switchroom 0.7.10 → 0.7.13

package/dist/vault/broker/server.js

@@ -1,5 +1,34 @@
 import { createRequire } from "node:module";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
@@ -13,9 +42,1529 @@ var __export = (target, all) => {
       configurable: true,
       set: __exportSetter.bind(all, name)
     });
-};
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+// node_modules/.bun/graceful-fs@4.2.11/node_modules/graceful-fs/polyfills.js
+var require_polyfills = __commonJS((exports, module) => {
+  var constants = __require("constants");
+  var origCwd = process.cwd;
+  var cwd = null;
+  var platform = process.env.GRACEFUL_FS_PLATFORM || process.platform;
+  process.cwd = function() {
+    if (!cwd)
+      cwd = origCwd.call(process);
+    return cwd;
+  };
+  try {
+    process.cwd();
+  } catch (er) {}
+  if (typeof process.chdir === "function") {
+    chdir = process.chdir;
+    process.chdir = function(d) {
+      cwd = null;
+      chdir.call(process, d);
+    };
+    if (Object.setPrototypeOf)
+      Object.setPrototypeOf(process.chdir, chdir);
+  }
+  var chdir;
+  module.exports = patch;
+  function patch(fs) {
+    if (constants.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
+      patchLchmod(fs);
+    }
+    if (!fs.lutimes) {
+      patchLutimes(fs);
+    }
+    fs.chown = chownFix(fs.chown);
+    fs.fchown = chownFix(fs.fchown);
+    fs.lchown = chownFix(fs.lchown);
+    fs.chmod = chmodFix(fs.chmod);
+    fs.fchmod = chmodFix(fs.fchmod);
+    fs.lchmod = chmodFix(fs.lchmod);
+    fs.chownSync = chownFixSync(fs.chownSync);
+    fs.fchownSync = chownFixSync(fs.fchownSync);
+    fs.lchownSync = chownFixSync(fs.lchownSync);
+    fs.chmodSync = chmodFixSync(fs.chmodSync);
+    fs.fchmodSync = chmodFixSync(fs.fchmodSync);
+    fs.lchmodSync = chmodFixSync(fs.lchmodSync);
+    fs.stat = statFix(fs.stat);
+    fs.fstat = statFix(fs.fstat);
+    fs.lstat = statFix(fs.lstat);
+    fs.statSync = statFixSync(fs.statSync);
+    fs.fstatSync = statFixSync(fs.fstatSync);
+    fs.lstatSync = statFixSync(fs.lstatSync);
+    if (fs.chmod && !fs.lchmod) {
+      fs.lchmod = function(path, mode, cb) {
+        if (cb)
+          process.nextTick(cb);
+      };
+      fs.lchmodSync = function() {};
+    }
+    if (fs.chown && !fs.lchown) {
+      fs.lchown = function(path, uid, gid, cb) {
+        if (cb)
+          process.nextTick(cb);
+      };
+      fs.lchownSync = function() {};
+    }
+    if (platform === "win32") {
+      fs.rename = typeof fs.rename !== "function" ? fs.rename : function(fs$rename) {
+        function rename(from, to, cb) {
+          var start = Date.now();
+          var backoff = 0;
+          fs$rename(from, to, function CB(er) {
+            if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 60000) {
+              setTimeout(function() {
+                fs.stat(to, function(stater, st) {
+                  if (stater && stater.code === "ENOENT")
+                    fs$rename(from, to, CB);
+                  else
+                    cb(er);
+                });
+              }, backoff);
+              if (backoff < 100)
+                backoff += 10;
+              return;
+            }
+            if (cb)
+              cb(er);
+          });
+        }
+        if (Object.setPrototypeOf)
+          Object.setPrototypeOf(rename, fs$rename);
+        return rename;
+      }(fs.rename);
+    }
+    fs.read = typeof fs.read !== "function" ? fs.read : function(fs$read) {
+      function read(fd, buffer, offset, length, position, callback_) {
+        var callback;
+        if (callback_ && typeof callback_ === "function") {
+          var eagCounter = 0;
+          callback = function(er, _, __) {
+            if (er && er.code === "EAGAIN" && eagCounter < 10) {
+              eagCounter++;
+              return fs$read.call(fs, fd, buffer, offset, length, position, callback);
+            }
+            callback_.apply(this, arguments);
+          };
+        }
+        return fs$read.call(fs, fd, buffer, offset, length, position, callback);
+      }
+      if (Object.setPrototypeOf)
+        Object.setPrototypeOf(read, fs$read);
+      return read;
+    }(fs.read);
+    fs.readSync = typeof fs.readSync !== "function" ? fs.readSync : function(fs$readSync) {
+      return function(fd, buffer, offset, length, position) {
+        var eagCounter = 0;
+        while (true) {
+          try {
+            return fs$readSync.call(fs, fd, buffer, offset, length, position);
+          } catch (er) {
+            if (er.code === "EAGAIN" && eagCounter < 10) {
+              eagCounter++;
+              continue;
+            }
+            throw er;
+          }
+        }
+      };
+    }(fs.readSync);
+    function patchLchmod(fs2) {
+      fs2.lchmod = function(path, mode, callback) {
+        fs2.open(path, constants.O_WRONLY | constants.O_SYMLINK, mode, function(err, fd) {
+          if (err) {
+            if (callback)
+              callback(err);
+            return;
+          }
+          fs2.fchmod(fd, mode, function(err2) {
+            fs2.close(fd, function(err22) {
+              if (callback)
+                callback(err2 || err22);
+            });
+          });
+        });
+      };
+      fs2.lchmodSync = function(path, mode) {
+        var fd = fs2.openSync(path, constants.O_WRONLY | constants.O_SYMLINK, mode);
+        var threw = true;
+        var ret;
+        try {
+          ret = fs2.fchmodSync(fd, mode);
+          threw = false;
+        } finally {
+          if (threw) {
+            try {
+              fs2.closeSync(fd);
+            } catch (er) {}
+          } else {
+            fs2.closeSync(fd);
+          }
+        }
+        return ret;
+      };
+    }
+    function patchLutimes(fs2) {
+      if (constants.hasOwnProperty("O_SYMLINK") && fs2.futimes) {
+        fs2.lutimes = function(path, at, mt, cb) {
+          fs2.open(path, constants.O_SYMLINK, function(er, fd) {
+            if (er) {
+              if (cb)
+                cb(er);
+              return;
+            }
+            fs2.futimes(fd, at, mt, function(er2) {
+              fs2.close(fd, function(er22) {
+                if (cb)
+                  cb(er2 || er22);
+              });
+            });
+          });
+        };
+        fs2.lutimesSync = function(path, at, mt) {
+          var fd = fs2.openSync(path, constants.O_SYMLINK);
+          var ret;
+          var threw = true;
+          try {
+            ret = fs2.futimesSync(fd, at, mt);
+            threw = false;
+          } finally {
+            if (threw) {
+              try {
+                fs2.closeSync(fd);
+              } catch (er) {}
+            } else {
+              fs2.closeSync(fd);
+            }
+          }
+          return ret;
+        };
+      } else if (fs2.futimes) {
+        fs2.lutimes = function(_a, _b, _c, cb) {
+          if (cb)
+            process.nextTick(cb);
+        };
+        fs2.lutimesSync = function() {};
+      }
+    }
+    function chmodFix(orig) {
+      if (!orig)
+        return orig;
+      return function(target, mode, cb) {
+        return orig.call(fs, target, mode, function(er) {
+          if (chownErOk(er))
+            er = null;
+          if (cb)
+            cb.apply(this, arguments);
+        });
+      };
+    }
+    function chmodFixSync(orig) {
+      if (!orig)
+        return orig;
+      return function(target, mode) {
+        try {
+          return orig.call(fs, target, mode);
+        } catch (er) {
+          if (!chownErOk(er))
+            throw er;
+        }
+      };
+    }
+    function chownFix(orig) {
+      if (!orig)
+        return orig;
+      return function(target, uid, gid, cb) {
+        return orig.call(fs, target, uid, gid, function(er) {
+          if (chownErOk(er))
+            er = null;
+          if (cb)
+            cb.apply(this, arguments);
+        });
+      };
+    }
+    function chownFixSync(orig) {
+      if (!orig)
+        return orig;
+      return function(target, uid, gid) {
+        try {
+          return orig.call(fs, target, uid, gid);
+        } catch (er) {
+          if (!chownErOk(er))
+            throw er;
+        }
+      };
+    }
+    function statFix(orig) {
+      if (!orig)
+        return orig;
+      return function(target, options, cb) {
+        if (typeof options === "function") {
+          cb = options;
+          options = null;
+        }
+        function callback(er, stats) {
+          if (stats) {
+            if (stats.uid < 0)
+              stats.uid += 4294967296;
+            if (stats.gid < 0)
+              stats.gid += 4294967296;
+          }
+          if (cb)
+            cb.apply(this, arguments);
+        }
+        return options ? orig.call(fs, target, options, callback) : orig.call(fs, target, callback);
+      };
+    }
+    function statFixSync(orig) {
+      if (!orig)
+        return orig;
+      return function(target, options) {
+        var stats = options ? orig.call(fs, target, options) : orig.call(fs, target);
+        if (stats) {
+          if (stats.uid < 0)
+            stats.uid += 4294967296;
+          if (stats.gid < 0)
+            stats.gid += 4294967296;
+        }
+        return stats;
+      };
+    }
+    function chownErOk(er) {
+      if (!er)
+        return true;
+      if (er.code === "ENOSYS")
+        return true;
+      var nonroot = !process.getuid || process.getuid() !== 0;
+      if (nonroot) {
+        if (er.code === "EINVAL" || er.code === "EPERM")
+          return true;
+      }
+      return false;
+    }
+  }
+});
+
+// node_modules/.bun/graceful-fs@4.2.11/node_modules/graceful-fs/legacy-streams.js
+var require_legacy_streams = __commonJS((exports, module) => {
+  var Stream = __require("stream").Stream;
+  module.exports = legacy;
+  function legacy(fs) {
+    return {
+      ReadStream,
+      WriteStream
+    };
+    function ReadStream(path, options) {
+      if (!(this instanceof ReadStream))
+        return new ReadStream(path, options);
+      Stream.call(this);
+      var self = this;
+      this.path = path;
+      this.fd = null;
+      this.readable = true;
+      this.paused = false;
+      this.flags = "r";
+      this.mode = 438;
+      this.bufferSize = 64 * 1024;
+      options = options || {};
+      var keys = Object.keys(options);
+      for (var index = 0, length = keys.length;index < length; index++) {
+        var key = keys[index];
+        this[key] = options[key];
+      }
+      if (this.encoding)
+        this.setEncoding(this.encoding);
+      if (this.start !== undefined) {
+        if (typeof this.start !== "number") {
+          throw TypeError("start must be a Number");
+        }
+        if (this.end === undefined) {
+          this.end = Infinity;
+        } else if (typeof this.end !== "number") {
+          throw TypeError("end must be a Number");
+        }
+        if (this.start > this.end) {
+          throw new Error("start must be <= end");
+        }
+        this.pos = this.start;
+      }
+      if (this.fd !== null) {
+        process.nextTick(function() {
+          self._read();
+        });
+        return;
+      }
+      fs.open(this.path, this.flags, this.mode, function(err, fd) {
+        if (err) {
+          self.emit("error", err);
+          self.readable = false;
+          return;
+        }
+        self.fd = fd;
+        self.emit("open", fd);
+        self._read();
+      });
+    }
+    function WriteStream(path, options) {
+      if (!(this instanceof WriteStream))
+        return new WriteStream(path, options);
+      Stream.call(this);
+      this.path = path;
+      this.fd = null;
+      this.writable = true;
+      this.flags = "w";
+      this.encoding = "binary";
+      this.mode = 438;
+      this.bytesWritten = 0;
+      options = options || {};
+      var keys = Object.keys(options);
+      for (var index = 0, length = keys.length;index < length; index++) {
+        var key = keys[index];
+        this[key] = options[key];
+      }
+      if (this.start !== undefined) {
+        if (typeof this.start !== "number") {
+          throw TypeError("start must be a Number");
+        }
+        if (this.start < 0) {
+          throw new Error("start must be >= zero");
+        }
+        this.pos = this.start;
+      }
+      this.busy = false;
+      this._queue = [];
+      if (this.fd === null) {
+        this._open = fs.open;
+        this._queue.push([this._open, this.path, this.flags, this.mode, undefined]);
+        this.flush();
+      }
+    }
+  }
+});
+
+// node_modules/.bun/graceful-fs@4.2.11/node_modules/graceful-fs/clone.js
+var require_clone = __commonJS((exports, module) => {
+  module.exports = clone;
+  var getPrototypeOf = Object.getPrototypeOf || function(obj) {
+    return obj.__proto__;
+  };
+  function clone(obj) {
+    if (obj === null || typeof obj !== "object")
+      return obj;
+    if (obj instanceof Object)
+      var copy = { __proto__: getPrototypeOf(obj) };
+    else
+      var copy = Object.create(null);
+    Object.getOwnPropertyNames(obj).forEach(function(key) {
+      Object.defineProperty(copy, key, Object.getOwnPropertyDescriptor(obj, key));
+    });
+    return copy;
+  }
+});
+
+// node_modules/.bun/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js
+var require_graceful_fs = __commonJS((exports, module) => {
+  var fs = __require("fs");
+  var polyfills = require_polyfills();
+  var legacy = require_legacy_streams();
+  var clone = require_clone();
+  var util = __require("util");
+  var gracefulQueue;
+  var previousSymbol;
+  if (typeof Symbol === "function" && typeof Symbol.for === "function") {
+    gracefulQueue = Symbol.for("graceful-fs.queue");
+    previousSymbol = Symbol.for("graceful-fs.previous");
+  } else {
+    gracefulQueue = "___graceful-fs.queue";
+    previousSymbol = "___graceful-fs.previous";
+  }
+  function noop() {}
+  function publishQueue(context, queue2) {
+    Object.defineProperty(context, gracefulQueue, {
+      get: function() {
+        return queue2;
+      }
+    });
+  }
+  var debug = noop;
+  if (util.debuglog)
+    debug = util.debuglog("gfs4");
+  else if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || ""))
+    debug = function() {
+      var m = util.format.apply(util, arguments);
+      m = "GFS4: " + m.split(/\n/).join(`
+GFS4: `);
+      console.error(m);
+    };
+  if (!fs[gracefulQueue]) {
+    queue = global[gracefulQueue] || [];
+    publishQueue(fs, queue);
+    fs.close = function(fs$close) {
+      function close(fd, cb) {
+        return fs$close.call(fs, fd, function(err) {
+          if (!err) {
+            resetQueue();
+          }
+          if (typeof cb === "function")
+            cb.apply(this, arguments);
+        });
+      }
+      Object.defineProperty(close, previousSymbol, {
+        value: fs$close
+      });
+      return close;
+    }(fs.close);
+    fs.closeSync = function(fs$closeSync) {
+      function closeSync(fd) {
+        fs$closeSync.apply(fs, arguments);
+        resetQueue();
+      }
+      Object.defineProperty(closeSync, previousSymbol, {
+        value: fs$closeSync
+      });
+      return closeSync;
+    }(fs.closeSync);
+    if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
+      process.on("exit", function() {
+        debug(fs[gracefulQueue]);
+        __require("assert").equal(fs[gracefulQueue].length, 0);
+      });
+    }
+  }
+  var queue;
+  if (!global[gracefulQueue]) {
+    publishQueue(global, fs[gracefulQueue]);
+  }
+  module.exports = patch(clone(fs));
+  if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs.__patched) {
+    module.exports = patch(fs);
+    fs.__patched = true;
+  }
+  function patch(fs2) {
+    polyfills(fs2);
+    fs2.gracefulify = patch;
+    fs2.createReadStream = createReadStream;
+    fs2.createWriteStream = createWriteStream;
+    var fs$readFile = fs2.readFile;
+    fs2.readFile = readFile;
+    function readFile(path, options, cb) {
+      if (typeof options === "function")
+        cb = options, options = null;
+      return go$readFile(path, options, cb);
+      function go$readFile(path2, options2, cb2, startTime) {
+        return fs$readFile(path2, options2, function(err) {
+          if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+            enqueue([go$readFile, [path2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          else {
+            if (typeof cb2 === "function")
+              cb2.apply(this, arguments);
+          }
+        });
+      }
+    }
+    var fs$writeFile = fs2.writeFile;
+    fs2.writeFile = writeFile;
+    function writeFile(path, data, options, cb) {
+      if (typeof options === "function")
+        cb = options, options = null;
+      return go$writeFile(path, data, options, cb);
+      function go$writeFile(path2, data2, options2, cb2, startTime) {
+        return fs$writeFile(path2, data2, options2, function(err) {
+          if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+            enqueue([go$writeFile, [path2, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          else {
+            if (typeof cb2 === "function")
+              cb2.apply(this, arguments);
+          }
+        });
+      }
+    }
+    var fs$appendFile = fs2.appendFile;
+    if (fs$appendFile)
+      fs2.appendFile = appendFile;
+    function appendFile(path, data, options, cb) {
+      if (typeof options === "function")
+        cb = options, options = null;
+      return go$appendFile(path, data, options, cb);
+      function go$appendFile(path2, data2, options2, cb2, startTime) {
+        return fs$appendFile(path2, data2, options2, function(err) {
+          if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+            enqueue([go$appendFile, [path2, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          else {
+            if (typeof cb2 === "function")
+              cb2.apply(this, arguments);
+          }
+        });
+      }
+    }
+    var fs$copyFile = fs2.copyFile;
+    if (fs$copyFile)
+      fs2.copyFile = copyFile;
+    function copyFile(src, dest, flags, cb) {
+      if (typeof flags === "function") {
+        cb = flags;
+        flags = 0;
+      }
+      return go$copyFile(src, dest, flags, cb);
+      function go$copyFile(src2, dest2, flags2, cb2, startTime) {
+        return fs$copyFile(src2, dest2, flags2, function(err) {
+          if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+            enqueue([go$copyFile, [src2, dest2, flags2, cb2], err, startTime || Date.now(), Date.now()]);
+          else {
+            if (typeof cb2 === "function")
+              cb2.apply(this, arguments);
+          }
+        });
+      }
+    }
+    var fs$readdir = fs2.readdir;
+    fs2.readdir = readdir;
+    var noReaddirOptionVersions = /^v[0-5]\./;
+    function readdir(path, options, cb) {
+      if (typeof options === "function")
+        cb = options, options = null;
+      var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path2, options2, cb2, startTime) {
+        return fs$readdir(path2, fs$readdirCallback(path2, options2, cb2, startTime));
+      } : function go$readdir2(path2, options2, cb2, startTime) {
+        return fs$readdir(path2, options2, fs$readdirCallback(path2, options2, cb2, startTime));
+      };
+      return go$readdir(path, options, cb);
+      function fs$readdirCallback(path2, options2, cb2, startTime) {
+        return function(err, files) {
+          if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+            enqueue([
+              go$readdir,
+              [path2, options2, cb2],
+              err,
+              startTime || Date.now(),
+              Date.now()
+            ]);
+          else {
+            if (files && files.sort)
+              files.sort();
+            if (typeof cb2 === "function")
+              cb2.call(this, err, files);
+          }
+        };
+      }
+    }
+    if (process.version.substr(0, 4) === "v0.8") {
+      var legStreams = legacy(fs2);
+      ReadStream = legStreams.ReadStream;
+      WriteStream = legStreams.WriteStream;
+    }
+    var fs$ReadStream = fs2.ReadStream;
+    if (fs$ReadStream) {
+      ReadStream.prototype = Object.create(fs$ReadStream.prototype);
+      ReadStream.prototype.open = ReadStream$open;
+    }
+    var fs$WriteStream = fs2.WriteStream;
+    if (fs$WriteStream) {
+      WriteStream.prototype = Object.create(fs$WriteStream.prototype);
+      WriteStream.prototype.open = WriteStream$open;
+    }
+    Object.defineProperty(fs2, "ReadStream", {
+      get: function() {
+        return ReadStream;
+      },
+      set: function(val) {
+        ReadStream = val;
+      },
+      enumerable: true,
+      configurable: true
+    });
+    Object.defineProperty(fs2, "WriteStream", {
+      get: function() {
+        return WriteStream;
+      },
+      set: function(val) {
+        WriteStream = val;
+      },
+      enumerable: true,
+      configurable: true
+    });
+    var FileReadStream = ReadStream;
+    Object.defineProperty(fs2, "FileReadStream", {
+      get: function() {
+        return FileReadStream;
+      },
+      set: function(val) {
+        FileReadStream = val;
+      },
+      enumerable: true,
+      configurable: true
+    });
+    var FileWriteStream = WriteStream;
+    Object.defineProperty(fs2, "FileWriteStream", {
+      get: function() {
+        return FileWriteStream;
+      },
+      set: function(val) {
+        FileWriteStream = val;
+      },
+      enumerable: true,
+      configurable: true
+    });
+    function ReadStream(path, options) {
+      if (this instanceof ReadStream)
+        return fs$ReadStream.apply(this, arguments), this;
+      else
+        return ReadStream.apply(Object.create(ReadStream.prototype), arguments);
+    }
+    function ReadStream$open() {
+      var that = this;
+      open(that.path, that.flags, that.mode, function(err, fd) {
+        if (err) {
+          if (that.autoClose)
+            that.destroy();
+          that.emit("error", err);
+        } else {
+          that.fd = fd;
+          that.emit("open", fd);
+          that.read();
+        }
+      });
+    }
+    function WriteStream(path, options) {
+      if (this instanceof WriteStream)
+        return fs$WriteStream.apply(this, arguments), this;
+      else
+        return WriteStream.apply(Object.create(WriteStream.prototype), arguments);
+    }
+    function WriteStream$open() {
+      var that = this;
+      open(that.path, that.flags, that.mode, function(err, fd) {
+        if (err) {
+          that.destroy();
+          that.emit("error", err);
+        } else {
+          that.fd = fd;
+          that.emit("open", fd);
+        }
+      });
+    }
+    function createReadStream(path, options) {
+      return new fs2.ReadStream(path, options);
+    }
+    function createWriteStream(path, options) {
+      return new fs2.WriteStream(path, options);
+    }
+    var fs$open = fs2.open;
+    fs2.open = open;
+    function open(path, flags, mode, cb) {
+      if (typeof mode === "function")
+        cb = mode, mode = null;
+      return go$open(path, flags, mode, cb);
+      function go$open(path2, flags2, mode2, cb2, startTime) {
+        return fs$open(path2, flags2, mode2, function(err, fd) {
+          if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+            enqueue([go$open, [path2, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+          else {
+            if (typeof cb2 === "function")
+              cb2.apply(this, arguments);
+          }
+        });
+      }
+    }
+    return fs2;
+  }
+  function enqueue(elem) {
+    debug("ENQUEUE", elem[0].name, elem[1]);
+    fs[gracefulQueue].push(elem);
+    retry();
+  }
+  var retryTimer;
+  function resetQueue() {
+    var now = Date.now();
+    for (var i = 0;i < fs[gracefulQueue].length; ++i) {
+      if (fs[gracefulQueue][i].length > 2) {
+        fs[gracefulQueue][i][3] = now;
+        fs[gracefulQueue][i][4] = now;
+      }
+    }
+    retry();
+  }
+  function retry() {
+    clearTimeout(retryTimer);
+    retryTimer = undefined;
+    if (fs[gracefulQueue].length === 0)
+      return;
+    var elem = fs[gracefulQueue].shift();
+    var fn = elem[0];
+    var args = elem[1];
+    var err = elem[2];
+    var startTime = elem[3];
+    var lastTime = elem[4];
+    if (startTime === undefined) {
+      debug("RETRY", fn.name, args);
+      fn.apply(null, args);
+    } else if (Date.now() - startTime >= 60000) {
+      debug("TIMEOUT", fn.name, args);
+      var cb = args.pop();
+      if (typeof cb === "function")
+        cb.call(null, err);
+    } else {
+      var sinceAttempt = Date.now() - lastTime;
+      var sinceStart = Math.max(lastTime - startTime, 1);
+      var desiredDelay = Math.min(sinceStart * 1.2, 100);
+      if (sinceAttempt >= desiredDelay) {
+        debug("RETRY", fn.name, args);
+        fn.apply(null, args.concat([startTime]));
+      } else {
+        fs[gracefulQueue].push(elem);
+      }
+    }
+    if (retryTimer === undefined) {
+      retryTimer = setTimeout(retry, 0);
+    }
+  }
+});
+
+// node_modules/.bun/retry@0.12.0/node_modules/retry/lib/retry_operation.js
+var require_retry_operation = __commonJS((exports, module) => {
+  function RetryOperation(timeouts, options) {
+    if (typeof options === "boolean") {
+      options = { forever: options };
+    }
+    this._originalTimeouts = JSON.parse(JSON.stringify(timeouts));
+    this._timeouts = timeouts;
+    this._options = options || {};
+    this._maxRetryTime = options && options.maxRetryTime || Infinity;
+    this._fn = null;
+    this._errors = [];
+    this._attempts = 1;
+    this._operationTimeout = null;
+    this._operationTimeoutCb = null;
+    this._timeout = null;
+    this._operationStart = null;
+    if (this._options.forever) {
+      this._cachedTimeouts = this._timeouts.slice(0);
+    }
+  }
+  module.exports = RetryOperation;
+  RetryOperation.prototype.reset = function() {
+    this._attempts = 1;
+    this._timeouts = this._originalTimeouts;
+  };
+  RetryOperation.prototype.stop = function() {
+    if (this._timeout) {
+      clearTimeout(this._timeout);
+    }
+    this._timeouts = [];
+    this._cachedTimeouts = null;
+  };
+  RetryOperation.prototype.retry = function(err) {
+    if (this._timeout) {
+      clearTimeout(this._timeout);
+    }
+    if (!err) {
+      return false;
+    }
+    var currentTime = new Date().getTime();
+    if (err && currentTime - this._operationStart >= this._maxRetryTime) {
+      this._errors.unshift(new Error("RetryOperation timeout occurred"));
+      return false;
+    }
+    this._errors.push(err);
+    var timeout = this._timeouts.shift();
+    if (timeout === undefined) {
+      if (this._cachedTimeouts) {
+        this._errors.splice(this._errors.length - 1, this._errors.length);
+        this._timeouts = this._cachedTimeouts.slice(0);
+        timeout = this._timeouts.shift();
+      } else {
+        return false;
+      }
+    }
+    var self = this;
+    var timer = setTimeout(function() {
+      self._attempts++;
+      if (self._operationTimeoutCb) {
+        self._timeout = setTimeout(function() {
+          self._operationTimeoutCb(self._attempts);
+        }, self._operationTimeout);
+        if (self._options.unref) {
+          self._timeout.unref();
+        }
+      }
+      self._fn(self._attempts);
+    }, timeout);
+    if (this._options.unref) {
+      timer.unref();
+    }
+    return true;
+  };
+  RetryOperation.prototype.attempt = function(fn, timeoutOps) {
+    this._fn = fn;
+    if (timeoutOps) {
+      if (timeoutOps.timeout) {
+        this._operationTimeout = timeoutOps.timeout;
+      }
+      if (timeoutOps.cb) {
+        this._operationTimeoutCb = timeoutOps.cb;
+      }
+    }
+    var self = this;
+    if (this._operationTimeoutCb) {
+      this._timeout = setTimeout(function() {
+        self._operationTimeoutCb();
+      }, self._operationTimeout);
+    }
+    this._operationStart = new Date().getTime();
+    this._fn(this._attempts);
+  };
+  RetryOperation.prototype.try = function(fn) {
+    console.log("Using RetryOperation.try() is deprecated");
+    this.attempt(fn);
+  };
+  RetryOperation.prototype.start = function(fn) {
+    console.log("Using RetryOperation.start() is deprecated");
+    this.attempt(fn);
+  };
+  RetryOperation.prototype.start = RetryOperation.prototype.try;
+  RetryOperation.prototype.errors = function() {
+    return this._errors;
+  };
+  RetryOperation.prototype.attempts = function() {
+    return this._attempts;
+  };
+  RetryOperation.prototype.mainError = function() {
+    if (this._errors.length === 0) {
+      return null;
+    }
+    var counts = {};
+    var mainError = null;
+    var mainErrorCount = 0;
+    for (var i = 0;i < this._errors.length; i++) {
+      var error = this._errors[i];
+      var message = error.message;
+      var count = (counts[message] || 0) + 1;
+      counts[message] = count;
+      if (count >= mainErrorCount) {
+        mainError = error;
+        mainErrorCount = count;
+      }
+    }
+    return mainError;
+  };
+});
+
+// node_modules/.bun/retry@0.12.0/node_modules/retry/lib/retry.js
+var require_retry = __commonJS((exports) => {
+  var RetryOperation = require_retry_operation();
+  exports.operation = function(options) {
+    var timeouts = exports.timeouts(options);
+    return new RetryOperation(timeouts, {
+      forever: options && options.forever,
+      unref: options && options.unref,
+      maxRetryTime: options && options.maxRetryTime
+    });
+  };
+  exports.timeouts = function(options) {
+    if (options instanceof Array) {
+      return [].concat(options);
+    }
+    var opts = {
+      retries: 10,
+      factor: 2,
+      minTimeout: 1 * 1000,
+      maxTimeout: Infinity,
+      randomize: false
+    };
+    for (var key in options) {
+      opts[key] = options[key];
+    }
+    if (opts.minTimeout > opts.maxTimeout) {
+      throw new Error("minTimeout is greater than maxTimeout");
+    }
+    var timeouts = [];
+    for (var i = 0;i < opts.retries; i++) {
+      timeouts.push(this.createTimeout(i, opts));
+    }
+    if (options && options.forever && !timeouts.length) {
+      timeouts.push(this.createTimeout(i, opts));
+    }
+    timeouts.sort(function(a, b) {
+      return a - b;
+    });
+    return timeouts;
+  };
+  exports.createTimeout = function(attempt, opts) {
+    var random = opts.randomize ? Math.random() + 1 : 1;
+    var timeout = Math.round(random * opts.minTimeout * Math.pow(opts.factor, attempt));
+    timeout = Math.min(timeout, opts.maxTimeout);
+    return timeout;
+  };
+  exports.wrap = function(obj, options, methods) {
+    if (options instanceof Array) {
+      methods = options;
+      options = null;
+    }
+    if (!methods) {
+      methods = [];
+      for (var key in obj) {
+        if (typeof obj[key] === "function") {
+          methods.push(key);
+        }
+      }
+    }
+    for (var i = 0;i < methods.length; i++) {
+      var method = methods[i];
+      var original = obj[method];
+      obj[method] = function retryWrapper(original2) {
+        var op = exports.operation(options);
+        var args = Array.prototype.slice.call(arguments, 1);
+        var callback = args.pop();
+        args.push(function(err) {
+          if (op.retry(err)) {
+            return;
+          }
+          if (err) {
+            arguments[0] = op.mainError();
+          }
+          callback.apply(this, arguments);
+        });
+        op.attempt(function() {
+          original2.apply(obj, args);
+        });
+      }.bind(obj, original);
+      obj[method].options = options;
+    }
+  };
+});
+
+// node_modules/.bun/signal-exit@3.0.7/node_modules/signal-exit/signals.js
+var require_signals = __commonJS((exports, module) => {
+  module.exports = [
+    "SIGABRT",
+    "SIGALRM",
+    "SIGHUP",
+    "SIGINT",
+    "SIGTERM"
+  ];
+  if (process.platform !== "win32") {
+    module.exports.push("SIGVTALRM", "SIGXCPU", "SIGXFSZ", "SIGUSR2", "SIGTRAP", "SIGSYS", "SIGQUIT", "SIGIOT");
+  }
+  if (process.platform === "linux") {
+    module.exports.push("SIGIO", "SIGPOLL", "SIGPWR", "SIGSTKFLT", "SIGUNUSED");
+  }
+});
+
+// node_modules/.bun/signal-exit@3.0.7/node_modules/signal-exit/index.js
+var require_signal_exit = __commonJS((exports, module) => {
+  var process2 = global.process;
+  var processOk = function(process3) {
+    return process3 && typeof process3 === "object" && typeof process3.removeListener === "function" && typeof process3.emit === "function" && typeof process3.reallyExit === "function" && typeof process3.listeners === "function" && typeof process3.kill === "function" && typeof process3.pid === "number" && typeof process3.on === "function";
+  };
+  if (!processOk(process2)) {
+    module.exports = function() {
+      return function() {};
+    };
+  } else {
+    assert = __require("assert");
+    signals = require_signals();
+    isWin = /^win/i.test(process2.platform);
+    EE = __require("events");
+    if (typeof EE !== "function") {
+      EE = EE.EventEmitter;
+    }
+    if (process2.__signal_exit_emitter__) {
+      emitter = process2.__signal_exit_emitter__;
+    } else {
+      emitter = process2.__signal_exit_emitter__ = new EE;
+      emitter.count = 0;
+      emitter.emitted = {};
+    }
+    if (!emitter.infinite) {
+      emitter.setMaxListeners(Infinity);
+      emitter.infinite = true;
+    }
+    module.exports = function(cb, opts) {
+      if (!processOk(global.process)) {
+        return function() {};
+      }
+      assert.equal(typeof cb, "function", "a callback must be provided for exit handler");
+      if (loaded === false) {
+        load();
+      }
+      var ev = "exit";
+      if (opts && opts.alwaysLast) {
+        ev = "afterexit";
+      }
+      var remove = function() {
+        emitter.removeListener(ev, cb);
+        if (emitter.listeners("exit").length === 0 && emitter.listeners("afterexit").length === 0) {
+          unload();
+        }
+      };
+      emitter.on(ev, cb);
+      return remove;
+    };
+    unload = function unload2() {
+      if (!loaded || !processOk(global.process)) {
+        return;
+      }
+      loaded = false;
+      signals.forEach(function(sig) {
+        try {
+          process2.removeListener(sig, sigListeners[sig]);
+        } catch (er) {}
+      });
+      process2.emit = originalProcessEmit;
+      process2.reallyExit = originalProcessReallyExit;
+      emitter.count -= 1;
+    };
+    module.exports.unload = unload;
+    emit = function emit2(event, code, signal) {
+      if (emitter.emitted[event]) {
+        return;
+      }
+      emitter.emitted[event] = true;
+      emitter.emit(event, code, signal);
+    };
+    sigListeners = {};
+    signals.forEach(function(sig) {
+      sigListeners[sig] = function listener() {
+        if (!processOk(global.process)) {
+          return;
+        }
+        var listeners = process2.listeners(sig);
+        if (listeners.length === emitter.count) {
+          unload();
+          emit("exit", null, sig);
+          emit("afterexit", null, sig);
+          if (isWin && sig === "SIGHUP") {
+            sig = "SIGINT";
+          }
+          process2.kill(process2.pid, sig);
+        }
+      };
+    });
+    module.exports.signals = function() {
+      return signals;
+    };
+    loaded = false;
+    load = function load2() {
+      if (loaded || !processOk(global.process)) {
+        return;
+      }
+      loaded = true;
+      emitter.count += 1;
+      signals = signals.filter(function(sig) {
+        try {
+          process2.on(sig, sigListeners[sig]);
+          return true;
+        } catch (er) {
+          return false;
+        }
+      });
+      process2.emit = processEmit;
+      process2.reallyExit = processReallyExit;
+    };
+    module.exports.load = load;
+    originalProcessReallyExit = process2.reallyExit;
+    processReallyExit = function processReallyExit2(code) {
+      if (!processOk(global.process)) {
+        return;
+      }
+      process2.exitCode = code || 0;
+      emit("exit", process2.exitCode, null);
+      emit("afterexit", process2.exitCode, null);
+      originalProcessReallyExit.call(process2, process2.exitCode);
+    };
+    originalProcessEmit = process2.emit;
+    processEmit = function processEmit2(ev, arg) {
+      if (ev === "exit" && processOk(global.process)) {
+        if (arg !== undefined) {
+          process2.exitCode = arg;
+        }
+        var ret = originalProcessEmit.apply(this, arguments);
+        emit("exit", process2.exitCode, null);
+        emit("afterexit", process2.exitCode, null);
+        return ret;
+      } else {
+        return originalProcessEmit.apply(this, arguments);
+      }
+    };
+  }
+  var assert;
+  var signals;
+  var isWin;
+  var EE;
+  var emitter;
+  var unload;
+  var emit;
+  var sigListeners;
+  var loaded;
+  var load;
+  var originalProcessReallyExit;
+  var processReallyExit;
+  var originalProcessEmit;
+  var processEmit;
+});
+
+// node_modules/.bun/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/mtime-precision.js
+var require_mtime_precision = __commonJS((exports, module) => {
+  var cacheSymbol = Symbol();
+  function probe(file, fs, callback) {
+    const cachedPrecision = fs[cacheSymbol];
+    if (cachedPrecision) {
+      return fs.stat(file, (err, stat) => {
+        if (err) {
+          return callback(err);
+        }
+        callback(null, stat.mtime, cachedPrecision);
+      });
+    }
+    const mtime = new Date(Math.ceil(Date.now() / 1000) * 1000 + 5);
+    fs.utimes(file, mtime, mtime, (err) => {
+      if (err) {
+        return callback(err);
+      }
+      fs.stat(file, (err2, stat) => {
+        if (err2) {
+          return callback(err2);
+        }
+        const precision = stat.mtime.getTime() % 1000 === 0 ? "s" : "ms";
+        Object.defineProperty(fs, cacheSymbol, { value: precision });
+        callback(null, stat.mtime, precision);
+      });
+    });
+  }
+  function getMtime(precision) {
+    let now = Date.now();
+    if (precision === "s") {
+      now = Math.ceil(now / 1000) * 1000;
+    }
+    return new Date(now);
+  }
+  exports.probe = probe;
+  exports.getMtime = getMtime;
+});
+
+// node_modules/.bun/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/lockfile.js
+var require_lockfile = __commonJS((exports, module) => {
+  var path = __require("path");
+  var fs = require_graceful_fs();
+  var retry = require_retry();
+  var onExit = require_signal_exit();
+  var mtimePrecision = require_mtime_precision();
+  var locks = {};
+  function getLockFile(file, options) {
+    return options.lockfilePath || `${file}.lock`;
+  }
+  function resolveCanonicalPath(file, options, callback) {
+    if (!options.realpath) {
+      return callback(null, path.resolve(file));
+    }
+    options.fs.realpath(file, callback);
+  }
+  function acquireLock(file, options, callback) {
+    const lockfilePath = getLockFile(file, options);
+    options.fs.mkdir(lockfilePath, (err) => {
+      if (!err) {
+        return mtimePrecision.probe(lockfilePath, options.fs, (err2, mtime, mtimePrecision2) => {
+          if (err2) {
+            options.fs.rmdir(lockfilePath, () => {});
+            return callback(err2);
+          }
+          callback(null, mtime, mtimePrecision2);
+        });
+      }
+      if (err.code !== "EEXIST") {
+        return callback(err);
+      }
+      if (options.stale <= 0) {
+        return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
+      }
+      options.fs.stat(lockfilePath, (err2, stat) => {
+        if (err2) {
+          if (err2.code === "ENOENT") {
+            return acquireLock(file, { ...options, stale: 0 }, callback);
+          }
+          return callback(err2);
+        }
+        if (!isLockStale(stat, options)) {
+          return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
+        }
+        removeLock(file, options, (err3) => {
+          if (err3) {
+            return callback(err3);
+          }
+          acquireLock(file, { ...options, stale: 0 }, callback);
+        });
+      });
+    });
+  }
+  function isLockStale(stat, options) {
+    return stat.mtime.getTime() < Date.now() - options.stale;
+  }
+  function removeLock(file, options, callback) {
+    options.fs.rmdir(getLockFile(file, options), (err) => {
+      if (err && err.code !== "ENOENT") {
+        return callback(err);
+      }
+      callback();
+    });
+  }
+  function updateLock(file, options) {
+    const lock2 = locks[file];
+    if (lock2.updateTimeout) {
+      return;
+    }
+    lock2.updateDelay = lock2.updateDelay || options.update;
+    lock2.updateTimeout = setTimeout(() => {
+      lock2.updateTimeout = null;
+      options.fs.stat(lock2.lockfilePath, (err, stat) => {
+        const isOverThreshold = lock2.lastUpdate + options.stale < Date.now();
+        if (err) {
+          if (err.code === "ENOENT" || isOverThreshold) {
+            return setLockAsCompromised(file, lock2, Object.assign(err, { code: "ECOMPROMISED" }));
+          }
+          lock2.updateDelay = 1000;
+          return updateLock(file, options);
+        }
+        const isMtimeOurs = lock2.mtime.getTime() === stat.mtime.getTime();
+        if (!isMtimeOurs) {
+          return setLockAsCompromised(file, lock2, Object.assign(new Error("Unable to update lock within the stale threshold"), { code: "ECOMPROMISED" }));
+        }
+        const mtime = mtimePrecision.getMtime(lock2.mtimePrecision);
+        options.fs.utimes(lock2.lockfilePath, mtime, mtime, (err2) => {
+          const isOverThreshold2 = lock2.lastUpdate + options.stale < Date.now();
+          if (lock2.released) {
+            return;
+          }
+          if (err2) {
+            if (err2.code === "ENOENT" || isOverThreshold2) {
+              return setLockAsCompromised(file, lock2, Object.assign(err2, { code: "ECOMPROMISED" }));
+            }
+            lock2.updateDelay = 1000;
+            return updateLock(file, options);
+          }
+          lock2.mtime = mtime;
+          lock2.lastUpdate = Date.now();
+          lock2.updateDelay = null;
+          updateLock(file, options);
+        });
+      });
+    }, lock2.updateDelay);
+    if (lock2.updateTimeout.unref) {
+      lock2.updateTimeout.unref();
+    }
+  }
+  function setLockAsCompromised(file, lock2, err) {
+    lock2.released = true;
+    if (lock2.updateTimeout) {
+      clearTimeout(lock2.updateTimeout);
+    }
+    if (locks[file] === lock2) {
+      delete locks[file];
+    }
+    lock2.options.onCompromised(err);
+  }
+  function lock(file, options, callback) {
+    options = {
+      stale: 1e4,
+      update: null,
+      realpath: true,
+      retries: 0,
+      fs,
+      onCompromised: (err) => {
+        throw err;
+      },
+      ...options
+    };
+    options.retries = options.retries || 0;
+    options.retries = typeof options.retries === "number" ? { retries: options.retries } : options.retries;
+    options.stale = Math.max(options.stale || 0, 2000);
+    options.update = options.update == null ? options.stale / 2 : options.update || 0;
+    options.update = Math.max(Math.min(options.update, options.stale / 2), 1000);
+    resolveCanonicalPath(file, options, (err, file2) => {
+      if (err) {
+        return callback(err);
+      }
+      const operation = retry.operation(options.retries);
+      operation.attempt(() => {
+        acquireLock(file2, options, (err2, mtime, mtimePrecision2) => {
+          if (operation.retry(err2)) {
+            return;
+          }
+          if (err2) {
+            return callback(operation.mainError());
+          }
+          const lock2 = locks[file2] = {
+            lockfilePath: getLockFile(file2, options),
+            mtime,
+            mtimePrecision: mtimePrecision2,
+            options,
+            lastUpdate: Date.now()
+          };
+          updateLock(file2, options);
+          callback(null, (releasedCallback) => {
+            if (lock2.released) {
+              return releasedCallback && releasedCallback(Object.assign(new Error("Lock is already released"), { code: "ERELEASED" }));
+            }
+            unlock(file2, { ...options, realpath: false }, releasedCallback);
+          });
+        });
+      });
+    });
+  }
+  function unlock(file, options, callback) {
+    options = {
+      fs,
+      realpath: true,
+      ...options
+    };
+    resolveCanonicalPath(file, options, (err, file2) => {
+      if (err) {
+        return callback(err);
+      }
+      const lock2 = locks[file2];
+      if (!lock2) {
+        return callback(Object.assign(new Error("Lock is not acquired/owned by you"), { code: "ENOTACQUIRED" }));
+      }
+      lock2.updateTimeout && clearTimeout(lock2.updateTimeout);
+      lock2.released = true;
+      delete locks[file2];
+      removeLock(file2, options, callback);
+    });
+  }
+  function check(file, options, callback) {
+    options = {
+      stale: 1e4,
+      realpath: true,
+      fs,
+      ...options
+    };
+    options.stale = Math.max(options.stale || 0, 2000);
+    resolveCanonicalPath(file, options, (err, file2) => {
+      if (err) {
+        return callback(err);
+      }
+      options.fs.stat(getLockFile(file2, options), (err2, stat) => {
+        if (err2) {
+          return err2.code === "ENOENT" ? callback(null, false) : callback(err2);
+        }
+        return callback(null, !isLockStale(stat, options));
+      });
+    });
+  }
+  function getLocks() {
+    return locks;
+  }
+  onExit(() => {
+    for (const file in locks) {
+      const options = locks[file].options;
+      try {
+        options.fs.rmdirSync(getLockFile(file, options));
+      } catch (e) {}
+    }
+  });
+  exports.lock = lock;
+  exports.unlock = unlock;
+  exports.check = check;
+  exports.getLocks = getLocks;
+});
+
+// node_modules/.bun/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/adapter.js
+var require_adapter = __commonJS((exports, module) => {
+  var fs = require_graceful_fs();
+  function createSyncFs(fs2) {
+    const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
+    const newFs = { ...fs2 };
+    methods.forEach((method) => {
+      newFs[method] = (...args) => {
+        const callback = args.pop();
+        let ret;
+        try {
+          ret = fs2[`${method}Sync`](...args);
+        } catch (err) {
+          return callback(err);
+        }
+        callback(null, ret);
+      };
+    });
+    return newFs;
+  }
+  function toPromise(method) {
+    return (...args) => new Promise((resolve, reject) => {
+      args.push((err, result) => {
+        if (err) {
+          reject(err);
+        } else {
+          resolve(result);
+        }
+      });
+      method(...args);
+    });
+  }
+  function toSync(method) {
+    return (...args) => {
+      let err;
+      let result;
+      args.push((_err, _result) => {
+        err = _err;
+        result = _result;
+      });
+      method(...args);
+      if (err) {
+        throw err;
+      }
+      return result;
+    };
+  }
+  function toSyncOptions(options) {
+    options = { ...options };
+    options.fs = createSyncFs(options.fs || fs);
+    if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
+      throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
+    }
+    return options;
+  }
+  module.exports = {
+    toPromise,
+    toSync,
+    toSyncOptions
+  };
+});
+
+// node_modules/.bun/proper-lockfile@4.1.2/node_modules/proper-lockfile/index.js
+var require_proper_lockfile = __commonJS((exports, module) => {
+  var lockfile = require_lockfile();
+  var { toPromise, toSync, toSyncOptions } = require_adapter();
+  async function lock(file, options) {
+    const release = await toPromise(lockfile.lock)(file, options);
+    return toPromise(release);
+  }
+  function lockSync(file, options) {
+    const release = toSync(lockfile.lock)(file, toSyncOptions(options));
+    return toSync(release);
+  }
+  function unlock(file, options) {
+    return toPromise(lockfile.unlock)(file, options);
+  }
+  function unlockSync(file, options) {
+    return toSync(lockfile.unlock)(file, toSyncOptions(options));
+  }
+  function check(file, options) {
+    return toPromise(lockfile.check)(file, options);
+  }
+  function checkSync(file, options) {
+    return toSync(lockfile.check)(file, toSyncOptions(options));
+  }
+  module.exports = lock;
+  module.exports.lock = lock;
+  module.exports.unlock = unlock;
+  module.exports.lockSync = lockSync;
+  module.exports.unlockSync = unlockSync;
+  module.exports.check = check;
+  module.exports.checkSync = checkSync;
+});
 
 // node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
@@ -11224,7 +12773,7 @@ var init_schema = __esm(() => {
     }).optional()
   });
   VaultConfigSchema = exports_external.object({
-    path: exports_external.string().default("~/.switchroom/vault.enc").describe("Path to encrypted vault file"),
+    path: exports_external.string().default("~/.switchroom/vault/vault.enc").describe("Path to encrypted vault file. v0.7.12+ canonical default is " + "`~/.switchroom/vault/vault.enc` (parent-dir bind-mount enables " + "atomic-rename writes from the broker container). Older installs " + "with `~/.switchroom/vault.enc` are auto-migrated on `switchroom " + "apply`; the legacy path becomes a symlink for v0.7.10/.11 CLI " + "compatibility (sunset in v0.7.14)."),
     broker: exports_external.object({
       socket: exports_external.string().default("~/.switchroom/vault-broker.sock").describe("Unix domain socket path for the vault-broker daemon"),
       enabled: exports_external.boolean().default(true).describe("Whether to start the vault-broker daemon on agent launch"),
@@ -11257,8 +12806,8 @@ var init_schema = __esm(() => {
 });
 
 // src/config/paths.ts
-import { existsSync as existsSync2 } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync as existsSync3 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
 function home() {
   return process.env.HOME ?? "/root";
 }
@@ -11266,18 +12815,18 @@ function resolveDualPath(pathStr) {
   const h = home();
   if (pathStr.startsWith("~/")) {
     const rest = pathStr.slice(2);
-    const absolute = resolve(h, rest);
+    const absolute = resolve2(h, rest);
     if (rest.startsWith(`${DEFAULT_STATE_DIR}/`)) {
       const frag = rest.slice(DEFAULT_STATE_DIR.length + 1);
-      if (!existsSync2(absolute)) {
-        const legacy = resolve(h, LEGACY_STATE_DIR, frag);
-        if (existsSync2(legacy))
+      if (!existsSync3(absolute)) {
+        const legacy = resolve2(h, LEGACY_STATE_DIR, frag);
+        if (existsSync3(legacy))
           return legacy;
       }
     }
     return absolute;
   }
-  return resolve(pathStr);
+  return resolve2(pathStr);
 }
 var DEFAULT_STATE_DIR = ".switchroom", LEGACY_STATE_DIR = ".clerk";
 var init_paths = () => {};
@@ -11291,9 +12840,9 @@ __export(exports_loader, {
   findConfigFile: () => findConfigFile,
   ConfigError: () => ConfigError
 });
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:fs";
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "node:fs";
 import { homedir } from "node:os";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 function formatZodErrors(error) {
   return error.errors.map((e) => {
     const path = e.path.join(".");
@@ -11303,24 +12852,24 @@ function formatZodErrors(error) {
 function findConfigFile(startDir) {
   const envPath = process.env.SWITCHROOM_CONFIG;
   const home2 = homedir();
-  const userDir = resolve2(home2, ".switchroom");
+  const userDir = resolve3(home2, ".switchroom");
   const searchPaths = [
-    envPath ? resolve2(envPath) : null,
-    startDir ? resolve2(startDir, "switchroom.yaml") : null,
-    startDir ? resolve2(startDir, "switchroom.yml") : null,
-    startDir ? resolve2(startDir, "clerk.yaml") : null,
-    startDir ? resolve2(startDir, "clerk.yml") : null,
-    resolve2(process.cwd(), "switchroom.yaml"),
-    resolve2(process.cwd(), "switchroom.yml"),
-    resolve2(process.cwd(), "clerk.yaml"),
-    resolve2(process.cwd(), "clerk.yml"),
-    resolve2(userDir, "switchroom.yaml"),
-    resolve2(userDir, "switchroom.yml"),
-    resolve2(userDir, "clerk.yaml"),
-    resolve2(userDir, "clerk.yml")
+    envPath ? resolve3(envPath) : null,
+    startDir ? resolve3(startDir, "switchroom.yaml") : null,
+    startDir ? resolve3(startDir, "switchroom.yml") : null,
+    startDir ? resolve3(startDir, "clerk.yaml") : null,
+    startDir ? resolve3(startDir, "clerk.yml") : null,
+    resolve3(process.cwd(), "switchroom.yaml"),
+    resolve3(process.cwd(), "switchroom.yml"),
+    resolve3(process.cwd(), "clerk.yaml"),
+    resolve3(process.cwd(), "clerk.yml"),
+    resolve3(userDir, "switchroom.yaml"),
+    resolve3(userDir, "switchroom.yml"),
+    resolve3(userDir, "clerk.yaml"),
+    resolve3(userDir, "clerk.yml")
   ].filter(Boolean);
   for (const path of searchPaths) {
-    if (existsSync3(path)) {
+    if (existsSync4(path)) {
       return path;
     }
   }
@@ -11328,12 +12877,12 @@ function findConfigFile(startDir) {
 }
 function loadConfig(configPath) {
   const filePath = configPath ?? findConfigFile();
-  if (!existsSync3(filePath)) {
+  if (!existsSync4(filePath)) {
     throw new ConfigError(`Config file not found: ${filePath}`);
   }
   let raw;
   try {
-    raw = readFileSync2(filePath, "utf-8");
+    raw = readFileSync3(filePath, "utf-8");
   } catch (err) {
     throw new ConfigError(`Failed to read config file: ${filePath}`, [
       `  ${err.message}`
@@ -11385,7 +12934,7 @@ var init_loader = __esm(() => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync4, chmodSync as chmodSync3, chownSync, existsSync as existsSync5, readFileSync as readFileSync5, readdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3, renameSync as renameSync2 } from "node:fs";
+import { mkdirSync as mkdirSync5, chmodSync as chmodSync4, chownSync, existsSync as existsSync6, readFileSync as readFileSync6, readdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3, renameSync as renameSync3 } from "node:fs";
 
 // src/agents/compose.ts
 import { createHash } from "node:crypto";
@@ -11676,11 +13225,12 @@ function allocateAgentUid(name) {
 }
 
 // src/vault/broker/server.ts
-import { dirname as dirname2, resolve as resolve3 } from "node:path";
+import { dirname as dirname4, resolve as resolve4, basename as basename3 } from "node:path";
 import * as os3 from "node:os";
 import * as path3 from "node:path";
 
 // src/vault/vault.ts
+var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
 import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
   readFileSync,
@@ -11690,10 +13240,34 @@ import {
   mkdirSync,
   unlinkSync
 } from "node:fs";
+import { dirname, basename, resolve } from "node:path";
+var KNOWN_VAULT_ARTIFACT_NAMES = new Set([
+  "vault.enc",
+  "vault.enc.bak",
+  "vault.enc.tmp",
+  "vault.enc.lock",
+  ".vault.enc.symlink-tmp"
+]);
+var SAVE_VAULT_LOCK_RETRY_MS = 5000;
 var SCRYPT_N = 32768;
 var SCRYPT_R = 8;
 var SCRYPT_P = 1;
 var SCRYPT_MAXMEM = 128 * 1024 * 1024;
+function atomicWriteFileSync(path, data, mode) {
+  const dir = dirname(resolve(path));
+  const tmp = resolve(dir, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+  try {
+    writeFileSync(tmp, data, { encoding: "utf8", mode });
+    renameSync(tmp, path);
+  } catch (err) {
+    try {
+      if (existsSync(tmp))
+        unlinkSync(tmp);
+    } catch {}
+    throw err;
+  }
+}
+
 class VaultError extends Error {
   constructor(message) {
     super(message);
@@ -11709,6 +13283,17 @@ function deriveKey(passphrase, salt, params = { N: SCRYPT_N, r: SCRYPT_R, p: SCR
     maxmem: SCRYPT_MAXMEM
   });
 }
+function encrypt(key, plaintext) {
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    iv: iv.toString("hex"),
+    data: encrypted.toString("hex"),
+    tag: tag.toString("hex")
+  };
+}
 function decrypt(key, iv, data, tag) {
   const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
   decipher.setAuthTag(Buffer.from(tag, "hex"));
@@ -11758,13 +13343,212 @@ function openVault(passphrase, vaultPath) {
   }
   return normalizeSecrets(vaultData.secrets ?? {});
 }
+function saveVault(passphrase, vaultPath, secrets) {
+  if (!existsSync(vaultPath)) {
+    throw new VaultError(`Vault file not found: ${vaultPath}`);
+  }
+  let releaseLock = null;
+  const lockStart = Date.now();
+  let lastErr = null;
+  const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() - lockStart < SAVE_VAULT_LOCK_RETRY_MS) {
+    try {
+      releaseLock = import_proper_lockfile.default.lockSync(vaultPath, {
+        stale: SAVE_VAULT_LOCK_RETRY_MS * 2,
+        realpath: true
+      });
+      lastErr = null;
+      break;
+    } catch (err) {
+      lastErr = err;
+      const code = err?.code ?? "";
+      if (code !== "ELOCKED")
+        throw err;
+      Atomics.wait(sleepBuf, 0, 0, 100);
+    }
+  }
+  if (releaseLock === null) {
+    if (lastErr) {
+      throw new VaultError(`vault busy: another writer holds the lock at ${vaultPath} ` + `(retried for ${SAVE_VAULT_LOCK_RETRY_MS}ms). Try again in a moment.`);
+    }
+  }
+  try {
+    let vaultFile;
+    try {
+      vaultFile = JSON.parse(readFileSync(vaultPath, "utf8"));
+    } catch {
+      throw new VaultError(`Failed to read vault file: ${vaultPath}`);
+    }
+    const salt = Buffer.from(vaultFile.salt, "hex");
+    const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+    vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
+    const vaultData = { secrets };
+    const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
+    vaultFile.iv = iv;
+    vaultFile.data = data;
+    vaultFile.tag = tag;
+    atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
+  } finally {
+    try {
+      releaseLock();
+    } catch {}
+  }
+}
+function acquireVaultLock(vaultPath) {
+  const start = Date.now();
+  const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
+  while (Date.now() - start < SAVE_VAULT_LOCK_RETRY_MS) {
+    try {
+      return import_proper_lockfile.default.lockSync(vaultPath, {
+        stale: SAVE_VAULT_LOCK_RETRY_MS * 2,
+        realpath: true
+      });
+    } catch (err) {
+      const code = err?.code ?? "";
+      if (code !== "ELOCKED")
+        throw err;
+      Atomics.wait(sleepBuf, 0, 0, 100);
+    }
+  }
+  throw new VaultError(`vault busy: another writer holds the lock at ${vaultPath} ` + `(retried for ${SAVE_VAULT_LOCK_RETRY_MS}ms).`);
+}
+
+// src/vault/migrate-layout.ts
+import {
+  copyFileSync,
+  chmodSync,
+  existsSync as existsSync2,
+  fsyncSync as fsyncSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  closeSync as closeSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  statSync,
+  symlinkSync,
+  unlinkSync as unlinkSync2
+} from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { basename as basename2, dirname as dirname2, join } from "node:path";
+function vaultLayoutPaths(home) {
+  const switchroomRoot = join(home, ".switchroom");
+  return {
+    oldPath: join(switchroomRoot, "vault.enc"),
+    newPath: join(switchroomRoot, "vault", "vault.enc"),
+    parent: join(switchroomRoot, "vault"),
+    switchroomRoot
+  };
+}
+function inspectVaultLayout(home) {
+  return runMigration(home, { dryRun: true });
+}
+function runMigration(home, opts) {
+  const { oldPath, newPath, parent, switchroomRoot } = vaultLayoutPaths(home);
+  const lockTarget = existsSync2(newPath) ? newPath : existsSync2(oldPath) ? oldPath : null;
+  const release = !opts.dryRun && lockTarget !== null ? acquireVaultLock(lockTarget) : null;
+  try {
+    const oldStat = lstatSyncOrNull(oldPath);
+    const newExists = existsSync2(newPath);
+    if (oldStat === null && !newExists) {
+      return { kind: "no-vault" };
+    }
+    if (oldStat?.isSymbolicLink() && newExists) {
+      return { kind: "already-migrated" };
+    }
+    if (oldStat?.isFile() && newExists) {
+      const oldHash = sha256File(oldPath);
+      const newHash = sha256File(newPath);
+      if (oldHash === newHash) {
+        if (opts.dryRun)
+          return { kind: "completed-partial" };
+        atomicReplaceWithSymlink(oldPath, "vault/vault.enc");
+        fsyncDir(switchroomRoot);
+        return { kind: "completed-partial" };
+      }
+      const oldRealStat = statSync(oldPath);
+      const newRealStat = statSync(newPath);
+      return {
+        kind: "divergent",
+        details: {
+          oldPath,
+          newPath,
+          oldHash,
+          newHash,
+          oldSize: oldRealStat.size,
+          newSize: newRealStat.size,
+          oldMtime: oldRealStat.mtime.toISOString(),
+          newMtime: newRealStat.mtime.toISOString()
+        }
+      };
+    }
+    if (oldStat?.isFile() && !newExists) {
+      if (opts.dryRun)
+        return { kind: "migrated" };
+      mkdirSync2(parent, { recursive: true, mode: 448 });
+      const tempNew = `${newPath}.tmp`;
+      copyFileSync(oldPath, tempNew);
+      chmodSync(tempNew, 384);
+      fsyncFile(tempNew);
+      renameSync2(tempNew, newPath);
+      fsyncDir(parent);
+      atomicReplaceWithSymlink(oldPath, "vault/vault.enc");
+      fsyncDir(switchroomRoot);
+      return { kind: "migrated" };
+    }
+    return { kind: "no-vault" };
+  } finally {
+    if (release !== null) {
+      try {
+        release();
+      } catch {}
+    }
+  }
+}
+function lstatSyncOrNull(path) {
+  try {
+    return lstatSync(path);
+  } catch {
+    return null;
+  }
+}
+function sha256File(path) {
+  const data = readFileSync2(path);
+  return createHash2("sha256").update(data).digest("hex");
+}
+function atomicReplaceWithSymlink(target, linkTarget) {
+  const tmp = join(dirname2(target), `.${basename2(target)}.symlink-tmp`);
+  if (existsSync2(tmp)) {
+    try {
+      unlinkSync2(tmp);
+    } catch {}
+  }
+  symlinkSync(linkTarget, tmp);
+  renameSync2(tmp, target);
+}
+function fsyncFile(path) {
+  const fd = openSync2(path, "r+");
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync2(fd);
+  }
+}
+function fsyncDir(path) {
+  const fd = openSync2(path, "r");
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync2(fd);
+  }
+}
 
 // src/vault/broker/server.ts
 init_loader();
 
 // src/vault/auto-unlock.ts
 import { createHmac, randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "node:crypto";
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 var FORMAT_VERSION = 1;
 var SALT_LEN = 16;
 var NONCE_LEN = 12;
@@ -11792,7 +13576,7 @@ class AutoUnlockDecryptError extends Error {
 function readMachineId() {
   for (const path of [MACHINE_ID_PRIMARY, MACHINE_ID_FALLBACK]) {
     try {
-      const id = readFileSync3(path, "utf8").trim();
+      const id = readFileSync4(path, "utf8").trim();
       if (id.length > 0)
         return id;
     } catch {}
@@ -11829,12 +13613,12 @@ function decryptAutoUnlock(blob, machineId) {
   }
 }
 function readAutoUnlockFile(filePath) {
-  if (!existsSync4(filePath)) {
+  if (!existsSync5(filePath)) {
     throw new AutoUnlockDecryptError("io");
   }
   let blob;
   try {
-    blob = readFileSync3(filePath);
+    blob = readFileSync4(filePath);
   } catch {
     throw new AutoUnlockDecryptError("io");
   }
@@ -11844,7 +13628,7 @@ var DEFAULT_AUTO_UNLOCK_PATH = "~/.switchroom/vault-auto-unlock";
 
 // src/vault/broker/peercred.ts
 import { execFileSync } from "node:child_process";
-import { readFileSync as readFileSync4, readlinkSync, fstatSync } from "node:fs";
+import { readFileSync as readFileSync5, readlinkSync, fstatSync } from "node:fs";
 
 // src/vault/broker/peercred-ffi.ts
 function getPeerCred(fd) {
@@ -11970,7 +13754,7 @@ function findClientPidByServerInode(rows, socketPath, serverInode) {
 }
 function readUid(pid) {
   try {
-    const status = readFileSync4(`/proc/${pid}/status`, "utf8");
+    const status = readFileSync5(`/proc/${pid}/status`, "utf8");
     const m = status.match(/^Uid:\s+(\d+)/m);
     if (!m)
       return null;
@@ -11988,7 +13772,7 @@ function readExe(pid) {
 }
 function readSystemdUnit(pid) {
   try {
-    const content = readFileSync4(`/proc/${pid}/cgroup`, "utf8");
+    const content = readFileSync5(`/proc/${pid}/cgroup`, "utf8");
     const lines = content.split(`
 `);
     for (const line of lines) {
@@ -12243,6 +14027,16 @@ var GetRequestSchema = exports_external.object({
   filename: exports_external.string().optional(),
   token: exports_external.string().optional()
 });
+var PutRequestSchema = exports_external.object({
+  v: exports_external.literal(1),
+  op: exports_external.literal("put"),
+  key: exports_external.string().min(1),
+  entry: exports_external.union([
+    exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
+    exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
+  ]),
+  token: exports_external.string().optional()
+});
 var ListRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("list"),
@@ -12327,6 +14121,7 @@ var ApprovalRecordRequestSchema = exports_external.object({
 });
 var RequestSchema = exports_external.discriminatedUnion("op", [
   GetRequestSchema,
+  PutRequestSchema,
   ListRequestSchema,
   StatusRequestSchema,
   LockRequestSchema,
@@ -12379,6 +14174,11 @@ var OkLockResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   locked: exports_external.literal(true)
 });
+var OkPutResponseSchema = exports_external.object({
+  ok: exports_external.literal(true),
+  put: exports_external.literal(true),
+  key: exports_external.string()
+});
 var OkMintGrantResponseSchema = exports_external.object({
   ok: exports_external.literal(true),
   token: exports_external.string(),
@@ -12464,6 +14264,7 @@ var ResponseSchema = exports_external.union([
   OkKeysResponseSchema,
   OkStatusResponseSchema,
   OkLockResponseSchema,
+  OkPutResponseSchema,
   OkMintGrantResponseSchema,
   OkListGrantsResponseSchema,
   OkRevokeGrantResponseSchema,
@@ -12613,13 +14414,13 @@ function genSalt(rounds, seed_length, callback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve3, reject) {
+    return new Promise(function(resolve4, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve3(res);
+        resolve4(res);
       });
     });
 }
@@ -12639,13 +14440,13 @@ function hash(password, salt, callback, progressCallback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve3, reject) {
+    return new Promise(function(resolve4, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve3(res);
+        resolve4(res);
       });
     });
 }
@@ -12678,13 +14479,13 @@ function compare(password, hashValue, callback, progressCallback) {
       throw Error("Illegal callback: " + typeof callback);
     _async(callback);
   } else
-    return new Promise(function(resolve3, reject) {
+    return new Promise(function(resolve4, reject) {
       _async(function(err, res) {
         if (err) {
           reject(err);
           return;
         }
-        resolve3(res);
+        resolve4(res);
       });
     });
 }
@@ -14478,12 +16279,12 @@ function countPendingNonces(db, now = Date.now()) {
        WHERE consumed_at IS NULL AND expires_at > ?
        GROUP BY agent_unit`).all(now);
   const perAgent = new Map;
-  let global = 0;
+  let global2 = 0;
   for (const r of rows) {
     perAgent.set(r.agent_unit, r.n);
-    global += r.n;
+    global2 += r.n;
   }
-  return { perAgent, global };
+  return { perAgent, global: global2 };
 }
 function computeRetryAfterMs(db, agent_unit, now = Date.now()) {
   const row = agent_unit ? db.query(`SELECT MIN(expires_at) AS expires_at FROM approval_nonces
@@ -14709,6 +16510,7 @@ var PID_FILE_DEFAULT = "~/.switchroom/vault-broker.pid";
 class VaultBroker {
   testOpts;
   secrets = null;
+  passphrase = null;
   config = null;
   startedAt = Date.now();
   server = null;
@@ -14721,9 +16523,12 @@ class VaultBroker {
   grantsDb;
   constructor(testOpts = {}) {
     this.testOpts = testOpts;
-    const usingTestOpt = testOpts._testSecrets !== undefined || testOpts._testConfig !== undefined || testOpts._testIdentify !== undefined || testOpts._testAuditLogger !== undefined || testOpts._testGrantsDb !== undefined;
+    const usingTestOpt = testOpts._testSecrets !== undefined || testOpts._testConfig !== undefined || testOpts._testIdentify !== undefined || testOpts._testAuditLogger !== undefined || testOpts._testGrantsDb !== undefined || testOpts._testVaultPath !== undefined;
     if (usingTestOpt && true) {
-      throw new Error("VaultBroker: BrokerTestOpts (_testSecrets/_testConfig/_testIdentify/_testAuditLogger/_testGrantsDb) " + "must not be set outside tests. Set NODE_ENV=test if you really mean it.");
+      throw new Error("VaultBroker: BrokerTestOpts (_testSecrets/_testConfig/_testIdentify/_testAuditLogger/_testGrantsDb/_testVaultPath) " + "must not be set outside tests. Set NODE_ENV=test if you really mean it.");
+    }
+    if (testOpts._testVaultPath !== undefined) {
+      this.vaultPath = testOpts._testVaultPath;
     }
     this.auditLogger = testOpts._testAuditLogger ?? createAuditLogger();
     if (testOpts._testGrantsDb !== undefined) {
@@ -14736,7 +16541,7 @@ class VaultBroker {
     if (process.platform !== "linux" && process.env.SWITCHROOM_BROKER_ALLOW_NON_LINUX !== "1") {
       throw new Error(`vault-broker is Linux-only (running on ${process.platform}). ` + `The broker's ACL relies on cgroup-based systemd unit identification, ` + `which is not available on this platform. ` + `Use 'switchroom vault get --no-broker' for direct vault access. ` + `If you need to run the broker for development on this platform, ` + `set SWITCHROOM_BROKER_ALLOW_NON_LINUX=1 — but understand that the ` + `broker will accept any same-user caller without per-cron ACL enforcement.`);
     }
-    this.socketPath = resolve3(socketPath);
+    this.socketPath = resolve4(socketPath);
     this.unlockSocketPath = this.socketPath.replace(/\.sock$/, ".unlock.sock");
     this.startedAt = Date.now();
     if (this.testOpts._testConfig) {
@@ -14746,7 +16551,7 @@ class VaultBroker {
       this.config = loadConfig2(configPath);
     }
     if (vaultPath) {
-      this.vaultPath = resolve3(vaultPath);
+      this.vaultPath = resolve4(vaultPath);
     } else {
       this.vaultPath = resolvePath(this.config.vault?.path ?? "~/.switchroom/vault.enc");
     }
@@ -14754,15 +16559,15 @@ class VaultBroker {
       this.secrets = { ...this.testOpts._testSecrets };
     }
     process.umask(63);
-    const parentDir = dirname2(this.socketPath);
-    mkdirSync4(parentDir, { recursive: true, mode: 448 });
+    const parentDir = dirname4(this.socketPath);
+    mkdirSync5(parentDir, { recursive: true, mode: 448 });
     try {
-      chmodSync3(parentDir, 448);
+      chmodSync4(parentDir, 448);
     } catch {}
     for (const p of [this.socketPath, this.unlockSocketPath]) {
-      if (existsSync5(p)) {
+      if (existsSync6(p)) {
         try {
-          unlinkSync2(p);
+          unlinkSync3(p);
         } catch {}
       }
     }
@@ -14778,8 +16583,10 @@ class VaultBroker {
     }
   }
   unlockFromPassphrase(passphrase) {
+    detectVaultLayoutDrift(this.vaultPath);
     const secrets = openVault(passphrase, this.vaultPath);
     this.secrets = secrets;
+    this.passphrase = passphrase;
   }
   lock() {
     if (this.secrets !== null) {
@@ -14792,6 +16599,7 @@ class VaultBroker {
       }
       this.secrets = null;
     }
+    this.passphrase = null;
   }
   stop() {
     this.lock();
@@ -14807,24 +16615,24 @@ class VaultBroker {
       try {
         entry.server.close();
       } catch {}
-      if (existsSync5(sockPath)) {
+      if (existsSync6(sockPath)) {
         try {
-          unlinkSync2(sockPath);
+          unlinkSync3(sockPath);
         } catch {}
       }
     }
     this.agentServers.clear();
     for (const p of [this.socketPath, this.unlockSocketPath]) {
-      if (p && existsSync5(p)) {
+      if (p && existsSync6(p)) {
         try {
-          unlinkSync2(p);
+          unlinkSync3(p);
         } catch {}
       }
     }
     try {
       const pidPath = resolvePath(PID_FILE_DEFAULT);
-      if (existsSync5(pidPath))
-        unlinkSync2(pidPath);
+      if (existsSync6(pidPath))
+        unlinkSync3(pidPath);
     } catch {}
   }
   getStatus() {
@@ -14838,7 +16646,7 @@ class VaultBroker {
     return this.secrets;
   }
   bindAgentSocket(socketPath) {
-    const abs = resolve3(socketPath);
+    const abs = resolve4(socketPath);
     const agentName = socketPathToAgent(abs);
     if (agentName === null) {
       return Promise.reject(new Error(`bindAgentSocket: socket path '${abs}' does not match the canonical ` + `/run/switchroom/broker/<agent>.sock shape — refusing to bind without ` + `a verifiable agent identity`));
@@ -14846,18 +16654,18 @@ class VaultBroker {
     return new Promise((resolveP, rejectP) => {
       if (abs.endsWith("/sock")) {
         const dir = abs.slice(0, -"/sock".length);
-        if (existsSync5(dir)) {
+        if (existsSync6(dir)) {
           try {
             chownSync(dir, 0, 0);
           } catch {}
           try {
-            chmodSync3(dir, 448);
+            chmodSync4(dir, 448);
           } catch {}
         }
       }
-      if (existsSync5(abs)) {
+      if (existsSync6(abs)) {
         try {
-          unlinkSync2(abs);
+          unlinkSync3(abs);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           process.stderr.write(`[vault-broker] could not unlink stale socket agent=${agentName} sock=${abs}: ${msg}
@@ -14870,7 +16678,7 @@ class VaultBroker {
       server.on("error", (err) => rejectP(err));
       server.listen(abs, () => {
         try {
-          chmodSync3(abs, 432);
+          chmodSync4(abs, 432);
         } catch {}
         try {
           const uid = allocateAgentUid(agentName);
@@ -14890,7 +16698,7 @@ class VaultBroker {
     });
   }
   _bindDataSocket() {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const server = net.createServer((socket) => {
         this._handleDataConnection(socket);
       });
@@ -14899,15 +16707,15 @@ class VaultBroker {
       });
       server.listen(this.socketPath, () => {
         try {
-          chmodSync3(this.socketPath, 384);
+          chmodSync4(this.socketPath, 384);
         } catch {}
         this.server = server;
-        resolve4();
+        resolve5();
       });
     });
   }
   _bindUnlockSocket() {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve5, reject) => {
       const server = net.createServer((socket) => {
         this._handleUnlockConnection(socket);
       });
@@ -14916,10 +16724,10 @@ class VaultBroker {
       });
       server.listen(this.unlockSocketPath, () => {
         try {
-          chmodSync3(this.unlockSocketPath, 384);
+          chmodSync4(this.unlockSocketPath, 384);
         } catch {}
         this.unlockServer = server;
-        resolve4();
+        resolve5();
       });
     });
   }
@@ -15205,6 +17013,90 @@ class VaultBroker {
       socket.write(encodeResponse(entryResponse(entry)));
       return;
     }
+    if (req.op === "put") {
+      if (this.secrets === null || this.passphrase === null) {
+        socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
+        return;
+      }
+      if (agentName === null) {
+        socket.write(encodeResponse(errorResponse("DENIED", "put requires path-as-identity (token-based grants are read-only)")));
+        return;
+      }
+      if (this.config === null) {
+        socket.write(encodeResponse(errorResponse("INTERNAL", "Broker config not loaded")));
+        return;
+      }
+      const aclResult = checkAclByAgent(this.config, agentName, req.key);
+      if (!aclResult.allow) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `denied:${aclResult.reason}`
+        });
+        socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
+        return;
+      }
+      const existing = this.secrets[req.key];
+      if (existing === undefined) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: "denied:unknown_key"
+        });
+        socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key} (broker put cannot introduce new keys; ask operator to set it once via 'switchroom vault set' from the host)`)));
+        return;
+      }
+      if (existing.kind !== req.entry.kind) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `denied:kind_mismatch ${existing.kind}→${req.entry.kind}`
+        });
+        socket.write(encodeResponse(errorResponse("BAD_REQUEST", `kind mismatch: existing entry is '${existing.kind}', new entry is '${req.entry.kind}'`)));
+        return;
+      }
+      const previousEntry = existing;
+      this.secrets[req.key] = req.entry;
+      try {
+        saveVault(this.passphrase, this.vaultPath, this.secrets);
+      } catch (err) {
+        this.secrets[req.key] = previousEntry;
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "put",
+          key: req.key,
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: `error:${err?.message ?? "save failed"}`
+        });
+        socket.write(encodeResponse(errorResponse("INTERNAL", `Failed to persist: ${err?.message ?? "unknown"}`)));
+        return;
+      }
+      this.auditLogger.write({
+        ts: new Date().toISOString(),
+        op: "put",
+        key: req.key,
+        caller: auditCaller,
+        pid: auditPid,
+        cgroup: auditCgroup,
+        result: "allowed"
+      });
+      socket.write(encodeResponse({ ok: true, put: true, key: req.key }));
+      return;
+    }
     if (req.op === "approval_request" || req.op === "approval_lookup" || req.op === "approval_consume" || req.op === "approval_revoke" || req.op === "approval_list" || req.op === "approval_record") {
       await this._handleApprovalOp(socket, req);
       return;
@@ -15272,11 +17164,11 @@ class VaultBroker {
       }
       try {
         const tokenDir = path3.join(os3.homedir(), ".switchroom", "agents", agent);
-        mkdirSync4(tokenDir, { recursive: true });
+        mkdirSync5(tokenDir, { recursive: true });
         const tokenPath = path3.join(tokenDir, ".vault-token");
         const tmpPath = `${tokenPath}.tmp.${process.pid}`;
         writeFileSync3(tmpPath, mintResult.token, { mode: 384 });
-        renameSync2(tmpPath, tokenPath);
+        renameSync3(tmpPath, tokenPath);
       } catch (err) {
         process.stderr.write(`[vault-broker] mint_grant: failed to write token file for agent ${agent}: ${err.message}
 `);
@@ -15327,9 +17219,9 @@ class VaultBroker {
         const row = this.grantsDb.query("SELECT agent_slug FROM vault_grants WHERE id = ?").get(id);
         if (row) {
           const tokenPath = path3.join(os3.homedir(), ".switchroom", "agents", row.agent_slug, ".vault-token");
-          if (existsSync5(tokenPath)) {
+          if (existsSync6(tokenPath)) {
             try {
-              unlinkSync2(tokenPath);
+              unlinkSync3(tokenPath);
             } catch {}
           }
         }
@@ -15570,7 +17462,7 @@ class VaultBroker {
     const envPath = process.env.SWITCHROOM_VAULT_BROKER_AUTO_UNLOCK_PATH;
     const configuredPath = (envPath && envPath.length > 0 ? envPath : undefined) ?? this.config?.vault?.broker?.autoUnlockCredentialPath ?? DEFAULT_AUTO_UNLOCK_PATH;
     const filePath = resolvePath(configuredPath);
-    if (!existsSync5(filePath))
+    if (!existsSync6(filePath))
       return false;
     let passphrase;
     try {
@@ -15607,7 +17499,7 @@ class VaultBroker {
     const credPath = `${dir}/vault-passphrase`;
     let passphrase;
     try {
-      passphrase = readFileSync5(credPath, "utf8").replace(/\n+$/, "");
+      passphrase = readFileSync6(credPath, "utf8").replace(/\n+$/, "");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -15644,6 +17536,21 @@ class VaultBroker {
     } catch {}
   }
 }
+function detectVaultLayoutDrift(vaultPath) {
+  const dir = dirname4(vaultPath);
+  if (basename3(dir) !== "vault")
+    return;
+  if (basename3(vaultPath) !== "vault.enc")
+    return;
+  const switchroomDir = dirname4(dir);
+  if (basename3(switchroomDir) !== ".switchroom")
+    return;
+  const home2 = dirname4(switchroomDir);
+  const result = inspectVaultLayout(home2);
+  if (result.kind === "divergent") {
+    throw new VaultError(`Vault layout divergence detected at boot: ${result.details.oldPath} and ${result.details.newPath} are both regular files with different content. An older switchroom CLI may have written to the legacy path after migration ran. Run \`switchroom apply\` from the host to surface the recovery recipe (state E refusal with literal \`mv\` commands). See docs/operators/state-e-recovery.md.`);
+  }
+}
 var _globalBroker = null;
 function registerShutdownHandlers(broker) {
   _globalBroker = broker;
@@ -15664,7 +17571,7 @@ async function main() {
   const vaultPath = process.env.SWITCHROOM_VAULT_PATH;
   let perAgentTargets = [];
   try {
-    if (existsSync5(perAgentDir)) {
+    if (existsSync6(perAgentDir)) {
       const entries = readdirSync(perAgentDir, { withFileTypes: true });
       const flat = [];
       const subdirs = [];
@@ -15672,11 +17579,11 @@ async function main() {
         if (e.name.startsWith("."))
           continue;
         if ((e.isFile() || e.isSocket()) && e.name.endsWith(".sock")) {
-          flat.push(resolve3(perAgentDir, e.name));
+          flat.push(resolve4(perAgentDir, e.name));
           continue;
         }
         if (e.isDirectory()) {
-          const candidate = resolve3(perAgentDir, e.name, "sock");
+          const candidate = resolve4(perAgentDir, e.name, "sock");
           if (socketPathToAgent(candidate) !== null) {
             subdirs.push(candidate);
           }