skillwiki 0.10.16 → 0.10.18

package/dist/{chunk-OWPQJOFG.js → chunk-GNS2ZV5P.js}

@@ -3,8 +3,9 @@ import {
   ExitCode,
   FleetManifestSchema,
   err,
+  isVaultSyncKey,
   ok
-} from "./chunk-C5OLZRRM.js";
+} from "./chunk-Y6KRDGI2.js";
 
 // src/utils/dotenv.ts
 import { readFile, writeFile, mkdir } from "fs/promises";
@@ -40,7 +41,7 @@ function parseDotenvText(text) {
     if (eq <= 0) continue;
     const key = line.slice(0, eq).trim();
     const value = line.slice(eq + 1).trim();
-    if (!_whitelist.has(key) && !isValidWikiProfileKey(key)) continue;
+    if (!_whitelist.has(key) && !isValidWikiProfileKey(key) && !isVaultSyncKey(key)) continue;
     if (value.length === 0) continue;
     out[key] = value;
   }
@@ -866,6 +867,45 @@ async function runVaultSyncPullHelper(input) {
   });
 }
 
+// src/utils/snapshot-worktree.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { join as join4, resolve } from "path";
+function readSkillWikiConfig(path) {
+  try {
+    return parseDotenvText(readFileSync2(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function readSnapshotProfile(path) {
+  const allowed = /* @__PURE__ */ new Set(["WIKI_GIT_WORKTREE", "SNAPSHOT_WORKTREE", "GIT_DIR"]);
+  const profile = {};
+  try {
+    for (const rawLine of readFileSync2(path, "utf8").split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (line.length === 0 || line.startsWith("#")) continue;
+      const eq = line.indexOf("=");
+      if (eq <= 0) continue;
+      const key = line.slice(0, eq).trim();
+      const value = line.slice(eq + 1).trim();
+      if (allowed.has(key) && value.length > 0) profile[key] = value;
+    }
+  } catch {
+  }
+  return profile;
+}
+function resolveConfiguredSnapshotWorktree(home) {
+  if (!home) return void 0;
+  const config = readSkillWikiConfig(join4(home, ".skillwiki", ".env"));
+  const explicit = config["vault_sync.snapshot_worktree"];
+  if (explicit) return resolve(explicit);
+  const snapshotProfile = config["vault_sync.snapshot_profile"];
+  if (!snapshotProfile) return void 0;
+  const profile = readSnapshotProfile(resolve(snapshotProfile));
+  const fromProfile = profile.WIKI_GIT_WORKTREE ?? profile.SNAPSHOT_WORKTREE ?? profile.GIT_DIR;
+  return fromProfile ? resolve(fromProfile) : void 0;
+}
+
 export {
   CONFIG_KEYS,
   isValidWikiProfileKey,
@@ -896,5 +936,6 @@ export {
   markJournalSuperseded,
   supersedeStaleReviewRequiredJournals,
   resolveVaultSyncPullHelper,
-  runVaultSyncPullHelper
+  runVaultSyncPullHelper,
+  resolveConfiguredSnapshotWorktree
 };

package/dist/{chunk-24MVNAFJ.js → chunk-IAPD6YTC.js}

@@ -19,7 +19,7 @@ import {
   splitFrontmatter,
   vaultIoConcurrency,
   writeRootIndexProjection
-} from "./chunk-NMUYMNNB.js";
+} from "./chunk-IGCW3DR2.js";
 import {
   CONFIG_KEYS,
   git,
@@ -29,11 +29,12 @@ import {
   parseDotenvFile,
   parseDotenvText,
   profileKey,
+  resolveConfiguredSnapshotWorktree,
   resolveVaultSyncPullHelper,
   satelliteGateFromFleetLoad,
   snapshotterAliasForLocalHost,
   writeDotenv
-} from "./chunk-OWPQJOFG.js";
+} from "./chunk-GNS2ZV5P.js";
 import {
   CompoundSchema,
   ExitCode,
@@ -44,8 +45,11 @@ import {
   detectSchema,
   err,
   getErrorMessage,
-  ok
-} from "./chunk-C5OLZRRM.js";
+  isVaultSyncKey,
+  ok,
+  parseVaultSyncKeyValue,
+  systemdPropertyFor
+} from "./chunk-Y6KRDGI2.js";
 
 // src/commands/log-append.ts
 import { readFile as readFile2, stat } from "fs/promises";
@@ -4774,7 +4778,7 @@ import { readFile as readFile15 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
 import { join as join19 } from "path";
 function validateKey(key) {
-  return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key);
+  return CONFIG_KEYS.includes(key) || isValidWikiProfileKey(key) || isVaultSyncKey(key);
 }
 function configPath(home) {
   return join19(home, ".skillwiki", ".env");
@@ -4791,6 +4795,12 @@ async function runConfigSet(input) {
   if (!validateKey(input.key)) {
     return { exitCode: ExitCode.INVALID_CONFIG_KEY, result: err("INVALID_CONFIG_KEY", { key: input.key }) };
   }
+  if (isVaultSyncKey(input.key)) {
+    const parsed = parseVaultSyncKeyValue(input.key, input.value);
+    if (!parsed.ok) {
+      return { exitCode: ExitCode.INVALID_CONFIG_VALUE, result: err("INVALID_CONFIG_VALUE", { key: input.key, value: input.value, message: parsed.message }) };
+    }
+  }
   const filePath = configPath(input.home);
   try {
     let originalContent;
@@ -6473,8 +6483,6 @@ function readVaultSyncConfig(home) {
     let role;
     let serviceScope;
     let snapshotScript;
-    let snapshotProfile;
-    let snapshotWorktree;
     for (const line of content.split(/\r?\n/)) {
       const trimmed = line.trim();
       if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
@@ -6487,58 +6495,18 @@ function readVaultSyncConfig(home) {
       if (k === "vault_sync.role") role = v;
       if (k === "vault_sync.service_scope") serviceScope = v;
       if (k === "vault_sync.snapshot_script") snapshotScript = v;
-      if (k === "vault_sync.snapshot_profile") snapshotProfile = v;
-      if (k === "vault_sync.snapshot_worktree") snapshotWorktree = v;
     }
-    return { installed, role, serviceScope, snapshotScript, snapshotProfile, snapshotWorktree };
+    return { installed, role, serviceScope, snapshotScript };
   } catch {
     return { installed: false };
   }
 }
-function readKeyFromEnvFile(path, keys) {
-  try {
-    const content = readFileSync10(path, "utf8");
-    for (const line of content.split(/\r?\n/)) {
-      const trimmed = line.trim();
-      if (trimmed.length === 0 || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq <= 0) continue;
-      const key = trimmed.slice(0, eq).trim();
-      if (!keys.includes(key)) continue;
-      const value = trimmed.slice(eq + 1).trim();
-      if (value.length > 0) return value;
-    }
-  } catch {
-  }
-  return void 0;
-}
-function resolveSnapshotGitWorktree(config) {
-  if (config.snapshotWorktree) return config.snapshotWorktree;
-  if (config.snapshotProfile) {
-    const fromProfile = readKeyFromEnvFile(config.snapshotProfile, ["WIKI_GIT_WORKTREE", "SNAPSHOT_WORKTREE", "GIT_DIR"]);
-    if (fromProfile) return fromProfile;
-  }
+function resolveSnapshotGitWorktree(home) {
+  const configured = resolveConfiguredSnapshotWorktree(home);
+  if (configured) return configured;
   const defaultPath = "/root/wiki-git";
   return existsSync13(defaultPath) ? defaultPath : void 0;
 }
-var SNAPSHOT_SEMANTIC_TO_SYSTEMD = {
-  load_state: "LoadState",
-  unit_file_state: "UnitFileState",
-  active_state: "ActiveState",
-  sub_state: "SubState",
-  next_elapse: "NextElapseUSecRealtime",
-  result: "Result",
-  exec_main_status: "ExecMainStatus",
-  exec_main_code: "ExecMainCode",
-  active_enter_timestamp: "ActiveEnterTimestamp",
-  inactive_enter_timestamp: "InactiveEnterTimestamp",
-  exec_main_start_timestamp: "ExecMainStartTimestamp",
-  exec_main_exit_timestamp: "ExecMainExitTimestamp",
-  invocation_id: "InvocationID"
-};
-function semanticToSystemdProp(semantic) {
-  return SNAPSHOT_SEMANTIC_TO_SYSTEMD[semantic];
-}
 function normalizeSystemdValue(raw) {
   if (raw == null) return void 0;
   const v = raw.trim();
@@ -6577,7 +6545,7 @@ function snapshotProp(kind, prop, fixture, scope) {
     return v == null ? void 0 : String(v);
   }
   const unit = kind === "timer" ? "wiki-snapshot.timer" : "wiki-snapshot.service";
-  const liveProp = semanticToSystemdProp(prop);
+  const liveProp = systemdPropertyFor(prop);
   if (!liveProp) return void 0;
   return systemctlShowProperty(scope, unit, liveProp);
 }
@@ -6594,7 +6562,8 @@ function snapshotterHealthChecks(scope, logDir, env) {
   const fixture = loadSnapshotFixture(env);
   const cadence = fixture ? fixture.cadence_minutes : parseInt(env.VS_SNAPSHOT_CADENCE_MINUTES ?? "30", 10) || 30;
   const timeout = fixture ? fixture.service_timeout_seconds : parseInt(env.VS_SNAPSHOT_SERVICE_TIMEOUT_SECONDS ?? "900", 10) || 900;
-  const nowMs = fixture ? Date.parse(fixture.now) : Date.now();
+  const injectedNowMs = env.VS_SNAPSHOT_HEALTH_NOW ? Date.parse(env.VS_SNAPSHOT_HEALTH_NOW) : Number.NaN;
+  const nowMs = fixture ? Date.parse(fixture.now) : Number.isFinite(injectedNowMs) ? injectedNowMs : Date.now();
   const warnAge = cadence * 2 + 15;
   const errorAge = cadence * 4 + 15;
   const tUnitfile = snapshotProp("timer", "unit_file_state", fixture, scope);
@@ -6781,7 +6750,7 @@ function vaultSyncChecks(input) {
       execSync2(`launchctl print gui/${uid}/com.karlchow.wiki-push`, {
         encoding: "utf8",
         timeout: 2e3,
-        stdio: ["pipe", "pipe", "pipe"]
+        stdio: ["pipe", "ignore", "ignore"]
       });
       c2 = check(
         "pass",
@@ -7134,7 +7103,7 @@ async function runDoctor(input) {
     checks.push(check("error", "wiki_path_set", "WIKI_PATH configured", "No vault configured. Run `skillwiki init` or pass --vault."));
   }
   const resolvedPath = resolved.ok ? resolved.data.path : void 0;
-  const gitCheckPath = vsConfig.role === "snapshotter" ? resolveSnapshotGitWorktree(vsConfig) ?? resolvedPath : resolvedPath;
+  const gitCheckPath = vsConfig.role === "snapshotter" ? resolveSnapshotGitWorktree(input.home) ?? resolvedPath : resolvedPath;
   checks.push(checkWikiPathExists(resolvedPath));
   checks.push(checkVaultStructure(resolvedPath));
   checks.push(checkObsidianTemplates(resolvedPath));

package/dist/{chunk-NMUYMNNB.js → chunk-IGCW3DR2.js}

@@ -6,7 +6,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-C5OLZRRM.js";
+} from "./chunk-Y6KRDGI2.js";
 
 // src/utils/index-projection.ts
 import { readFile as readFile4 } from "fs/promises";

package/dist/{chunk-UJLSUJB6.js → chunk-QJPCCW4N.js}

@@ -6,17 +6,18 @@ import {
   hasActiveGitSequencer,
   hasUnmergedPaths,
   loadFleetManifestAndHost,
+  resolveConfiguredSnapshotWorktree,
   runVaultSyncPullHelper,
   supersedeStaleReviewRequiredJournals
-} from "./chunk-OWPQJOFG.js";
+} from "./chunk-GNS2ZV5P.js";
 import {
   ExitCode,
   err,
   ok
-} from "./chunk-C5OLZRRM.js";
+} from "./chunk-Y6KRDGI2.js";
 
 // src/utils/managed-write-preflight.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2 } from "fs";
 import { join as join2, resolve } from "path";
 
 // src/utils/managed-write-lock.ts
@@ -149,7 +150,8 @@ function releaseManagedWriteLock(handle) {
 
 // src/utils/managed-write-preflight.ts
 var DEFAULT_DEPS = {
-  converge: (input) => runVaultSyncPullHelper(input)
+  converge: (input) => runVaultSyncPullHelper(input),
+  resolveConfiguredSnapshotWorktree
 };
 function preflightBlocker(vault) {
   const unmerged = hasUnmergedPaths(vault);
@@ -171,19 +173,17 @@ function preflightBlocker(vault) {
   if (op) return { reason: "review-required", operation_id: op };
   return null;
 }
-function fleetManifestBytes(vault) {
-  const path = join2(vault, FLEET_REL_PATH);
-  if (!existsSync2(path)) return null;
-  return readFileSync2(path);
+function hasFleetManifest(vault) {
+  return existsSync2(join2(vault, FLEET_REL_PATH));
 }
 function isGitVault(vault) {
   return Boolean(git(vault, ["rev-parse", "--absolute-git-dir"]));
 }
 async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
-  const vault = input.vault;
-  const convergenceVault = input.convergenceVault && resolve(input.convergenceVault) !== resolve(vault) ? resolve(input.convergenceVault) : void 0;
-  const gitVault = convergenceVault ?? vault;
-  const mutationBlocker = preflightBlocker(vault);
+  const mutationVault = resolve(input.vault);
+  let convergenceVault = input.convergenceVault && resolve(input.convergenceVault) !== mutationVault ? resolve(input.convergenceVault) : void 0;
+  let convergenceSource = convergenceVault ? "explicit" : "single-path";
+  const mutationBlocker = preflightBlocker(mutationVault);
   if (mutationBlocker) {
     return {
       exitCode: ExitCode.PREFLIGHT_FAILED,
@@ -194,46 +194,27 @@ async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
       })
     };
   }
-  if (convergenceVault) {
-    if (!isGitVault(convergenceVault)) {
-      return {
-        exitCode: ExitCode.PREFLIGHT_FAILED,
-        result: err("PREFLIGHT_FAILED", {
-          reason: "convergence-vault-not-git",
-          convergence_vault: convergenceVault
-        })
-      };
-    }
-    const gitBlocker = preflightBlocker(convergenceVault);
-    if (gitBlocker) {
-      return {
-        exitCode: ExitCode.PREFLIGHT_FAILED,
-        result: err("PREFLIGHT_FAILED", {
-          reason: gitBlocker.reason,
-          operation_id: gitBlocker.operation_id,
-          unmerged_paths: gitBlocker.unmerged_paths,
-          convergence_vault: convergenceVault
-        })
-      };
-    }
-  }
   const fleet = await loadFleetManifestAndHost({
-    vault,
+    vault: mutationVault,
     hostId: input.hostId,
     env: input.env,
     home: input.home,
-    osHostname: input.osHostname
+    cwd: input.cwd,
+    osHostname: input.osHostname,
+    user: input.user
   });
-  const dualPathMeta = convergenceVault ? { convergence_vault: convergenceVault } : {};
   if (!fleet) {
-    const head = git(gitVault, ["rev-parse", "HEAD"]) || null;
+    const gitVault2 = isGitVault(mutationVault) ? mutationVault : null;
+    const head = gitVault2 ? git(gitVault2, ["rev-parse", "HEAD"]) || null : null;
     return {
       exitCode: ExitCode.OK,
       result: ok({
         mode: "standalone",
+        mutation_vault: mutationVault,
+        git_vault: gitVault2,
         base_oid: head,
         converged: false,
-        ...dualPathMeta
+        convergence_source: "single-path"
       })
     };
   }
@@ -247,27 +228,6 @@ async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
       })
     };
   }
-  if (convergenceVault && fleetManifestBytes(convergenceVault)) {
-    const convergeFleetCtx = await loadFleetManifestAndHost({
-      vault: convergenceVault,
-      hostId: input.hostId ?? fleet.hostId,
-      env: input.env,
-      home: input.home,
-      osHostname: input.osHostname
-    });
-    if (!convergeFleetCtx || convergeFleetCtx.identityStatus !== "known" || convergeFleetCtx.hostId !== fleet.hostId) {
-      return {
-        exitCode: ExitCode.PREFLIGHT_FAILED,
-        result: err("PREFLIGHT_FAILED", {
-          reason: "convergence-vault-identity-mismatch",
-          host_id: fleet.hostId,
-          convergence_host_id: convergeFleetCtx?.hostId,
-          convergence_identity_status: convergeFleetCtx?.identityStatus,
-          convergence_vault: convergenceVault
-        })
-      };
-    }
-  }
   const host = fleet.manifest.hosts[fleet.hostId];
   if (!host) {
     return {
@@ -282,12 +242,101 @@ async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
       result: ok({
         mode: "immutable-record",
         host_id: fleet.hostId,
+        mutation_vault: mutationVault,
+        git_vault: null,
         base_oid: null,
         converged: false,
-        ...dualPathMeta
+        ...convergenceVault ? { convergence_vault: convergenceVault } : {},
+        convergence_source: convergenceSource
       })
     };
   }
+  if (!convergenceVault && host.role === "snapshotter" && host.protected === true) {
+    const home = input.home ?? input.env?.HOME ?? process.env.HOME ?? "";
+    const configured = (deps.resolveConfiguredSnapshotWorktree ?? resolveConfiguredSnapshotWorktree)(home);
+    if (!configured) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "convergence-vault-not-configured",
+          host_id: fleet.hostId,
+          mutation_vault: mutationVault
+        })
+      };
+    }
+    convergenceVault = resolve(configured);
+    convergenceSource = "configured";
+    if (convergenceVault === mutationVault) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "convergence-vault-not-distinct",
+          host_id: fleet.hostId,
+          mutation_vault: mutationVault,
+          convergence_vault: convergenceVault
+        })
+      };
+    }
+  }
+  const gitVault = convergenceVault ?? mutationVault;
+  if (convergenceVault) {
+    if (!isGitVault(convergenceVault)) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "convergence-vault-not-git",
+          convergence_vault: convergenceVault
+        })
+      };
+    }
+    const convergenceHasFleet = hasFleetManifest(convergenceVault);
+    if (convergenceSource === "configured" && !convergenceHasFleet) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "convergence-vault-fleet-missing",
+          host_id: fleet.hostId,
+          convergence_vault: convergenceVault
+        })
+      };
+    }
+    const gitBlocker = preflightBlocker(convergenceVault);
+    if (gitBlocker) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: gitBlocker.reason,
+          operation_id: gitBlocker.operation_id,
+          unmerged_paths: gitBlocker.unmerged_paths,
+          convergence_vault: convergenceVault
+        })
+      };
+    }
+  }
+  if (convergenceVault && hasFleetManifest(convergenceVault)) {
+    const convergeFleetCtx = await loadFleetManifestAndHost({
+      vault: convergenceVault,
+      hostId: input.hostId ?? fleet.hostId,
+      env: input.env,
+      home: input.home,
+      cwd: input.cwd,
+      osHostname: input.osHostname,
+      user: input.user
+    });
+    if (!convergeFleetCtx || convergeFleetCtx.identityStatus !== "known" || convergeFleetCtx.hostId !== fleet.hostId) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "convergence-vault-identity-mismatch",
+          host_id: fleet.hostId,
+          convergence_host_id: convergeFleetCtx?.hostId,
+          convergence_identity_status: convergeFleetCtx?.identityStatus,
+          convergence_vault: convergenceVault
+        })
+      };
+    }
+  }
+  const dualPathMeta = convergenceVault ? { convergence_vault: convergenceVault } : {};
   const converge = await deps.converge({
     vault: gitVault,
     lockToken: convergenceVault ? void 0 : input.lockToken,
@@ -313,37 +362,51 @@ async function runManagedWritePreflight(input, deps = DEFAULT_DEPS) {
     result: ok({
       mode: "git-writer",
       host_id: fleet.hostId,
+      mutation_vault: mutationVault,
+      git_vault: gitVault,
       base_oid: baseOid,
       converged: true,
       helper_path: converge.data.helper_path,
-      ...dualPathMeta
+      ...dualPathMeta,
+      convergence_source: convergenceSource
     })
   };
 }
 async function runManagedWriteTransaction(input, deps = DEFAULT_DEPS) {
-  const lock = acquireManagedWriteLock(input.vault, input.command);
+  const mutationVault = resolve(input.vault);
+  const lock = acquireManagedWriteLock(mutationVault, input.command);
   if (!lock.ok) {
     return { exitCode: ExitCode.SYNC_LOCK_HELD, result: lock };
   }
-  let handle = lock.data;
+  const handle = lock.data;
   try {
-    const preflight = await runManagedWritePreflight(
-      {
-        vault: input.vault,
-        command: input.command,
-        convergenceVault: input.convergenceVault,
-        hostId: input.hostId,
-        lockToken: handle.ownerToken,
-        env: input.env,
-        home: input.home,
-        osHostname: input.osHostname
-      },
-      deps
-    );
+    const preflightInput = {
+      vault: mutationVault,
+      command: input.command,
+      convergenceVault: input.convergenceVault,
+      hostId: input.hostId,
+      lockToken: handle.ownerToken,
+      env: input.env,
+      home: input.home,
+      cwd: input.cwd,
+      osHostname: input.osHostname,
+      user: input.user
+    };
+    const preflight = input.preflight ? await input.preflight(preflightInput) : await runManagedWritePreflight(preflightInput, deps);
     if (!preflight.result.ok) {
       return { exitCode: preflight.exitCode, result: preflight.result };
     }
     const receipt = preflight.result.data;
+    if (receipt.mutation_vault !== mutationVault) {
+      return {
+        exitCode: ExitCode.PREFLIGHT_FAILED,
+        result: err("PREFLIGHT_FAILED", {
+          reason: "mutation-vault-receipt-mismatch",
+          expected: mutationVault,
+          actual: receipt.mutation_vault
+        })
+      };
+    }
     if (receipt.mode === "immutable-record" && !input.allowImmutableRecord) {
       return {
         exitCode: ExitCode.PREFLIGHT_FAILED,
@@ -361,8 +424,6 @@ async function runManagedWriteTransaction(input, deps = DEFAULT_DEPS) {
 }
 
 export {
-  acquireManagedWriteLock,
-  releaseManagedWriteLock,
   runManagedWritePreflight,
   runManagedWriteTransaction
 };

package/dist/{chunk-C5OLZRRM.js → chunk-Y6KRDGI2.js}

@@ -55,7 +55,8 @@ var ExitCode = {
   FLEET_MANIFEST_INVALID: 50,
   SENSITIVE_CONTENT_DETECTED: 51,
   FLEET_SATELLITE_HEALTH_FAILED: 52,
-  PROTECTED_SNAPSHOTTER_WRITE_BLOCKED: 53
+  PROTECTED_SNAPSHOTTER_WRITE_BLOCKED: 53,
+  INVALID_CONFIG_VALUE: 54
 };
 
 // ../shared/src/json-output.ts
@@ -285,6 +286,47 @@ var FleetManifestSchema = z.object({
     }
   }
 });
+var vaultSyncRole = z.enum(["leaf", "snapshotter", "none"]);
+var vaultSyncScheduler = z.enum(["systemd", "launchd", "none"]);
+var vaultSyncScope = z.enum(["user", "system", "none"]);
+var vaultSyncBool = z.enum(["true", "false"]);
+var vaultSyncDuration = z.union([
+  z.string().regex(/^[1-9][0-9]*[mhs]$/, "must be <positive-int>m|h|s (e.g. 15m, 300s) or none"),
+  z.literal("none")
+]);
+var vaultSyncPathOrNone = z.union([
+  absolutePath,
+  z.literal("none")
+]);
+var VaultSyncConfigSchema = z.object({
+  "vault_sync.installed": vaultSyncBool,
+  "vault_sync.role": vaultSyncRole,
+  "vault_sync.scheduler": vaultSyncScheduler,
+  "vault_sync.service_scope": vaultSyncScope,
+  "vault_sync.snapshot_profile": vaultSyncPathOrNone,
+  "vault_sync.snapshot_script": vaultSyncPathOrNone,
+  "vault_sync.snapshot_worktree": vaultSyncPathOrNone,
+  "vault_sync.fuse_refresh_enabled": vaultSyncBool,
+  "vault_sync.fuse_refresh_interval": vaultSyncDuration,
+  "vault_sync.fuse_max_dir_cache": vaultSyncDuration,
+  "vault_sync.fuse_service_scope": vaultSyncScope
+}).strict();
+var VAULT_SYNC_KEYS = Object.keys(VaultSyncConfigSchema.shape);
+function isVaultSyncKey(key) {
+  return VAULT_SYNC_KEYS.includes(key);
+}
+function parseVaultSyncKeyValue(key, value) {
+  if (!isVaultSyncKey(key)) {
+    return { ok: false, message: `unknown vault_sync key: ${key}` };
+  }
+  const fieldSchema = VaultSyncConfigSchema.shape[key];
+  const parsed = fieldSchema.safeParse(value);
+  if (parsed.success) {
+    return { ok: true };
+  }
+  const first = parsed.error.issues[0];
+  return { ok: false, message: first?.message ?? "invalid value" };
+}
 function detectSchema(fm) {
   const COMPOUND_TYPES = /* @__PURE__ */ new Set(["lesson", "pattern", "antipattern", "gotcha"]);
   if (typeof fm.type === "string" && COMPOUND_TYPES.has(fm.type) && "project" in fm) return { schema: "compound" };
@@ -341,6 +383,29 @@ function getErrorMessage(e) {
   return e instanceof Error ? e.message : String(e);
 }
 
+// ../shared/src/systemd-property-catalog.json
+var systemd_property_catalog_default = {
+  load_state: "LoadState",
+  unit_file_state: "UnitFileState",
+  active_state: "ActiveState",
+  sub_state: "SubState",
+  next_elapse: "NextElapseUSecRealtime",
+  result: "Result",
+  exec_main_status: "ExecMainStatus",
+  exec_main_code: "ExecMainCode",
+  active_enter_timestamp: "ActiveEnterTimestamp",
+  inactive_enter_timestamp: "InactiveEnterTimestamp",
+  exec_main_start_timestamp: "ExecMainStartTimestamp",
+  exec_main_exit_timestamp: "ExecMainExitTimestamp",
+  invocation_id: "InvocationID"
+};
+
+// ../shared/src/systemd-property-catalog.ts
+var SYSTEMD_PROPERTY_CATALOG = Object.freeze({ ...systemd_property_catalog_default });
+function systemdPropertyFor(semantic) {
+  return SYSTEMD_PROPERTY_CATALOG[semantic];
+}
+
 export {
   ExitCode,
   ok,
@@ -351,7 +416,10 @@ export {
   CompoundSchema,
   MetaSchema,
   FleetManifestSchema,
+  isVaultSyncKey,
+  parseVaultSyncKeyValue,
   detectSchema,
   isBlockedHost,
-  getErrorMessage
+  getErrorMessage,
+  systemdPropertyFor
 };