdir as readdir2, readFile as readFile2, rename as rename2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 
-// src/base64url.ts
-function encode(bytes) {
-  return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
-function decode(text4) {
-  return Uint8Array.from(atob(text4.replaceAll("-", "+").replaceAll("_", "/")), (char) => char.charCodeAt(0));
-}
-
-// src/hpke.ts
-var X25519 = { name: "X25519" };
-var text = new TextEncoder();
-var empty = new Uint8Array();
-var version2 = text.encode("HPKE-v1");
-var kemSuite = concat(text.encode("KEM"), [0, 32]);
-var hpkeSuite = concat(text.encode("HPKE"), [0, 32, 0, 1, 0, 1]);
-var pkcs8 = [48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32];
-async function generateKeyPair() {
-  const pair = await crypto.subtle.generateKey(X25519, true, ["deriveBits"]);
-  return {
-    publicKey: new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey)),
-    privateKey: new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey)).slice(pkcs8.length)
-  };
-}
-async function seal(publicKey, info3, aad, plaintext) {
-  const ephemeral = await crypto.subtle.generateKey(X25519, true, ["deriveBits"]);
-  const enc = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
-  const { key, iv } = await setup(await diffieHellman(ephemeral.privateKey, publicKey), enc, publicKey, info3);
-  return concat(enc, new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: aad }, key, plaintext)));
-}
-async function open(privateKey, info3, aad, sealed) {
-  const recipient = await crypto.subtle.importKey("pkcs8", concat(pkcs8, privateKey), X25519, true, ["deriveBits"]);
-  const { x } = await crypto.subtle.exportKey("jwk", recipient);
-  const enc = sealed.subarray(0, 32);
-  const { key, iv } = await setup(await diffieHellman(recipient, enc), enc, decode(x), info3);
-  return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv, additionalData: aad }, key, sealed.subarray(32)));
-}
-async function diffieHellman(privateKey, publicKey) {
-  const peer = await crypto.subtle.importKey("raw", publicKey, X25519, false, []);
-  return new Uint8Array(await crypto.subtle.deriveBits({ name: "X25519", public: peer }, privateKey, 256));
-}
-async function setup(dh, enc, recipient, info3) {
-  const prk = await labeledExtract(kemSuite, empty, "eae_prk", dh);
-  const sharedSecret = await labeledExpand(kemSuite, prk, "shared_secret", concat(enc, recipient), 32);
-  const context = concat(
-    [0],
-    await labeledExtract(hpkeSuite, empty, "psk_id_hash", empty),
-    await labeledExtract(hpkeSuite, empty, "info_hash", info3)
-  );
-  const secret = await labeledExtract(hpkeSuite, sharedSecret, "secret", empty);
-  const key = await labeledExpand(hpkeSuite, secret, "key", context, 16);
-  return {
-    key: await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["encrypt", "decrypt"]),
-    iv: await labeledExpand(hpkeSuite, secret, "base_nonce", context, 12)
-  };
-}
-function labeledExtract(suite, salt, label, ikm) {
-  return hmac(salt.length ? salt : new Uint8Array(32), concat(version2, suite, text.encode(label), ikm));
-}
-async function labeledExpand(suite, prk, label, info3, length) {
-  const block = await hmac(prk, concat([0, length], version2, suite, text.encode(label), info3, [1]));
-  return block.slice(0, length);
-}
-async function hmac(key, data) {
-  const hmacKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  return new Uint8Array(await crypto.subtle.sign("HMAC", hmacKey, data));
-}
-function concat(...parts) {
-  const bytes = new Uint8Array(parts.reduce((length, part) => length + part.length, 0));
-  let offset = 0;
-  for (const part of parts) {
-    bytes.set(part, offset);
-    offset += part.length;
-  }
-  return bytes;
-}
-
 // src/answer.ts
-var text2 = new TextEncoder();
-var info = text2.encode("enclave answer");
+var text3 = new TextEncoder();
+var info2 = text3.encode("enclave answer");
 async function openAnswer(privateKey, name, sealed) {
-  return JSON.parse(new TextDecoder().decode(await open(privateKey, info, text2.encode(name), sealed)));
-}
-
-// src/passkey.ts
-import { createHash, createPrivateKey, sign } from "node:crypto";
-var userPresentVerifiedAndSynced = 1 | 4 | 8 | 16;
-function relyingParty({ origin, rpId }) {
-  const host = new URL(origin).hostname;
-  const id = rpId ?? host;
-  if (host !== id && !host.endsWith(`.${id}`)) throw new Error(`${origin} can't use passkeys for ${id}`);
-  return id;
-}
-function accepts(passkey, request) {
-  const credentialId = Buffer.from(passkey.credentialId, "base64").toString("base64url");
-  return passkey.rpId === relyingParty(request) && (!request.allowCredentials?.length || request.allowCredentials.includes(credentialId));
-}
-function signAssertion(passkey, request) {
-  const rpId = relyingParty(request);
-  const clientDataJSON = Buffer.from(JSON.stringify({ type: "webauthn.get", challenge: request.challenge, origin: request.origin, crossOrigin: false }));
-  const authenticatorData = Buffer.concat([sha256(Buffer.from(rpId)), Buffer.from([userPresentVerifiedAndSynced]), Buffer.alloc(4)]);
-  const key = createPrivateKey({ key: Buffer.from(passkey.privateKey, "base64"), format: "der", type: "pkcs8" });
-  const signed = Buffer.concat([authenticatorData, sha256(clientDataJSON)]);
-  return {
-    id: Buffer.from(passkey.credentialId, "base64").toString("base64url"),
-    authenticatorData: authenticatorData.toString("base64url"),
-    clientDataJSON: clientDataJSON.toString("base64url"),
-    signature: sign(key.asymmetricKeyType === "ed25519" ? null : "sha256", signed, key).toString("base64url"),
-    userHandle: Buffer.from(passkey.userHandle, "base64").toString("base64url")
-  };
-}
-function sha256(data) {
-  return createHash("sha256").update(data).digest();
+  return JSON.parse(new TextDecoder().decode(await open(privateKey, info2, text3.encode(name), sealed)));
 }
 
 // src/proton.ts
@@ -11454,66 +11551,93 @@ var import_msgpack = __toESM(require_dist(), 1);
 import { execFile } from "node:child_process";
 import { createPrivateKey as createPrivateKey2 } from "node:crypto";
 import { promisify } from "node:util";
-var renamed = { totp_uri: "totp" };
+var bytes = array(number());
+var text4 = string().min(1);
+var lines = array(unknown()).transform((values) => values.flatMap((value) => text4.safeParse(value).data ?? []).join("\n"));
+var section = record(string(), unknown());
+var passkeys = array(object({ content: bytes }));
+var protonItem = object({
+  title: string(),
+  content: record(string(), unknown()),
+  note: string().nullish(),
+  extra_fields: array(object({ name: string(), content: record(string(), unknown()) })).nullish()
+});
+var vaultList = object({ vaults: array(object({ name: string() })) });
+var itemList = object({ items: array(object({ id: string(), share_id: string(), content: protonItem })) });
+var sealedPasskey = object({ v: number(), c: bytes });
+var passkeyData = object({
+  rid: string(),
+  cid: bytes,
+  uhd: bytes.optional(),
+  un: string().optional(),
+  key: object({
+    kty: object({ c: _enum(["EC2", "OKP"]) }),
+    par: array(tuple([object({ c: number() }), object({ c: unknown() })]))
+  })
+});
+var renamed = /* @__PURE__ */ new Map([["totp_uri", "totp"]]);
 var run = promisify(execFile);
-async function* readProton(vaultName, passCli = process.env.ENCLAVE_PASS_CLI ?? "pass-cli") {
-  const pass = async (args, attempts = 6) => {
-    for (let attempt = 1; ; attempt++) {
-      try {
-        return JSON.parse((await run(passCli, args, { maxBuffer: 256 << 20 })).stdout);
-      } catch (error) {
-        if (attempt >= attempts) throw error;
-        await new Promise((resolve) => setTimeout(resolve, 2 ** attempt * 1e3));
-      }
+async function pass(args) {
+  const { stdout } = await run(process.env.ENCLAVE_PASS_CLI ?? "pass-cli", args, { maxBuffer: 256 << 20 }).catch(
+    (error) => {
+      throw new Error(
+        `pass-cli ${args.slice(0, 2).join(" ")} failed (is it signed in? pass-cli info): ${String(error.stderr || error.message).trim()}`
+      );
     }
-  };
-  const list = (flags = [], attempts) => pass(["item", "list", `--vault-name=${vaultName}`, "--filter-state=active", "--output=json", ...flags], attempts);
-  const full = await list(["--show-secrets"], 1).catch(() => void 0);
-  if (full) return yield* full.items.map((item) => item.content);
-  const { items } = await list();
-  for (const { id, share_id } of items)
-    yield (await pass(["item", "view", `--share-id=${share_id}`, `--item-id=${id}`, "--output=json"])).item.content;
+  );
+  return JSON.parse(stdout);
+}
+async function protonVaults() {
+  return vaultList.parse(await pass(["vault", "list", "--output=json"])).vaults.map((vault2) => vault2.name);
+}
+async function readProton(vault2) {
+  const { items } = itemList.parse(
+    await pass(["item", "list", `--vault-name=${vault2}`, "--filter-state=active", "--output=json", "--show-secrets"])
+  );
+  return items.map((item) => ({ id: `${item.share_id}/${item.id}`, vault: vault2, content: item.content }));
 }
 function* toItems(proton, items = /* @__PURE__ */ new Map()) {
   for (const entry of proton) {
     const item = toItem(entry);
     if (!Object.keys(item).length) continue;
     const who = item.email ?? item.username;
-    let name = entry.title.trim() || "Untitled";
-    if (items.has(name) && who) name = `${name} (${who})`;
-    for (let n = 2; items.has(name); n++) name = `${entry.title} (${n})`;
+    const title = entry.title.trim() || "Untitled";
+    let name = title;
+    if (items.has(name) && who) name = `${title} (${who})`;
+    for (let n = 2; items.has(name); n++) name = `${title} (${n})`;
     items.set(name, item);
-    yield [name, item];
+    yield [name, item, entry];
   }
 }
-function toItem({ content, note, extra_fields = [] }) {
+function toItem({ content, note, extra_fields }) {
   const item = {};
   const add = (field, value) => {
-    if (typeof value !== "string" || !value) return;
+    if (!value) return;
     let name = field;
     for (let n = 2; name in item; n++) name = `${field} ${n}`;
     item[name] = value;
   };
   for (const fields of Object.values(content)) {
-    if (!fields || typeof fields !== "object") continue;
-    for (const [field, value] of Object.entries(fields)) {
-      if (field === "passkeys") for (const passkey of value) add("passkey", JSON.stringify(readPasskey(passkey.content)));
-      else if (Array.isArray(value)) add(field, value.filter((line) => typeof line === "string").join("\n"));
-      else add(renamed[field] ?? field, value);
+    for (const [field, value] of Object.entries(section.safeParse(fields).data ?? {})) {
+      if (field === "passkeys")
+        for (const passkey of passkeys.parse(value)) add("passkey", JSON.stringify(readPasskey(passkey.content)));
+      else add(renamed.get(field) ?? field, union([text4, lines]).safeParse(value).data);
     }
   }
-  for (const extra of extra_fields) add(extra.name.toLowerCase(), Object.values(extra.content)[0]);
-  add("note", note);
+  for (const extra of extra_fields ?? []) {
+    const [kind, value] = Object.entries(extra.content)[0] ?? [];
+    add(kind === "Totp" ? "totp" : extra.name.toLowerCase(), text4.safeParse(value).data);
+  }
+  add("note", note ?? void 0);
   return item;
 }
 function readPasskey(content) {
-  const outer = (0, import_msgpack.decode)(Uint8Array.from(content));
+  const outer = sealedPasskey.parse((0, import_msgpack.decode)(Uint8Array.from(content)));
   if (outer.v !== 1) throw new Error(`unknown Proton passkey format ${outer.v}`);
-  const passkey = (0, import_msgpack.decode)(Uint8Array.from(outer.c));
-  const key = passkey.key;
-  const parameters = new Map(key.par.map(([label, value]) => [label.c, value.c]));
-  const bytes = (label) => Buffer.from(parameters.get(label)).toString("base64url");
-  const jwk = key.kty.c === "EC2" ? { kty: "EC", crv: "P-256", x: bytes(-2), y: bytes(-3), d: bytes(-4) } : { kty: "OKP", crv: "Ed25519", x: bytes(-2), d: bytes(-4) };
+  const passkey = passkeyData.parse((0, import_msgpack.decode)(Uint8Array.from(outer.c)));
+  const parameters = new Map(passkey.key.par.map(([label, value]) => [label.c, value.c]));
+  const parameter = (label) => Buffer.from(bytes.parse(parameters.get(label))).toString("base64url");
+  const jwk = passkey.key.kty.c === "EC2" ? { kty: "EC", crv: "P-256", x: parameter(-2), y: parameter(-3), d: parameter(-4) } : { kty: "OKP", crv: "Ed25519", x: parameter(-2), d: parameter(-4) };
   return {
     rpId: passkey.rid,
     credentialId: Buffer.from(passkey.cid).toString("base64"),
@@ -11546,16 +11670,16 @@ async function runWithSecrets(command, secrets, stdio = terminal) {
 function redact(secrets) {
   const hidden = Object.entries(secrets).filter(([, value]) => value).sort(([, a], [, b]) => b.length - a.length);
   const held = Math.max(0, ...hidden.map(([, value]) => value.length - 1));
-  const hide = (text4) => hidden.reduce((text5, [name, value]) => text5.replaceAll(value, `[hidden ${name}]`), text4);
+  const hide = (text5) => hidden.reduce((text6, [name, value]) => text6.replaceAll(value, `[hidden ${name}]`), text5);
   const decoder = new StringDecoder("utf8");
   let tail = "";
   return new Transform({
     transform(chunk, _encoding, done) {
-      const text4 = hide(tail + decoder.write(chunk));
-      const end = Math.max(0, text4.length - held);
-      const split = isHighSurrogate(text4.charCodeAt(end - 1)) ? end - 1 : end;
-      tail = text4.slice(split);
-      done(null, text4.slice(0, split));
+      const text5 = hide(tail + decoder.write(chunk));
+      const end = Math.max(0, text5.length - held);
+      const split = isHighSurrogate(text5.charCodeAt(end - 1)) ? end - 1 : end;
+      tail = text5.slice(split);
+      done(null, text5.slice(0, split));
     },
     flush(done) {
       done(null, hide(tail + decoder.end()));
@@ -11566,65 +11690,6 @@ function isHighSurrogate(code2) {
   return code2 >= 55296 && code2 <= 56319;
 }
 
-// src/store.ts
-import { randomUUID } from "node:crypto";
-import { link, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-var text3 = new TextEncoder();
-var info2 = text3.encode("enclave item");
-var extension = ".enclave";
-var Store = class {
-  dir;
-  constructor(dir) {
-    this.dir = dir;
-  }
-  async get(name) {
-    const sealed = await readFile(this.path(name)).catch(missing);
-    if (!sealed) return void 0;
-    const { privateKey } = await this.key();
-    return JSON.parse(new TextDecoder().decode(await open(privateKey, info2, text3.encode(name), new Uint8Array(sealed))));
-  }
-  async put(name, item) {
-    const { publicKey } = await this.key();
-    const sealed = await seal(publicKey, info2, text3.encode(name), text3.encode(JSON.stringify(item)));
-    const temporary = await this.temporary(sealed);
-    await rename(temporary, this.path(name));
-  }
-  async remove(name) {
-    await rm(this.path(name), { force: true });
-  }
-  async names() {
-    const files = await readdir(join(this.dir, "items")).catch(missing) ?? [];
-    return files.filter((file) => file.endsWith(extension)).map((file) => decodeURIComponent(file.slice(0, -extension.length)));
-  }
-  path(name) {
-    return join(this.dir, "items", encodeURIComponent(name) + extension);
-  }
-  async key() {
-    const path = join(this.dir, "key.json");
-    const saved = await readFile(path, "utf8").catch(missing);
-    if (saved) {
-      const { publicKey: publicKey2, privateKey: privateKey2 } = JSON.parse(saved);
-      return { publicKey: decode(publicKey2), privateKey: decode(privateKey2) };
-    }
-    const { publicKey, privateKey } = await generateKeyPair();
-    const temporary = await this.temporary(JSON.stringify({ publicKey: encode(publicKey), privateKey: encode(privateKey) }));
-    await link(temporary, path).catch((error) => {
-      if (error.code !== "EEXIST") throw error;
-    }).finally(() => rm(temporary));
-    return this.key();
-  }
-  async temporary(data) {
-    const path = join(this.dir, "items", `${randomUUID()}.tmp`);
-    await mkdir(join(this.dir, "items"), { recursive: true, mode: 448 });
-    await writeFile(path, data, { mode: 384 });
-    return path;
-  }
-};
-function missing(error) {
-  if (error.code !== "ENOENT") throw error;
-}
-
 // src/totp.ts
 var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
 async function totp(setupKey, now = Date.now()) {
@@ -11640,21 +11705,21 @@ async function totp(setupKey, now = Date.now()) {
   const code2 = (mac.getUint32(mac.getUint8(mac.byteLength - 1) & 15) & 2147483647) % 10 ** digits;
   return String(code2).padStart(digits, "0");
 }
-function decodeBase32(text4) {
-  const bytes = [];
+function decodeBase32(text5) {
+  const bytes2 = [];
   let value = 0;
   let bits = 0;
-  for (const char of text4.toUpperCase().replace(/[\s=-]/g, "")) {
+  for (const char of text5.toUpperCase().replace(/[\s=-]/g, "")) {
     const index = alphabet.indexOf(char);
     if (index < 0) throw new Error("that 2FA setup key isn't valid");
     value = (value << 5 | index) & 4095;
     bits += 5;
     if (bits >= 8) {
       bits -= 8;
-      bytes.push(value >> bits & 255);
+      bytes2.push(value >> bits & 255);
     }
   }
-  return new Uint8Array(bytes);
+  return new Uint8Array(bytes2);
 }
 
 // src/vault.ts
@@ -11667,102 +11732,169 @@ var requests = {
 function openVault({
   from = process.env.ENCLAVE_FROM,
   home = process.env.ENCLAVE_HOME ?? join2(homedir(), ".enclave"),
-  relay = process.env.ENCLAVE_RELAY ?? hostedRelay
+  relay = process.env.ENCLAVE_RELAY ?? hostedRelay,
+  store = new Store(home)
 } = {}) {
-  const store = new Store(home);
   const pendingPath = (name) => join2(home, "pending", `${encodeURIComponent(name)}.json`);
   async function readPending(name) {
     const json = await readFile2(pendingPath(name), "utf8").catch(() => void 0);
     return json ? JSON.parse(json) : void 0;
   }
   async function ask(name, fields = ["password"]) {
+    if (!fields.length || fields.some((field) => !field.trim()) || new Set(fields).size < fields.length)
+      throw new Error("ask for at least one field, each with its own name");
     const token = encode(crypto.getRandomValues(new Uint8Array(32)));
     const { publicKey, privateKey } = await generateKeyPair();
     const url = await new ConvexHttpClient(relay, { logger: false }).mutation(requests.open, { token });
     const previous = await readPending(name);
-    if (previous) await new ConvexHttpClient(previous.relay, { logger: false }).mutation(requests.close, { token: previous.token }).catch(() => void 0);
+    if (previous)
+      await new ConvexHttpClient(previous.relay, { logger: false }).mutation(requests.close, { token: previous.token }).catch(() => void 0);
+    const pending = { relay, token, privateKey: encode(privateKey), fields };
     await mkdir2(join2(home, "pending"), { recursive: true, mode: 448 });
-    await writeFile2(pendingPath(name), JSON.stringify({ relay, token, privateKey: encode(privateKey), fields }), { mode: 384 });
+    const temporary = `${pendingPath(name)}.${randomUUID2()}`;
+    await writeFile2(temporary, JSON.stringify(pending), { mode: 384 });
+    await rename2(temporary, pendingPath(name));
     const fragment = new URLSearchParams([
       ...from ? [["from", from]] : [],
       ["name", name],
       ...fields.map((field) => ["field", field]),
       ["key", encode(publicKey)]
     ]);
-    return { url: `${url}#${fragment}`, wait: () => wait(name) };
+    return { url: `${url}#${fragment}`, wait: () => waitFor(name, pending) };
   }
-  async function wait(name) {
+  async function wait(name, signal) {
     const pending = await readPending(name);
     if (!pending) throw new Error(`nothing asked for ${name}`);
+    return waitFor(name, pending, signal);
+  }
+  async function waitFor(name, pending, signal) {
     const client = new ConvexClient(pending.relay, { logger: false });
+    const forget = async () => {
+      const current = await readPending(name);
+      if (current?.token === pending.token) await rm2(pendingPath(name), { force: true });
+      return current && current.token !== pending.token;
+    };
     try {
-      const sealed = await new Promise(
-        (resolve, reject) => client.onUpdate(
+      const sealed = await new Promise((resolve, reject) => {
+        signal?.throwIfAborted();
+        signal?.addEventListener("abort", () => reject(signal.reason));
+        client.onUpdate(
           requests.watch,
           { token: pending.token },
           (request) => {
-            if (!request) reject(new Error(`the link for ${name} expired`));
+            if (!request) resolve(null);
             else if (request.answer) resolve(request.answer);
           },
           reject
-        )
-      );
-      const answer = await openAnswer(decode(pending.privateKey), name, new Uint8Array(sealed));
-      if (!pending.fields.every((field) => typeof answer[field] === "string")) throw new Error(`the answer for ${name} is incomplete`);
+        );
+      });
+      if (!sealed)
+        throw new Error(
+          await forget() ? `a newer link for ${name} replaced this one` : `the link for ${name} expired`
+        );
+      const answer = record(string(), string()).safeParse(await openAnswer(decode(pending.privateKey), name, new Uint8Array(sealed))).data;
+      if (!answer || !pending.fields.every((field) => field in answer))
+        throw new Error(`the answer for ${name} is incomplete`);
       const update = Object.fromEntries(pending.fields.map((field) => [field, answer[field]]));
       await store.put(name, { ...await store.get(name), ...update });
+      await client.mutation(requests.close, { token: pending.token }).catch(() => void 0);
+      await forget();
       return pending.fields;
     } finally {
-      await client.mutation(requests.close, { token: pending.token });
       await client.close();
-      await rm2(pendingPath(name), { force: true });
     }
   }
-  async function get(name, field) {
+  async function read(name, field) {
     const value = (await store.get(name))?.[field];
     if (value === void 0) throw new Error(`no ${field} saved for ${name}`);
-    return field === "totp" ? totp(value) : value;
-  }
-  async function list() {
-    const names = await store.names();
-    return Promise.all(names.map(async (name) => ({ name, fields: Object.keys(await store.get(name) ?? {}) })));
+    return value;
   }
-  async function importProton(vaultName) {
-    const items = /* @__PURE__ */ new Map();
-    for await (const entry of readProton(vaultName)) for (const [name, item] of toItems([entry], items)) await store.put(name, item);
-    return items;
+  async function get(name, field) {
+    const kind = field.match(/^(totp|passkey)( \d+)?$/)?.[1];
+    if (kind === "passkey")
+      throw new Error(`${name}'s ${field} stays in the vault: sign in with it through \`enclave passkey\``);
+    const value = await read(name, field);
+    return kind === "totp" ? totp(value) : value;
+  }
+  async function list(search) {
+    const term = search?.toLowerCase();
+    const items = await Promise.all(
+      (await store.names()).map(async (name) => ({ name, item: await store.get(name) ?? {} }))
+    );
+    return items.filter(
+      ({ name, item }) => !term || name.toLowerCase().includes(term) || sites(item).some((site) => site.includes(term))
+    ).map(({ name, item }) => ({ name, fields: Object.keys(item) }));
+  }
+  async function importProton(vaults = []) {
+    const manifest = join2(home, "proton.json");
+    const saved = await readFile2(manifest, "utf8").catch(() => void 0);
+    const before = saved ? JSON.parse(saved) : {};
+    const read2 = vaults.length ? vaults : await protonVaults();
+    const entries = (await Promise.all(read2.map(readProton))).flat();
+    const protonNames = new Set(Object.values(before).map(({ name }) => name));
+    const taken = new Map(
+      saved ? (await store.names()).filter((name) => !protonNames.has(name)).map((name) => [name, true]) : []
+    );
+    const after = {};
+    const fresh = [];
+    for (const entry of entries) {
+      const name = before[entry.id]?.name;
+      const title = entry.content.title.trim() || "Untitled";
+      if (name && (name === title || name.startsWith(`${title} (`)) && !taken.has(name) && Object.keys(toItem(entry.content)).length) {
+        after[entry.id] = { name, vault: entry.vault };
+        taken.set(name, true);
+      } else fresh.push(entry);
+    }
+    const byContent = new Map(fresh.map((entry) => [entry.content, entry]));
+    for (const [name, , content] of toItems(
+      fresh.map((entry) => entry.content),
+      taken
+    ))
+      after[byContent.get(content).id] = { name, vault: byContent.get(content).vault };
+    const imported = new Map(
+      entries.filter((entry) => after[entry.id]).map((entry) => [after[entry.id].name, toItem(entry.content)])
+    );
+    for (const [name, item] of imported) await store.put(name, item);
+    const removed = Object.values(before).filter(({ name, vault: vault2 }) => read2.includes(vault2) && !imported.has(name)).map(({ name }) => name);
+    for (const name of removed) await store.remove(name);
+    const kept = Object.fromEntries(Object.entries(before).filter(([, { vault: vault2 }]) => !read2.includes(vault2)));
+    const temporary = `${manifest}.${randomUUID2()}`;
+    await writeFile2(temporary, JSON.stringify({ ...kept, ...after }), { mode: 384 });
+    await rename2(temporary, manifest);
+    return { items: [...imported].map(([name, item]) => ({ name, fields: Object.keys(item) })), removed };
   }
   const armed = join2(home, "armed");
   async function passkey(name, field = "passkey", timeout = 3e5) {
-    await get(name, field);
+    await read(name, field);
     await mkdir2(armed, { recursive: true, mode: 448 });
-    const path = join2(armed, `${encodeURIComponent(name)}.json`);
-    await writeFile2(path, JSON.stringify({ name, field, until: Date.now() + timeout }), { mode: 384 });
-    const signedIn = new Promise((resolve, reject) => {
-      const watcher = watch(armed, () => readFile2(path).catch(() => done()));
-      const timer = setTimeout(() => done(new Error(`nobody signed in with ${name}'s passkey in time`)), timeout);
-      const done = (error) => {
-        watcher.close();
-        clearTimeout(timer);
-        if (error) rm2(path, { force: true }).then(() => reject(error));
-        else resolve();
-      };
+    await writeFile2(join2(armed, `${randomUUID2()}.json`), JSON.stringify({ name, field, until: Date.now() + timeout }), {
+      mode: 384
     });
-    signedIn.catch(() => void 0);
-    return { signedIn };
   }
   async function sign2(request) {
-    for (const file of await readdir2(armed).catch(() => [])) {
+    for (const file of (await readdir2(armed).catch(() => [])).filter((file2) => file2.endsWith(".json"))) {
       const path = join2(armed, file);
-      const { name, field, until } = JSON.parse(await readFile2(path, "utf8").catch(() => "{}"));
-      if (!name || until < Date.now()) continue;
-      const key = JSON.parse(await get(name, field));
+      const arm = JSON.parse(await readFile2(path, "utf8").catch(() => "{}"));
+      if (!arm.name) continue;
+      if (arm.until < Date.now()) {
+        await rm2(path, { force: true });
+        continue;
+      }
+      const key = JSON.parse(await read(arm.name, arm.field));
       if (!accepts(key, request)) continue;
-      await rm2(path, { force: true });
+      const claimed = await rename2(path, `${path}.used`).then(
+        () => true,
+        () => false
+      );
+      if (!claimed) continue;
+      await rm2(`${path}.used`, { force: true });
       return signAssertion(key, request);
     }
     throw new Error(`no passkey is ready for ${request.rpId ?? new URL(request.origin).hostname}`);
   }
+  async function save(name, field, value) {
+    await store.put(name, { ...await store.get(name), [field]: value });
+  }
   async function remove(name) {
     await store.remove(name);
   }
@@ -11776,11 +11908,16 @@ function openVault({
     );
     return runWithSecrets(command, Object.fromEntries(values), stdio);
   }
-  return { ask, wait, get, list, remove, run: run2, importProton, passkey, sign: sign2 };
+  return { ask, wait, get, save, list, remove, run: run2, importProton, passkey, sign: sign2 };
 }
 var vault = openVault();
+function sites(item) {
+  return Object.entries(item).filter(([field]) => /^(urls?|website|original login uri)( \d+)?$/.test(field)).flatMap(([, value]) => value.toLowerCase().split(/\s+/));
+}
 
 export {
+  signRequest,
+  Store,
   openVault,
   vault
 };