switchroom 0.18.11 → 0.18.13

package/dist/host-control/main.js

@@ -7010,6 +7010,13 @@ var require_dist = __commonJS((exports) => {
   exports.visitAsync = visit.visitAsync;
 });
 
+// src/util/atomic.ts
+import { closeSync, constants, fsyncSync, openSync, renameSync as renameSync2, rmSync, writeSync } from "node:fs";
+var TMP_OPEN_FLAGS;
+var init_atomic = __esm(() => {
+  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+});
+
 // node_modules/.bun/handlebars@4.7.9/node_modules/handlebars/dist/cjs/handlebars/utils.js
 var require_utils = __commonJS((exports) => {
   exports.__esModule = true;
@@ -8373,7 +8380,7 @@ var require_parser2 = __commonJS((exports, module) => {
         throw new Error(str);
       },
       parse: function parse(input) {
-        var self2 = this, stack = [0], vstack = [null], lstack = [], table = this.table, yytext = "", yylineno = 0, yyleng = 0, recovering = 0, TERROR = 2, EOF = 1;
+        var self = this, stack = [0], vstack = [null], lstack = [], table = this.table, yytext = "", yylineno = 0, yyleng = 0, recovering = 0, TERROR = 2, EOF = 1;
         this.lexer.setInput(input);
         this.lexer.yy = this.yy;
         this.yy.lexer = this.lexer;
@@ -8392,9 +8399,9 @@ var require_parser2 = __commonJS((exports, module) => {
         }
         function lex() {
           var token;
-          token = self2.lexer.lex() || 1;
+          token = self.lexer.lex() || 1;
           if (typeof token !== "number") {
-            token = self2.symbols_[token] || token;
+            token = self.symbols_[token] || token;
           }
           return token;
         }
@@ -12545,2739 +12552,29 @@ var require_printer = __commonJS((exports) => {
     for (var i = 0, l = pairs.length;i < l; i++) {
       joinedPairs.push(this.accept(pairs[i]));
     }
-    return "HASH{" + joinedPairs.join(", ") + "}";
-  };
-  PrintVisitor.prototype.HashPair = function(pair) {
-    return pair.key + "=" + this.accept(pair.value);
-  };
-});
-
-// node_modules/.bun/handlebars@4.7.9/node_modules/handlebars/lib/index.js
-var require_lib = __commonJS((exports, module) => {
-  var handlebars = require_handlebars()["default"];
-  var printer = require_printer();
-  handlebars.PrintVisitor = printer.PrintVisitor;
-  handlebars.print = printer.print;
-  module.exports = handlebars;
-  function extension(module2, filename) {
-    var fs = __require("fs");
-    var templateString = fs.readFileSync(filename, "utf8");
-    module2.exports = handlebars.compile(templateString);
-  }
-  if (__require.extensions) {
-    __require.extensions[".handlebars"] = extension;
-    __require.extensions[".hbs"] = extension;
-  }
-});
-
-// telegram-plugin/secret-detect/suppressor.ts
-function isSuppressed(text, start, end) {
-  const left = Math.max(0, start - WINDOW);
-  const right = Math.min(text.length, end + WINDOW);
-  const context = text.slice(left, start) + text.slice(end, right);
-  return MARKER_RE.test(context);
-}
-var MARKERS, WINDOW = 40, MARKER_RE;
-var init_suppressor = __esm(() => {
-  MARKERS = ["test", "mock", "example", "fixture", "dummy"];
-  MARKER_RE = new RegExp(`\\b(?:${MARKERS.join("|")})\\b`, "i");
-});
-
-// telegram-plugin/secret-detect/slug.ts
-function sanitizeKeyName(raw) {
-  const up = raw.toUpperCase();
-  const cleaned = up.replace(/[^A-Z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
-  return cleaned.length > 0 ? cleaned : "SECRET";
-}
-function datePart(now = new Date) {
-  const y = now.getUTCFullYear();
-  const m = String(now.getUTCMonth() + 1).padStart(2, "0");
-  const d = String(now.getUTCDate()).padStart(2, "0");
-  return `${y}${m}${d}`;
-}
-function deriveSlug(inputs, existing) {
-  let base;
-  if (inputs.key_name && inputs.key_name.trim().length > 0) {
-    base = sanitizeKeyName(inputs.key_name);
-  } else {
-    base = `${inputs.rule_id}_${datePart(inputs.now)}`;
-  }
-  if (!existing.has(base))
-    return base;
-  let n = 2;
-  while (existing.has(`${base}_${n}`))
-    n++;
-  return `${base}_${n}`;
-}
-
-// node_modules/.bun/boundary@2.0.0/node_modules/boundary/lib/index.js
-var require_lib2 = __commonJS((exports2) => {
-  Object.defineProperty(exports2, "__esModule", { value: true });
-  exports2.binarySearch = exports2.upperBound = exports2.lowerBound = exports2.compare = undefined;
-  function compare(v1, v2) {
-    return v1 < v2;
-  }
-  exports2.compare = compare;
-  function upperBound(array, value, comp = compare) {
-    let len = array.length;
-    let i = 0;
-    while (len) {
-      let diff = len >>> 1;
-      let cursor = i + diff;
-      if (comp(value, array[cursor])) {
-        len = diff;
-      } else {
-        i = cursor + 1;
-        len -= diff + 1;
-      }
-    }
-    return i;
-  }
-  exports2.upperBound = upperBound;
-  function lowerBound(array, value, comp = compare) {
-    let len = array.length;
-    let i = 0;
-    while (len) {
-      let diff = len >>> 1;
-      let cursor = i + diff;
-      if (comp(array[cursor], value)) {
-        i = cursor + 1;
-        len -= diff + 1;
-      } else {
-        len = diff;
-      }
-    }
-    return i;
-  }
-  exports2.lowerBound = lowerBound;
-  function binarySearch(array, value, comp = compare) {
-    let cursor = lowerBound(array, value, comp);
-    return cursor !== array.length && !comp(value, array[cursor]);
-  }
-  exports2.binarySearch = binarySearch;
-});
-
-// node_modules/.bun/structured-source@4.0.0/node_modules/structured-source/lib/structured-source.js
-var require_structured_source = __commonJS((exports2) => {
-  Object.defineProperty(exports2, "__esModule", { value: true });
-  exports2.StructuredSource = undefined;
-  var boundary_1 = require_lib2();
-
-  class StructuredSource {
-    constructor(source) {
-      this.indice = [0];
-      let regexp = /[\r\n\u2028\u2029]/g;
-      const length = source.length;
-      regexp.lastIndex = 0;
-      while (true) {
-        let result = regexp.exec(source);
-        if (!result) {
-          break;
-        }
-        let index = result.index;
-        if (source.charCodeAt(index) === 13 && source.charCodeAt(index + 1) === 10) {
-          index += 1;
-        }
-        let nextIndex = index + 1;
-        if (length < nextIndex) {
-          break;
-        }
-        this.indice.push(nextIndex);
-        regexp.lastIndex = nextIndex;
-      }
-    }
-    get line() {
-      return this.indice.length;
-    }
-    locationToRange(loc) {
-      return [this.positionToIndex(loc.start), this.positionToIndex(loc.end)];
-    }
-    rangeToLocation(range) {
-      return {
-        start: this.indexToPosition(range[0]),
-        end: this.indexToPosition(range[1])
-      };
-    }
-    positionToIndex(pos) {
-      let start = this.indice[pos.line - 1];
-      return start + pos.column;
-    }
-    indexToPosition(index) {
-      const startLine = (0, boundary_1.upperBound)(this.indice, index);
-      return {
-        line: startLine,
-        column: index - this.indice[startLine - 1]
-      };
-    }
-  }
-  exports2.StructuredSource = StructuredSource;
-});
-// node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/SecretLintSourceCodeImpl.js
-var import_structured_source;
-var init_SecretLintSourceCodeImpl = __esm(() => {
-  import_structured_source = __toESM(require_structured_source(), 1);
-});
-
-// node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/helper/promise-event-emitter.js
-class EventEmitter {
-  #listeners = new Map;
-  on(type, listener) {
-    const prevSet = this.#listeners.get(type);
-    const listenerSet = prevSet ?? new Set;
-    listenerSet?.add(listener);
-    this.#listeners.set(type, listenerSet);
-  }
-  emit(type, ...args) {
-    const listenerSet = this.#listeners.get(type);
-    if (!listenerSet) {
-      return;
-    }
-    for (const listenerSetElement of listenerSet) {
-      listenerSetElement(...args);
-    }
-  }
-  off(type, listener) {
-    const listenerSet = this.#listeners.get(type);
-    if (!listenerSet) {
-      return;
-    }
-    for (const listenerSetElement of listenerSet) {
-      if (listenerSetElement === listener) {
-        listenerSet.delete(listener);
-      }
-    }
-  }
-  removeAllListeners() {
-    this.#listeners.clear();
-  }
-  listenerCount(type) {
-    return this.#listeners.get(type)?.size ?? 0;
-  }
-  listeners(type) {
-    return Array.from(this.#listeners.get(type) ?? []);
-  }
-}
-// node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RuleContext.js
-var init_RuleContext = () => {};
-// node_modules/.bun/@secretlint+profiler@12.2.0/node_modules/@secretlint/profiler/module/index.js
-class SecretLintProfiler {
-  perf;
-  entries = [];
-  measures = [];
-  executionPromises = [];
-  constructor(options) {
-    this.perf = options.perf;
-    const pattern = /(.*?)::end(\|\|.*)?/;
-    const observer = new options.PerformanceObserver((items) => {
-      const entries = items.getEntries();
-      entries.forEach((entry) => {
-        if (entry.entryType === "mark") {
-          const match = entry.name.match(pattern);
-          const endIdentifier = match ? match[1] : undefined;
-          const suffix = match && match[2] ? match[2] : "";
-          if (endIdentifier) {
-            const startIdentifier = `${endIdentifier}::start`;
-            this.entries.find((savedEntry) => {
-              return savedEntry.name === startIdentifier;
-            });
-            if (startIdentifier) {
-              this.executionPromises.push(Promise.resolve().then(() => {
-                this.perf.measure(endIdentifier + suffix, `${endIdentifier}::start${suffix}`, `${endIdentifier}::end${suffix}`);
-              }));
-            }
-          }
-          this.entries.push(entry);
-        } else if (entry.entryType === "measure") {
-          this.measures.push(entry);
-        }
-      });
-    });
-    observer.observe({ entryTypes: ["mark", "measure"] });
-  }
-  mark(marker) {
-    if ("id" in marker) {
-      this.perf.mark(`${marker.type}||${marker.id}`);
-    } else {
-      this.perf.mark(marker.type);
-    }
-  }
-  waifForExecutionPromises = () => {
-    return Promise.all(this.executionPromises).finally(() => {
-      this.executionPromises.length = 0;
-    });
-  };
-  async getEntries() {
-    await this.waifForExecutionPromises();
-    return this.entries;
-  }
-  async getMeasures() {
-    await this.waifForExecutionPromises();
-    return this.measures;
-  }
-}
-
-// node_modules/.bun/@secretlint+profiler@12.2.0/node_modules/@secretlint/profiler/module/node.js
-import perf_hooks from "node:perf_hooks";
-
-class NullPerformanceObserver {
-  disconnect() {}
-  observe(_options) {}
-}
-var secretLintProfiler;
-var init_node = __esm(() => {
-  secretLintProfiler = new SecretLintProfiler({
-    perf: perf_hooks.performance,
-    PerformanceObserver: perf_hooks.PerformanceObserver ? perf_hooks.PerformanceObserver : NullPerformanceObserver
-  });
-});
-
-// node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RunningEvents.js
-var init_RunningEvents = __esm(() => {
-  init_node();
-});
-
-// node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/RulePresetContext.js
-var init_RulePresetContext = __esm(() => {
-  init_RuleContext();
-});
-// node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/messages/index.js
-var init_messages = () => {};
-
-// node_modules/.bun/ms@2.1.3/node_modules/ms/index.js
-var require_ms = __commonJS((exports2, module) => {
-  var s = 1000;
-  var m = s * 60;
-  var h = m * 60;
-  var d = h * 24;
-  var w = d * 7;
-  var y = d * 365.25;
-  module.exports = function(val, options) {
-    options = options || {};
-    var type = typeof val;
-    if (type === "string" && val.length > 0) {
-      return parse(val);
-    } else if (type === "number" && isFinite(val)) {
-      return options.long ? fmtLong(val) : fmtShort(val);
-    }
-    throw new Error("val is not a non-empty string or a valid number. val=" + JSON.stringify(val));
-  };
-  function parse(str) {
-    str = String(str);
-    if (str.length > 100) {
-      return;
-    }
-    var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(str);
-    if (!match) {
-      return;
-    }
-    var n = parseFloat(match[1]);
-    var type = (match[2] || "ms").toLowerCase();
-    switch (type) {
-      case "years":
-      case "year":
-      case "yrs":
-      case "yr":
-      case "y":
-        return n * y;
-      case "weeks":
-      case "week":
-      case "w":
-        return n * w;
-      case "days":
-      case "day":
-      case "d":
-        return n * d;
-      case "hours":
-      case "hour":
-      case "hrs":
-      case "hr":
-      case "h":
-        return n * h;
-      case "minutes":
-      case "minute":
-      case "mins":
-      case "min":
-      case "m":
-        return n * m;
-      case "seconds":
-      case "second":
-      case "secs":
-      case "sec":
-      case "s":
-        return n * s;
-      case "milliseconds":
-      case "millisecond":
-      case "msecs":
-      case "msec":
-      case "ms":
-        return n;
-      default:
-        return;
-    }
-  }
-  function fmtShort(ms) {
-    var msAbs = Math.abs(ms);
-    if (msAbs >= d) {
-      return Math.round(ms / d) + "d";
-    }
-    if (msAbs >= h) {
-      return Math.round(ms / h) + "h";
-    }
-    if (msAbs >= m) {
-      return Math.round(ms / m) + "m";
-    }
-    if (msAbs >= s) {
-      return Math.round(ms / s) + "s";
-    }
-    return ms + "ms";
-  }
-  function fmtLong(ms) {
-    var msAbs = Math.abs(ms);
-    if (msAbs >= d) {
-      return plural(ms, msAbs, d, "day");
-    }
-    if (msAbs >= h) {
-      return plural(ms, msAbs, h, "hour");
-    }
-    if (msAbs >= m) {
-      return plural(ms, msAbs, m, "minute");
-    }
-    if (msAbs >= s) {
-      return plural(ms, msAbs, s, "second");
-    }
-    return ms + " ms";
-  }
-  function plural(ms, msAbs, n, name) {
-    var isPlural = msAbs >= n * 1.5;
-    return Math.round(ms / n) + " " + name + (isPlural ? "s" : "");
-  }
-});
-
-// node_modules/.bun/debug@4.4.3/node_modules/debug/src/common.js
-var require_common = __commonJS((exports2, module) => {
-  function setup(env) {
-    createDebug.debug = createDebug;
-    createDebug.default = createDebug;
-    createDebug.coerce = coerce2;
-    createDebug.disable = disable;
-    createDebug.enable = enable;
-    createDebug.enabled = enabled;
-    createDebug.humanize = require_ms();
-    createDebug.destroy = destroy;
-    Object.keys(env).forEach((key) => {
-      createDebug[key] = env[key];
-    });
-    createDebug.names = [];
-    createDebug.skips = [];
-    createDebug.formatters = {};
-    function selectColor(namespace) {
-      let hash = 0;
-      for (let i = 0;i < namespace.length; i++) {
-        hash = (hash << 5) - hash + namespace.charCodeAt(i);
-        hash |= 0;
-      }
-      return createDebug.colors[Math.abs(hash) % createDebug.colors.length];
-    }
-    createDebug.selectColor = selectColor;
-    function createDebug(namespace) {
-      let prevTime;
-      let enableOverride = null;
-      let namespacesCache;
-      let enabledCache;
-      function debug(...args) {
-        if (!debug.enabled) {
-          return;
-        }
-        const self2 = debug;
-        const curr = Number(new Date);
-        const ms = curr - (prevTime || curr);
-        self2.diff = ms;
-        self2.prev = prevTime;
-        self2.curr = curr;
-        prevTime = curr;
-        args[0] = createDebug.coerce(args[0]);
-        if (typeof args[0] !== "string") {
-          args.unshift("%O");
-        }
-        let index = 0;
-        args[0] = args[0].replace(/%([a-zA-Z%])/g, (match, format) => {
-          if (match === "%%") {
-            return "%";
-          }
-          index++;
-          const formatter = createDebug.formatters[format];
-          if (typeof formatter === "function") {
-            const val = args[index];
-            match = formatter.call(self2, val);
-            args.splice(index, 1);
-            index--;
-          }
-          return match;
-        });
-        createDebug.formatArgs.call(self2, args);
-        const logFn = self2.log || createDebug.log;
-        logFn.apply(self2, args);
-      }
-      debug.namespace = namespace;
-      debug.useColors = createDebug.useColors();
-      debug.color = createDebug.selectColor(namespace);
-      debug.extend = extend;
-      debug.destroy = createDebug.destroy;
-      Object.defineProperty(debug, "enabled", {
-        enumerable: true,
-        configurable: false,
-        get: () => {
-          if (enableOverride !== null) {
-            return enableOverride;
-          }
-          if (namespacesCache !== createDebug.namespaces) {
-            namespacesCache = createDebug.namespaces;
-            enabledCache = createDebug.enabled(namespace);
-          }
-          return enabledCache;
-        },
-        set: (v) => {
-          enableOverride = v;
-        }
-      });
-      if (typeof createDebug.init === "function") {
-        createDebug.init(debug);
-      }
-      return debug;
-    }
-    function extend(namespace, delimiter) {
-      const newDebug = createDebug(this.namespace + (typeof delimiter === "undefined" ? ":" : delimiter) + namespace);
-      newDebug.log = this.log;
-      return newDebug;
-    }
-    function enable(namespaces) {
-      createDebug.save(namespaces);
-      createDebug.namespaces = namespaces;
-      createDebug.names = [];
-      createDebug.skips = [];
-      const split = (typeof namespaces === "string" ? namespaces : "").trim().replace(/\s+/g, ",").split(",").filter(Boolean);
-      for (const ns of split) {
-        if (ns[0] === "-") {
-          createDebug.skips.push(ns.slice(1));
-        } else {
-          createDebug.names.push(ns);
-        }
-      }
-    }
-    function matchesTemplate(search, template) {
-      let searchIndex = 0;
-      let templateIndex = 0;
-      let starIndex = -1;
-      let matchIndex = 0;
-      while (searchIndex < search.length) {
-        if (templateIndex < template.length && (template[templateIndex] === search[searchIndex] || template[templateIndex] === "*")) {
-          if (template[templateIndex] === "*") {
-            starIndex = templateIndex;
-            matchIndex = searchIndex;
-            templateIndex++;
-          } else {
-            searchIndex++;
-            templateIndex++;
-          }
-        } else if (starIndex !== -1) {
-          templateIndex = starIndex + 1;
-          matchIndex++;
-          searchIndex = matchIndex;
-        } else {
-          return false;
-        }
-      }
-      while (templateIndex < template.length && template[templateIndex] === "*") {
-        templateIndex++;
-      }
-      return templateIndex === template.length;
-    }
-    function disable() {
-      const namespaces = [
-        ...createDebug.names,
-        ...createDebug.skips.map((namespace) => "-" + namespace)
-      ].join(",");
-      createDebug.enable("");
-      return namespaces;
-    }
-    function enabled(name) {
-      for (const skip of createDebug.skips) {
-        if (matchesTemplate(name, skip)) {
-          return false;
-        }
-      }
-      for (const ns of createDebug.names) {
-        if (matchesTemplate(name, ns)) {
-          return true;
-        }
-      }
-      return false;
-    }
-    function coerce2(val) {
-      if (val instanceof Error) {
-        return val.stack || val.message;
-      }
-      return val;
-    }
-    function destroy() {
-      console.warn("Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.");
-    }
-    createDebug.enable(createDebug.load());
-    return createDebug;
-  }
-  module.exports = setup;
-});
-
-// node_modules/.bun/debug@4.4.3/node_modules/debug/src/browser.js
-var require_browser = __commonJS((exports2, module) => {
-  exports2.formatArgs = formatArgs;
-  exports2.save = save;
-  exports2.load = load;
-  exports2.useColors = useColors;
-  exports2.storage = localstorage();
-  exports2.destroy = (() => {
-    let warned = false;
-    return () => {
-      if (!warned) {
-        warned = true;
-        console.warn("Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.");
-      }
-    };
-  })();
-  exports2.colors = [
-    "#0000CC",
-    "#0000FF",
-    "#0033CC",
-    "#0033FF",
-    "#0066CC",
-    "#0066FF",
-    "#0099CC",
-    "#0099FF",
-    "#00CC00",
-    "#00CC33",
-    "#00CC66",
-    "#00CC99",
-    "#00CCCC",
-    "#00CCFF",
-    "#3300CC",
-    "#3300FF",
-    "#3333CC",
-    "#3333FF",
-    "#3366CC",
-    "#3366FF",
-    "#3399CC",
-    "#3399FF",
-    "#33CC00",
-    "#33CC33",
-    "#33CC66",
-    "#33CC99",
-    "#33CCCC",
-    "#33CCFF",
-    "#6600CC",
-    "#6600FF",
-    "#6633CC",
-    "#6633FF",
-    "#66CC00",
-    "#66CC33",
-    "#9900CC",
-    "#9900FF",
-    "#9933CC",
-    "#9933FF",
-    "#99CC00",
-    "#99CC33",
-    "#CC0000",
-    "#CC0033",
-    "#CC0066",
-    "#CC0099",
-    "#CC00CC",
-    "#CC00FF",
-    "#CC3300",
-    "#CC3333",
-    "#CC3366",
-    "#CC3399",
-    "#CC33CC",
-    "#CC33FF",
-    "#CC6600",
-    "#CC6633",
-    "#CC9900",
-    "#CC9933",
-    "#CCCC00",
-    "#CCCC33",
-    "#FF0000",
-    "#FF0033",
-    "#FF0066",
-    "#FF0099",
-    "#FF00CC",
-    "#FF00FF",
-    "#FF3300",
-    "#FF3333",
-    "#FF3366",
-    "#FF3399",
-    "#FF33CC",
-    "#FF33FF",
-    "#FF6600",
-    "#FF6633",
-    "#FF9900",
-    "#FF9933",
-    "#FFCC00",
-    "#FFCC33"
-  ];
-  function useColors() {
-    if (typeof window !== "undefined" && window.process && (window.process.type === "renderer" || window.process.__nwjs)) {
-      return true;
-    }
-    if (typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/(edge|trident)\/(\d+)/)) {
-      return false;
-    }
-    let m;
-    return typeof document !== "undefined" && document.documentElement && document.documentElement.style && document.documentElement.style.WebkitAppearance || typeof window !== "undefined" && window.console && (window.console.firebug || window.console.exception && window.console.table) || typeof navigator !== "undefined" && navigator.userAgent && (m = navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/)) && parseInt(m[1], 10) >= 31 || typeof navigator !== "undefined" && navigator.userAgent && navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/);
-  }
-  function formatArgs(args) {
-    args[0] = (this.useColors ? "%c" : "") + this.namespace + (this.useColors ? " %c" : " ") + args[0] + (this.useColors ? "%c " : " ") + "+" + module.exports.humanize(this.diff);
-    if (!this.useColors) {
-      return;
-    }
-    const c = "color: " + this.color;
-    args.splice(1, 0, c, "color: inherit");
-    let index = 0;
-    let lastC = 0;
-    args[0].replace(/%[a-zA-Z%]/g, (match) => {
-      if (match === "%%") {
-        return;
-      }
-      index++;
-      if (match === "%c") {
-        lastC = index;
-      }
-    });
-    args.splice(lastC, 0, c);
-  }
-  exports2.log = console.debug || console.log || (() => {});
-  function save(namespaces) {
-    try {
-      if (namespaces) {
-        exports2.storage.setItem("debug", namespaces);
-      } else {
-        exports2.storage.removeItem("debug");
-      }
-    } catch (error) {}
-  }
-  function load() {
-    let r;
-    try {
-      r = exports2.storage.getItem("debug") || exports2.storage.getItem("DEBUG");
-    } catch (error) {}
-    if (!r && typeof process !== "undefined" && "env" in process) {
-      r = process.env.DEBUG;
-    }
-    return r;
-  }
-  function localstorage() {
-    try {
-      return localStorage;
-    } catch (error) {}
-  }
-  module.exports = require_common()(exports2);
-  var { formatters } = module.exports;
-  formatters.j = function(v) {
-    try {
-      return JSON.stringify(v);
-    } catch (error) {
-      return "[UnexpectedJSONParseError]: " + error.message;
-    }
-  };
-});
-
-// node_modules/.bun/has-flag@4.0.0/node_modules/has-flag/index.js
-var require_has_flag = __commonJS((exports2, module) => {
-  module.exports = (flag, argv = process.argv) => {
-    const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
-    const position = argv.indexOf(prefix + flag);
-    const terminatorPosition = argv.indexOf("--");
-    return position !== -1 && (terminatorPosition === -1 || position < terminatorPosition);
-  };
-});
-
-// node_modules/.bun/supports-color@7.2.0/node_modules/supports-color/index.js
-var require_supports_color = __commonJS((exports2, module) => {
-  var os = __require("os");
-  var tty = __require("tty");
-  var hasFlag = require_has_flag();
-  var { env } = process;
-  var forceColor;
-  if (hasFlag("no-color") || hasFlag("no-colors") || hasFlag("color=false") || hasFlag("color=never")) {
-    forceColor = 0;
-  } else if (hasFlag("color") || hasFlag("colors") || hasFlag("color=true") || hasFlag("color=always")) {
-    forceColor = 1;
-  }
-  if ("FORCE_COLOR" in env) {
-    if (env.FORCE_COLOR === "true") {
-      forceColor = 1;
-    } else if (env.FORCE_COLOR === "false") {
-      forceColor = 0;
-    } else {
-      forceColor = env.FORCE_COLOR.length === 0 ? 1 : Math.min(parseInt(env.FORCE_COLOR, 10), 3);
-    }
-  }
-  function translateLevel(level) {
-    if (level === 0) {
-      return false;
-    }
-    return {
-      level,
-      hasBasic: true,
-      has256: level >= 2,
-      has16m: level >= 3
-    };
-  }
-  function supportsColor(haveStream, streamIsTTY) {
-    if (forceColor === 0) {
-      return 0;
-    }
-    if (hasFlag("color=16m") || hasFlag("color=full") || hasFlag("color=truecolor")) {
-      return 3;
-    }
-    if (hasFlag("color=256")) {
-      return 2;
-    }
-    if (haveStream && !streamIsTTY && forceColor === undefined) {
-      return 0;
-    }
-    const min = forceColor || 0;
-    if (env.TERM === "dumb") {
-      return min;
-    }
-    if (process.platform === "win32") {
-      const osRelease = os.release().split(".");
-      if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
-        return Number(osRelease[2]) >= 14931 ? 3 : 2;
-      }
-      return 1;
-    }
-    if ("CI" in env) {
-      if (["TRAVIS", "CIRCLECI", "APPVEYOR", "GITLAB_CI", "GITHUB_ACTIONS", "BUILDKITE"].some((sign) => (sign in env)) || env.CI_NAME === "codeship") {
-        return 1;
-      }
-      return min;
-    }
-    if ("TEAMCITY_VERSION" in env) {
-      return /^(9\.(0*[1-9]\d*)\.|\d{2,}\.)/.test(env.TEAMCITY_VERSION) ? 1 : 0;
-    }
-    if (env.COLORTERM === "truecolor") {
-      return 3;
-    }
-    if ("TERM_PROGRAM" in env) {
-      const version2 = parseInt((env.TERM_PROGRAM_VERSION || "").split(".")[0], 10);
-      switch (env.TERM_PROGRAM) {
-        case "iTerm.app":
-          return version2 >= 3 ? 3 : 2;
-        case "Apple_Terminal":
-          return 2;
-      }
-    }
-    if (/-256(color)?$/i.test(env.TERM)) {
-      return 2;
-    }
-    if (/^screen|^xterm|^vt100|^vt220|^rxvt|color|ansi|cygwin|linux/i.test(env.TERM)) {
-      return 1;
-    }
-    if ("COLORTERM" in env) {
-      return 1;
-    }
-    return min;
-  }
-  function getSupportLevel(stream) {
-    const level = supportsColor(stream, stream && stream.isTTY);
-    return translateLevel(level);
-  }
-  module.exports = {
-    supportsColor: getSupportLevel,
-    stdout: translateLevel(supportsColor(true, tty.isatty(1))),
-    stderr: translateLevel(supportsColor(true, tty.isatty(2)))
-  };
-});
-
-// node_modules/.bun/debug@4.4.3/node_modules/debug/src/node.js
-var require_node = __commonJS((exports2, module) => {
-  var tty = __require("tty");
-  var util3 = __require("util");
-  exports2.init = init;
-  exports2.log = log;
-  exports2.formatArgs = formatArgs;
-  exports2.save = save;
-  exports2.load = load;
-  exports2.useColors = useColors;
-  exports2.destroy = util3.deprecate(() => {}, "Instance method `debug.destroy()` is deprecated and no longer does anything. It will be removed in the next major version of `debug`.");
-  exports2.colors = [6, 2, 3, 4, 5, 1];
-  try {
-    const supportsColor = require_supports_color();
-    if (supportsColor && (supportsColor.stderr || supportsColor).level >= 2) {
-      exports2.colors = [
-        20,
-        21,
-        26,
-        27,
-        32,
-        33,
-        38,
-        39,
-        40,
-        41,
-        42,
-        43,
-        44,
-        45,
-        56,
-        57,
-        62,
-        63,
-        68,
-        69,
-        74,
-        75,
-        76,
-        77,
-        78,
-        79,
-        80,
-        81,
-        92,
-        93,
-        98,
-        99,
-        112,
-        113,
-        128,
-        129,
-        134,
-        135,
-        148,
-        149,
-        160,
-        161,
-        162,
-        163,
-        164,
-        165,
-        166,
-        167,
-        168,
-        169,
-        170,
-        171,
-        172,
-        173,
-        178,
-        179,
-        184,
-        185,
-        196,
-        197,
-        198,
-        199,
-        200,
-        201,
-        202,
-        203,
-        204,
-        205,
-        206,
-        207,
-        208,
-        209,
-        214,
-        215,
-        220,
-        221
-      ];
-    }
-  } catch (error) {}
-  exports2.inspectOpts = Object.keys(process.env).filter((key) => {
-    return /^debug_/i.test(key);
-  }).reduce((obj, key) => {
-    const prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, (_, k) => {
-      return k.toUpperCase();
-    });
-    let val = process.env[key];
-    if (/^(yes|on|true|enabled)$/i.test(val)) {
-      val = true;
-    } else if (/^(no|off|false|disabled)$/i.test(val)) {
-      val = false;
-    } else if (val === "null") {
-      val = null;
-    } else {
-      val = Number(val);
-    }
-    obj[prop] = val;
-    return obj;
-  }, {});
-  function useColors() {
-    return "colors" in exports2.inspectOpts ? Boolean(exports2.inspectOpts.colors) : tty.isatty(process.stderr.fd);
-  }
-  function formatArgs(args) {
-    const { namespace: name, useColors: useColors2 } = this;
-    if (useColors2) {
-      const c = this.color;
-      const colorCode = "\x1B[3" + (c < 8 ? c : "8;5;" + c);
-      const prefix = `  ${colorCode};1m${name} \x1B[0m`;
-      args[0] = prefix + args[0].split(`
-`).join(`
-` + prefix);
-      args.push(colorCode + "m+" + module.exports.humanize(this.diff) + "\x1B[0m");
-    } else {
-      args[0] = getDate() + name + " " + args[0];
-    }
-  }
-  function getDate() {
-    if (exports2.inspectOpts.hideDate) {
-      return "";
-    }
-    return new Date().toISOString() + " ";
-  }
-  function log(...args) {
-    return process.stderr.write(util3.formatWithOptions(exports2.inspectOpts, ...args) + `
-`);
-  }
-  function save(namespaces) {
-    if (namespaces) {
-      process.env.DEBUG = namespaces;
-    } else {
-      delete process.env.DEBUG;
-    }
-  }
-  function load() {
-    return process.env.DEBUG;
-  }
-  function init(debug) {
-    debug.inspectOpts = {};
-    const keys = Object.keys(exports2.inspectOpts);
-    for (let i = 0;i < keys.length; i++) {
-      debug.inspectOpts[keys[i]] = exports2.inspectOpts[keys[i]];
-    }
-  }
-  module.exports = require_common()(exports2);
-  var { formatters } = module.exports;
-  formatters.o = function(v) {
-    this.inspectOpts.colors = this.useColors;
-    return util3.inspect(v, this.inspectOpts).split(`
-`).map((str) => str.trim()).join(" ");
-  };
-  formatters.O = function(v) {
-    this.inspectOpts.colors = this.useColors;
-    return util3.inspect(v, this.inspectOpts);
-  };
-});
-
-// node_modules/.bun/debug@4.4.3/node_modules/debug/src/index.js
-var require_src = __commonJS((exports2, module) => {
-  if (typeof process === "undefined" || process.type === "renderer" || false || process.__nwjs) {
-    module.exports = require_browser();
-  } else {
-    module.exports = require_node();
-  }
-});
-
-// node_modules/.bun/@secretlint+core@12.2.0/node_modules/@secretlint/core/module/index.js
-var import_debug, debug;
-var init_module = __esm(() => {
-  init_SecretLintSourceCodeImpl();
-  init_RuleContext();
-  init_RunningEvents();
-  init_node();
-  init_RulePresetContext();
-  init_messages();
-  import_debug = __toESM(require_src(), 1);
-  debug = import_debug.default("@secretlint/core");
-});
-
-// node_modules/.bun/@secretlint+secretlint-rule-preset-recommend@12.2.0/node_modules/@secretlint/secretlint-rule-preset-recommend/module/index.js
-function requireLodash_uniq() {
-  if (hasRequiredLodash_uniq)
-    return lodash_uniq;
-  hasRequiredLodash_uniq = 1;
-  var LARGE_ARRAY_SIZE = 200;
-  var HASH_UNDEFINED = "__lodash_hash_undefined__";
-  var INFINITY = 1 / 0;
-  var funcTag = "[object Function]", genTag = "[object GeneratorFunction]";
-  var reRegExpChar = /[\\^$.*+?()[\]{}|]/g;
-  var reIsHostCtor = /^\[object .+?Constructor\]$/;
-  var freeGlobal = typeof commonjsGlobal == "object" && commonjsGlobal && commonjsGlobal.Object === Object && commonjsGlobal;
-  var freeSelf = typeof self == "object" && self && self.Object === Object && self;
-  var root = freeGlobal || freeSelf || Function("return this")();
-  function arrayIncludes(array, value) {
-    var length = array ? array.length : 0;
-    return !!length && baseIndexOf(array, value, 0) > -1;
-  }
-  function baseFindIndex(array, predicate, fromIndex, fromRight) {
-    var length = array.length, index = fromIndex + -1;
-    while (++index < length) {
-      if (predicate(array[index], index, array)) {
-        return index;
-      }
-    }
-    return -1;
-  }
-  function baseIndexOf(array, value, fromIndex) {
-    if (value !== value) {
-      return baseFindIndex(array, baseIsNaN, fromIndex);
-    }
-    var index = fromIndex - 1, length = array.length;
-    while (++index < length) {
-      if (array[index] === value) {
-        return index;
-      }
-    }
-    return -1;
-  }
-  function baseIsNaN(value) {
-    return value !== value;
-  }
-  function cacheHas(cache, key) {
-    return cache.has(key);
-  }
-  function getValue(object, key) {
-    return object == null ? undefined : object[key];
-  }
-  function isHostObject(value) {
-    var result = false;
-    if (value != null && typeof value.toString != "function") {
-      try {
-        result = !!(value + "");
-      } catch (e) {}
-    }
-    return result;
-  }
-  function setToArray(set) {
-    var index = -1, result = Array(set.size);
-    set.forEach(function(value) {
-      result[++index] = value;
-    });
-    return result;
-  }
-  var arrayProto = Array.prototype, funcProto = Function.prototype, objectProto = Object.prototype;
-  var coreJsData = root["__core-js_shared__"];
-  var maskSrcKey = function() {
-    var uid = /[^.]+$/.exec(coreJsData && coreJsData.keys && coreJsData.keys.IE_PROTO || "");
-    return uid ? "Symbol(src)_1." + uid : "";
-  }();
-  var funcToString = funcProto.toString;
-  var hasOwnProperty = objectProto.hasOwnProperty;
-  var objectToString = objectProto.toString;
-  var reIsNative = RegExp("^" + funcToString.call(hasOwnProperty).replace(reRegExpChar, "\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, "$1.*?") + "$");
-  var splice = arrayProto.splice;
-  var Map2 = getNative(root, "Map"), Set2 = getNative(root, "Set"), nativeCreate = getNative(Object, "create");
-  function Hash(entries) {
-    var index = -1, length = entries ? entries.length : 0;
-    this.clear();
-    while (++index < length) {
-      var entry = entries[index];
-      this.set(entry[0], entry[1]);
-    }
-  }
-  function hashClear() {
-    this.__data__ = nativeCreate ? nativeCreate(null) : {};
-  }
-  function hashDelete(key) {
-    return this.has(key) && delete this.__data__[key];
-  }
-  function hashGet(key) {
-    var data = this.__data__;
-    if (nativeCreate) {
-      var result = data[key];
-      return result === HASH_UNDEFINED ? undefined : result;
-    }
-    return hasOwnProperty.call(data, key) ? data[key] : undefined;
-  }
-  function hashHas(key) {
-    var data = this.__data__;
-    return nativeCreate ? data[key] !== undefined : hasOwnProperty.call(data, key);
-  }
-  function hashSet(key, value) {
-    var data = this.__data__;
-    data[key] = nativeCreate && value === undefined ? HASH_UNDEFINED : value;
-    return this;
-  }
-  Hash.prototype.clear = hashClear;
-  Hash.prototype["delete"] = hashDelete;
-  Hash.prototype.get = hashGet;
-  Hash.prototype.has = hashHas;
-  Hash.prototype.set = hashSet;
-  function ListCache(entries) {
-    var index = -1, length = entries ? entries.length : 0;
-    this.clear();
-    while (++index < length) {
-      var entry = entries[index];
-      this.set(entry[0], entry[1]);
-    }
-  }
-  function listCacheClear() {
-    this.__data__ = [];
-  }
-  function listCacheDelete(key) {
-    var data = this.__data__, index = assocIndexOf(data, key);
-    if (index < 0) {
-      return false;
-    }
-    var lastIndex = data.length - 1;
-    if (index == lastIndex) {
-      data.pop();
-    } else {
-      splice.call(data, index, 1);
-    }
-    return true;
-  }
-  function listCacheGet(key) {
-    var data = this.__data__, index = assocIndexOf(data, key);
-    return index < 0 ? undefined : data[index][1];
-  }
-  function listCacheHas(key) {
-    return assocIndexOf(this.__data__, key) > -1;
-  }
-  function listCacheSet(key, value) {
-    var data = this.__data__, index = assocIndexOf(data, key);
-    if (index < 0) {
-      data.push([key, value]);
-    } else {
-      data[index][1] = value;
-    }
-    return this;
-  }
-  ListCache.prototype.clear = listCacheClear;
-  ListCache.prototype["delete"] = listCacheDelete;
-  ListCache.prototype.get = listCacheGet;
-  ListCache.prototype.has = listCacheHas;
-  ListCache.prototype.set = listCacheSet;
-  function MapCache(entries) {
-    var index = -1, length = entries ? entries.length : 0;
-    this.clear();
-    while (++index < length) {
-      var entry = entries[index];
-      this.set(entry[0], entry[1]);
-    }
-  }
-  function mapCacheClear() {
-    this.__data__ = {
-      hash: new Hash,
-      map: new (Map2 || ListCache),
-      string: new Hash
-    };
-  }
-  function mapCacheDelete(key) {
-    return getMapData(this, key)["delete"](key);
-  }
-  function mapCacheGet(key) {
-    return getMapData(this, key).get(key);
-  }
-  function mapCacheHas(key) {
-    return getMapData(this, key).has(key);
-  }
-  function mapCacheSet(key, value) {
-    getMapData(this, key).set(key, value);
-    return this;
-  }
-  MapCache.prototype.clear = mapCacheClear;
-  MapCache.prototype["delete"] = mapCacheDelete;
-  MapCache.prototype.get = mapCacheGet;
-  MapCache.prototype.has = mapCacheHas;
-  MapCache.prototype.set = mapCacheSet;
-  function SetCache(values) {
-    var index = -1, length = values ? values.length : 0;
-    this.__data__ = new MapCache;
-    while (++index < length) {
-      this.add(values[index]);
-    }
-  }
-  function setCacheAdd(value) {
-    this.__data__.set(value, HASH_UNDEFINED);
-    return this;
-  }
-  function setCacheHas(value) {
-    return this.__data__.has(value);
-  }
-  SetCache.prototype.add = SetCache.prototype.push = setCacheAdd;
-  SetCache.prototype.has = setCacheHas;
-  function assocIndexOf(array, key) {
-    var length = array.length;
-    while (length--) {
-      if (eq(array[length][0], key)) {
-        return length;
-      }
-    }
-    return -1;
-  }
-  function baseIsNative(value) {
-    if (!isObject2(value) || isMasked(value)) {
-      return false;
-    }
-    var pattern = isFunction2(value) || isHostObject(value) ? reIsNative : reIsHostCtor;
-    return pattern.test(toSource(value));
-  }
-  function baseUniq(array, iteratee, comparator) {
-    var index = -1, includes2 = arrayIncludes, length = array.length, isCommon = true, result = [], seen = result;
-    if (length >= LARGE_ARRAY_SIZE) {
-      var set = createSet(array);
-      if (set) {
-        return setToArray(set);
-      }
-      isCommon = false;
-      includes2 = cacheHas;
-      seen = new SetCache;
-    } else {
-      seen = result;
-    }
-    outer:
-      while (++index < length) {
-        var value = array[index], computed = value;
-        value = value !== 0 ? value : 0;
-        if (isCommon && computed === computed) {
-          var seenIndex = seen.length;
-          while (seenIndex--) {
-            if (seen[seenIndex] === computed) {
-              continue outer;
-            }
-          }
-          result.push(value);
-        } else if (!includes2(seen, computed, comparator)) {
-          if (seen !== result) {
-            seen.push(computed);
-          }
-          result.push(value);
-        }
-      }
-    return result;
-  }
-  var createSet = !(Set2 && 1 / setToArray(new Set2([, -0]))[1] == INFINITY) ? noop : function(values) {
-    return new Set2(values);
-  };
-  function getMapData(map, key) {
-    var data = map.__data__;
-    return isKeyable(key) ? data[typeof key == "string" ? "string" : "hash"] : data.map;
-  }
-  function getNative(object, key) {
-    var value = getValue(object, key);
-    return baseIsNative(value) ? value : undefined;
-  }
-  function isKeyable(value) {
-    var type = typeof value;
-    return type == "string" || type == "number" || type == "symbol" || type == "boolean" ? value !== "__proto__" : value === null;
-  }
-  function isMasked(func) {
-    return !!maskSrcKey && maskSrcKey in func;
-  }
-  function toSource(func) {
-    if (func != null) {
-      try {
-        return funcToString.call(func);
-      } catch (e) {}
-      try {
-        return func + "";
-      } catch (e) {}
-    }
-    return "";
-  }
-  function uniq(array) {
-    return array && array.length ? baseUniq(array) : [];
-  }
-  function eq(value, other) {
-    return value === other || value !== value && other !== other;
-  }
-  function isFunction2(value) {
-    var tag = isObject2(value) ? objectToString.call(value) : "";
-    return tag == funcTag || tag == genTag;
-  }
-  function isObject2(value) {
-    var type = typeof value;
-    return !!value && (type == "object" || type == "function");
-  }
-  function noop() {}
-  lodash_uniq = uniq;
-  return lodash_uniq;
-}
-function requireLodash_uniqwith() {
-  if (hasRequiredLodash_uniqwith)
-    return lodash_uniqwith;
-  hasRequiredLodash_uniqwith = 1;
-  var LARGE_ARRAY_SIZE = 200;
-  var HASH_UNDEFINED = "__lodash_hash_undefined__";
-  var INFINITY = 1 / 0;
-  var funcTag = "[object Function]", genTag = "[object GeneratorFunction]";
-  var reRegExpChar = /[\\^$.*+?()[\]{}|]/g;
-  var reIsHostCtor = /^\[object .+?Constructor\]$/;
-  var freeGlobal = typeof commonjsGlobal == "object" && commonjsGlobal && commonjsGlobal.Object === Object && commonjsGlobal;
-  var freeSelf = typeof self == "object" && self && self.Object === Object && self;
-  var root = freeGlobal || freeSelf || Function("return this")();
-  function arrayIncludes(array, value) {
-    var length = array ? array.length : 0;
-    return !!length && baseIndexOf(array, value, 0) > -1;
-  }
-  function arrayIncludesWith(array, value, comparator) {
-    var index = -1, length = array ? array.length : 0;
-    while (++index < length) {
-      if (comparator(value, array[index])) {
-        return true;
-      }
-    }
-    return false;
-  }
-  function baseFindIndex(array, predicate, fromIndex, fromRight) {
-    var length = array.length, index = fromIndex + -1;
-    while (++index < length) {
-      if (predicate(array[index], index, array)) {
-        return index;
-      }
-    }
-    return -1;
-  }
-  function baseIndexOf(array, value, fromIndex) {
-    if (value !== value) {
-      return baseFindIndex(array, baseIsNaN, fromIndex);
-    }
-    var index = fromIndex - 1, length = array.length;
-    while (++index < length) {
-      if (array[index] === value) {
-        return index;
-      }
-    }
-    return -1;
-  }
-  function baseIsNaN(value) {
-    return value !== value;
-  }
-  function cacheHas(cache, key) {
-    return cache.has(key);
-  }
-  function getValue(object, key) {
-    return object == null ? undefined : object[key];
-  }
-  function isHostObject(value) {
-    var result = false;
-    if (value != null && typeof value.toString != "function") {
-      try {
-        result = !!(value + "");
-      } catch (e) {}
-    }
-    return result;
-  }
-  function setToArray(set) {
-    var index = -1, result = Array(set.size);
-    set.forEach(function(value) {
-      result[++index] = value;
-    });
-    return result;
-  }
-  var arrayProto = Array.prototype, funcProto = Function.prototype, objectProto = Object.prototype;
-  var coreJsData = root["__core-js_shared__"];
-  var maskSrcKey = function() {
-    var uid = /[^.]+$/.exec(coreJsData && coreJsData.keys && coreJsData.keys.IE_PROTO || "");
-    return uid ? "Symbol(src)_1." + uid : "";
-  }();
-  var funcToString = funcProto.toString;
-  var hasOwnProperty = objectProto.hasOwnProperty;
-  var objectToString = objectProto.toString;
-  var reIsNative = RegExp("^" + funcToString.call(hasOwnProperty).replace(reRegExpChar, "\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, "$1.*?") + "$");
-  var splice = arrayProto.splice;
-  var Map2 = getNative(root, "Map"), Set2 = getNative(root, "Set"), nativeCreate = getNative(Object, "create");
-  function Hash(entries) {
-    var index = -1, length = entries ? entries.length : 0;
-    this.clear();
-    while (++index < length) {
-      var entry = entries[index];
-      this.set(entry[0], entry[1]);
-    }
-  }
-  function hashClear() {
-    this.__data__ = nativeCreate ? nativeCreate(null) : {};
-  }
-  function hashDelete(key) {
-    return this.has(key) && delete this.__data__[key];
-  }
-  function hashGet(key) {
-    var data = this.__data__;
-    if (nativeCreate) {
-      var result = data[key];
-      return result === HASH_UNDEFINED ? undefined : result;
-    }
-    return hasOwnProperty.call(data, key) ? data[key] : undefined;
-  }
-  function hashHas(key) {
-    var data = this.__data__;
-    return nativeCreate ? data[key] !== undefined : hasOwnProperty.call(data, key);
-  }
-  function hashSet(key, value) {
-    var data = this.__data__;
-    data[key] = nativeCreate && value === undefined ? HASH_UNDEFINED : value;
-    return this;
-  }
-  Hash.prototype.clear = hashClear;
-  Hash.prototype["delete"] = hashDelete;
-  Hash.prototype.get = hashGet;
-  Hash.prototype.has = hashHas;
-  Hash.prototype.set = hashSet;
-  function ListCache(entries) {
-    var index = -1, length = entries ? entries.length : 0;
-    this.clear();
-    while (++index < length) {
-      var entry = entries[index];
-      this.set(entry[0], entry[1]);
-    }
-  }
-  function listCacheClear() {
-    this.__data__ = [];
-  }
-  function listCacheDelete(key) {
-    var data = this.__data__, index = assocIndexOf(data, key);
-    if (index < 0) {
-      return false;
-    }
-    var lastIndex = data.length - 1;
-    if (index == lastIndex) {
-      data.pop();
-    } else {
-      splice.call(data, index, 1);
-    }
-    return true;
-  }
-  function listCacheGet(key) {
-    var data = this.__data__, index = assocIndexOf(data, key);
-    return index < 0 ? undefined : data[index][1];
-  }
-  function listCacheHas(key) {
-    return assocIndexOf(this.__data__, key) > -1;
-  }
-  function listCacheSet(key, value) {
-    var data = this.__data__, index = assocIndexOf(data, key);
-    if (index < 0) {
-      data.push([key, value]);
-    } else {
-      data[index][1] = value;
-    }
-    return this;
-  }
-  ListCache.prototype.clear = listCacheClear;
-  ListCache.prototype["delete"] = listCacheDelete;
-  ListCache.prototype.get = listCacheGet;
-  ListCache.prototype.has = listCacheHas;
-  ListCache.prototype.set = listCacheSet;
-  function MapCache(entries) {
-    var index = -1, length = entries ? entries.length : 0;
-    this.clear();
-    while (++index < length) {
-      var entry = entries[index];
-      this.set(entry[0], entry[1]);
-    }
-  }
-  function mapCacheClear() {
-    this.__data__ = {
-      hash: new Hash,
-      map: new (Map2 || ListCache),
-      string: new Hash
-    };
-  }
-  function mapCacheDelete(key) {
-    return getMapData(this, key)["delete"](key);
-  }
-  function mapCacheGet(key) {
-    return getMapData(this, key).get(key);
-  }
-  function mapCacheHas(key) {
-    return getMapData(this, key).has(key);
-  }
-  function mapCacheSet(key, value) {
-    getMapData(this, key).set(key, value);
-    return this;
-  }
-  MapCache.prototype.clear = mapCacheClear;
-  MapCache.prototype["delete"] = mapCacheDelete;
-  MapCache.prototype.get = mapCacheGet;
-  MapCache.prototype.has = mapCacheHas;
-  MapCache.prototype.set = mapCacheSet;
-  function SetCache(values) {
-    var index = -1, length = values ? values.length : 0;
-    this.__data__ = new MapCache;
-    while (++index < length) {
-      this.add(values[index]);
-    }
-  }
-  function setCacheAdd(value) {
-    this.__data__.set(value, HASH_UNDEFINED);
-    return this;
-  }
-  function setCacheHas(value) {
-    return this.__data__.has(value);
-  }
-  SetCache.prototype.add = SetCache.prototype.push = setCacheAdd;
-  SetCache.prototype.has = setCacheHas;
-  function assocIndexOf(array, key) {
-    var length = array.length;
-    while (length--) {
-      if (eq(array[length][0], key)) {
-        return length;
-      }
-    }
-    return -1;
-  }
-  function baseIsNative(value) {
-    if (!isObject2(value) || isMasked(value)) {
-      return false;
-    }
-    var pattern = isFunction2(value) || isHostObject(value) ? reIsNative : reIsHostCtor;
-    return pattern.test(toSource(value));
-  }
-  function baseUniq(array, iteratee, comparator) {
-    var index = -1, includes2 = arrayIncludes, length = array.length, isCommon = true, result = [], seen = result;
-    if (comparator) {
-      isCommon = false;
-      includes2 = arrayIncludesWith;
-    } else if (length >= LARGE_ARRAY_SIZE) {
-      var set = createSet(array);
-      if (set) {
-        return setToArray(set);
-      }
-      isCommon = false;
-      includes2 = cacheHas;
-      seen = new SetCache;
-    } else {
-      seen = result;
-    }
-    outer:
-      while (++index < length) {
-        var value = array[index], computed = value;
-        value = comparator || value !== 0 ? value : 0;
-        if (isCommon && computed === computed) {
-          var seenIndex = seen.length;
-          while (seenIndex--) {
-            if (seen[seenIndex] === computed) {
-              continue outer;
-            }
-          }
-          result.push(value);
-        } else if (!includes2(seen, computed, comparator)) {
-          if (seen !== result) {
-            seen.push(computed);
-          }
-          result.push(value);
-        }
-      }
-    return result;
-  }
-  var createSet = !(Set2 && 1 / setToArray(new Set2([, -0]))[1] == INFINITY) ? noop : function(values) {
-    return new Set2(values);
-  };
-  function getMapData(map, key) {
-    var data = map.__data__;
-    return isKeyable(key) ? data[typeof key == "string" ? "string" : "hash"] : data.map;
-  }
-  function getNative(object, key) {
-    var value = getValue(object, key);
-    return baseIsNative(value) ? value : undefined;
-  }
-  function isKeyable(value) {
-    var type = typeof value;
-    return type == "string" || type == "number" || type == "symbol" || type == "boolean" ? value !== "__proto__" : value === null;
-  }
-  function isMasked(func) {
-    return !!maskSrcKey && maskSrcKey in func;
-  }
-  function toSource(func) {
-    if (func != null) {
-      try {
-        return funcToString.call(func);
-      } catch (e) {}
-      try {
-        return func + "";
-      } catch (e) {}
-    }
-    return "";
-  }
-  function uniqWith(array, comparator) {
-    return array && array.length ? baseUniq(array, undefined, comparator) : [];
-  }
-  function eq(value, other) {
-    return value === other || value !== value && other !== other;
-  }
-  function isFunction2(value) {
-    var tag = isObject2(value) ? objectToString.call(value) : "";
-    return tag == funcTag || tag == genTag;
-  }
-  function isObject2(value) {
-    var type = typeof value;
-    return !!value && (type == "object" || type == "function");
-  }
-  function noop() {}
-  lodash_uniqwith = uniqWith;
-  return lodash_uniqwith;
-}
-function requireLodash_sortby() {
-  if (hasRequiredLodash_sortby)
-    return lodash_sortby.exports;
-  hasRequiredLodash_sortby = 1;
-  (function(module, exports$1) {
-    var LARGE_ARRAY_SIZE = 200;
-    var FUNC_ERROR_TEXT = "Expected a function";
-    var HASH_UNDEFINED = "__lodash_hash_undefined__";
-    var UNORDERED_COMPARE_FLAG = 1, PARTIAL_COMPARE_FLAG = 2;
-    var MAX_SAFE_INTEGER = 9007199254740991;
-    var argsTag = "[object Arguments]", arrayTag = "[object Array]", boolTag = "[object Boolean]", dateTag = "[object Date]", errorTag = "[object Error]", funcTag = "[object Function]", genTag = "[object GeneratorFunction]", mapTag = "[object Map]", numberTag = "[object Number]", objectTag = "[object Object]", promiseTag = "[object Promise]", regexpTag = "[object RegExp]", setTag = "[object Set]", stringTag = "[object String]", symbolTag = "[object Symbol]", weakMapTag = "[object WeakMap]";
-    var arrayBufferTag = "[object ArrayBuffer]", dataViewTag = "[object DataView]", float32Tag = "[object Float32Array]", float64Tag = "[object Float64Array]", int8Tag = "[object Int8Array]", int16Tag = "[object Int16Array]", int32Tag = "[object Int32Array]", uint8Tag = "[object Uint8Array]", uint8ClampedTag = "[object Uint8ClampedArray]", uint16Tag = "[object Uint16Array]", uint32Tag = "[object Uint32Array]";
-    var reIsDeepProp = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/, reIsPlainProp = /^\w*$/, reLeadingDot = /^\./, rePropName = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g;
-    var reRegExpChar = /[\\^$.*+?()[\]{}|]/g;
-    var reEscapeChar = /\\(\\)?/g;
-    var reIsHostCtor = /^\[object .+?Constructor\]$/;
-    var reIsUint = /^(?:0|[1-9]\d*)$/;
-    var typedArrayTags = {};
-    typedArrayTags[float32Tag] = typedArrayTags[float64Tag] = typedArrayTags[int8Tag] = typedArrayTags[int16Tag] = typedArrayTags[int32Tag] = typedArrayTags[uint8Tag] = typedArrayTags[uint8ClampedTag] = typedArrayTags[uint16Tag] = typedArrayTags[uint32Tag] = true;
-    typedArrayTags[argsTag] = typedArrayTags[arrayTag] = typedArrayTags[arrayBufferTag] = typedArrayTags[boolTag] = typedArrayTags[dataViewTag] = typedArrayTags[dateTag] = typedArrayTags[errorTag] = typedArrayTags[funcTag] = typedArrayTags[mapTag] = typedArrayTags[numberTag] = typedArrayTags[objectTag] = typedArrayTags[regexpTag] = typedArrayTags[setTag] = typedArrayTags[stringTag] = typedArrayTags[weakMapTag] = false;
-    var freeGlobal = typeof commonjsGlobal == "object" && commonjsGlobal && commonjsGlobal.Object === Object && commonjsGlobal;
-    var freeSelf = typeof self == "object" && self && self.Object === Object && self;
-    var root = freeGlobal || freeSelf || Function("return this")();
-    var freeExports = exports$1 && !exports$1.nodeType && exports$1;
-    var freeModule = freeExports && true && module && !module.nodeType && module;
-    var moduleExports = freeModule && freeModule.exports === freeExports;
-    var freeProcess = moduleExports && freeGlobal.process;
-    var nodeUtil = function() {
-      try {
-        return freeProcess && freeProcess.binding("util");
-      } catch (e) {}
-    }();
-    var nodeIsTypedArray = nodeUtil && nodeUtil.isTypedArray;
-    function apply(func, thisArg, args) {
-      switch (args.length) {
-        case 0:
-          return func.call(thisArg);
-        case 1:
-          return func.call(thisArg, args[0]);
-        case 2:
-          return func.call(thisArg, args[0], args[1]);
-        case 3:
-          return func.call(thisArg, args[0], args[1], args[2]);
-      }
-      return func.apply(thisArg, args);
-    }
-    function arrayMap(array, iteratee) {
-      var index = -1, length = array ? array.length : 0, result = Array(length);
-      while (++index < length) {
-        result[index] = iteratee(array[index], index, array);
-      }
-      return result;
-    }
-    function arrayPush(array, values) {
-      var index = -1, length = values.length, offset = array.length;
-      while (++index < length) {
-        array[offset + index] = values[index];
-      }
-      return array;
-    }
-    function arraySome(array, predicate) {
-      var index = -1, length = array ? array.length : 0;
-      while (++index < length) {
-        if (predicate(array[index], index, array)) {
-          return true;
-        }
-      }
-      return false;
-    }
-    function baseProperty(key) {
-      return function(object) {
-        return object == null ? undefined : object[key];
-      };
-    }
-    function baseSortBy(array, comparer) {
-      var length = array.length;
-      array.sort(comparer);
-      while (length--) {
-        array[length] = array[length].value;
-      }
-      return array;
-    }
-    function baseTimes(n, iteratee) {
-      var index = -1, result = Array(n);
-      while (++index < n) {
-        result[index] = iteratee(index);
-      }
-      return result;
-    }
-    function baseUnary(func) {
-      return function(value) {
-        return func(value);
-      };
-    }
-    function getValue(object, key) {
-      return object == null ? undefined : object[key];
-    }
-    function isHostObject(value) {
-      var result = false;
-      if (value != null && typeof value.toString != "function") {
-        try {
-          result = !!(value + "");
-        } catch (e) {}
-      }
-      return result;
-    }
-    function mapToArray(map) {
-      var index = -1, result = Array(map.size);
-      map.forEach(function(value, key) {
-        result[++index] = [key, value];
-      });
-      return result;
-    }
-    function overArg(func, transform) {
-      return function(arg) {
-        return func(transform(arg));
-      };
-    }
-    function setToArray(set) {
-      var index = -1, result = Array(set.size);
-      set.forEach(function(value) {
-        result[++index] = value;
-      });
-      return result;
-    }
-    var arrayProto = Array.prototype, funcProto = Function.prototype, objectProto = Object.prototype;
-    var coreJsData = root["__core-js_shared__"];
-    var maskSrcKey = function() {
-      var uid = /[^.]+$/.exec(coreJsData && coreJsData.keys && coreJsData.keys.IE_PROTO || "");
-      return uid ? "Symbol(src)_1." + uid : "";
-    }();
-    var funcToString = funcProto.toString;
-    var hasOwnProperty = objectProto.hasOwnProperty;
-    var objectToString = objectProto.toString;
-    var reIsNative = RegExp("^" + funcToString.call(hasOwnProperty).replace(reRegExpChar, "\\$&").replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, "$1.*?") + "$");
-    var { Symbol: Symbol2, Uint8Array: Uint8Array2 } = root, propertyIsEnumerable = objectProto.propertyIsEnumerable, splice = arrayProto.splice, spreadableSymbol = Symbol2 ? Symbol2.isConcatSpreadable : undefined;
-    var nativeKeys = overArg(Object.keys, Object), nativeMax = Math.max;
-    var DataView2 = getNative(root, "DataView"), Map2 = getNative(root, "Map"), Promise2 = getNative(root, "Promise"), Set2 = getNative(root, "Set"), WeakMap2 = getNative(root, "WeakMap"), nativeCreate = getNative(Object, "create");
-    var dataViewCtorString = toSource(DataView2), mapCtorString = toSource(Map2), promiseCtorString = toSource(Promise2), setCtorString = toSource(Set2), weakMapCtorString = toSource(WeakMap2);
-    var symbolProto = Symbol2 ? Symbol2.prototype : undefined, symbolValueOf = symbolProto ? symbolProto.valueOf : undefined, symbolToString = symbolProto ? symbolProto.toString : undefined;
-    function Hash(entries) {
-      var index = -1, length = entries ? entries.length : 0;
-      this.clear();
-      while (++index < length) {
-        var entry = entries[index];
-        this.set(entry[0], entry[1]);
-      }
-    }
-    function hashClear() {
-      this.__data__ = nativeCreate ? nativeCreate(null) : {};
-    }
-    function hashDelete(key) {
-      return this.has(key) && delete this.__data__[key];
-    }
-    function hashGet(key) {
-      var data = this.__data__;
-      if (nativeCreate) {
-        var result = data[key];
-        return result === HASH_UNDEFINED ? undefined : result;
-      }
-      return hasOwnProperty.call(data, key) ? data[key] : undefined;
-    }
-    function hashHas(key) {
-      var data = this.__data__;
-      return nativeCreate ? data[key] !== undefined : hasOwnProperty.call(data, key);
-    }
-    function hashSet(key, value) {
-      var data = this.__data__;
-      data[key] = nativeCreate && value === undefined ? HASH_UNDEFINED : value;
-      return this;
-    }
-    Hash.prototype.clear = hashClear;
-    Hash.prototype["delete"] = hashDelete;
-    Hash.prototype.get = hashGet;
-    Hash.prototype.has = hashHas;
-    Hash.prototype.set = hashSet;
-    function ListCache(entries) {
-      var index = -1, length = entries ? entries.length : 0;
-      this.clear();
-      while (++index < length) {
-        var entry = entries[index];
-        this.set(entry[0], entry[1]);
-      }
-    }
-    function listCacheClear() {
-      this.__data__ = [];
-    }
-    function listCacheDelete(key) {
-      var data = this.__data__, index = assocIndexOf(data, key);
-      if (index < 0) {
-        return false;
-      }
-      var lastIndex = data.length - 1;
-      if (index == lastIndex) {
-        data.pop();
-      } else {
-        splice.call(data, index, 1);
-      }
-      return true;
-    }
-    function listCacheGet(key) {
-      var data = this.__data__, index = assocIndexOf(data, key);
-      return index < 0 ? undefined : data[index][1];
-    }
-    function listCacheHas(key) {
-      return assocIndexOf(this.__data__, key) > -1;
-    }
-    function listCacheSet(key, value) {
-      var data = this.__data__, index = assocIndexOf(data, key);
-      if (index < 0) {
-        data.push([key, value]);
-      } else {
-        data[index][1] = value;
-      }
-      return this;
-    }
-    ListCache.prototype.clear = listCacheClear;
-    ListCache.prototype["delete"] = listCacheDelete;
-    ListCache.prototype.get = listCacheGet;
-    ListCache.prototype.has = listCacheHas;
-    ListCache.prototype.set = listCacheSet;
-    function MapCache(entries) {
-      var index = -1, length = entries ? entries.length : 0;
-      this.clear();
-      while (++index < length) {
-        var entry = entries[index];
-        this.set(entry[0], entry[1]);
-      }
-    }
-    function mapCacheClear() {
-      this.__data__ = {
-        hash: new Hash,
-        map: new (Map2 || ListCache),
-        string: new Hash
-      };
-    }
-    function mapCacheDelete(key) {
-      return getMapData(this, key)["delete"](key);
-    }
-    function mapCacheGet(key) {
-      return getMapData(this, key).get(key);
-    }
-    function mapCacheHas(key) {
-      return getMapData(this, key).has(key);
-    }
-    function mapCacheSet(key, value) {
-      getMapData(this, key).set(key, value);
-      return this;
-    }
-    MapCache.prototype.clear = mapCacheClear;
-    MapCache.prototype["delete"] = mapCacheDelete;
-    MapCache.prototype.get = mapCacheGet;
-    MapCache.prototype.has = mapCacheHas;
-    MapCache.prototype.set = mapCacheSet;
-    function SetCache(values) {
-      var index = -1, length = values ? values.length : 0;
-      this.__data__ = new MapCache;
-      while (++index < length) {
-        this.add(values[index]);
-      }
-    }
-    function setCacheAdd(value) {
-      this.__data__.set(value, HASH_UNDEFINED);
-      return this;
-    }
-    function setCacheHas(value) {
-      return this.__data__.has(value);
-    }
-    SetCache.prototype.add = SetCache.prototype.push = setCacheAdd;
-    SetCache.prototype.has = setCacheHas;
-    function Stack(entries) {
-      this.__data__ = new ListCache(entries);
-    }
-    function stackClear() {
-      this.__data__ = new ListCache;
-    }
-    function stackDelete(key) {
-      return this.__data__["delete"](key);
-    }
-    function stackGet(key) {
-      return this.__data__.get(key);
-    }
-    function stackHas(key) {
-      return this.__data__.has(key);
-    }
-    function stackSet(key, value) {
-      var cache = this.__data__;
-      if (cache instanceof ListCache) {
-        var pairs = cache.__data__;
-        if (!Map2 || pairs.length < LARGE_ARRAY_SIZE - 1) {
-          pairs.push([key, value]);
-          return this;
-        }
-        cache = this.__data__ = new MapCache(pairs);
-      }
-      cache.set(key, value);
-      return this;
-    }
-    Stack.prototype.clear = stackClear;
-    Stack.prototype["delete"] = stackDelete;
-    Stack.prototype.get = stackGet;
-    Stack.prototype.has = stackHas;
-    Stack.prototype.set = stackSet;
-    function arrayLikeKeys(value, inherited) {
-      var result = isArray2(value) || isArguments(value) ? baseTimes(value.length, String) : [];
-      var length = result.length, skipIndexes = !!length;
-      for (var key in value) {
-        if (hasOwnProperty.call(value, key) && !(skipIndexes && (key == "length" || isIndex(key, length)))) {
-          result.push(key);
-        }
-      }
-      return result;
-    }
-    function assocIndexOf(array, key) {
-      var length = array.length;
-      while (length--) {
-        if (eq(array[length][0], key)) {
-          return length;
-        }
-      }
-      return -1;
-    }
-    var baseEach = createBaseEach(baseForOwn);
-    function baseFlatten(array, depth, predicate, isStrict, result) {
-      var index = -1, length = array.length;
-      predicate || (predicate = isFlattenable);
-      result || (result = []);
-      while (++index < length) {
-        var value = array[index];
-        if (predicate(value)) {
-          {
-            arrayPush(result, value);
-          }
-        } else {
-          result[result.length] = value;
-        }
-      }
-      return result;
-    }
-    var baseFor = createBaseFor();
-    function baseForOwn(object, iteratee) {
-      return object && baseFor(object, iteratee, keys);
-    }
-    function baseGet(object, path) {
-      path = isKey(path, object) ? [path] : castPath(path);
-      var index = 0, length = path.length;
-      while (object != null && index < length) {
-        object = object[toKey(path[index++])];
-      }
-      return index && index == length ? object : undefined;
-    }
-    function baseGetTag(value) {
-      return objectToString.call(value);
-    }
-    function baseHasIn(object, key) {
-      return object != null && key in Object(object);
-    }
-    function baseIsEqual(value, other, customizer, bitmask, stack) {
-      if (value === other) {
-        return true;
-      }
-      if (value == null || other == null || !isObject2(value) && !isObjectLike(other)) {
-        return value !== value && other !== other;
-      }
-      return baseIsEqualDeep(value, other, baseIsEqual, customizer, bitmask, stack);
-    }
-    function baseIsEqualDeep(object, other, equalFunc, customizer, bitmask, stack) {
-      var objIsArr = isArray2(object), othIsArr = isArray2(other), objTag = arrayTag, othTag = arrayTag;
-      if (!objIsArr) {
-        objTag = getTag(object);
-        objTag = objTag == argsTag ? objectTag : objTag;
-      }
-      if (!othIsArr) {
-        othTag = getTag(other);
-        othTag = othTag == argsTag ? objectTag : othTag;
-      }
-      var objIsObj = objTag == objectTag && !isHostObject(object), othIsObj = othTag == objectTag && !isHostObject(other), isSameTag = objTag == othTag;
-      if (isSameTag && !objIsObj) {
-        stack || (stack = new Stack);
-        return objIsArr || isTypedArray(object) ? equalArrays(object, other, equalFunc, customizer, bitmask, stack) : equalByTag(object, other, objTag, equalFunc, customizer, bitmask, stack);
-      }
-      if (!(bitmask & PARTIAL_COMPARE_FLAG)) {
-        var objIsWrapped = objIsObj && hasOwnProperty.call(object, "__wrapped__"), othIsWrapped = othIsObj && hasOwnProperty.call(other, "__wrapped__");
-        if (objIsWrapped || othIsWrapped) {
-          var objUnwrapped = objIsWrapped ? object.value() : object, othUnwrapped = othIsWrapped ? other.value() : other;
-          stack || (stack = new Stack);
-          return equalFunc(objUnwrapped, othUnwrapped, customizer, bitmask, stack);
-        }
-      }
-      if (!isSameTag) {
-        return false;
-      }
-      stack || (stack = new Stack);
-      return equalObjects(object, other, equalFunc, customizer, bitmask, stack);
-    }
-    function baseIsMatch(object, source, matchData, customizer) {
-      var index = matchData.length, length = index;
-      if (object == null) {
-        return !length;
-      }
-      object = Object(object);
-      while (index--) {
-        var data = matchData[index];
-        if (data[2] ? data[1] !== object[data[0]] : !(data[0] in object)) {
-          return false;
-        }
-      }
-      while (++index < length) {
-        data = matchData[index];
-        var key = data[0], objValue = object[key], srcValue = data[1];
-        if (data[2]) {
-          if (objValue === undefined && !(key in object)) {
-            return false;
-          }
-        } else {
-          var stack = new Stack;
-          var result;
-          if (!(result === undefined ? baseIsEqual(srcValue, objValue, customizer, UNORDERED_COMPARE_FLAG | PARTIAL_COMPARE_FLAG, stack) : result)) {
-            return false;
-          }
-        }
-      }
-      return true;
-    }
-    function baseIsNative(value) {
-      if (!isObject2(value) || isMasked(value)) {
-        return false;
-      }
-      var pattern = isFunction2(value) || isHostObject(value) ? reIsNative : reIsHostCtor;
-      return pattern.test(toSource(value));
-    }
-    function baseIsTypedArray(value) {
-      return isObjectLike(value) && isLength(value.length) && !!typedArrayTags[objectToString.call(value)];
-    }
-    function baseIteratee(value) {
-      if (typeof value == "function") {
-        return value;
-      }
-      if (value == null) {
-        return identity;
-      }
-      if (typeof value == "object") {
-        return isArray2(value) ? baseMatchesProperty(value[0], value[1]) : baseMatches(value);
-      }
-      return property(value);
-    }
-    function baseKeys(object) {
-      if (!isPrototype(object)) {
-        return nativeKeys(object);
-      }
-      var result = [];
-      for (var key in Object(object)) {
-        if (hasOwnProperty.call(object, key) && key != "constructor") {
-          result.push(key);
-        }
-      }
-      return result;
-    }
-    function baseMap(collection, iteratee) {
-      var index = -1, result = isArrayLike(collection) ? Array(collection.length) : [];
-      baseEach(collection, function(value, key, collection2) {
-        result[++index] = iteratee(value, key, collection2);
-      });
-      return result;
-    }
-    function baseMatches(source) {
-      var matchData = getMatchData(source);
-      if (matchData.length == 1 && matchData[0][2]) {
-        return matchesStrictComparable(matchData[0][0], matchData[0][1]);
-      }
-      return function(object) {
-        return object === source || baseIsMatch(object, source, matchData);
-      };
-    }
-    function baseMatchesProperty(path, srcValue) {
-      if (isKey(path) && isStrictComparable(srcValue)) {
-        return matchesStrictComparable(toKey(path), srcValue);
-      }
-      return function(object) {
-        var objValue = get(object, path);
-        return objValue === undefined && objValue === srcValue ? hasIn(object, path) : baseIsEqual(srcValue, objValue, undefined, UNORDERED_COMPARE_FLAG | PARTIAL_COMPARE_FLAG);
-      };
-    }
-    function baseOrderBy(collection, iteratees, orders) {
-      var index = -1;
-      iteratees = arrayMap(iteratees.length ? iteratees : [identity], baseUnary(baseIteratee));
-      var result = baseMap(collection, function(value, key, collection2) {
-        var criteria = arrayMap(iteratees, function(iteratee) {
-          return iteratee(value);
-        });
-        return { criteria, index: ++index, value };
-      });
-      return baseSortBy(result, function(object, other) {
-        return compareMultiple(object, other, orders);
-      });
-    }
-    function basePropertyDeep(path) {
-      return function(object) {
-        return baseGet(object, path);
-      };
-    }
-    function baseRest(func, start) {
-      start = nativeMax(start === undefined ? func.length - 1 : start, 0);
-      return function() {
-        var args = arguments, index = -1, length = nativeMax(args.length - start, 0), array = Array(length);
-        while (++index < length) {
-          array[index] = args[start + index];
-        }
-        index = -1;
-        var otherArgs = Array(start + 1);
-        while (++index < start) {
-          otherArgs[index] = args[index];
-        }
-        otherArgs[start] = array;
-        return apply(func, this, otherArgs);
-      };
-    }
-    function baseToString(value) {
-      if (typeof value == "string") {
-        return value;
-      }
-      if (isSymbol(value)) {
-        return symbolToString ? symbolToString.call(value) : "";
-      }
-      var result = value + "";
-      return result == "0" && 1 / value == -Infinity ? "-0" : result;
-    }
-    function castPath(value) {
-      return isArray2(value) ? value : stringToPath(value);
-    }
-    function compareAscending(value, other) {
-      if (value !== other) {
-        var valIsDefined = value !== undefined, valIsNull = value === null, valIsReflexive = value === value, valIsSymbol = isSymbol(value);
-        var othIsDefined = other !== undefined, othIsNull = other === null, othIsReflexive = other === other, othIsSymbol = isSymbol(other);
-        if (!othIsNull && !othIsSymbol && !valIsSymbol && value > other || valIsSymbol && othIsDefined && othIsReflexive && !othIsNull && !othIsSymbol || valIsNull && othIsDefined && othIsReflexive || !valIsDefined && othIsReflexive || !valIsReflexive) {
-          return 1;
-        }
-        if (!valIsNull && !valIsSymbol && !othIsSymbol && value < other || othIsSymbol && valIsDefined && valIsReflexive && !valIsNull && !valIsSymbol || othIsNull && valIsDefined && valIsReflexive || !othIsDefined && valIsReflexive || !othIsReflexive) {
-          return -1;
-        }
-      }
-      return 0;
-    }
-    function compareMultiple(object, other, orders) {
-      var index = -1, objCriteria = object.criteria, othCriteria = other.criteria, length = objCriteria.length, ordersLength = orders.length;
-      while (++index < length) {
-        var result = compareAscending(objCriteria[index], othCriteria[index]);
-        if (result) {
-          if (index >= ordersLength) {
-            return result;
-          }
-          var order = orders[index];
-          return result * (order == "desc" ? -1 : 1);
-        }
-      }
-      return object.index - other.index;
-    }
-    function createBaseEach(eachFunc, fromRight) {
-      return function(collection, iteratee) {
-        if (collection == null) {
-          return collection;
-        }
-        if (!isArrayLike(collection)) {
-          return eachFunc(collection, iteratee);
-        }
-        var length = collection.length, index = -1, iterable = Object(collection);
-        while (++index < length) {
-          if (iteratee(iterable[index], index, iterable) === false) {
-            break;
-          }
-        }
-        return collection;
-      };
-    }
-    function createBaseFor(fromRight) {
-      return function(object, iteratee, keysFunc) {
-        var index = -1, iterable = Object(object), props = keysFunc(object), length = props.length;
-        while (length--) {
-          var key = props[++index];
-          if (iteratee(iterable[key], key, iterable) === false) {
-            break;
-          }
-        }
-        return object;
-      };
-    }
-    function equalArrays(array, other, equalFunc, customizer, bitmask, stack) {
-      var isPartial = bitmask & PARTIAL_COMPARE_FLAG, arrLength = array.length, othLength = other.length;
-      if (arrLength != othLength && !(isPartial && othLength > arrLength)) {
-        return false;
-      }
-      var stacked = stack.get(array);
-      if (stacked && stack.get(other)) {
-        return stacked == other;
-      }
-      var index = -1, result = true, seen = bitmask & UNORDERED_COMPARE_FLAG ? new SetCache : undefined;
-      stack.set(array, other);
-      stack.set(other, array);
-      while (++index < arrLength) {
-        var arrValue = array[index], othValue = other[index];
-        if (customizer) {
-          var compared = isPartial ? customizer(othValue, arrValue, index, other, array, stack) : customizer(arrValue, othValue, index, array, other, stack);
-        }
-        if (compared !== undefined) {
-          if (compared) {
-            continue;
-          }
-          result = false;
-          break;
-        }
-        if (seen) {
-          if (!arraySome(other, function(othValue2, othIndex) {
-            if (!seen.has(othIndex) && (arrValue === othValue2 || equalFunc(arrValue, othValue2, customizer, bitmask, stack))) {
-              return seen.add(othIndex);
-            }
-          })) {
-            result = false;
-            break;
-          }
-        } else if (!(arrValue === othValue || equalFunc(arrValue, othValue, customizer, bitmask, stack))) {
-          result = false;
-          break;
-        }
-      }
-      stack["delete"](array);
-      stack["delete"](other);
-      return result;
-    }
-    function equalByTag(object, other, tag, equalFunc, customizer, bitmask, stack) {
-      switch (tag) {
-        case dataViewTag:
-          if (object.byteLength != other.byteLength || object.byteOffset != other.byteOffset) {
-            return false;
-          }
-          object = object.buffer;
-          other = other.buffer;
-        case arrayBufferTag:
-          if (object.byteLength != other.byteLength || !equalFunc(new Uint8Array2(object), new Uint8Array2(other))) {
-            return false;
-          }
-          return true;
-        case boolTag:
-        case dateTag:
-        case numberTag:
-          return eq(+object, +other);
-        case errorTag:
-          return object.name == other.name && object.message == other.message;
-        case regexpTag:
-        case stringTag:
-          return object == other + "";
-        case mapTag:
-          var convert = mapToArray;
-        case setTag:
-          var isPartial = bitmask & PARTIAL_COMPARE_FLAG;
-          convert || (convert = setToArray);
-          if (object.size != other.size && !isPartial) {
-            return false;
-          }
-          var stacked = stack.get(object);
-          if (stacked) {
-            return stacked == other;
-          }
-          bitmask |= UNORDERED_COMPARE_FLAG;
-          stack.set(object, other);
-          var result = equalArrays(convert(object), convert(other), equalFunc, customizer, bitmask, stack);
-          stack["delete"](object);
-          return result;
-        case symbolTag:
-          if (symbolValueOf) {
-            return symbolValueOf.call(object) == symbolValueOf.call(other);
-          }
-      }
-      return false;
-    }
-    function equalObjects(object, other, equalFunc, customizer, bitmask, stack) {
-      var isPartial = bitmask & PARTIAL_COMPARE_FLAG, objProps = keys(object), objLength = objProps.length, othProps = keys(other), othLength = othProps.length;
-      if (objLength != othLength && !isPartial) {
-        return false;
-      }
-      var index = objLength;
-      while (index--) {
-        var key = objProps[index];
-        if (!(isPartial ? key in other : hasOwnProperty.call(other, key))) {
-          return false;
-        }
-      }
-      var stacked = stack.get(object);
-      if (stacked && stack.get(other)) {
-        return stacked == other;
-      }
-      var result = true;
-      stack.set(object, other);
-      stack.set(other, object);
-      var skipCtor = isPartial;
-      while (++index < objLength) {
-        key = objProps[index];
-        var objValue = object[key], othValue = other[key];
-        if (customizer) {
-          var compared = isPartial ? customizer(othValue, objValue, key, other, object, stack) : customizer(objValue, othValue, key, object, other, stack);
-        }
-        if (!(compared === undefined ? objValue === othValue || equalFunc(objValue, othValue, customizer, bitmask, stack) : compared)) {
-          result = false;
-          break;
-        }
-        skipCtor || (skipCtor = key == "constructor");
-      }
-      if (result && !skipCtor) {
-        var objCtor = object.constructor, othCtor = other.constructor;
-        if (objCtor != othCtor && (("constructor" in object) && ("constructor" in other)) && !(typeof objCtor == "function" && objCtor instanceof objCtor && typeof othCtor == "function" && othCtor instanceof othCtor)) {
-          result = false;
-        }
-      }
-      stack["delete"](object);
-      stack["delete"](other);
-      return result;
-    }
-    function getMapData(map, key) {
-      var data = map.__data__;
-      return isKeyable(key) ? data[typeof key == "string" ? "string" : "hash"] : data.map;
-    }
-    function getMatchData(object) {
-      var result = keys(object), length = result.length;
-      while (length--) {
-        var key = result[length], value = object[key];
-        result[length] = [key, value, isStrictComparable(value)];
-      }
-      return result;
-    }
-    function getNative(object, key) {
-      var value = getValue(object, key);
-      return baseIsNative(value) ? value : undefined;
-    }
-    var getTag = baseGetTag;
-    if (DataView2 && getTag(new DataView2(new ArrayBuffer(1))) != dataViewTag || Map2 && getTag(new Map2) != mapTag || Promise2 && getTag(Promise2.resolve()) != promiseTag || Set2 && getTag(new Set2) != setTag || WeakMap2 && getTag(new WeakMap2) != weakMapTag) {
-      getTag = function(value) {
-        var result = objectToString.call(value), Ctor = result == objectTag ? value.constructor : undefined, ctorString = Ctor ? toSource(Ctor) : undefined;
-        if (ctorString) {
-          switch (ctorString) {
-            case dataViewCtorString:
-              return dataViewTag;
-            case mapCtorString:
-              return mapTag;
-            case promiseCtorString:
-              return promiseTag;
-            case setCtorString:
-              return setTag;
-            case weakMapCtorString:
-              return weakMapTag;
-          }
-        }
-        return result;
-      };
-    }
-    function hasPath(object, path, hasFunc) {
-      path = isKey(path, object) ? [path] : castPath(path);
-      var result, index = -1, length = path.length;
-      while (++index < length) {
-        var key = toKey(path[index]);
-        if (!(result = object != null && hasFunc(object, key))) {
-          break;
-        }
-        object = object[key];
-      }
-      if (result) {
-        return result;
-      }
-      var length = object ? object.length : 0;
-      return !!length && isLength(length) && isIndex(key, length) && (isArray2(object) || isArguments(object));
-    }
-    function isFlattenable(value) {
-      return isArray2(value) || isArguments(value) || !!(spreadableSymbol && value && value[spreadableSymbol]);
-    }
-    function isIndex(value, length) {
-      length = length == null ? MAX_SAFE_INTEGER : length;
-      return !!length && (typeof value == "number" || reIsUint.test(value)) && (value > -1 && value % 1 == 0 && value < length);
-    }
-    function isIterateeCall(value, index, object) {
-      if (!isObject2(object)) {
-        return false;
-      }
-      var type = typeof index;
-      if (type == "number" ? isArrayLike(object) && isIndex(index, object.length) : type == "string" && (index in object)) {
-        return eq(object[index], value);
-      }
-      return false;
-    }
-    function isKey(value, object) {
-      if (isArray2(value)) {
-        return false;
-      }
-      var type = typeof value;
-      if (type == "number" || type == "symbol" || type == "boolean" || value == null || isSymbol(value)) {
-        return true;
-      }
-      return reIsPlainProp.test(value) || !reIsDeepProp.test(value) || object != null && value in Object(object);
-    }
-    function isKeyable(value) {
-      var type = typeof value;
-      return type == "string" || type == "number" || type == "symbol" || type == "boolean" ? value !== "__proto__" : value === null;
-    }
-    function isMasked(func) {
-      return !!maskSrcKey && maskSrcKey in func;
-    }
-    function isPrototype(value) {
-      var Ctor = value && value.constructor, proto = typeof Ctor == "function" && Ctor.prototype || objectProto;
-      return value === proto;
-    }
-    function isStrictComparable(value) {
-      return value === value && !isObject2(value);
-    }
-    function matchesStrictComparable(key, srcValue) {
-      return function(object) {
-        if (object == null) {
-          return false;
-        }
-        return object[key] === srcValue && (srcValue !== undefined || (key in Object(object)));
-      };
-    }
-    var stringToPath = memoize(function(string) {
-      string = toString(string);
-      var result = [];
-      if (reLeadingDot.test(string)) {
-        result.push("");
-      }
-      string.replace(rePropName, function(match, number, quote, string2) {
-        result.push(quote ? string2.replace(reEscapeChar, "$1") : number || match);
-      });
-      return result;
-    });
-    function toKey(value) {
-      if (typeof value == "string" || isSymbol(value)) {
-        return value;
-      }
-      var result = value + "";
-      return result == "0" && 1 / value == -Infinity ? "-0" : result;
-    }
-    function toSource(func) {
-      if (func != null) {
-        try {
-          return funcToString.call(func);
-        } catch (e) {}
-        try {
-          return func + "";
-        } catch (e) {}
-      }
-      return "";
-    }
-    var sortBy = baseRest(function(collection, iteratees) {
-      if (collection == null) {
-        return [];
-      }
-      var length = iteratees.length;
-      if (length > 1 && isIterateeCall(collection, iteratees[0], iteratees[1])) {
-        iteratees = [];
-      } else if (length > 2 && isIterateeCall(iteratees[0], iteratees[1], iteratees[2])) {
-        iteratees = [iteratees[0]];
-      }
-      return baseOrderBy(collection, baseFlatten(iteratees), []);
-    });
-    function memoize(func, resolver) {
-      if (typeof func != "function" || resolver && typeof resolver != "function") {
-        throw new TypeError(FUNC_ERROR_TEXT);
-      }
-      var memoized = function() {
-        var args = arguments, key = resolver ? resolver.apply(this, args) : args[0], cache = memoized.cache;
-        if (cache.has(key)) {
-          return cache.get(key);
-        }
-        var result = func.apply(this, args);
-        memoized.cache = cache.set(key, result);
-        return result;
-      };
-      memoized.cache = new (memoize.Cache || MapCache);
-      return memoized;
-    }
-    memoize.Cache = MapCache;
-    function eq(value, other) {
-      return value === other || value !== value && other !== other;
-    }
-    function isArguments(value) {
-      return isArrayLikeObject(value) && hasOwnProperty.call(value, "callee") && (!propertyIsEnumerable.call(value, "callee") || objectToString.call(value) == argsTag);
-    }
-    var isArray2 = Array.isArray;
-    function isArrayLike(value) {
-      return value != null && isLength(value.length) && !isFunction2(value);
-    }
-    function isArrayLikeObject(value) {
-      return isObjectLike(value) && isArrayLike(value);
-    }
-    function isFunction2(value) {
-      var tag = isObject2(value) ? objectToString.call(value) : "";
-      return tag == funcTag || tag == genTag;
-    }
-    function isLength(value) {
-      return typeof value == "number" && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
-    }
-    function isObject2(value) {
-      var type = typeof value;
-      return !!value && (type == "object" || type == "function");
-    }
-    function isObjectLike(value) {
-      return !!value && typeof value == "object";
-    }
-    function isSymbol(value) {
-      return typeof value == "symbol" || isObjectLike(value) && objectToString.call(value) == symbolTag;
-    }
-    var isTypedArray = nodeIsTypedArray ? baseUnary(nodeIsTypedArray) : baseIsTypedArray;
-    function toString(value) {
-      return value == null ? "" : baseToString(value);
-    }
-    function get(object, path, defaultValue) {
-      var result = object == null ? undefined : baseGet(object, path);
-      return result === undefined ? defaultValue : result;
-    }
-    function hasIn(object, path) {
-      return object != null && hasPath(object, path, baseHasIn);
-    }
-    function keys(object) {
-      return isArrayLike(object) ? arrayLikeKeys(object) : baseKeys(object);
-    }
-    function identity(value) {
-      return value;
-    }
-    function property(path) {
-      return isKey(path) ? baseProperty(toKey(path)) : basePropertyDeep(path);
-    }
-    module.exports = sortBy;
-  })(lodash_sortby, lodash_sortby.exports);
-  return lodash_sortby.exports;
-}
-function requireEscapeStringRegexp() {
-  if (hasRequiredEscapeStringRegexp)
-    return escapeStringRegexp;
-  hasRequiredEscapeStringRegexp = 1;
-  escapeStringRegexp = (string) => {
-    if (typeof string !== "string") {
-      throw new TypeError("Expected a string");
-    }
-    return string.replace(/[|\\{}()[\]^$+*?.]/g, "\\$&").replace(/-/g, "\\x2d");
-  };
-  return escapeStringRegexp;
-}
-function requireRegexpParse() {
-  if (hasRequiredRegexpParse)
-    return regexpParse;
-  hasRequiredRegexpParse = 1;
-  Object.defineProperty(regexpParse, "__esModule", { value: true });
-  regexpParse.isRegExpString = regexpParse.parseRegExpString = undefined;
-  var REGEXP_LITERAL_PATTERN = /^\/(.+)\/([guimysd]*)$/;
-  var parseRegExpString = function(str) {
-    var result = str.match(REGEXP_LITERAL_PATTERN);
-    if (!result) {
-      return null;
-    }
-    return {
-      source: result[1],
-      flagString: result[2]
-    };
+    return "HASH{" + joinedPairs.join(", ") + "}";
   };
-  regexpParse.parseRegExpString = parseRegExpString;
-  var isRegExpString = function(str) {
-    return REGEXP_LITERAL_PATTERN.test(str);
+  PrintVisitor.prototype.HashPair = function(pair) {
+    return pair.key + "=" + this.accept(pair.value);
   };
-  regexpParse.isRegExpString = isRegExpString;
-  return regexpParse;
-}
-function requireRegexpStringMatcher() {
-  if (hasRequiredRegexpStringMatcher)
-    return regexpStringMatcher;
-  hasRequiredRegexpStringMatcher = 1;
-  (function(exports$1) {
-    var __importDefault = regexpStringMatcher && regexpStringMatcher.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { default: mod };
-    };
-    Object.defineProperty(exports$1, "__esModule", { value: true });
-    exports$1.matchPatterns = exports$1.createRegExp = undefined;
-    var lodash_uniq_1 = __importDefault(requireLodash_uniq());
-    var lodash_uniqwith_1 = __importDefault(requireLodash_uniqwith());
-    var lodash_sortby_1 = __importDefault(requireLodash_sortby());
-    var escape_string_regexp_1 = __importDefault(requireEscapeStringRegexp());
-    var regexp_parse_1 = requireRegexpParse();
-    var DEFAULT_FLAGS = "ug";
-    var defaultFlags = function(flagsString) {
-      if (flagsString.length === 0) {
-        return DEFAULT_FLAGS;
-      }
-      return (0, lodash_uniq_1.default)((flagsString + DEFAULT_FLAGS).split("")).join("");
-    };
-    var createRegExp = function(patternString, defaultFlag) {
-      if (defaultFlag === undefined) {
-        defaultFlag = DEFAULT_FLAGS;
-      }
-      if (patternString.length === 0) {
-        throw new Error("Empty string can not handled");
-      }
-      if ((0, regexp_parse_1.isRegExpString)(patternString)) {
-        var regExpStructure = (0, regexp_parse_1.parseRegExpString)(patternString);
-        if (regExpStructure) {
-          return new RegExp(regExpStructure.source, defaultFlags(regExpStructure.flagString));
-        }
-        throw new Error('"'.concat(patternString, '" can not parse as RegExp.'));
-      } else {
-        return new RegExp((0, escape_string_regexp_1.default)(patternString), defaultFlag);
-      }
-    };
-    exports$1.createRegExp = createRegExp;
-    var isEqualMatchPatternResult = function(a, b) {
-      return a.startIndex === b.startIndex && a.endIndex === b.endIndex && a.match === b.match;
-    };
-    var matchPatterns = function(text, regExpLikeStrings) {
-      var matchPatternResults = [];
-      regExpLikeStrings.map(function(patternString) {
-        return (0, exports$1.createRegExp)(patternString);
-      }).forEach(function(regExp) {
-        var results = text.matchAll(regExp);
-        Array.from(results).forEach(function(result) {
-          if (result.index === undefined) {
-            return;
-          }
-          var match = result[0];
-          var index = result.index;
-          matchPatternResults.push({
-            match,
-            captures: result.slice(1),
-            startIndex: index,
-            endIndex: index + match.length
-          });
-        });
-      });
-      var uniqResults = (0, lodash_uniqwith_1.default)(matchPatternResults, isEqualMatchPatternResult);
-      return (0, lodash_sortby_1.default)(uniqResults, ["startIndex", "endIndex"]);
-    };
-    exports$1.matchPatterns = matchPatterns;
-  })(regexpStringMatcher);
-  return regexpStringMatcher;
-}
-var commonjsGlobal, regexpStringMatcher, lodash_uniq, hasRequiredLodash_uniq, lodash_uniqwith, hasRequiredLodash_uniqwith, lodash_sortby, hasRequiredLodash_sortby, escapeStringRegexp, hasRequiredEscapeStringRegexp, regexpParse, hasRequiredRegexpParse, hasRequiredRegexpStringMatcher, regexpStringMatcherExports, OID_DATA, OID_SHA1, OID_SHA256, OID_SHA384, OID_SHA512, typeMap;
-var init_module2 = __esm(() => {
-  commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : {};
-  regexpStringMatcher = {};
-  lodash_sortby = { exports: {} };
-  lodash_sortby.exports;
-  regexpParse = {};
-  regexpStringMatcherExports = requireRegexpStringMatcher();
-  OID_DATA = new Uint8Array([42, 134, 72, 134, 247, 13, 1, 7, 1]);
-  OID_SHA1 = new Uint8Array([43, 14, 3, 2, 26]);
-  OID_SHA256 = new Uint8Array([96, 134, 72, 1, 101, 3, 4, 2, 1]);
-  OID_SHA384 = new Uint8Array([96, 134, 72, 1, 101, 3, 4, 2, 2]);
-  OID_SHA512 = new Uint8Array([96, 134, 72, 1, 101, 3, 4, 2, 3]);
-  typeMap = new Map([
-    ["ghp", "GitHub personal access tokens"],
-    ["gho", "OAuth access tokens"],
-    ["ghu", "GitHub user-to-server tokens"],
-    ["ghs", "GitHub server-to-server tokens"],
-    ["ghr", "refresh tokens"],
-    ["github_pat", "fine-grained personal access tokens"]
-  ]);
-});
-
-// telegram-plugin/secret-detect/secretlint-source.ts
-var init_secretlint_source = __esm(() => {
-  init_module();
-  init_module2();
-  init_suppressor();
 });
 
-// src/util/atomic.ts
-import { closeSync as closeSync2, constants, fsyncSync, openSync as openSync2, renameSync as renameSync2, rmSync, writeSync } from "node:fs";
-var TMP_OPEN_FLAGS;
-var init_atomic = __esm(() => {
-  TMP_OPEN_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0);
+// node_modules/.bun/handlebars@4.7.9/node_modules/handlebars/lib/index.js
+var require_lib = __commonJS((exports, module) => {
+  var handlebars = require_handlebars()["default"];
+  var printer = require_printer();
+  handlebars.PrintVisitor = printer.PrintVisitor;
+  handlebars.print = printer.print;
+  module.exports = handlebars;
+  function extension(module2, filename) {
+    var fs = __require("fs");
+    var templateString = fs.readFileSync(filename, "utf8");
+    module2.exports = handlebars.compile(templateString);
+  }
+  if (__require.extensions) {
+    __require.extensions[".handlebars"] = extension;
+    __require.extensions[".hbs"] = extension;
+  }
 });
 
 // node_modules/.bun/commander@13.1.0/node_modules/commander/lib/error.js
@@ -15986,10 +13283,10 @@ var require_suggestSimilar = __commonJS((exports2) => {
 
 // node_modules/.bun/commander@13.1.0/node_modules/commander/lib/command.js
 var require_command = __commonJS((exports2) => {
-  var EventEmitter2 = __require("node:events").EventEmitter;
+  var EventEmitter = __require("node:events").EventEmitter;
   var childProcess = __require("node:child_process");
   var path2 = __require("node:path");
-  var fs2 = __require("node:fs");
+  var fs3 = __require("node:fs");
   var process2 = __require("node:process");
   var { Argument, humanReadableArgName } = require_argument();
   var { CommanderError } = require_error();
@@ -15997,7 +13294,7 @@ var require_command = __commonJS((exports2) => {
   var { Option, DualOptions } = require_option();
   var { suggestSimilar } = require_suggestSimilar();
 
-  class Command extends EventEmitter2 {
+  class Command extends EventEmitter {
     constructor(name) {
       super();
       this.commands = [];
@@ -16510,7 +13807,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       this.processedArgs = [];
     }
     _checkForMissingExecutable(executableFile, executableDir, subcommandName) {
-      if (fs2.existsSync(executableFile))
+      if (fs3.existsSync(executableFile))
         return;
       const executableDirMessage = executableDir ? `searched for local subcommand relative to directory '${executableDir}'` : "no directory for search for local subcommand, use .executableDir() to supply a custom directory";
       const executableMissing = `'${executableFile}' does not exist
@@ -16525,11 +13822,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
       const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
       function findFile(baseDir, baseName) {
         const localBin = path2.resolve(baseDir, baseName);
-        if (fs2.existsSync(localBin))
+        if (fs3.existsSync(localBin))
           return localBin;
         if (sourceExt.includes(path2.extname(baseName)))
           return;
-        const foundExt = sourceExt.find((ext) => fs2.existsSync(`${localBin}${ext}`));
+        const foundExt = sourceExt.find((ext) => fs3.existsSync(`${localBin}${ext}`));
         if (foundExt)
           return `${localBin}${foundExt}`;
         return;
@@ -16541,7 +13838,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
       if (this._scriptPath) {
         let resolvedScriptPath;
         try {
-          resolvedScriptPath = fs2.realpathSync(this._scriptPath);
+          resolvedScriptPath = fs3.realpathSync(this._scriptPath);
         } catch {
           resolvedScriptPath = this._scriptPath;
         }
@@ -17316,7 +14613,7 @@ var require_commander = __commonJS((exports2) => {
 
 // src/host-control/main.ts
 import { homedir as homedir6 } from "node:os";
-import { existsSync as existsSync11, readdirSync as readdirSync4 } from "node:fs";
+import { existsSync as existsSync12, readdirSync as readdirSync4 } from "node:fs";
 import { join as join11, resolve as resolve9 } from "node:path";
 
 // src/config/loader.ts
@@ -21399,7 +18696,12 @@ var ScheduleEntrySchema = exports_external.object({
 var AgentSoulSchema = exports_external.object({
   name: exports_external.string().describe("Agent persona name (e.g., 'Coach', 'Sage')"),
   style: exports_external.string().describe("Communication style description"),
-  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers")
+  creature: exports_external.string().optional().describe("Persona creature/form (e.g., 'owl', 'octopus')"),
+  vibe: exports_external.string().optional().describe("One-line personality vibe (e.g., 'calm, precise')"),
+  expertise: exports_external.string().optional().describe("Domain expertise summary rendered into the persona"),
+  emoji: exports_external.string().optional().describe("Signature emoji for the persona (e.g., '\uD83E\uDD89')"),
+  boundaries: exports_external.string().optional().describe("Behavioral boundaries and disclaimers"),
+  shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).default("generalist").describe("Persona-shape discriminator the per-agent CLAUDE.md template can " + "branch on (e.g., 'you are an executive assistant' vs 'a senior " + "engineer'). No runtime behavior yet — template work lands in a " + "later issue. Cascade: override (per-agent wins over default).")
 }).optional();
 var AgentToolsSchema = exports_external.object({
   allow: exports_external.array(exports_external.string()).default([]).describe("Allowed tools (use ['all'] for unrestricted)"),
@@ -21564,6 +18866,11 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
+  button_choice_confirmation: exports_external.object({
+    enabled: exports_external.boolean().default(false).describe("When true, tapping an agent-emitted inline_keyboard button annotates " + "the source message body with a '✅ You chose: <label> · HH:MM' line so " + "the chat surface is self-documenting. Only applies to single-use " + "keyboards (re-tappable keyboards are never annotated). Requires the " + "agent's parseMode to be the default 'html'. Opt-in (default false). " + "Limitation: the annotated body is rebuilt from the message's plain " + "text, so any formatting entities (bold, links, code, ...) on the " + "original message are lost when the annotation is applied."),
+    format: exports_external.string().default("✅ You chose: {label} · {time}").describe("Template for the annotation line. `{label}` is replaced with the " + "tapped button's text (newlines stripped, HTML-escaped, trimmed to 60 " + "chars) and `{time}` with HH:MM in the chosen timezone. Note: retap " + "dedup (replacing a prior annotation instead of appending another " + "line) only recognizes the DEFAULT format shape — a custom format " + "accumulates one line per retap."),
+    timezone: exports_external.enum(["gateway", "utc"]).default("gateway").describe("Timezone for the {time} placeholder. 'gateway' uses the gateway " + "process's local time; 'utc' uses UTC. Per-user timezones are out of " + "scope for v1.")
+  }).optional().describe("Auto-confirm 'You chose: X' annotation on inline_keyboard taps (#789). " + "Cascades from defaults.channels.telegram.button_choice_confirmation."),
   webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
   webhook_dispatch: exports_external.object({
     github: exports_external.array(webhookDispatchRule).optional(),
@@ -21712,7 +19019,12 @@ var profileFields = {
   soul: exports_external.object({
     name: exports_external.string().optional(),
     style: exports_external.string().optional(),
-    boundaries: exports_external.string().optional()
+    creature: exports_external.string().optional(),
+    vibe: exports_external.string().optional(),
+    expertise: exports_external.string().optional(),
+    emoji: exports_external.string().optional(),
+    boundaries: exports_external.string().optional(),
+    shape: exports_external.enum(["executive-assistant", "developer", "coach", "generalist"]).optional()
   }).optional(),
   tools: exports_external.object({
     allow: exports_external.array(exports_external.string()).optional(),
@@ -21909,7 +19221,8 @@ var VaultConfigSchema = exports_external.object({
     autoUnlockCredentialPath: exports_external.string().default("~/.switchroom/vault-auto-unlock").describe("Path to the machine-bound auto-unlock blob (see " + "src/vault/auto-unlock.ts for the format). Default lives under " + "~/.switchroom so it can be bind-mounted into the vault-broker " + "container by docker compose. Tilde-expansion happens " + "at read time."),
     approvalAuth: exports_external.enum(["passphrase", "telegram-id"]).default("passphrase").describe("Posture for tap-to-Approve on vault grant cards. `passphrase` " + "(default) prompts the operator to type the vault passphrase on " + "every Approve — two-factor (Telegram ID + passphrase). " + "`telegram-id` mints immediately on Approve with no passphrase " + "prompt — single-factor (Telegram ID only); REQUIRES " + "`autoUnlock: true` so the broker already holds the passphrase. " + "Trades a factor of security for smoother UX; opt-in only."),
     postureMintAgents: exports_external.array(exports_external.string().min(1)).default([]).describe("Per-agent opt-in for posture-attested broker calls (`mint_grant` / " + "`list_grants` / `put` with `attest_via_posture: true`). Only agents " + "whose names are in this list can use the silent-mint path under " + "`approvalAuth: telegram-id`. Default `[]` — no agent can self-mint " + "until the operator explicitly opts it in. The request's `agent` " + "field must also equal the calling peer's resolved agent name " + "(broker rejects cross-agent posture mints). When `approvalAuth` is " + "`passphrase` this list is ignored — passphrase attestation still " + "works as before. Each entry is an agent slug exactly as it appears " + "under `agents:` in this config."),
-    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload).")
+    adminOnlyKeys: exports_external.array(exports_external.string().min(1)).default([]).describe("Vault keys held to a higher approval bar: only the admin operator " + "(`access.allowFrom[0]`) may approve a grant for them, and they can " + "NEVER be minted via posture attestation — granting one requires the " + "operator passphrase (so an agent, even one on `postureMintAgents`, " + "cannot self-grant it). Entries are exact key names or `*` globs, " + "e.g. `stripe/*`, `*/oauth-token`, `microsoft/ken-tokens` (`*` matches " + "any run of characters incl. `/`; case-sensitive). Default `[]` — no " + "key is admin-only. Posture may RETAIN an admin-only key across a " + "union re-mint but never ADD one. Takes effect on broker + gateway " + "restart (broker has no ACL hot-reload)."),
+    auditFailClosed: exports_external.boolean().default(false).describe("sec WS10-F3 (#1420) — fail-CLOSED on an audit-append failure. When " + "`false` (default, backward-compatible) the broker fails OPEN: if a " + "vault-audit.log append fails it logs to stderr, bumps the durable " + "fail-open counter, and STILL releases the secret. When `true`, a " + "failed audit append DENIES the secret release with " + "`AUDIT_UNAVAILABLE` — no secret leaves the broker without a durable " + "audit row. The env var `SWITCHROOM_VAULT_AUDIT_FAIL_CLOSED` " + "(`1`/`true` or `0`/`false`) overrides this at runtime. Either way " + "the fail-open counter is surfaced by `switchroom doctor`. Takes " + "effect on broker restart.")
   }).default({}).superRefine((broker, ctx) => {
     if (broker.approvalAuth === "telegram-id" && broker.autoUnlock !== true) {
       ctx.addIssue({
@@ -21948,7 +19261,9 @@ var FleetHealthConfigSchema = exports_external.object({
 });
 var HostdConfigSchema = exports_external.object({
   config_edit_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the `config_propose_edit` hostd verb (RFC " + "admin-agent-config-edit §3). Default false — the verb returns " + "`E_CONFIG_EDIT_DISABLED` until the operator explicitly flips " + "this to true. When true, admin agents can propose unified-diff " + "patches against " + "`/state/config/switchroom.yaml`, gated by an operator approval " + "card in the primary chat. Same trust posture as `update_apply` " + "and `agent_restart`: the human-in-the-loop tap is the security " + "boundary, not the agent's judgement."),
-  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat.")
+  config_edit_rate_per_hour: exports_external.number().int().min(1).max(20).default(3).describe("Per-requesting-agent rate cap for `config_propose_edit` cards " + "(RFC admin-agent-config-edit §5). Default 3 cards/hour; min 1, " + "max 20. ENFORCED server-side: a caller exceeding this in a sliding " + "1-hour window is rejected with `E_RATE_LIMITED` (carrying a " + "`retry_after` fix) instead of posting another operator approval " + "card — so a looping agent is throttled rather than spamming the chat."),
+  operator_attest_enabled: exports_external.boolean().default(false).describe("Opt-in toggle for the operator-passphrase 2nd factor on hostd's " + "mutating verbs (#1841, RFC host-control-daemon.md §5.4). Default " + "false — attestation is ACCEPTED-and-audited whenever present, but " + "no verb REQUIRES it (behaviour is byte-identical to today, so " + "existing fleets and the Telegram approval-card flow are unchanged). " + "When true, the verbs in `operator_attest_required_verbs` demand a " + "valid operator-passphrase attestation IN ADDITION to admin: hostd " + "forwards the passphrase to the vault broker over its own admin-client " + "connection (`/run/switchroom/broker/hostd/sock`) and treats a broker " + "DENIED as a gate failure. hostd never holds the passphrase. Leave " + "this off until BOTH the gateway passphrase-forward and the " + "cross-compose broker socket are deployed, or gated verbs will fail."),
+  operator_attest_required_verbs: exports_external.array(exports_external.string().min(1)).default(["update_apply", "apply", "rollout"]).describe("Which mutating hostd verbs REQUIRE a valid operator-passphrase " + "attestation when `operator_attest_enabled` is true (#1841). Default " + "is the RFC §5.4 fleet-mutation set (`update_apply`, `apply`, " + "`rollout`). Verbs NOT in this list still accept-and-audit an " + "attestation when one is supplied, but never require it. Ignored " + "entirely when `operator_attest_enabled` is false.")
 });
 var CronEgressSchema = exports_external.object({
   allowed_hosts: exports_external.array(exports_external.string().min(1)).default([]).describe("Hosts a poll may reach (exact, https-only). loopback/private/IP-literal are always rejected."),
@@ -22371,6 +19686,11 @@ function mergeAgentConfig(defaultsIn, agentIn) {
       if (v !== undefined)
         combined[k] = v;
     }
+    const baseSoul = base;
+    const overrideSoul = override;
+    if (baseSoul.shape !== undefined && (overrideSoul.shape === undefined || overrideSoul.shape === "generalist")) {
+      combined.shape = baseSoul.shape;
+    }
     merged.soul = combined;
   }
   if (defaults.memory || merged.memory) {
@@ -23182,6 +20502,7 @@ import { createHash } from "node:crypto";
 
 // src/agents/scaffold.ts
 import { join as join5, resolve as resolve5 } from "node:path";
+init_atomic();
 
 // src/config/timezone.ts
 var CONTAINER_DEFAULT_UTC_ZONES = new Set([
@@ -23230,18 +20551,22 @@ var tails = new Map;
 
 // src/agents/inject.ts
 var INJECT_COMMANDS = new Map([
-  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true }],
-  ["/status", { description: "Show session status", expectsOutput: true, dialog: true }],
-  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true }],
-  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true }],
-  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true }],
-  ["/model", { description: "Open model picker", expectsOutput: true }],
+  ["/cost", { description: "Show session cost", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/status", { description: "Show session status", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/usage", { description: "Show plan quota", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/hooks", { description: "List configured hooks", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/memory", { description: "Open memory picker", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/help", { description: "Show help / command discovery", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/context", { description: "Show context window usage", expectsOutput: true, argsAllowed: false }],
+  ["/release-notes", { description: "Show release-notes version list", expectsOutput: true, dialog: true, argsAllowed: false }],
+  ["/model", { description: "Open model picker", expectsOutput: true, argsAllowed: true }],
   [
     "/clear",
     {
       description: "Clear session screen",
       expectsOutput: false,
-      silentNote: "context cleared — fresh slate"
+      silentNote: "context cleared — fresh slate",
+      argsAllowed: false
     }
   ],
   [
@@ -23249,7 +20574,8 @@ var INJECT_COMMANDS = new Map([
     {
       description: "Compact conversation history",
       expectsOutput: false,
-      silentNote: "compaction runs silently"
+      silentNote: "compaction runs silently",
+      argsAllowed: false
     }
   ]
 ]);
@@ -23259,6 +20585,15 @@ var INJECT_BLOCKED = new Map([
   ["/logout", { reason: "would terminate the agent's auth session" }],
   ["/exit", { reason: "would kill the agent process" }],
   ["/quit", { reason: "would kill the agent process" }],
+  ["/upgrade", { reason: "mutates the Claude Code installation" }],
+  ["/init", { reason: "generates/overwrites CLAUDE.md and runs a model turn" }],
+  ["/mcp", { reason: "opens an interactive MCP server management dialog" }],
+  ["/permissions", { reason: "opens an interactive permissions editor that mutates tool policy" }],
+  ["/install-github-app", { reason: "runs a network/OAuth install flow" }],
+  ["/add-dir", { reason: "mutates the session's working-directory set" }],
+  ["/terminal-setup", { reason: "mutates terminal keybinding configuration" }],
+  ["/privacy-settings", { reason: "opens an interactive privacy-settings dialog" }],
+  ["/bug", { reason: "submits a bug report over the network" }],
   [
     "/effort",
     {
@@ -23276,6 +20611,7 @@ var HINDSIGHT_CONSUMER_NAME = "hindsight";
 var HINDSIGHT_IMAGE_REPO = "ghcr.io/switchroom/switchroom-hindsight";
 var HINDSIGHT_IMAGE = `${HINDSIGHT_IMAGE_REPO}:latest`;
 var HINDSIGHT_BROKER_SOCK_VOLUME = `auth-broker-${HINDSIGHT_CONSUMER_NAME}-sock`;
+var HINDSIGHT_CREDS_MIRROR_VOLUME = `consumer-creds-${HINDSIGHT_CONSUMER_NAME}`;
 var HINDSIGHT_HEALTHCHECK_PY = 'import urllib.request,sys; sys.exit(0 if urllib.request.urlopen("http://localhost:8888/health",timeout=4).getcode()==200 else 1)';
 var HINDSIGHT_HEALTHCHECK_CMD = `python3 -c '${HINDSIGHT_HEALTHCHECK_PY}'`;
 
@@ -23308,6 +20644,8 @@ var KNOWN_VAULT_ARTIFACT_NAMES = new Set([
 var SCRYPT_MAXMEM = 128 * 1024 * 1024;
 
 // src/vault/broker/client.ts
+import * as net from "node:net";
+import * as fs from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { join as join4 } from "node:path";
 
@@ -23444,6 +20782,13 @@ var ApprovalLookupRequestSchema = exports_external.object({
   action: exports_external.string().min(1),
   current_approver_set: exports_external.array(exports_external.string())
 });
+var ApprovalLookupByRequestRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("approval_lookup_by_request"),
+  agent_unit: exports_external.string().min(1),
+  request_id: exports_external.string().regex(/^[0-9a-f]{32}$/),
+  current_approver_set: exports_external.array(exports_external.string())
+});
 var ApprovalConsumeRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("approval_consume"),
@@ -23498,6 +20843,7 @@ var RequestSchema = exports_external.discriminatedUnion("op", [
   RevokeGrantRequestSchema,
   ApprovalRequestRequestSchema,
   ApprovalLookupRequestSchema,
+  ApprovalLookupByRequestRequestSchema,
   ApprovalConsumeRequestSchema,
   ApprovalRevokeRequestSchema,
   ApprovalListRequestSchema,
@@ -23520,7 +20866,8 @@ var ErrorCode = exports_external.enum([
   "DENIED",
   "UNKNOWN_KEY",
   "BAD_REQUEST",
-  "INTERNAL"
+  "INTERNAL",
+  "AUDIT_UNAVAILABLE"
 ]);
 var OkEntryResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
@@ -23657,16 +21004,123 @@ var ResponseSchema = exports_external.union([
   OkApprovalConsumeRecordResponseSchema,
   ErrorResponseSchema
 ]);
+function encodeRequest(req) {
+  const json = JSON.stringify(req);
+  if (Buffer.byteLength(json, "utf8") > MAX_FRAME_BYTES) {
+    throw new Error(`Request frame too large (${Buffer.byteLength(json, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
+  }
+  return json + `
+`;
+}
+function decodeResponse(line) {
+  if (Buffer.byteLength(line, "utf8") > MAX_FRAME_BYTES) {
+    throw new RangeError(`Response frame too large (${Buffer.byteLength(line, "utf8")} bytes; max ${MAX_FRAME_BYTES})`);
+  }
+  const obj = JSON.parse(line);
+  return ResponseSchema.parse(obj);
+}
+
+// src/runtime-mode.ts
+function isDockerRuntime() {
+  return process.env.SWITCHROOM_RUNTIME === "docker";
+}
 
 // src/vault/broker/client.ts
+var DEFAULT_TIMEOUT_MS = 2000;
 var LEGACY_SOCKET_PATH = join4(homedir3(), ".switchroom", "vault-broker.sock");
 var OPERATOR_SOCKET_PATH = join4(homedir3(), ".switchroom", "broker-operator", "sock");
+function defaultBrokerSocketPath() {
+  if (fs.existsSync(OPERATOR_SOCKET_PATH))
+    return OPERATOR_SOCKET_PATH;
+  if (isDockerRuntime())
+    return OPERATOR_SOCKET_PATH;
+  return LEGACY_SOCKET_PATH;
+}
+function resolveBrokerSocketPath(opts) {
+  if (opts?.socket)
+    return opts.socket;
+  const env = process.env.SWITCHROOM_VAULT_BROKER_SOCK;
+  if (env)
+    return env;
+  if (opts?.vaultBrokerSocket)
+    return opts.vaultBrokerSocket;
+  return defaultBrokerSocketPath();
+}
+async function rpcRaw(req, opts) {
+  return rpc(req, opts);
+}
+async function rpc(req, opts) {
+  const socketPath = resolveBrokerSocketPath(opts);
+  const timeoutMs = opts?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve5) => {
+    let settled = false;
+    const settle = (val) => {
+      if (settled)
+        return;
+      settled = true;
+      resolve5(val);
+    };
+    const client = new net.Socket;
+    const timer = setTimeout(() => {
+      client.destroy();
+      settle({ kind: "unreachable", msg: `broker did not respond within ${timeoutMs}ms` });
+    }, timeoutMs);
+    client.on("error", (err) => {
+      clearTimeout(timer);
+      const code = err.code ?? "ERR";
+      let msg;
+      if (code === "ENOENT")
+        msg = "broker socket not found (is the daemon running?)";
+      else if (code === "ECONNREFUSED")
+        msg = "broker socket exists but refused connection";
+      else if (code === "EACCES")
+        msg = "broker socket access denied (wrong UID?)";
+      else
+        msg = `broker connection failed: ${err.message}`;
+      settle({ kind: "unreachable", msg });
+    });
+    let buffer = "";
+    client.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const newlineIdx = buffer.indexOf(`
+`);
+      if (newlineIdx !== -1) {
+        const line = buffer.slice(0, newlineIdx).trimEnd();
+        clearTimeout(timer);
+        client.destroy();
+        try {
+          const resp = decodeResponse(line);
+          settle({ kind: "response", resp });
+        } catch (err) {
+          settle({
+            kind: "unreachable",
+            msg: `unparseable broker response: ${err instanceof Error ? err.message : String(err)}`
+          });
+        }
+      }
+    });
+    client.on("connect", () => {
+      try {
+        client.write(encodeRequest(req));
+      } catch (err) {
+        clearTimeout(timer);
+        client.destroy();
+        settle({
+          kind: "unreachable",
+          msg: `failed to send request: ${err instanceof Error ? err.message : String(err)}`
+        });
+      }
+    });
+    client.connect({ path: socketPath });
+  });
+}
 
 // src/vault/resolver.ts
 var materializedDirs = new Set;
 
 // src/agents/scaffold.ts
 var REPO_ROOT = resolve5(import.meta.dirname, "../..");
+var CLAUDE_MD_YOURS_PLACEHOLDER = "This space is yours. Add per-agent rules, exceptions, or context the " + "Switchroom template doesn't capture. Everything above the marker line is " + "regenerated on every apply; this section is preserved.";
 var SWITCHROOM_OWNED_SETTINGS_KEYS = new Set([
   "permissions",
   "mcpServers",
@@ -23697,8 +21151,8 @@ import { spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
 import { mkdir, chmod, chown, unlink, appendFile } from "node:fs/promises";
 import {
   readdirSync as readdirSync3,
-  existsSync as existsSync10,
-  readFileSync as readFileSync8,
+  existsSync as existsSync11,
+  readFileSync as readFileSync9,
   writeFileSync as writeFileSync5,
   renameSync as renameSync3,
   mkdirSync as mkdirSync4,
@@ -23719,7 +21173,8 @@ var IDEMPOTENCY_WINDOW_MS = 15000;
 var RequestEnvelope = {
   v: exports_external.literal(1),
   request_id: exports_external.string().min(1).max(128),
-  idempotency_key: exports_external.string().min(1).max(128).optional()
+  idempotency_key: exports_external.string().min(1).max(128).optional(),
+  operator_passphrase: exports_external.string().min(1).max(1024).optional()
 };
 var AgentRestartRequestSchema = exports_external.object({
   ...RequestEnvelope,
@@ -28399,9 +25854,9 @@ class PostHog extends PostHogBackendClient {
 
 // src/analytics/posthog.ts
 import {
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { dirname as dirname2 } from "node:path";
@@ -28420,8 +25875,8 @@ function getDistinctId() {
     return cachedDistinctId;
   const path = resolveStatePath("analytics-id");
   try {
-    if (existsSync6(path)) {
-      const existing = readFileSync5(path, "utf-8").trim();
+    if (existsSync7(path)) {
+      const existing = readFileSync6(path, "utf-8").trim();
       if (existing) {
         cachedDistinctId = existing;
         return existing;
@@ -28594,7 +26049,7 @@ function err(code, human) {
 
 // src/util/audit-hashchain.ts
 import { createHash as createHash3 } from "node:crypto";
-import { openSync, readSync, fstatSync, closeSync } from "node:fs";
+import { openSync as openSync2, readSync, fstatSync, closeSync as closeSync2 } from "node:fs";
 var CHAIN_GENESIS = "GENESIS";
 var SEP = "\x00";
 function rowHash(prev, seq, rowJsonNoChain) {
@@ -28615,7 +26070,7 @@ function chainRow(state, entry) {
 function readTail(path, tailBytes = 64 * 1024) {
   let fd;
   try {
-    fd = openSync(path, "r");
+    fd = openSync2(path, "r");
   } catch {
     return null;
   }
@@ -28631,7 +26086,7 @@ function readTail(path, tailBytes = 64 * 1024) {
     return null;
   } finally {
     try {
-      closeSync(fd);
+      closeSync2(fd);
     } catch {}
   }
 }
@@ -28858,7 +26313,7 @@ function scanGenericSecrets(text) {
 // telegram-plugin/secret-detect/chunker.ts
 var CHUNK_THRESHOLD = 32 * 1024;
 var WINDOW_SIZE = 16 * 1024;
-var OVERLAP = 1024;
+var OVERLAP = 8 * 1024;
 function chunk(text) {
   if (text.length <= CHUNK_THRESHOLD) {
     return [{ offset: 0, text }];
@@ -28875,9 +26330,43 @@ function chunk(text) {
   return out;
 }
 
-// telegram-plugin/secret-detect/index.ts
-init_suppressor();
+// telegram-plugin/secret-detect/suppressor.ts
+var MARKERS = ["test", "mock", "example", "fixture", "dummy"];
+var WINDOW = 40;
+var MARKER_RE = new RegExp(`\\b(?:${MARKERS.join("|")})\\b`, "i");
+function isSuppressed(text, start, end) {
+  const left = Math.max(0, start - WINDOW);
+  const right = Math.min(text.length, end + WINDOW);
+  const context = text.slice(left, start) + text.slice(end, right);
+  return MARKER_RE.test(context);
+}
 
+// telegram-plugin/secret-detect/slug.ts
+function sanitizeKeyName(raw) {
+  const up = raw.toUpperCase();
+  const cleaned = up.replace(/[^A-Z0-9_]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+  return cleaned.length > 0 ? cleaned : "SECRET";
+}
+function datePart(now = new Date) {
+  const y = now.getUTCFullYear();
+  const m = String(now.getUTCMonth() + 1).padStart(2, "0");
+  const d = String(now.getUTCDate()).padStart(2, "0");
+  return `${y}${m}${d}`;
+}
+function deriveSlug(inputs, existing) {
+  let base;
+  if (inputs.key_name && inputs.key_name.trim().length > 0) {
+    base = sanitizeKeyName(inputs.key_name);
+  } else {
+    base = `${inputs.rule_id}_${datePart(inputs.now)}`;
+  }
+  if (!existing.has(base))
+    return base;
+  let n = 2;
+  while (existing.has(`${base}_${n}`))
+    n++;
+  return `${base}_${n}`;
+}
 // telegram-plugin/secret-detect/url-redact.ts
 var SENSITIVE_PARAMS = new Set([
   "token",
@@ -28923,7 +26412,6 @@ function redactOne(raw) {
 }
 
 // telegram-plugin/secret-detect/index.ts
-init_secretlint_source();
 function detectSecrets(text) {
   if (!text || text.length === 0)
     return [];
@@ -29040,7 +26528,7 @@ function redactedMarker(ruleId) {
   return `[REDACTED:${trimmed}]`;
 }
 // src/cli/install-detect.ts
-import * as fs from "node:fs";
+import * as fs2 from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 var BIN_PATH = "/usr/local/bin/switchroom";
@@ -29054,12 +26542,12 @@ function detectInstallType() {
   try {
     const repoArtifact = sourceArtifactPath();
     const distPrefix = sourceDistPrefix();
-    const binExists = fs.existsSync(BIN_PATH);
-    const repoExists = fs.existsSync(repoArtifact);
+    const binExists = fs2.existsSync(BIN_PATH);
+    const repoExists = fs2.existsSync(repoArtifact);
     if (binExists) {
-      const lst = fs.lstatSync(BIN_PATH);
+      const lst = fs2.lstatSync(BIN_PATH);
       if (lst.isSymbolicLink()) {
-        const target = fs.readlinkSync(BIN_PATH);
+        const target = fs2.readlinkSync(BIN_PATH);
         const resolved = path.isAbsolute(target) ? target : path.resolve(path.dirname(BIN_PATH), target);
         if (resolved.startsWith(distPrefix)) {
           return {
@@ -29096,20 +26584,20 @@ var import_yaml3 = __toESM(require_dist(), 1);
 init_atomic();
 
 // src/cli/resolve-version.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
 import { dirname as dirname4, join as join7 } from "node:path";
 
 // src/build-info.ts
-var VERSION = "0.18.11";
+var VERSION = "0.18.13";
 
 // src/cli/resolve-version.ts
 function readPackageVersion() {
   let dir = import.meta.dirname;
   for (let i = 0;i < 12 && dir && dir !== "/"; i++) {
     const p = join7(dir, "package.json");
-    if (existsSync8(p)) {
+    if (existsSync9(p)) {
       try {
-        const pkg = JSON.parse(readFileSync6(p, "utf-8"));
+        const pkg = JSON.parse(readFileSync7(p, "utf-8"));
         if (pkg?.name === "switchroom" && typeof pkg.version === "string") {
           return pkg.version;
         }
@@ -29170,6 +26658,8 @@ function parseAuditLine(line) {
     entry.error = o.error;
   if (typeof o.phase === "string")
     entry.phase = o.phase;
+  if (typeof o.method === "string")
+    entry.method = o.method;
   if (typeof o.stdout_tail === "string")
     entry.stdout_tail = o.stdout_tail;
   if (typeof o.stderr_tail === "string")
@@ -29295,7 +26785,7 @@ function parseRolloutResultLine(stdout) {
 }
 
 // node_modules/.bun/commander@13.1.0/node_modules/commander/esm.mjs
-var import__3 = __toESM(require_commander(), 1);
+var import__2 = __toESM(require_commander(), 1);
 
 // src/cli/update.ts
 import { join as join8, dirname as dirname5, resolve as resolve7 } from "node:path";
@@ -29418,7 +26908,7 @@ function parseUpdateResultLine(stdout) {
 
 // src/host-control/config-edit-validator.ts
 var import_yaml5 = __toESM(require_dist(), 1);
-import { mkdtempSync, writeFileSync as writeFileSync4, rmSync as rmSync2, existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+import { mkdtempSync, writeFileSync as writeFileSync4, rmSync as rmSync2, existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join as join9, isAbsolute as isAbsolute2, normalize, basename as basename2 } from "node:path";
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -29530,17 +27020,44 @@ function validateShape(unifiedDiff, targetPath) {
       };
     }
   }
+  {
+    let inHunk = false;
+    let hunkHasContext = false;
+    const failZeroContext = {
+      ok: false,
+      code: "E_PATCH_INVALID_SHAPE",
+      detail: "zero-context hunk not allowed; regenerate the diff with context " + "lines (git diff default of 3)"
+    };
+    const scanLines = lines.length > 0 && lines[lines.length - 1] === "" ? lines.slice(0, -1) : lines;
+    for (const ln of scanLines) {
+      if (ln.startsWith("@@")) {
+        if (inHunk && !hunkHasContext)
+          return failZeroContext;
+        inHunk = true;
+        hunkHasContext = false;
+      } else if (ln.startsWith("--- ") || ln.startsWith("+++ ")) {
+        if (inHunk && !hunkHasContext)
+          return failZeroContext;
+        inHunk = false;
+      } else if (inHunk) {
+        if (ln.startsWith(" ") || ln === "")
+          hunkHasContext = true;
+      }
+    }
+    if (inHunk && !hunkHasContext)
+      return failZeroContext;
+  }
   return null;
 }
 function applyPatch(unifiedDiff, configPath, gitBin) {
-  if (!existsSync9(configPath)) {
+  if (!existsSync10(configPath)) {
     return {
       ok: false,
       code: "E_PATCH_APPLY_FAILED",
       detail: `target config not found at ${configPath}`
     };
   }
-  const liveContent = readFileSync7(configPath, "utf8");
+  const liveContent = readFileSync8(configPath, "utf8");
   const scratchDir = mkdtempSync(join9(tmpdir(), "config-propose-edit-"));
   try {
     const targetBasename = configPath.split("/").pop() ?? "switchroom.yaml";
@@ -29553,8 +27070,7 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
     const baseArgs = [
       "apply",
       "--whitespace=nowarn",
-      "--recount",
-      "--unidiff-zero"
+      "--recount"
     ];
     const checkP1 = spawnSync2(bin, [...baseArgs.slice(0, 1), "--check", ...baseArgs.slice(1), "-p1", patchFile], { cwd: scratchDir, encoding: "utf8", timeout: 1e4 });
     let pStrip = "-p1";
@@ -29578,7 +27094,7 @@ function applyPatch(unifiedDiff, configPath, gitBin) {
         detail: `git apply failed: ${(real.stderr || "").trim().slice(0, 500)}`
       };
     }
-    const after = readFileSync7(scratchFile, "utf8");
+    const after = readFileSync8(scratchFile, "utf8");
     return { ok: true, after };
   } finally {
     rmSync2(scratchDir, { recursive: true, force: true });
@@ -29776,7 +27292,7 @@ function validateConfigEdit(opts) {
     return schemaErr;
   let beforeData = {};
   try {
-    const beforeRaw = existsSync9(opts.configPath) ? readFileSync7(opts.configPath, "utf8") : "";
+    const beforeRaw = existsSync10(opts.configPath) ? readFileSync8(opts.configPath, "utf8") : "";
     const beforeDoc = import_yaml5.parseDocument(beforeRaw, { merge: false, strict: false });
     beforeData = beforeDoc.toJS();
   } catch {
@@ -30225,12 +27741,12 @@ function collectScheduleEntries(config) {
 // src/agent-scheduler/replay.ts
 var STALE_LOOKBACK_MAX_MIN = 14 * 24 * 60;
 function readRecentFires(jsonlPath) {
-  const fs2 = __require("node:fs");
-  if (!fs2.existsSync(jsonlPath))
+  const fs3 = __require("node:fs");
+  if (!fs3.existsSync(jsonlPath))
     return [];
   let raw;
   try {
-    raw = fs2.readFileSync(jsonlPath, "utf8");
+    raw = fs3.readFileSync(jsonlPath, "utf8");
   } catch {
     return [];
   }
@@ -30248,6 +27764,13 @@ function readRecentFires(jsonlPath) {
 }
 
 // src/host-control/server.ts
+var HOSTD_BROKER_SOCKET_PATH = "/run/switchroom/broker/hostd/sock";
+var DEFAULT_OPERATOR_ATTEST_VERBS = [
+  "update_apply",
+  "apply",
+  "rollout"
+];
+var ATTEST_AUDIT_METHOD = "passphrase-attest";
 function resolveDigests(imageRefs) {
   const out = new Map;
   for (const ref of imageRefs) {
@@ -30272,9 +27795,9 @@ function resolveDigests(imageRefs) {
 function readCachedInstallType(bindRoot) {
   const cacheDir = join10(bindRoot, ".switchroom");
   const cachePath = join10(cacheDir, "install-type.json");
-  if (existsSync10(cachePath)) {
+  if (existsSync11(cachePath)) {
     try {
-      const raw = readFileSync8(cachePath, "utf-8");
+      const raw = readFileSync9(cachePath, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed && typeof parsed.install_type === "string" && typeof parsed.detected_at === "string") {
         return parsed;
@@ -30302,6 +27825,9 @@ var CONFIG_APPROVAL_TIMEOUT_MS = 60 * 60 * 1000;
 function defaultApprovalId() {
   return randomBytes(4).toString("hex");
 }
+function idempotencyScope(caller) {
+  return caller.kind === "agent" ? `agent:${caller.name}` : "operator";
+}
 function formatConfigApprovalDenyError(approval, approvalId) {
   if (approval.denySource === "dispatch_failure") {
     const detail = approval.reason ?? "card dispatch failed";
@@ -30323,7 +27849,7 @@ function writeFileInPlacePreservingInode(targetPath, content) {
   } finally {
     closeSync3(fd);
   }
-  const readBack = readFileSync8(targetPath);
+  const readBack = readFileSync9(targetPath);
   if (readBack.length !== buf.length) {
     throw new Error(`in-place write short: wrote ${buf.length} bytes but read back ${readBack.length}`);
   }
@@ -30369,7 +27895,7 @@ class HostdServer {
         await chmod(dir, 493).catch(() => {
           return;
         });
-        if (existsSync10(sockPath))
+        if (existsSync11(sockPath))
           await unlink(sockPath).catch(() => {
             return;
           });
@@ -30406,7 +27932,7 @@ class HostdServer {
           await chmod(dir, 493).catch(() => {
             return;
           });
-          if (existsSync10(sockPath))
+          if (existsSync11(sockPath))
             await unlink(sockPath).catch(() => {
               return;
             });
@@ -30442,11 +27968,11 @@ class HostdServer {
   }
   async reconcileOrphanedFleetMutations() {
     const path2 = this.auditLogPath();
-    if (!existsSync10(path2))
+    if (!existsSync11(path2))
       return;
     let raw;
     try {
-      raw = readFileSync8(path2, "utf-8");
+      raw = readFileSync9(path2, "utf-8");
     } catch {
       return;
     }
@@ -30563,9 +28089,17 @@ class HostdServer {
       socket.end();
       return;
     }
-    const idempotencyKey = req.idempotency_key ?? req.request_id;
     const now = Date.now();
     this.evictExpiredIdempotency(now);
+    const denied = this.checkGate(req, caller);
+    if (denied) {
+      const resp2 = deniedResponse(req.request_id, denied);
+      await this.writeAudit({ caller, req, resp: resp2 });
+      socket.write(encodeResponse(resp2));
+      socket.end();
+      return;
+    }
+    const idempotencyKey = `${idempotencyScope(caller)} ${req.idempotency_key ?? req.request_id}`;
     const prior = this.idempotencyKeys.get(idempotencyKey);
     if (prior && now - prior.ts < IDEMPOTENCY_WINDOW_MS) {
       const cached = this.statusByRequestId.get(prior.request_id);
@@ -30576,14 +28110,15 @@ class HostdServer {
       }
     }
     this.idempotencyKeys.set(idempotencyKey, { request_id: req.request_id, ts: now });
-    const denied = this.checkGate(req, caller);
-    if (denied) {
-      const resp2 = deniedResponse(req.request_id, denied);
-      await this.writeAudit({ caller, req, resp: resp2 });
+    const attest = await this.checkOperatorAttest(req, caller);
+    if (attest.denied !== null) {
+      const resp2 = deniedResponse(req.request_id, attest.denied);
+      await this.writeAudit({ caller, req, resp: resp2, method: attest.method });
       socket.write(encodeResponse(resp2));
       socket.end();
       return;
     }
+    const attestMethod = attest.method;
     const started = Date.now();
     let resp;
     try {
@@ -30642,10 +28177,70 @@ class HostdServer {
       resp = err("E_DISPATCH_FAILED", "hostd dispatch failed").why(msg).op(req.op).caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).build(req.request_id, Date.now() - started);
       resp = { ...resp, error: `hostd dispatch failed: ${msg}` };
     }
-    await this.writeAudit({ caller, req, resp });
+    await this.writeAudit({ caller, req, resp, method: attestMethod });
     socket.write(encodeResponse(resp));
     socket.end();
   }
+  async checkOperatorAttest(req, caller) {
+    const hostdCfg = this.opts.config.hostd;
+    if (hostdCfg?.operator_attest_enabled !== true) {
+      return { denied: null };
+    }
+    if (caller.kind === "operator")
+      return { denied: null };
+    const requiredVerbs = hostdCfg.operator_attest_required_verbs ?? DEFAULT_OPERATOR_ATTEST_VERBS;
+    const required = requiredVerbs.includes(req.op);
+    const passphrase = req.operator_passphrase;
+    if (!required) {
+      if (passphrase === undefined)
+        return { denied: null };
+      const v2 = await this.attestVerifier().verify(passphrase);
+      return v2.ok ? { denied: null, method: ATTEST_AUDIT_METHOD } : {
+        denied: `${req.op} operator-attest failed: ${v2.reason}`,
+        method: ATTEST_AUDIT_METHOD
+      };
+    }
+    if (passphrase === undefined) {
+      return {
+        denied: `${req.op} requires operator-passphrase attestation ` + `(hostd.operator_attest_enabled is on and ${req.op} is in ` + `operator_attest_required_verbs)`,
+        method: ATTEST_AUDIT_METHOD
+      };
+    }
+    const v = await this.attestVerifier().verify(passphrase);
+    return v.ok ? { denied: null, method: ATTEST_AUDIT_METHOD } : {
+      denied: `${req.op} operator-attest failed: ${v.reason}`,
+      method: ATTEST_AUDIT_METHOD
+    };
+  }
+  attestVerifier() {
+    if (this.opts.attestVerifier)
+      return this.opts.attestVerifier;
+    if (!this._defaultAttestVerifier) {
+      this._defaultAttestVerifier = {
+        verify: (passphrase) => this.brokerAttestVerify(passphrase)
+      };
+    }
+    return this._defaultAttestVerifier;
+  }
+  _defaultAttestVerifier;
+  async brokerAttestVerify(passphrase) {
+    const res = await rpcRaw({
+      v: 1,
+      op: "list_grants",
+      agent: "hostd",
+      passphrase
+    }, { vaultBrokerSocket: HOSTD_BROKER_SOCKET_PATH, timeoutMs: 5000 });
+    if (res.kind === "unreachable") {
+      return { ok: false, reason: `broker unreachable: ${res.msg}` };
+    }
+    const resp = res.resp;
+    if (resp.ok === true)
+      return { ok: true };
+    return {
+      ok: false,
+      reason: `broker denied attestation (${resp.code ?? "DENIED"})`
+    };
+  }
   checkGate(req, caller) {
     if (caller.kind === "operator")
       return null;
@@ -30779,7 +28374,7 @@ class HostdServer {
       join10(root, "profiles"),
       join10(root, "profiles", "default"),
       join10(root, "vendor", "hindsight-memory")
-    ].filter((p) => !existsSync10(p));
+    ].filter((p) => !existsSync11(p));
   }
   applyAssetPreflight(request_id, started) {
     const missing = this.missingApplyAssets();
@@ -30889,6 +28484,26 @@ class HostdServer {
     const assetDenied = this.applyAssetPreflight(req.request_id, started);
     if (assetDenied)
       return assetDenied;
+    if (req.args.agents !== undefined) {
+      let validAgents = null;
+      try {
+        const cfg = loadConfig(this.opts.configPath);
+        validAgents = Object.keys(cfg.agents ?? {});
+      } catch {
+        validAgents = null;
+      }
+      if (validAgents !== null) {
+        const buildDenied = (human) => err("E_UNKNOWN_AGENT", human).fixBadInput("agents").op("rollout").caller(caller.kind).agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+        const requested = req.args.agents;
+        if (requested.length === 0) {
+          return buildDenied(`empty agents list — pass at least one agent, ` + `or omit "agents" to roll all. Valid agents: ${validAgents.join(", ")}`);
+        }
+        const unknown = requested.filter((a) => !validAgents.includes(a));
+        if (unknown.length > 0) {
+          return buildDenied(`unknown agent(s): ${unknown.join(", ")}. ` + `Valid agents: ${validAgents.join(", ")}`);
+        }
+      }
+    }
     const entry = this.launchRollout(req.args, req.request_id, caller, started);
     return {
       v: 1,
@@ -30952,10 +28567,10 @@ class HostdServer {
   async beginSelfBump(req, caller, started) {
     const ownVersion = this.opts.selfVersion ?? SWITCHROOM_VERSION;
     const composePath = join10(this.hostdDirPath(), "docker-compose.yml");
-    if (!existsSync10(composePath)) {
+    if (!existsSync11(composePath)) {
       return deniedResponse(req.request_id, `rollout: hostd's CLI (v${ownVersion}) is older than the target ` + `${req.args.pin} and needs a self-bump first, but its compose file ` + `is missing at ${composePath}. Run \`switchroom hostd install ` + `--tag ${req.args.pin}\` on the host, then re-run the roll. ` + `Nothing was changed.`, Date.now() - started);
     }
-    const before = readFileSync8(composePath, "utf8");
+    const before = readFileSync9(composePath, "utf8");
     const bumped = bumpHostdComposeImageTag(before, req.args.pin);
     if (!bumped) {
       return deniedResponse(req.request_id, `rollout: hostd needs a self-bump to ${req.args.pin} but no ` + `switchroom-hostd image line was found in ${composePath} ` + `(hand-edited compose?). Run \`switchroom hostd install --tag ` + `${req.args.pin}\` on the host, then re-run the roll. Nothing ` + `was changed.`, Date.now() - started);
@@ -31086,11 +28701,11 @@ class HostdServer {
   }
   async resumePendingSelfBumpRollout() {
     const markerPath = join10(this.hostdDirPath(), SELF_BUMP_MARKER_FILENAME);
-    if (!existsSync10(markerPath))
+    if (!existsSync11(markerPath))
       return;
     let raw;
     try {
-      raw = readFileSync8(markerPath, "utf8");
+      raw = readFileSync9(markerPath, "utf8");
     } finally {
       try {
         unlinkSync2(markerPath);
@@ -31168,8 +28783,17 @@ class HostdServer {
       stderr_tail: tail(res.stderr)
     };
   }
+  rejectUnconfiguredTarget(name, request_id, op, started) {
+    if (Object.prototype.hasOwnProperty.call(this.opts.agentUids, name)) {
+      return null;
+    }
+    return deniedResponse(request_id, `${op}: "${name}" is not a configured agent. ` + `${op} targets only peer agent containers (switchroom-<agent>); ` + `singleton service containers (vault-broker, approval-kernel, ` + `hostd, web) and unknown names are rejected. Configured agents: ` + `${Object.keys(this.opts.agentUids).sort().join(", ")}.`, Date.now() - started);
+  }
   async handleAgentLogs(req, started) {
     const tailLines = req.args.tail ?? 100;
+    const rejected = this.rejectUnconfiguredTarget(req.args.name, req.request_id, "agent_logs", started);
+    if (rejected)
+      return rejected;
     const container = `switchroom-${req.args.name}`;
     const res = await this.runDocker([
       "logs",
@@ -31195,6 +28819,9 @@ class HostdServer {
     if (!req.args.argv.every(isSafeExecArgvElement)) {
       return deniedResponse(req.request_id, `agent_exec: an argv element contains a control character ` + `(C0 / DEL) or exceeds ${MAX_EXEC_ARGV_ELEMENT_BYTES} bytes, ` + `which is not permitted (#1401 / #1400).`, Date.now() - started);
     }
+    const rejected = this.rejectUnconfiguredTarget(req.args.name, req.request_id, "agent_exec", started);
+    if (rejected)
+      return rejected;
     const container = `switchroom-${req.args.name}`;
     const res = await this.runDocker(["exec", container, ...req.args.argv]);
     return {
@@ -31221,18 +28848,19 @@ class HostdServer {
     if (!verdict.ok) {
       return err(verdict.code, verdict.detail).fixBadInput("unified_diff").op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).build(req.request_id, Date.now() - started);
     }
+    let beforeContent;
+    try {
+      beforeContent = readFileSync9(configPath, "utf-8");
+    } catch {
+      beforeContent = "";
+    }
     if (caller.kind === "agent" && this.opts.config.agents[caller.name]?.admin !== true) {
-      let beforeContent;
-      try {
-        beforeContent = readFileSync8(configPath, "utf-8");
-      } catch {
-        beforeContent = "";
-      }
       const admission = admitSelfScopedNonAdminEdit(beforeContent, verdict.postApplyContent, caller.name);
       if (!admission.ok) {
         return err("E_NOT_SELF_SCOPED", admission.detail).why("non-admin agents may only add rules to their own " + "agents.<self>.tools.allow OR append their own " + "agents.<self>.memory.mental_models via config_propose_edit " + `(mental-model check: ${admission.mentalModelDetail})`).fixBadInput("unified_diff").op("config_propose_edit").caller("agent").agentName(caller.name).asDenied().build(req.request_id, Date.now() - started);
       }
     }
+    const proposedChangedPaths = classifyBlastRadius(beforeContent, verdict.postApplyContent).changedPaths;
     if (!this.opts.approvalGateway) {
       return err("E_NO_APPROVAL_GATEWAY", "validation passed but hostd was started without an approval-gateway wiring; the operator build is missing the telegram-plugin link").fixOperatorAction("infra", [
         "ensure hostd was launched with --approval-gateway / telegram-plugin link"
@@ -31246,23 +28874,42 @@ class HostdServer {
 `);
       return await pending;
     }
-    const rate = this.checkConfigEditRate(callerName, Date.now());
-    if (!rate.ok) {
-      const retryAtIso = new Date(rate.retryAtMs).toISOString();
-      process.stderr.write(`hostd: config_propose_edit — RATE-LIMITED ${callerName} ` + `(>${rate.limit}/hour); next slot ${retryAtIso}
+    const run = this.runConfigProposeRateThenApply(req, caller, callerName, configPath, started, proposedChangedPaths);
+    this.inflightConfigProposals.set(dedupeKey, run);
+    try {
+      return await run;
+    } finally {
+      this.inflightConfigProposals.delete(dedupeKey);
+    }
+  }
+  async runConfigProposeRateThenApply(req, caller, callerName, configPath, started, proposedChangedPaths) {
+    let preApproved = false;
+    try {
+      if (this.opts.approvalGateway.checkPreApproved) {
+        preApproved = await this.opts.approvalGateway.checkPreApproved(callerName, req.args.unified_diff);
+      }
+    } catch {
+      preApproved = false;
+    }
+    if (!preApproved) {
+      const rate = this.checkConfigEditRate(callerName, Date.now());
+      if (!rate.ok) {
+        const retryAtIso = new Date(rate.retryAtMs).toISOString();
+        process.stderr.write(`hostd: config_propose_edit — RATE-LIMITED ${callerName} ` + `(>${rate.limit}/hour); next slot ${retryAtIso}
 `);
-      this.appendAuditRow({
-        ts: new Date().toISOString(),
-        op: "config_propose_edit",
-        phase: "rate_limited",
-        request_id: req.request_id,
-        caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
-        result: "denied",
-        exit_code: null,
-        duration_ms: Date.now() - started,
-        error: `E_RATE_LIMITED: >${rate.limit} config_propose_edit cards/hour`
-      });
-      return err("E_RATE_LIMITED", `config_propose_edit rate limit exceeded (max ${rate.limit}/hour for this agent)`).why(`next slot opens at ${retryAtIso}`).fixRetryAfter(retryAtIso).op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+        this.appendAuditRow({
+          ts: new Date().toISOString(),
+          op: "config_propose_edit",
+          phase: "rate_limited",
+          request_id: req.request_id,
+          caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
+          result: "denied",
+          exit_code: null,
+          duration_ms: Date.now() - started,
+          error: `E_RATE_LIMITED: >${rate.limit} config_propose_edit cards/hour`
+        });
+        return err("E_RATE_LIMITED", `config_propose_edit rate limit exceeded (max ${rate.limit}/hour for this agent)`).why(`next slot opens at ${retryAtIso}`).fixRetryAfter(retryAtIso).op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+      }
     }
     this.appendAuditRow({
       ts: new Date().toISOString(),
@@ -31272,15 +28919,10 @@ class HostdServer {
       caller: caller.kind === "agent" ? { kind: "agent", name: caller.name } : { kind: "operator" },
       result: "started",
       exit_code: null,
-      duration_ms: Date.now() - started
+      duration_ms: Date.now() - started,
+      ...preApproved ? { pre_approved: true } : {}
     });
-    const run = this.runConfigProposeApprovalAndApply(req, caller, callerName, configPath, verdict.postApplyContent, started);
-    this.inflightConfigProposals.set(dedupeKey, run);
-    try {
-      return await run;
-    } finally {
-      this.inflightConfigProposals.delete(dedupeKey);
-    }
+    return await this.runConfigProposeApprovalAndApply(req, caller, callerName, configPath, started, proposedChangedPaths);
   }
   inflightConfigProposals = new Map;
   configEditPostTimes = new Map;
@@ -31299,7 +28941,7 @@ class HostdServer {
     this.configEditPostTimes.set(callerName, prior);
     return { ok: true };
   }
-  async runConfigProposeApprovalAndApply(req, caller, callerName, configPath, postApply, started) {
+  async runConfigProposeApprovalAndApply(req, caller, callerName, configPath, started, proposedChangedPaths) {
     const approvalId = (this.opts.generateApprovalId ?? defaultApprovalId)();
     const approval = await this.opts.approvalGateway.requestApproval({
       requestId: approvalId,
@@ -31328,7 +28970,7 @@ class HostdServer {
     try {
       let snapshot;
       try {
-        snapshot = readFileSync8(configPath, "utf-8");
+        snapshot = readFileSync9(configPath, "utf-8");
       } catch (e) {
         await approval.finalize({
           outcome: "reconcile_failed_rolled_back",
@@ -31336,8 +28978,43 @@ class HostdServer {
         });
         return this.reconcileFailedRolledBack(`snapshot read failed: ${e.message}`, req, caller, started);
       }
+      const reverdict = validateConfigEdit({
+        configPath,
+        targetPath: req.args.target_path,
+        unifiedDiff: req.args.unified_diff
+      });
+      if (!reverdict.ok) {
+        const why = `stored diff no longer applies against the current config` + `: ${reverdict.detail}`;
+        await approval.finalize({
+          outcome: "aborted_config_changed",
+          detail: `config changed since proposal — re-propose (${why})`
+        });
+        return this.configChangedSinceProposal(why, req, caller, started);
+      }
+      const postApplyFresh = reverdict.postApplyContent;
+      const applyChangedPaths = classifyBlastRadius(snapshot, postApplyFresh).changedPaths;
+      const sameChangeSet = applyChangedPaths.length === proposedChangedPaths.length && applyChangedPaths.every((p, i) => p === proposedChangedPaths[i]);
+      if (!sameChangeSet) {
+        const why = `re-applied diff changes different config paths than approved ` + `(approved: [${proposedChangedPaths.join(", ")}]; ` + `would change: [${applyChangedPaths.join(", ")}])`;
+        await approval.finalize({
+          outcome: "aborted_config_changed",
+          detail: `config changed since proposal — re-propose (${why})`
+        });
+        return this.configChangedSinceProposal(why, req, caller, started);
+      }
+      if (caller.kind === "agent" && this.opts.config.agents[caller.name]?.admin !== true) {
+        const reAdmission = admitSelfScopedNonAdminEdit(snapshot, postApplyFresh, caller.name);
+        if (!reAdmission.ok) {
+          const why = `re-applied diff is no longer self-scoped for non-admin caller ` + `"${caller.name}": ${reAdmission.detail}`;
+          await approval.finalize({
+            outcome: "aborted_config_changed",
+            detail: `config changed since proposal — re-propose (${why})`
+          });
+          return this.configChangedSinceProposal(why, req, caller, started);
+        }
+      }
       try {
-        writeFileInPlacePreservingInode(configPath, postApply);
+        writeFileInPlacePreservingInode(configPath, postApplyFresh);
       } catch (e) {
         try {
           writeFileInPlacePreservingInode(configPath, snapshot);
@@ -31351,7 +29028,7 @@ class HostdServer {
       const runner = this.opts.runReconcile ?? (async () => this.runSwitchroom(caller.kind === "agent" ? ["apply", "--only", callerName, "--non-interactive"] : ["apply", "--non-interactive"]));
       const recRes = await runner({ requestId: approvalId });
       if (recRes.exit_code === 0) {
-        const blast = classifyBlastRadius(snapshot, postApply);
+        const blast = classifyBlastRadius(snapshot, postApplyFresh);
         await approval.finalize({
           outcome: "applied",
           affectedAgents: blast.agents,
@@ -31389,6 +29066,11 @@ class HostdServer {
       release();
     }
   }
+  configChangedSinceProposal(why, req, caller, started) {
+    const legacy = `E_CONFIG_CHANGED: config changed since proposal — re-propose (${why})`;
+    const built = err("E_CONFIG_CHANGED", "config changed since the proposal was validated; re-propose against the current config").why(why).fixBadInput("unified_diff").op("config_propose_edit").caller(caller.kind === "agent" ? "agent" : "operator").agentName(caller.kind === "agent" ? caller.name : undefined).asDenied().build(req.request_id, Date.now() - started);
+    return { ...built, error: legacy };
+  }
   reconcileFailedRolledBack(detail, req, caller, started, output) {
     const legacy = `E_RECONCILE_FAILED_ROLLED_BACK: ${detail}`;
     const built = err("E_RECONCILE_FAILED_ROLLED_BACK", "config write or reconcile failed; live file rolled back to snapshot").why(detail).fixOperatorAction("infra", [
@@ -31581,7 +29263,7 @@ ${output.recovery.stderr}` : "";
       return this.opts.imageRefsForDigests();
     try {
       const composePath = join10(this.opts.bindRoot ?? this.opts.homeDir, ".switchroom", "compose", "docker-compose.yml");
-      if (!existsSync10(composePath))
+      if (!existsSync11(composePath))
         return [];
       const r = spawnSync3("docker", [
         "compose",
@@ -31720,10 +29402,10 @@ ${output.recovery.stderr}` : "";
   }
   rolloutRowExistsInLog(targetRequestId) {
     const path2 = this.auditLogPath();
-    if (!existsSync10(path2))
+    if (!existsSync11(path2))
       return false;
     try {
-      const raw = readFileSync8(path2, "utf-8");
+      const raw = readFileSync9(path2, "utf-8");
       return latestRolloutRowForRequest(raw, targetRequestId) !== null;
     } catch {
       return false;
@@ -31731,11 +29413,11 @@ ${output.recovery.stderr}` : "";
   }
   rolloutStatusFromLog(responseRequestId, targetRequestId, started) {
     const path2 = this.auditLogPath();
-    if (!existsSync10(path2))
+    if (!existsSync11(path2))
       return null;
     let raw;
     try {
-      raw = readFileSync8(path2, "utf-8");
+      raw = readFileSync9(path2, "utf-8");
     } catch {
       return null;
     }
@@ -31840,6 +29522,7 @@ ${output.recovery.stderr}` : "";
     await this.appendAuditRow({
       ts: new Date().toISOString(),
       op: args.req.op,
+      ...args.method ? { method: args.method } : {},
       caller: args.caller.kind === "agent" ? { kind: "agent", name: args.caller.name } : { kind: "operator" },
       request_id: args.req.request_id,
       result: args.resp.result,
@@ -32068,12 +29751,83 @@ function isSafeExecArgvElement(s) {
 
 // src/host-control/approval-gateway.ts
 import { connect as connect2 } from "node:net";
+import { randomBytes as randomBytes2 } from "node:crypto";
+var PRE_APPROVED_QUERY_TIMEOUT_MS = 2000;
 
 class SocketApprovalGateway {
   opts;
   constructor(opts) {
     this.opts = opts;
   }
+  async checkPreApproved(agentName, unifiedDiff) {
+    const sockPath = this.opts.resolveGatewaySocket(agentName);
+    if (sockPath === null)
+      return false;
+    const log = this.opts.log ?? (() => {});
+    const correlationId = `preapp-${randomBytes2(8).toString("hex")}`;
+    return await new Promise((resolve9) => {
+      let settled = false;
+      const client2 = connect2({ path: sockPath });
+      let buffer = "";
+      const done = (result) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timer);
+        try {
+          client2.destroy();
+        } catch {}
+        resolve9(result);
+      };
+      const timer = setTimeout(() => {
+        log(`checkPreApproved timed out after ${PRE_APPROVED_QUERY_TIMEOUT_MS}ms (agent=${agentName}) — failing closed`);
+        done(false);
+      }, PRE_APPROVED_QUERY_TIMEOUT_MS);
+      client2.on("connect", () => {
+        try {
+          client2.write(JSON.stringify({
+            type: "check_pre_approved",
+            agentName,
+            correlationId,
+            unifiedDiff
+          }) + `
+`);
+        } catch (err2) {
+          log(`check_pre_approved write failed (agent=${agentName}): ${err2.message} — failing closed`);
+          done(false);
+        }
+      });
+      client2.on("data", (chunk2) => {
+        buffer += chunk2.toString("utf8");
+        const lines = buffer.split(`
+`);
+        buffer = lines.pop() ?? "";
+        for (const line of lines) {
+          if (!line.trim())
+            continue;
+          let parsed;
+          try {
+            parsed = JSON.parse(line);
+          } catch {
+            done(false);
+            return;
+          }
+          const obj = parsed;
+          if (obj.type === "pre_approved_result" && obj.correlationId === correlationId) {
+            done(obj.preApproved === true);
+            return;
+          }
+          done(false);
+          return;
+        }
+      });
+      client2.on("error", (err2) => {
+        log(`checkPreApproved socket error (agent=${agentName}): ${err2.message} — failing closed`);
+        done(false);
+      });
+      client2.on("close", () => done(false));
+    });
+  }
   async requestApproval(req) {
     const sockPath = this.opts.resolveGatewaySocket(req.agentName);
     if (sockPath === null) {
@@ -32914,7 +30668,7 @@ async function loadConfigResilient() {
       try {
         for (const name of readdirSync4(agentsDir).sort()) {
           const sock = resolve9(agentsDir, name, "telegram", "gateway.sock");
-          if (existsSync11(sock))
+          if (existsSync12(sock))
             out.push({ agent: name, sock });
         }
       } catch {}
@@ -32964,7 +30718,7 @@ async function main() {
   const agentsDir = process.env.SWITCHROOM_AGENTS_DIR ?? join11(homedir6(), ".switchroom", "agents");
   const resolveGatewaySocket = (agentName) => {
     const sock = resolve9(agentsDir, agentName, "telegram", "gateway.sock");
-    return existsSync11(sock) ? sock : null;
+    return existsSync12(sock) ? sock : null;
   };
   const approvalGateway = new SocketApprovalGateway({
     resolveGatewaySocket,
@@ -32992,7 +30746,11 @@ async function main() {
       ])),
       ...config.hostd ? {
         hostd: {
-          ...config.hostd.config_edit_enabled !== undefined ? { config_edit_enabled: config.hostd.config_edit_enabled } : {}
+          ...config.hostd.config_edit_enabled !== undefined ? { config_edit_enabled: config.hostd.config_edit_enabled } : {},
+          ...config.hostd.operator_attest_enabled !== undefined ? { operator_attest_enabled: config.hostd.operator_attest_enabled } : {},
+          ...config.hostd.operator_attest_required_verbs !== undefined ? {
+            operator_attest_required_verbs: config.hostd.operator_attest_required_verbs
+          } : {}
         }
       } : {}
     },