switchroom 0.7.11 → 0.7.15

package/dist/vault/broker/server.js

@@ -17,7 +17,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/identity.js
+// node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS((exports) => {
   var ALIAS = Symbol.for("yaml.alias");
   var DOC = Symbol.for("yaml.document");
@@ -71,7 +71,7 @@ var require_identity = __commonJS((exports) => {
   exports.isSeq = isSeq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/visit.js
+// node_modules/yaml/dist/visit.js
 var require_visit = __commonJS((exports) => {
   var identity = require_identity();
   var BREAK = Symbol("break visit");
@@ -226,7 +226,7 @@ var require_visit = __commonJS((exports) => {
   exports.visitAsync = visitAsync;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/directives.js
+// node_modules/yaml/dist/doc/directives.js
 var require_directives = __commonJS((exports) => {
   var identity = require_identity();
   var visit = require_visit();
@@ -378,7 +378,7 @@ var require_directives = __commonJS((exports) => {
   exports.Directives = Directives;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/anchors.js
+// node_modules/yaml/dist/doc/anchors.js
 var require_anchors = __commonJS((exports) => {
   var identity = require_identity();
   var visit = require_visit();
@@ -440,7 +440,7 @@ var require_anchors = __commonJS((exports) => {
   exports.findNewAnchor = findNewAnchor;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/applyReviver.js
+// node_modules/yaml/dist/doc/applyReviver.js
 var require_applyReviver = __commonJS((exports) => {
   function applyReviver(reviver, obj, key, val) {
     if (val && typeof val === "object") {
@@ -487,7 +487,7 @@ var require_applyReviver = __commonJS((exports) => {
   exports.applyReviver = applyReviver;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/toJS.js
+// node_modules/yaml/dist/nodes/toJS.js
 var require_toJS = __commonJS((exports) => {
   var identity = require_identity();
   function toJS(value, arg, ctx) {
@@ -514,7 +514,7 @@ var require_toJS = __commonJS((exports) => {
   exports.toJS = toJS;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Node.js
+// node_modules/yaml/dist/nodes/Node.js
 var require_Node = __commonJS((exports) => {
   var applyReviver = require_applyReviver();
   var identity = require_identity();
@@ -551,7 +551,7 @@ var require_Node = __commonJS((exports) => {
   exports.NodeBase = NodeBase;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Alias.js
+// node_modules/yaml/dist/nodes/Alias.js
 var require_Alias = __commonJS((exports) => {
   var anchors = require_anchors();
   var visit = require_visit();
@@ -659,7 +659,7 @@ var require_Alias = __commonJS((exports) => {
   exports.Alias = Alias;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Scalar.js
+// node_modules/yaml/dist/nodes/Scalar.js
 var require_Scalar = __commonJS((exports) => {
   var identity = require_identity();
   var Node = require_Node();
@@ -687,7 +687,7 @@ var require_Scalar = __commonJS((exports) => {
   exports.isScalarValue = isScalarValue;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/createNode.js
+// node_modules/yaml/dist/doc/createNode.js
 var require_createNode = __commonJS((exports) => {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -759,7 +759,7 @@ var require_createNode = __commonJS((exports) => {
   exports.createNode = createNode;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Collection.js
+// node_modules/yaml/dist/nodes/Collection.js
 var require_Collection = __commonJS((exports) => {
   var createNode = require_createNode();
   var identity = require_identity();
@@ -874,7 +874,7 @@ var require_Collection = __commonJS((exports) => {
   exports.isEmptyPath = isEmptyPath;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyComment.js
+// node_modules/yaml/dist/stringify/stringifyComment.js
 var require_stringifyComment = __commonJS((exports) => {
   var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
   function indentComment(comment, indent) {
@@ -891,7 +891,7 @@ var require_stringifyComment = __commonJS((exports) => {
   exports.stringifyComment = stringifyComment;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/foldFlowLines.js
+// node_modules/yaml/dist/stringify/foldFlowLines.js
 var require_foldFlowLines = __commonJS((exports) => {
   var FOLD_FLOW = "flow";
   var FOLD_BLOCK = "block";
@@ -1028,7 +1028,7 @@ ${indent}${text.slice(fold + 1, end2)}`;
   exports.foldFlowLines = foldFlowLines;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyString.js
+// node_modules/yaml/dist/stringify/stringifyString.js
 var require_stringifyString = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var foldFlowLines = require_foldFlowLines();
@@ -1326,7 +1326,7 @@ ${indent}`);
   exports.stringifyString = stringifyString;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringify.js
+// node_modules/yaml/dist/stringify/stringify.js
 var require_stringify = __commonJS((exports) => {
   var anchors = require_anchors();
   var identity = require_identity();
@@ -1447,7 +1447,7 @@ ${ctx.indent}${str}`;
   exports.stringify = stringify;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyPair.js
+// node_modules/yaml/dist/stringify/stringifyPair.js
 var require_stringifyPair = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -1583,7 +1583,7 @@ ${ctx.indent}`;
   exports.stringifyPair = stringifyPair;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/log.js
+// node_modules/yaml/dist/log.js
 var require_log = __commonJS((exports) => {
   var node_process = __require("process");
   function debug(logLevel, ...messages) {
@@ -1602,7 +1602,7 @@ var require_log = __commonJS((exports) => {
   exports.warn = warn;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/merge.js
+// node_modules/yaml/dist/schema/yaml-1.1/merge.js
 var require_merge = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -1656,7 +1656,7 @@ var require_merge = __commonJS((exports) => {
   exports.merge = merge;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js
+// node_modules/yaml/dist/nodes/addPairToJSMap.js
 var require_addPairToJSMap = __commonJS((exports) => {
   var log = require_log();
   var merge = require_merge();
@@ -1717,7 +1717,7 @@ var require_addPairToJSMap = __commonJS((exports) => {
   exports.addPairToJSMap = addPairToJSMap;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/Pair.js
+// node_modules/yaml/dist/nodes/Pair.js
 var require_Pair = __commonJS((exports) => {
   var createNode = require_createNode();
   var stringifyPair = require_stringifyPair();
@@ -1755,7 +1755,7 @@ var require_Pair = __commonJS((exports) => {
   exports.createPair = createPair;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyCollection.js
+// node_modules/yaml/dist/stringify/stringifyCollection.js
 var require_stringifyCollection = __commonJS((exports) => {
   var identity = require_identity();
   var stringify = require_stringify();
@@ -1907,7 +1907,7 @@ ${indent}${end}`;
   exports.stringifyCollection = stringifyCollection;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLMap.js
+// node_modules/yaml/dist/nodes/YAMLMap.js
 var require_YAMLMap = __commonJS((exports) => {
   var stringifyCollection = require_stringifyCollection();
   var addPairToJSMap = require_addPairToJSMap();
@@ -2034,7 +2034,7 @@ var require_YAMLMap = __commonJS((exports) => {
   exports.findPair = findPair;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/map.js
+// node_modules/yaml/dist/schema/common/map.js
 var require_map = __commonJS((exports) => {
   var identity = require_identity();
   var YAMLMap = require_YAMLMap();
@@ -2053,7 +2053,7 @@ var require_map = __commonJS((exports) => {
   exports.map = map;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/nodes/YAMLSeq.js
+// node_modules/yaml/dist/nodes/YAMLSeq.js
 var require_YAMLSeq = __commonJS((exports) => {
   var createNode = require_createNode();
   var stringifyCollection = require_stringifyCollection();
@@ -2146,7 +2146,7 @@ var require_YAMLSeq = __commonJS((exports) => {
   exports.YAMLSeq = YAMLSeq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/seq.js
+// node_modules/yaml/dist/schema/common/seq.js
 var require_seq = __commonJS((exports) => {
   var identity = require_identity();
   var YAMLSeq = require_YAMLSeq();
@@ -2165,7 +2165,7 @@ var require_seq = __commonJS((exports) => {
   exports.seq = seq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/string.js
+// node_modules/yaml/dist/schema/common/string.js
 var require_string = __commonJS((exports) => {
   var stringifyString = require_stringifyString();
   var string = {
@@ -2181,7 +2181,7 @@ var require_string = __commonJS((exports) => {
   exports.string = string;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/common/null.js
+// node_modules/yaml/dist/schema/common/null.js
 var require_null = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var nullTag = {
@@ -2196,7 +2196,7 @@ var require_null = __commonJS((exports) => {
   exports.nullTag = nullTag;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/bool.js
+// node_modules/yaml/dist/schema/core/bool.js
 var require_bool = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var boolTag = {
@@ -2217,7 +2217,7 @@ var require_bool = __commonJS((exports) => {
   exports.boolTag = boolTag;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyNumber.js
+// node_modules/yaml/dist/stringify/stringifyNumber.js
 var require_stringifyNumber = __commonJS((exports) => {
   function stringifyNumber({ format, minFractionDigits, tag, value }) {
     if (typeof value === "bigint")
@@ -2241,7 +2241,7 @@ var require_stringifyNumber = __commonJS((exports) => {
   exports.stringifyNumber = stringifyNumber;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/float.js
+// node_modules/yaml/dist/schema/core/float.js
 var require_float = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -2284,7 +2284,7 @@ var require_float = __commonJS((exports) => {
   exports.floatNaN = floatNaN;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/int.js
+// node_modules/yaml/dist/schema/core/int.js
 var require_int = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -2326,7 +2326,7 @@ var require_int = __commonJS((exports) => {
   exports.intOct = intOct;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/core/schema.js
+// node_modules/yaml/dist/schema/core/schema.js
 var require_schema = __commonJS((exports) => {
   var map = require_map();
   var _null = require_null();
@@ -2351,7 +2351,7 @@ var require_schema = __commonJS((exports) => {
   exports.schema = schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/json/schema.js
+// node_modules/yaml/dist/schema/json/schema.js
 var require_schema2 = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var map = require_map();
@@ -2415,7 +2415,7 @@ var require_schema2 = __commonJS((exports) => {
   exports.schema = schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/binary.js
+// node_modules/yaml/dist/schema/yaml-1.1/binary.js
 var require_binary = __commonJS((exports) => {
   var node_buffer = __require("buffer");
   var Scalar = require_Scalar();
@@ -2470,7 +2470,7 @@ var require_binary = __commonJS((exports) => {
   exports.binary = binary;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/pairs.js
+// node_modules/yaml/dist/schema/yaml-1.1/pairs.js
 var require_pairs = __commonJS((exports) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -2545,7 +2545,7 @@ ${cn.comment}` : item.comment;
   exports.resolvePairs = resolvePairs;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/omap.js
+// node_modules/yaml/dist/schema/yaml-1.1/omap.js
 var require_omap = __commonJS((exports) => {
   var identity = require_identity();
   var toJS = require_toJS();
@@ -2617,7 +2617,7 @@ var require_omap = __commonJS((exports) => {
   exports.omap = omap;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/bool.js
+// node_modules/yaml/dist/schema/yaml-1.1/bool.js
 var require_bool2 = __commonJS((exports) => {
   var Scalar = require_Scalar();
   function boolStringify({ value, source }, ctx) {
@@ -2646,7 +2646,7 @@ var require_bool2 = __commonJS((exports) => {
   exports.trueTag = trueTag;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/float.js
+// node_modules/yaml/dist/schema/yaml-1.1/float.js
 var require_float2 = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
@@ -2692,7 +2692,7 @@ var require_float2 = __commonJS((exports) => {
   exports.floatNaN = floatNaN;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/int.js
+// node_modules/yaml/dist/schema/yaml-1.1/int.js
 var require_int2 = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
@@ -2768,7 +2768,7 @@ var require_int2 = __commonJS((exports) => {
   exports.intOct = intOct;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/set.js
+// node_modules/yaml/dist/schema/yaml-1.1/set.js
 var require_set = __commonJS((exports) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -2851,7 +2851,7 @@ var require_set = __commonJS((exports) => {
   exports.set = set;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
+// node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
 var require_timestamp = __commonJS((exports) => {
   var stringifyNumber = require_stringifyNumber();
   function parseSexagesimal(str, asBigInt) {
@@ -2933,7 +2933,7 @@ var require_timestamp = __commonJS((exports) => {
   exports.timestamp = timestamp;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/yaml-1.1/schema.js
+// node_modules/yaml/dist/schema/yaml-1.1/schema.js
 var require_schema3 = __commonJS((exports) => {
   var map = require_map();
   var _null = require_null();
@@ -2974,7 +2974,7 @@ var require_schema3 = __commonJS((exports) => {
   exports.schema = schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/tags.js
+// node_modules/yaml/dist/schema/tags.js
 var require_tags = __commonJS((exports) => {
   var map = require_map();
   var _null = require_null();
@@ -3065,7 +3065,7 @@ var require_tags = __commonJS((exports) => {
   exports.getTags = getTags;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/schema/Schema.js
+// node_modules/yaml/dist/schema/Schema.js
 var require_Schema = __commonJS((exports) => {
   var identity = require_identity();
   var map = require_map();
@@ -3095,7 +3095,7 @@ var require_Schema = __commonJS((exports) => {
   exports.Schema = Schema;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/stringify/stringifyDocument.js
+// node_modules/yaml/dist/stringify/stringifyDocument.js
 var require_stringifyDocument = __commonJS((exports) => {
   var identity = require_identity();
   var stringify = require_stringify();
@@ -3175,7 +3175,7 @@ var require_stringifyDocument = __commonJS((exports) => {
   exports.stringifyDocument = stringifyDocument;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/doc/Document.js
+// node_modules/yaml/dist/doc/Document.js
 var require_Document = __commonJS((exports) => {
   var Alias = require_Alias();
   var Collection = require_Collection();
@@ -3410,7 +3410,7 @@ var require_Document = __commonJS((exports) => {
   exports.Document = Document;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/errors.js
+// node_modules/yaml/dist/errors.js
 var require_errors = __commonJS((exports) => {
   class YAMLError extends Error {
     constructor(name, pos, code, message) {
@@ -3475,7 +3475,7 @@ ${pointer}
   exports.prettifyError = prettifyError;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-props.js
+// node_modules/yaml/dist/compose/resolve-props.js
 var require_resolve_props = __commonJS((exports) => {
   function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
     let spaceBefore = false;
@@ -3605,7 +3605,7 @@ var require_resolve_props = __commonJS((exports) => {
   exports.resolveProps = resolveProps;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-contains-newline.js
+// node_modules/yaml/dist/compose/util-contains-newline.js
 var require_util_contains_newline = __commonJS((exports) => {
   function containsNewline(key) {
     if (!key)
@@ -3645,7 +3645,7 @@ var require_util_contains_newline = __commonJS((exports) => {
   exports.containsNewline = containsNewline;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-flow-indent-check.js
+// node_modules/yaml/dist/compose/util-flow-indent-check.js
 var require_util_flow_indent_check = __commonJS((exports) => {
   var utilContainsNewline = require_util_contains_newline();
   function flowIndentCheck(indent, fc, onError) {
@@ -3660,7 +3660,7 @@ var require_util_flow_indent_check = __commonJS((exports) => {
   exports.flowIndentCheck = flowIndentCheck;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-map-includes.js
+// node_modules/yaml/dist/compose/util-map-includes.js
 var require_util_map_includes = __commonJS((exports) => {
   var identity = require_identity();
   function mapIncludes(ctx, items, search) {
@@ -3673,7 +3673,7 @@ var require_util_map_includes = __commonJS((exports) => {
   exports.mapIncludes = mapIncludes;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-map.js
+// node_modules/yaml/dist/compose/resolve-block-map.js
 var require_resolve_block_map = __commonJS((exports) => {
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -3780,7 +3780,7 @@ var require_resolve_block_map = __commonJS((exports) => {
   exports.resolveBlockMap = resolveBlockMap;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-seq.js
+// node_modules/yaml/dist/compose/resolve-block-seq.js
 var require_resolve_block_seq = __commonJS((exports) => {
   var YAMLSeq = require_YAMLSeq();
   var resolveProps = require_resolve_props();
@@ -3828,7 +3828,7 @@ var require_resolve_block_seq = __commonJS((exports) => {
   exports.resolveBlockSeq = resolveBlockSeq;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-end.js
+// node_modules/yaml/dist/compose/resolve-end.js
 var require_resolve_end = __commonJS((exports) => {
   function resolveEnd(end, offset, reqSpace, onError) {
     let comment = "";
@@ -3868,7 +3868,7 @@ var require_resolve_end = __commonJS((exports) => {
   exports.resolveEnd = resolveEnd;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-collection.js
+// node_modules/yaml/dist/compose/resolve-flow-collection.js
 var require_resolve_flow_collection = __commonJS((exports) => {
   var identity = require_identity();
   var Pair = require_Pair();
@@ -4059,7 +4059,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
   exports.resolveFlowCollection = resolveFlowCollection;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-collection.js
+// node_modules/yaml/dist/compose/compose-collection.js
 var require_compose_collection = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -4121,7 +4121,7 @@ var require_compose_collection = __commonJS((exports) => {
   exports.composeCollection = composeCollection;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-block-scalar.js
+// node_modules/yaml/dist/compose/resolve-block-scalar.js
 var require_resolve_block_scalar = __commonJS((exports) => {
   var Scalar = require_Scalar();
   function resolveBlockScalar(ctx, scalar, onError) {
@@ -4314,7 +4314,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
   exports.resolveBlockScalar = resolveBlockScalar;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/resolve-flow-scalar.js
+// node_modules/yaml/dist/compose/resolve-flow-scalar.js
 var require_resolve_flow_scalar = __commonJS((exports) => {
   var Scalar = require_Scalar();
   var resolveEnd = require_resolve_end();
@@ -4530,7 +4530,7 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
   exports.resolveFlowScalar = resolveFlowScalar;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-scalar.js
+// node_modules/yaml/dist/compose/compose-scalar.js
 var require_compose_scalar = __commonJS((exports) => {
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -4608,7 +4608,7 @@ var require_compose_scalar = __commonJS((exports) => {
   exports.composeScalar = composeScalar;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/util-empty-scalar-position.js
+// node_modules/yaml/dist/compose/util-empty-scalar-position.js
 var require_util_empty_scalar_position = __commonJS((exports) => {
   function emptyScalarPosition(offset, before, pos) {
     if (before) {
@@ -4635,7 +4635,7 @@ var require_util_empty_scalar_position = __commonJS((exports) => {
   exports.emptyScalarPosition = emptyScalarPosition;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-node.js
+// node_modules/yaml/dist/compose/compose-node.js
 var require_compose_node = __commonJS((exports) => {
   var Alias = require_Alias();
   var identity = require_identity();
@@ -4738,7 +4738,7 @@ var require_compose_node = __commonJS((exports) => {
   exports.composeNode = composeNode;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/compose-doc.js
+// node_modules/yaml/dist/compose/compose-doc.js
 var require_compose_doc = __commonJS((exports) => {
   var Document = require_Document();
   var composeNode = require_compose_node();
@@ -4778,7 +4778,7 @@ var require_compose_doc = __commonJS((exports) => {
   exports.composeDoc = composeDoc;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/compose/composer.js
+// node_modules/yaml/dist/compose/composer.js
 var require_composer = __commonJS((exports) => {
   var node_process = __require("process");
   var directives = require_directives();
@@ -4967,7 +4967,7 @@ ${end.comment}` : end.comment;
   exports.Composer = Composer;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-scalar.js
+// node_modules/yaml/dist/parse/cst-scalar.js
 var require_cst_scalar = __commonJS((exports) => {
   var resolveBlockScalar = require_resolve_block_scalar();
   var resolveFlowScalar = require_resolve_flow_scalar();
@@ -5157,7 +5157,7 @@ var require_cst_scalar = __commonJS((exports) => {
   exports.setScalarValue = setScalarValue;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-stringify.js
+// node_modules/yaml/dist/parse/cst-stringify.js
 var require_cst_stringify = __commonJS((exports) => {
   var stringify = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
   function stringifyToken(token) {
@@ -5215,7 +5215,7 @@ var require_cst_stringify = __commonJS((exports) => {
   exports.stringify = stringify;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst-visit.js
+// node_modules/yaml/dist/parse/cst-visit.js
 var require_cst_visit = __commonJS((exports) => {
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
@@ -5274,7 +5274,7 @@ var require_cst_visit = __commonJS((exports) => {
   exports.visit = visit;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/cst.js
+// node_modules/yaml/dist/parse/cst.js
 var require_cst = __commonJS((exports) => {
   var cstScalar = require_cst_scalar();
   var cstStringify = require_cst_stringify();
@@ -5375,7 +5375,7 @@ var require_cst = __commonJS((exports) => {
   exports.tokenType = tokenType;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/lexer.js
+// node_modules/yaml/dist/parse/lexer.js
 var require_lexer = __commonJS((exports) => {
   var cst = require_cst();
   function isEmpty(ch) {
@@ -5961,7 +5961,7 @@ var require_lexer = __commonJS((exports) => {
   exports.Lexer = Lexer;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/line-counter.js
+// node_modules/yaml/dist/parse/line-counter.js
 var require_line_counter = __commonJS((exports) => {
   class LineCounter {
     constructor() {
@@ -5989,7 +5989,7 @@ var require_line_counter = __commonJS((exports) => {
   exports.LineCounter = LineCounter;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/parse/parser.js
+// node_modules/yaml/dist/parse/parser.js
 var require_parser = __commonJS((exports) => {
   var node_process = __require("process");
   var cst = require_cst();
@@ -6838,7 +6838,7 @@ var require_parser = __commonJS((exports) => {
   exports.Parser = Parser;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/public-api.js
+// node_modules/yaml/dist/public-api.js
 var require_public_api = __commonJS((exports) => {
   var composer = require_composer();
   var Document = require_Document();
@@ -6932,7 +6932,7 @@ var require_public_api = __commonJS((exports) => {
   exports.stringify = stringify;
 });
 
-// node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
+// node_modules/yaml/dist/index.js
 var composer, Document, Schema, errors, Alias, identity, Pair, Scalar, YAMLMap, YAMLSeq, cst, lexer, lineCounter, parser, publicApi, visit, $Composer, $Document, $Schema, $YAMLError, $YAMLParseError, $YAMLWarning, $Alias, $isAlias, $isCollection, $isDocument, $isMap, $isNode, $isPair, $isScalar, $isSeq, $Pair, $Scalar, $YAMLMap, $YAMLSeq, $Lexer, $LineCounter, $Parser, $parse, $parseAllDocuments, $parseDocument, $stringify, $visit, $visitAsync;
 var init_dist = __esm(() => {
   composer = require_composer();
@@ -6981,7 +6981,7 @@ var init_dist = __esm(() => {
   $visitAsync = visit.visitAsync;
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType = (data) => {
   const t = typeof data;
   switch (t) {
@@ -7112,7 +7112,7 @@ var init_util = __esm(() => {
   ]);
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// node_modules/zod/v3/ZodError.js
 var ZodIssueCode, quotelessJson = (obj) => {
   const json = JSON.stringify(obj, null, 2);
   return json.replace(/"([^"]+)":/g, "$1:");
@@ -7233,7 +7233,7 @@ var init_ZodError = __esm(() => {
   };
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -7340,7 +7340,7 @@ var init_en = __esm(() => {
   en_default = errorMap;
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/errors.js
+// node_modules/zod/v3/errors.js
 function setErrorMap(map) {
   overrideErrorMap = map;
 }
@@ -7353,7 +7353,7 @@ var init_errors = __esm(() => {
   overrideErrorMap = en_default;
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// node_modules/zod/v3/helpers/parseUtil.js
 function addIssueToContext(ctx, issueData) {
   const overrideMap = getErrorMap();
   const issue = makeIssue({
@@ -7458,10 +7458,10 @@ var init_parseUtil = __esm(() => {
   });
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/typeAliases.js
+// node_modules/zod/v3/helpers/typeAliases.js
 var init_typeAliases = () => {};
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 var init_errorUtil = __esm(() => {
   (function(errorUtil2) {
@@ -7470,7 +7470,7 @@ var init_errorUtil = __esm(() => {
   })(errorUtil || (errorUtil = {}));
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
+// node_modules/zod/v3/types.js
 class ParseInputLazyPath {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -10821,7 +10821,7 @@ var init_types = __esm(() => {
   NEVER = INVALID;
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
+// node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
   void: () => voidType,
@@ -10941,7 +10941,7 @@ var init_external = __esm(() => {
   init_ZodError();
 });
 
-// node_modules/.bun/zod@3.25.76/node_modules/zod/index.js
+// node_modules/zod/index.js
 var init_zod = __esm(() => {
   init_external();
   init_external();
@@ -11224,7 +11224,7 @@ var init_schema = __esm(() => {
     }).optional()
   });
   VaultConfigSchema = exports_external.object({
-    path: exports_external.string().default("~/.switchroom/vault.enc").describe("Path to encrypted vault file"),
+    path: exports_external.string().default("~/.switchroom/vault/vault.enc").describe("Path to encrypted vault file. v0.7.12+ canonical default is " + "`~/.switchroom/vault/vault.enc` (parent-dir bind-mount enables " + "atomic-rename writes from the broker container). Older installs " + "with `~/.switchroom/vault.enc` are auto-migrated on `switchroom " + "apply`; the legacy path becomes a symlink for v0.7.10/.11 CLI " + "compatibility (sunset in v0.7.14)."),
     broker: exports_external.object({
       socket: exports_external.string().default("~/.switchroom/vault-broker.sock").describe("Unix domain socket path for the vault-broker daemon"),
       enabled: exports_external.boolean().default(true).describe("Whether to start the vault-broker daemon on agent launch"),
@@ -11257,7 +11257,7 @@ var init_schema = __esm(() => {
 });
 
 // src/config/paths.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync as existsSync4 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 function home() {
   return process.env.HOME ?? "/root";
@@ -11269,9 +11269,9 @@ function resolveDualPath(pathStr) {
     const absolute = resolve2(h, rest);
     if (rest.startsWith(`${DEFAULT_STATE_DIR}/`)) {
       const frag = rest.slice(DEFAULT_STATE_DIR.length + 1);
-      if (!existsSync2(absolute)) {
+      if (!existsSync4(absolute)) {
         const legacy = resolve2(h, LEGACY_STATE_DIR, frag);
-        if (existsSync2(legacy))
+        if (existsSync4(legacy))
           return legacy;
       }
     }
@@ -11291,7 +11291,7 @@ __export(exports_loader, {
   findConfigFile: () => findConfigFile,
   ConfigError: () => ConfigError
 });
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "node:fs";
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "node:fs";
 import { homedir } from "node:os";
 import { resolve as resolve3 } from "node:path";
 function formatZodErrors(error) {
@@ -11320,7 +11320,7 @@ function findConfigFile(startDir) {
     resolve3(userDir, "clerk.yml")
   ].filter(Boolean);
   for (const path of searchPaths) {
-    if (existsSync3(path)) {
+    if (existsSync5(path)) {
       return path;
     }
   }
@@ -11328,12 +11328,12 @@ function findConfigFile(startDir) {
 }
 function loadConfig(configPath) {
   const filePath = configPath ?? findConfigFile();
-  if (!existsSync3(filePath)) {
+  if (!existsSync5(filePath)) {
     throw new ConfigError(`Config file not found: ${filePath}`);
   }
   let raw;
   try {
-    raw = readFileSync2(filePath, "utf-8");
+    raw = readFileSync4(filePath, "utf-8");
   } catch (err) {
     throw new ConfigError(`Failed to read config file: ${filePath}`, [
       `  ${err.message}`
@@ -11385,7 +11385,7 @@ var init_loader = __esm(() => {
 
 // src/vault/broker/server.ts
 import * as net from "node:net";
-import { mkdirSync as mkdirSync4, chmodSync as chmodSync3, chownSync, existsSync as existsSync5, readFileSync as readFileSync5, readdirSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3, renameSync as renameSync2 } from "node:fs";
+import { mkdirSync as mkdirSync5, chmodSync as chmodSync4, chownSync, existsSync as existsSync7, readFileSync as readFileSync7, readdirSync as readdirSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync3, renameSync as renameSync3 } from "node:fs";
 
 // src/agents/compose.ts
 import { createHash } from "node:crypto";
@@ -11676,21 +11676,183 @@ function allocateAgentUid(name) {
 }
 
 // src/vault/broker/server.ts
-import { dirname as dirname3, resolve as resolve4 } from "node:path";
+import { dirname as dirname4, resolve as resolve4, basename as basename3 } from "node:path";
 import * as os3 from "node:os";
 import * as path3 from "node:path";
 
 // src/vault/vault.ts
 import { randomBytes, scryptSync, createCipheriv, createDecipheriv } from "node:crypto";
 import {
-  readFileSync,
+  readFileSync as readFileSync2,
   writeFileSync,
-  existsSync,
+  existsSync as existsSync2,
   renameSync,
   mkdirSync,
-  unlinkSync
+  unlinkSync as unlinkSync2
 } from "node:fs";
 import { dirname, basename, resolve } from "node:path";
+
+// src/vault/flock.ts
+import {
+  existsSync,
+  openSync,
+  closeSync,
+  writeSync,
+  fsyncSync,
+  unlinkSync,
+  readFileSync,
+  readdirSync,
+  rmdirSync,
+  statSync,
+  constants as fsConstants
+} from "node:fs";
+var DEFAULT_LOCK_RETRY_MS = 5000;
+function lockPathFor(vaultPath) {
+  return `${vaultPath}.lock`;
+}
+function readLockHolder(lockPath) {
+  try {
+    const raw = readFileSync(lockPath, "utf8");
+    const lines = raw.split(`
+`);
+    const pid = Number.parseInt(lines[0] ?? "", 10);
+    const acquiredAtMs = Number.parseInt(lines[1] ?? "", 10);
+    if (!Number.isFinite(pid) || pid <= 0)
+      return null;
+    if (!Number.isFinite(acquiredAtMs) || acquiredAtMs <= 0)
+      return null;
+    return { pid, acquiredAtMs, argv0: lines[2] ?? "" };
+  } catch {
+    return null;
+  }
+}
+function pidIsLive(pid) {
+  if (process.platform === "linux") {
+    return existsSync(`/proc/${pid}`);
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function clearStaleSentinelDir(lockPath) {
+  try {
+    if (!existsSync(lockPath))
+      return true;
+    const s = statSync(lockPath);
+    if (!s.isDirectory())
+      return true;
+    for (const entry of readdirSync(lockPath)) {
+      try {
+        unlinkSync(`${lockPath}/${entry}`);
+      } catch {}
+    }
+    rmdirSync(lockPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function acquireLock(vaultPath, options = {}) {
+  const budgetMs = options.budgetMs ?? DEFAULT_LOCK_RETRY_MS;
+  const lockPath = lockPathFor(vaultPath);
+  const deadline = Date.now() + budgetMs;
+  const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
+  while (true) {
+    let fd = null;
+    try {
+      fd = openSync(lockPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384);
+    } catch (err) {
+      const code = err?.code ?? "";
+      if (code === "EEXIST") {
+        let isDir = false;
+        try {
+          isDir = statSync(lockPath).isDirectory();
+        } catch {}
+        if (isDir) {
+          if (clearStaleSentinelDir(lockPath))
+            continue;
+        }
+        const holder = readLockHolder(lockPath);
+        if (holder && !pidIsLive(holder.pid)) {
+          try {
+            unlinkSync(lockPath);
+          } catch {}
+          continue;
+        }
+        if (Date.now() >= deadline) {
+          throw makeBusyError(vaultPath, lockPath, holder, budgetMs);
+        }
+        Atomics.wait(sleepBuf, 0, 0, 100);
+        continue;
+      } else {
+        throw err;
+      }
+    }
+    try {
+      const meta = `${process.pid}
+${Date.now()}
+${process.argv[1] ?? ""}
+`;
+      writeSync(fd, meta);
+      fsyncSync(fd);
+    } catch {
+      try {
+        closeSync(fd);
+      } catch {}
+      try {
+        unlinkSync(lockPath);
+      } catch {}
+      throw new Error(`vault flock: failed to write holder metadata to ${lockPath}`);
+    }
+    const ownedFd = fd;
+    return {
+      release: () => {
+        try {
+          closeSync(ownedFd);
+        } catch {}
+        try {
+          unlinkSync(lockPath);
+        } catch {}
+      }
+    };
+  }
+}
+
+class VaultBusyError extends Error {
+  vaultPath;
+  lockPath;
+  holderPid;
+  heldForMs;
+  budgetMs;
+  constructor(message, fields) {
+    super(message);
+    this.name = "VaultBusyError";
+    this.vaultPath = fields.vaultPath;
+    this.lockPath = fields.lockPath;
+    this.holderPid = fields.holderPid;
+    this.heldForMs = fields.heldForMs;
+    this.budgetMs = fields.budgetMs;
+  }
+}
+function makeBusyError(vaultPath, lockPath, holder, budgetMs) {
+  const holderPid = holder?.pid ?? null;
+  const heldForMs = holder ? Date.now() - holder.acquiredAtMs : null;
+  const holderClause = holder ? `held by pid ${holder.pid} (acquired ${Math.round((heldForMs ?? 0) / 1000)}s ago)` : "held by another writer (holder PID unreadable — lock file empty or unparseable)";
+  return new VaultBusyError(`vault busy: ${holderClause} at ${lockPath} (retried for ${budgetMs}ms). ` + `Try again in a moment. If the holder process is gone, the next acquirer ` + `will clear the stale lock automatically.`, { vaultPath, lockPath, holderPid, heldForMs, budgetMs });
+}
+
+// src/vault/vault.ts
+var KNOWN_VAULT_ARTIFACT_NAMES = new Set([
+  "vault.enc",
+  "vault.enc.bak",
+  "vault.enc.tmp",
+  "vault.enc.lock",
+  ".vault.enc.symlink-tmp"
+]);
+var SAVE_VAULT_LOCK_RETRY_MS = DEFAULT_LOCK_RETRY_MS;
 var SCRYPT_N = 32768;
 var SCRYPT_R = 8;
 var SCRYPT_P = 1;
@@ -11703,17 +11865,20 @@ function atomicWriteFileSync(path, data, mode) {
     renameSync(tmp, path);
   } catch (err) {
     try {
-      if (existsSync(tmp))
-        unlinkSync(tmp);
+      if (existsSync2(tmp))
+        unlinkSync2(tmp);
     } catch {}
     throw err;
   }
 }
 
 class VaultError extends Error {
-  constructor(message) {
+  cause;
+  constructor(message, options) {
     super(message);
     this.name = "VaultError";
+    if (options?.cause !== undefined)
+      this.cause = options.cause;
   }
 }
 var LEGACY_SCRYPT_N = 16384;
@@ -11759,12 +11924,12 @@ function normalizeSecrets(raw) {
   return out;
 }
 function openVault(passphrase, vaultPath) {
-  if (!existsSync(vaultPath)) {
+  if (!existsSync2(vaultPath)) {
     throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
   let vaultFile;
   try {
-    vaultFile = JSON.parse(readFileSync(vaultPath, "utf8"));
+    vaultFile = JSON.parse(readFileSync2(vaultPath, "utf8"));
   } catch {
     throw new VaultError(`Failed to read vault file: ${vaultPath}`);
   }
@@ -11786,24 +11951,181 @@ function openVault(passphrase, vaultPath) {
   return normalizeSecrets(vaultData.secrets ?? {});
 }
 function saveVault(passphrase, vaultPath, secrets) {
-  if (!existsSync(vaultPath)) {
+  if (!existsSync2(vaultPath)) {
     throw new VaultError(`Vault file not found: ${vaultPath}`);
   }
-  let vaultFile;
+  let releaseLock = null;
+  try {
+    releaseLock = acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
+  } catch (err) {
+    if (err instanceof VaultBusyError) {
+      throw new VaultError(err.message, { cause: err });
+    }
+    throw err;
+  }
   try {
-    vaultFile = JSON.parse(readFileSync(vaultPath, "utf8"));
+    let vaultFile;
+    try {
+      vaultFile = JSON.parse(readFileSync2(vaultPath, "utf8"));
+    } catch {
+      throw new VaultError(`Failed to read vault file: ${vaultPath}`);
+    }
+    const salt = Buffer.from(vaultFile.salt, "hex");
+    const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+    vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
+    const vaultData = { secrets };
+    const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
+    vaultFile.iv = iv;
+    vaultFile.data = data;
+    vaultFile.tag = tag;
+    atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
+  } finally {
+    if (releaseLock !== null) {
+      try {
+        releaseLock();
+      } catch {}
+    }
+  }
+}
+function acquireVaultLock(vaultPath) {
+  try {
+    return acquireLock(vaultPath, { budgetMs: SAVE_VAULT_LOCK_RETRY_MS }).release;
+  } catch (err) {
+    if (err instanceof VaultBusyError) {
+      throw new VaultError(err.message, { cause: err });
+    }
+    throw err;
+  }
+}
+
+// src/vault/migrate-layout.ts
+import {
+  copyFileSync,
+  chmodSync,
+  existsSync as existsSync3,
+  fsyncSync as fsyncSync3,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync as openSync3,
+  closeSync as closeSync3,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
+  statSync as statSync2,
+  symlinkSync,
+  unlinkSync as unlinkSync3
+} from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { basename as basename2, dirname as dirname2, join } from "node:path";
+function vaultLayoutPaths(home) {
+  const switchroomRoot = join(home, ".switchroom");
+  return {
+    oldPath: join(switchroomRoot, "vault.enc"),
+    newPath: join(switchroomRoot, "vault", "vault.enc"),
+    parent: join(switchroomRoot, "vault"),
+    switchroomRoot
+  };
+}
+function inspectVaultLayout(home) {
+  return runMigration(home, { dryRun: true });
+}
+function runMigration(home, opts) {
+  const { oldPath, newPath, parent, switchroomRoot } = vaultLayoutPaths(home);
+  const lockTarget = existsSync3(newPath) ? newPath : existsSync3(oldPath) ? oldPath : null;
+  const release = !opts.dryRun && lockTarget !== null ? acquireVaultLock(lockTarget) : null;
+  try {
+    const oldStat = lstatSyncOrNull(oldPath);
+    const newExists = existsSync3(newPath);
+    if (oldStat === null && !newExists) {
+      return { kind: "no-vault" };
+    }
+    if (oldStat?.isSymbolicLink() && newExists) {
+      return { kind: "already-migrated" };
+    }
+    if (oldStat?.isFile() && newExists) {
+      const oldHash = sha256File(oldPath);
+      const newHash = sha256File(newPath);
+      if (oldHash === newHash) {
+        if (opts.dryRun)
+          return { kind: "completed-partial" };
+        atomicReplaceWithSymlink(oldPath, "vault/vault.enc");
+        fsyncDir(switchroomRoot);
+        return { kind: "completed-partial" };
+      }
+      const oldRealStat = statSync2(oldPath);
+      const newRealStat = statSync2(newPath);
+      return {
+        kind: "divergent",
+        details: {
+          oldPath,
+          newPath,
+          oldHash,
+          newHash,
+          oldSize: oldRealStat.size,
+          newSize: newRealStat.size,
+          oldMtime: oldRealStat.mtime.toISOString(),
+          newMtime: newRealStat.mtime.toISOString()
+        }
+      };
+    }
+    if (oldStat?.isFile() && !newExists) {
+      if (opts.dryRun)
+        return { kind: "migrated" };
+      mkdirSync2(parent, { recursive: true, mode: 448 });
+      const tempNew = `${newPath}.tmp`;
+      copyFileSync(oldPath, tempNew);
+      chmodSync(tempNew, 384);
+      fsyncFile(tempNew);
+      renameSync2(tempNew, newPath);
+      fsyncDir(parent);
+      atomicReplaceWithSymlink(oldPath, "vault/vault.enc");
+      fsyncDir(switchroomRoot);
+      return { kind: "migrated" };
+    }
+    return { kind: "no-vault" };
+  } finally {
+    if (release !== null) {
+      try {
+        release();
+      } catch {}
+    }
+  }
+}
+function lstatSyncOrNull(path) {
+  try {
+    return lstatSync(path);
   } catch {
-    throw new VaultError(`Failed to read vault file: ${vaultPath}`);
+    return null;
+  }
+}
+function sha256File(path) {
+  const data = readFileSync3(path);
+  return createHash2("sha256").update(data).digest("hex");
+}
+function atomicReplaceWithSymlink(target, linkTarget) {
+  const tmp = join(dirname2(target), `.${basename2(target)}.symlink-tmp`);
+  if (existsSync3(tmp)) {
+    try {
+      unlinkSync3(tmp);
+    } catch {}
+  }
+  symlinkSync(linkTarget, tmp);
+  renameSync2(tmp, target);
+}
+function fsyncFile(path) {
+  const fd = openSync3(path, "r+");
+  try {
+    fsyncSync3(fd);
+  } finally {
+    closeSync3(fd);
+  }
+}
+function fsyncDir(path) {
+  const fd = openSync3(path, "r");
+  try {
+    fsyncSync3(fd);
+  } finally {
+    closeSync3(fd);
   }
-  const salt = Buffer.from(vaultFile.salt, "hex");
-  const key = deriveKey(passphrase, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
-  vaultFile.kdf = { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P };
-  const vaultData = { secrets };
-  const { iv, data, tag } = encrypt(key, JSON.stringify(vaultData));
-  vaultFile.iv = iv;
-  vaultFile.data = data;
-  vaultFile.tag = tag;
-  atomicWriteFileSync(vaultPath, JSON.stringify(vaultFile, null, 2), 384);
 }
 
 // src/vault/broker/server.ts
@@ -11811,7 +12133,7 @@ init_loader();
 
 // src/vault/auto-unlock.ts
 import { createHmac, randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "node:crypto";
-import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
 var FORMAT_VERSION = 1;
 var SALT_LEN = 16;
 var NONCE_LEN = 12;
@@ -11839,7 +12161,7 @@ class AutoUnlockDecryptError extends Error {
 function readMachineId() {
   for (const path of [MACHINE_ID_PRIMARY, MACHINE_ID_FALLBACK]) {
     try {
-      const id = readFileSync3(path, "utf8").trim();
+      const id = readFileSync5(path, "utf8").trim();
       if (id.length > 0)
         return id;
     } catch {}
@@ -11876,12 +12198,12 @@ function decryptAutoUnlock(blob, machineId) {
   }
 }
 function readAutoUnlockFile(filePath) {
-  if (!existsSync4(filePath)) {
+  if (!existsSync6(filePath)) {
     throw new AutoUnlockDecryptError("io");
   }
   let blob;
   try {
-    blob = readFileSync3(filePath);
+    blob = readFileSync5(filePath);
   } catch {
     throw new AutoUnlockDecryptError("io");
   }
@@ -11891,7 +12213,7 @@ var DEFAULT_AUTO_UNLOCK_PATH = "~/.switchroom/vault-auto-unlock";
 
 // src/vault/broker/peercred.ts
 import { execFileSync } from "node:child_process";
-import { readFileSync as readFileSync4, readlinkSync, fstatSync } from "node:fs";
+import { readFileSync as readFileSync6, readlinkSync, fstatSync } from "node:fs";
 
 // src/vault/broker/peercred-ffi.ts
 function getPeerCred(fd) {
@@ -12017,7 +12339,7 @@ function findClientPidByServerInode(rows, socketPath, serverInode) {
 }
 function readUid(pid) {
   try {
-    const status = readFileSync4(`/proc/${pid}/status`, "utf8");
+    const status = readFileSync6(`/proc/${pid}/status`, "utf8");
     const m = status.match(/^Uid:\s+(\d+)/m);
     if (!m)
       return null;
@@ -12035,7 +12357,7 @@ function readExe(pid) {
 }
 function readSystemdUnit(pid) {
   try {
-    const content = readFileSync4(`/proc/${pid}/cgroup`, "utf8");
+    const content = readFileSync6(`/proc/${pid}/cgroup`, "utf8");
     const lines = content.split(`
 `);
     for (const line of lines) {
@@ -12298,7 +12620,8 @@ var PutRequestSchema = exports_external.object({
     exports_external.object({ kind: exports_external.literal("string"), value: exports_external.string() }),
     exports_external.object({ kind: exports_external.literal("binary"), value: exports_external.string() })
   ]),
-  token: exports_external.string().optional()
+  token: exports_external.string().optional(),
+  passphrase: exports_external.string().optional()
 });
 var ListRequestSchema = exports_external.object({
   v: exports_external.literal(1),
@@ -12309,9 +12632,10 @@ var MintGrantRequestSchema = exports_external.object({
   v: exports_external.literal(1),
   op: exports_external.literal("mint_grant"),
   agent: exports_external.string().min(1),
-  keys: exports_external.array(exports_external.string().min(1)).min(1),
+  keys: exports_external.array(exports_external.string().min(1)),
   ttl_seconds: exports_external.number().int().positive().nullable(),
-  description: exports_external.string().optional()
+  description: exports_external.string().optional(),
+  write_keys: exports_external.array(exports_external.string().min(1)).optional()
 });
 var ListGrantsRequestSchema = exports_external.object({
   v: exports_external.literal(1),
@@ -12452,6 +12776,7 @@ var GrantMetaSchema = exports_external.object({
   id: exports_external.string(),
   agent_slug: exports_external.string(),
   key_allow: exports_external.array(exports_external.string()),
+  write_allow: exports_external.array(exports_external.string()).default([]),
   expires_at: exports_external.number().nullable(),
   created_at: exports_external.number(),
   description: exports_external.string().nullable()
@@ -12622,7 +12947,7 @@ function createAuditLogger(opts = {}) {
 // src/vault/grants.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 
-// node_modules/.bun/bcryptjs@3.0.3/node_modules/bcryptjs/index.js
+// node_modules/bcryptjs/index.js
 import nodeCrypto from "crypto";
 var randomFallback = null;
 function randomBytes3(len) {
@@ -14307,6 +14632,11 @@ function migrateGrantsSchema(db) {
       description TEXT
     )
   `);
+  const cols = db.query(`PRAGMA table_info(vault_grants)`).all();
+  const hasWriteAllow = cols.some((c) => c.name === "write_allow");
+  if (!hasWriteAllow) {
+    db.run(`ALTER TABLE vault_grants ADD COLUMN write_allow TEXT NOT NULL DEFAULT '[]'`);
+  }
 }
 var BCRYPT_COST = 10;
 function generateId() {
@@ -14330,21 +14660,43 @@ function rowToGrant(row) {
     id: row.id,
     agent_slug: row.agent_slug,
     key_allow: parseKeyAllow(row.key_allow),
+    write_allow: parseKeyAllow(row.write_allow ?? "[]"),
     expires_at: row.expires_at ?? null,
     revoked_at: row.revoked_at ?? null,
     created_at: row.created_at,
     description: row.description ?? null
   };
 }
-async function mintGrant(db, agent_slug, key_allow, ttl_seconds, description) {
+function keyMatchesPatterns(patterns, key) {
+  for (const pat of patterns) {
+    if (pat.endsWith("*")) {
+      const prefix = pat.slice(0, -1);
+      if (key.startsWith(prefix))
+        return true;
+    } else if (pat === key) {
+      return true;
+    }
+  }
+  return false;
+}
+async function mintGrant(db, agent_slug, key_allow, ttl_seconds, description, write_allow = []) {
   const id = generateId();
   const secret = generateSecret();
   const token = `${id}.${secret}`;
   const secret_hash = await hash(secret, BCRYPT_COST);
   const now = Math.floor(Date.now() / 1000);
   const expires_at = ttl_seconds != null ? now + ttl_seconds : null;
-  db.run(`INSERT INTO vault_grants (id, secret_hash, agent_slug, key_allow, expires_at, revoked_at, created_at, description)
-     VALUES (?, ?, ?, ?, ?, NULL, ?, ?)`, [id, secret_hash, agent_slug, JSON.stringify(key_allow), expires_at, now, description ?? null]);
+  db.run(`INSERT INTO vault_grants (id, secret_hash, agent_slug, key_allow, write_allow, expires_at, revoked_at, created_at, description)
+     VALUES (?, ?, ?, ?, ?, ?, NULL, ?, ?)`, [
+    id,
+    secret_hash,
+    agent_slug,
+    JSON.stringify(key_allow),
+    JSON.stringify(write_allow),
+    expires_at,
+    now,
+    description ?? null
+  ]);
   return { token, id, expires_at };
 }
 async function validateGrant(db, token, key) {
@@ -14385,6 +14737,41 @@ async function validateGrant(db, token, key) {
   }
   return { ok: true, grant };
 }
+async function validateGrantForWrite(db, token, key) {
+  const dotIdx = token.indexOf(".");
+  if (dotIdx === -1 || !token.startsWith("vg_")) {
+    return { ok: false, reason: "grant-invalid" };
+  }
+  const id = token.slice(0, dotIdx);
+  const secret = token.slice(dotIdx + 1);
+  if (!id || !secret) {
+    return { ok: false, reason: "grant-invalid" };
+  }
+  const row = db.query(`SELECT id, secret_hash, agent_slug, key_allow, write_allow, expires_at, revoked_at, created_at, description
+       FROM vault_grants WHERE id = ?`).get(id);
+  if (!row)
+    return { ok: false, reason: "grant-invalid" };
+  const secretHash = row.secret_hash;
+  let hashMatches;
+  try {
+    hashMatches = await compare(secret, secretHash);
+  } catch {
+    hashMatches = false;
+  }
+  if (!hashMatches)
+    return { ok: false, reason: "grant-invalid" };
+  const grant = rowToGrant(row);
+  const now = Math.floor(Date.now() / 1000);
+  if (grant.revoked_at !== null)
+    return { ok: false, reason: "grant-revoked" };
+  if (grant.expires_at !== null && grant.expires_at < now) {
+    return { ok: false, reason: "grant-expired" };
+  }
+  if (!keyMatchesPatterns(grant.write_allow, key)) {
+    return { ok: false, reason: "grant-write-not-allowed" };
+  }
+  return { ok: true, grant };
+}
 function revokeGrant(db, id) {
   const now = Math.floor(Date.now() / 1000);
   const result = db.run(`UPDATE vault_grants SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL`, [now, id]);
@@ -14393,11 +14780,11 @@ function revokeGrant(db, id) {
 function listGrants(db, agent_slug) {
   let rows;
   if (agent_slug !== undefined) {
-    rows = db.query(`SELECT id, agent_slug, key_allow, expires_at, revoked_at, created_at, description
+    rows = db.query(`SELECT id, agent_slug, key_allow, write_allow, expires_at, revoked_at, created_at, description
          FROM vault_grants WHERE revoked_at IS NULL AND agent_slug = ?
          ORDER BY created_at DESC`).all(agent_slug);
   } else {
-    rows = db.query(`SELECT id, agent_slug, key_allow, expires_at, revoked_at, created_at, description
+    rows = db.query(`SELECT id, agent_slug, key_allow, write_allow, expires_at, revoked_at, created_at, description
          FROM vault_grants WHERE revoked_at IS NULL
          ORDER BY created_at DESC`).all();
   }
@@ -14786,9 +15173,12 @@ class VaultBroker {
   grantsDb;
   constructor(testOpts = {}) {
     this.testOpts = testOpts;
-    const usingTestOpt = testOpts._testSecrets !== undefined || testOpts._testConfig !== undefined || testOpts._testIdentify !== undefined || testOpts._testAuditLogger !== undefined || testOpts._testGrantsDb !== undefined;
+    const usingTestOpt = testOpts._testSecrets !== undefined || testOpts._testConfig !== undefined || testOpts._testIdentify !== undefined || testOpts._testAuditLogger !== undefined || testOpts._testGrantsDb !== undefined || testOpts._testVaultPath !== undefined;
     if (usingTestOpt && true) {
-      throw new Error("VaultBroker: BrokerTestOpts (_testSecrets/_testConfig/_testIdentify/_testAuditLogger/_testGrantsDb) " + "must not be set outside tests. Set NODE_ENV=test if you really mean it.");
+      throw new Error("VaultBroker: BrokerTestOpts (_testSecrets/_testConfig/_testIdentify/_testAuditLogger/_testGrantsDb/_testVaultPath) " + "must not be set outside tests. Set NODE_ENV=test if you really mean it.");
+    }
+    if (testOpts._testVaultPath !== undefined) {
+      this.vaultPath = testOpts._testVaultPath;
     }
     this.auditLogger = testOpts._testAuditLogger ?? createAuditLogger();
     if (testOpts._testGrantsDb !== undefined) {
@@ -14819,15 +15209,15 @@ class VaultBroker {
       this.secrets = { ...this.testOpts._testSecrets };
     }
     process.umask(63);
-    const parentDir = dirname3(this.socketPath);
-    mkdirSync4(parentDir, { recursive: true, mode: 448 });
+    const parentDir = dirname4(this.socketPath);
+    mkdirSync5(parentDir, { recursive: true, mode: 448 });
     try {
-      chmodSync3(parentDir, 448);
+      chmodSync4(parentDir, 448);
     } catch {}
     for (const p of [this.socketPath, this.unlockSocketPath]) {
-      if (existsSync5(p)) {
+      if (existsSync7(p)) {
         try {
-          unlinkSync2(p);
+          unlinkSync4(p);
         } catch {}
       }
     }
@@ -14843,6 +15233,7 @@ class VaultBroker {
     }
   }
   unlockFromPassphrase(passphrase) {
+    detectVaultLayoutDrift(this.vaultPath);
     const secrets = openVault(passphrase, this.vaultPath);
     this.secrets = secrets;
     this.passphrase = passphrase;
@@ -14874,24 +15265,24 @@ class VaultBroker {
       try {
         entry.server.close();
       } catch {}
-      if (existsSync5(sockPath)) {
+      if (existsSync7(sockPath)) {
         try {
-          unlinkSync2(sockPath);
+          unlinkSync4(sockPath);
         } catch {}
       }
     }
     this.agentServers.clear();
     for (const p of [this.socketPath, this.unlockSocketPath]) {
-      if (p && existsSync5(p)) {
+      if (p && existsSync7(p)) {
         try {
-          unlinkSync2(p);
+          unlinkSync4(p);
         } catch {}
       }
     }
     try {
       const pidPath = resolvePath(PID_FILE_DEFAULT);
-      if (existsSync5(pidPath))
-        unlinkSync2(pidPath);
+      if (existsSync7(pidPath))
+        unlinkSync4(pidPath);
     } catch {}
   }
   getStatus() {
@@ -14913,18 +15304,18 @@ class VaultBroker {
     return new Promise((resolveP, rejectP) => {
       if (abs.endsWith("/sock")) {
         const dir = abs.slice(0, -"/sock".length);
-        if (existsSync5(dir)) {
+        if (existsSync7(dir)) {
           try {
             chownSync(dir, 0, 0);
           } catch {}
           try {
-            chmodSync3(dir, 448);
+            chmodSync4(dir, 448);
           } catch {}
         }
       }
-      if (existsSync5(abs)) {
+      if (existsSync7(abs)) {
         try {
-          unlinkSync2(abs);
+          unlinkSync4(abs);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
           process.stderr.write(`[vault-broker] could not unlink stale socket agent=${agentName} sock=${abs}: ${msg}
@@ -14937,7 +15328,7 @@ class VaultBroker {
       server.on("error", (err) => rejectP(err));
       server.listen(abs, () => {
         try {
-          chmodSync3(abs, 432);
+          chmodSync4(abs, 432);
         } catch {}
         try {
           const uid = allocateAgentUid(agentName);
@@ -14966,7 +15357,7 @@ class VaultBroker {
       });
       server.listen(this.socketPath, () => {
         try {
-          chmodSync3(this.socketPath, 384);
+          chmodSync4(this.socketPath, 384);
         } catch {}
         this.server = server;
         resolve5();
@@ -14983,7 +15374,7 @@ class VaultBroker {
       });
       server.listen(this.unlockSocketPath, () => {
         try {
-          chmodSync3(this.unlockSocketPath, 384);
+          chmodSync4(this.unlockSocketPath, 384);
         } catch {}
         this.unlockServer = server;
         resolve5();
@@ -15277,30 +15668,71 @@ class VaultBroker {
         socket.write(encodeResponse(errorResponse("LOCKED", "Vault is locked")));
         return;
       }
-      if (agentName === null) {
-        socket.write(encodeResponse(errorResponse("DENIED", "put requires path-as-identity (token-based grants are read-only)")));
+      let passphraseAttested = false;
+      if (req.passphrase !== undefined && req.passphrase !== "") {
+        if (req.passphrase === this.passphrase) {
+          passphraseAttested = true;
+        } else {
+          this.auditLogger.write({
+            ts: new Date().toISOString(),
+            op: "put",
+            key: req.key,
+            caller: auditCaller,
+            pid: auditPid,
+            cgroup: auditCgroup,
+            result: "denied:passphrase-mismatch",
+            method: "passphrase"
+          });
+          socket.write(encodeResponse(errorResponse("DENIED", "supplied passphrase does not match the broker's unlocked passphrase")));
+          return;
+        }
+      }
+      let writeGrantId = null;
+      if (req.token !== undefined && req.token !== "") {
+        const v = await validateGrantForWrite(this.grantsDb, req.token, req.key);
+        if (v.ok) {
+          writeGrantId = v.grant.id;
+        } else if (v.reason === "grant-expired" || v.reason === "grant-revoked") {
+          this.auditLogger.write({
+            ts: new Date().toISOString(),
+            op: "put",
+            key: req.key,
+            caller: auditCaller,
+            pid: auditPid,
+            cgroup: auditCgroup,
+            result: `denied:${v.reason}`,
+            method: "grant"
+          });
+          socket.write(encodeResponse(errorResponse("DENIED", v.reason)));
+          return;
+        }
+      }
+      if (writeGrantId === null && !passphraseAttested && agentName === null) {
+        socket.write(encodeResponse(errorResponse("DENIED", "put requires path-as-identity, a valid write-grant token, or operator-passphrase attestation")));
         return;
       }
       if (this.config === null) {
         socket.write(encodeResponse(errorResponse("INTERNAL", "Broker config not loaded")));
         return;
       }
-      const aclResult = checkAclByAgent(this.config, agentName, req.key);
-      if (!aclResult.allow) {
-        this.auditLogger.write({
-          ts: new Date().toISOString(),
-          op: "put",
-          key: req.key,
-          caller: auditCaller,
-          pid: auditPid,
-          cgroup: auditCgroup,
-          result: `denied:${aclResult.reason}`
-        });
-        socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
-        return;
+      if (writeGrantId === null && !passphraseAttested) {
+        const aclResult = checkAclByAgent(this.config, agentName, req.key);
+        if (!aclResult.allow) {
+          this.auditLogger.write({
+            ts: new Date().toISOString(),
+            op: "put",
+            key: req.key,
+            caller: auditCaller,
+            pid: auditPid,
+            cgroup: auditCgroup,
+            result: `denied:${aclResult.reason}`
+          });
+          socket.write(encodeResponse(errorResponse("DENIED", aclResult.reason)));
+          return;
+        }
       }
       const existing = this.secrets[req.key];
-      if (existing === undefined) {
+      if (existing === undefined && writeGrantId === null && !passphraseAttested) {
         this.auditLogger.write({
           ts: new Date().toISOString(),
           op: "put",
@@ -15310,10 +15742,10 @@ class VaultBroker {
           cgroup: auditCgroup,
           result: "denied:unknown_key"
         });
-        socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key} (broker put cannot introduce new keys; ask operator to set it once via 'switchroom vault set' from the host)`)));
+        socket.write(encodeResponse(errorResponse("UNKNOWN_KEY", `Key not found: ${req.key} (broker put cannot introduce new keys without a write-grant; ask operator to 'switchroom vault grant <agent> --write ${req.key}' or set it once via 'switchroom vault set' from the host)`)));
         return;
       }
-      if (existing.kind !== req.entry.kind) {
+      if (existing !== undefined && existing.kind !== req.entry.kind && !passphraseAttested) {
         this.auditLogger.write({
           ts: new Date().toISOString(),
           op: "put",
@@ -15331,7 +15763,11 @@ class VaultBroker {
       try {
         saveVault(this.passphrase, this.vaultPath, this.secrets);
       } catch (err) {
-        this.secrets[req.key] = previousEntry;
+        if (previousEntry === undefined) {
+          delete this.secrets[req.key];
+        } else {
+          this.secrets[req.key] = previousEntry;
+        }
         this.auditLogger.write({
           ts: new Date().toISOString(),
           op: "put",
@@ -15339,7 +15775,8 @@ class VaultBroker {
           caller: auditCaller,
           pid: auditPid,
           cgroup: auditCgroup,
-          result: `error:${err?.message ?? "save failed"}`
+          result: `error:${err?.message ?? "save failed"}`,
+          ...passphraseAttested ? { method: "passphrase" } : writeGrantId !== null ? { method: "grant", grant_id: writeGrantId } : {}
         });
         socket.write(encodeResponse(errorResponse("INTERNAL", `Failed to persist: ${err?.message ?? "unknown"}`)));
         return;
@@ -15351,7 +15788,8 @@ class VaultBroker {
         caller: auditCaller,
         pid: auditPid,
         cgroup: auditCgroup,
-        result: "allowed"
+        result: "allowed",
+        ...passphraseAttested ? { method: "passphrase" } : writeGrantId !== null ? { method: "grant", grant_id: writeGrantId } : {}
       });
       socket.write(encodeResponse({ ok: true, put: true, key: req.key }));
       return;
@@ -15404,10 +15842,22 @@ class VaultBroker {
       }
     }
     if (req.op === "mint_grant") {
-      const { agent, keys, ttl_seconds, description } = req;
+      const { agent, keys, ttl_seconds, description, write_keys } = req;
+      if (keys.length === 0 && (write_keys?.length ?? 0) === 0) {
+        this.auditLogger.write({
+          ts: new Date().toISOString(),
+          op: "mint_grant",
+          caller: auditCaller,
+          pid: auditPid,
+          cgroup: auditCgroup,
+          result: "denied:no-capabilities"
+        });
+        socket.write(encodeResponse(errorResponse("BAD_REQUEST", "mint_grant requires at least one of `keys` or `write_keys` to be non-empty")));
+        return;
+      }
       let mintResult;
       try {
-        mintResult = await mintGrant(this.grantsDb, agent, keys, ttl_seconds, description);
+        mintResult = await mintGrant(this.grantsDb, agent, keys, ttl_seconds, description, write_keys ?? []);
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         this.auditLogger.write({
@@ -15423,11 +15873,11 @@ class VaultBroker {
       }
       try {
         const tokenDir = path3.join(os3.homedir(), ".switchroom", "agents", agent);
-        mkdirSync4(tokenDir, { recursive: true });
+        mkdirSync5(tokenDir, { recursive: true });
         const tokenPath = path3.join(tokenDir, ".vault-token");
         const tmpPath = `${tokenPath}.tmp.${process.pid}`;
         writeFileSync3(tmpPath, mintResult.token, { mode: 384 });
-        renameSync2(tmpPath, tokenPath);
+        renameSync3(tmpPath, tokenPath);
       } catch (err) {
         process.stderr.write(`[vault-broker] mint_grant: failed to write token file for agent ${agent}: ${err.message}
 `);
@@ -15460,10 +15910,11 @@ class VaultBroker {
         cgroup: auditCgroup,
         result: `allowed:${grants.length}`
       });
-      const grantMetas = grants.map(({ id, agent_slug, key_allow, expires_at, created_at, description }) => ({
+      const grantMetas = grants.map(({ id, agent_slug, key_allow, write_allow, expires_at, created_at, description }) => ({
         id,
         agent_slug,
         key_allow,
+        write_allow,
         expires_at,
         created_at,
         description
@@ -15478,9 +15929,9 @@ class VaultBroker {
         const row = this.grantsDb.query("SELECT agent_slug FROM vault_grants WHERE id = ?").get(id);
         if (row) {
           const tokenPath = path3.join(os3.homedir(), ".switchroom", "agents", row.agent_slug, ".vault-token");
-          if (existsSync5(tokenPath)) {
+          if (existsSync7(tokenPath)) {
             try {
-              unlinkSync2(tokenPath);
+              unlinkSync4(tokenPath);
             } catch {}
           }
         }
@@ -15721,7 +16172,7 @@ class VaultBroker {
     const envPath = process.env.SWITCHROOM_VAULT_BROKER_AUTO_UNLOCK_PATH;
     const configuredPath = (envPath && envPath.length > 0 ? envPath : undefined) ?? this.config?.vault?.broker?.autoUnlockCredentialPath ?? DEFAULT_AUTO_UNLOCK_PATH;
     const filePath = resolvePath(configuredPath);
-    if (!existsSync5(filePath))
+    if (!existsSync7(filePath))
       return false;
     let passphrase;
     try {
@@ -15758,7 +16209,7 @@ class VaultBroker {
     const credPath = `${dir}/vault-passphrase`;
     let passphrase;
     try {
-      passphrase = readFileSync5(credPath, "utf8").replace(/\n+$/, "");
+      passphrase = readFileSync7(credPath, "utf8").replace(/\n+$/, "");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -15795,6 +16246,21 @@ class VaultBroker {
     } catch {}
   }
 }
+function detectVaultLayoutDrift(vaultPath) {
+  const dir = dirname4(vaultPath);
+  if (basename3(dir) !== "vault")
+    return;
+  if (basename3(vaultPath) !== "vault.enc")
+    return;
+  const switchroomDir = dirname4(dir);
+  if (basename3(switchroomDir) !== ".switchroom")
+    return;
+  const home2 = dirname4(switchroomDir);
+  const result = inspectVaultLayout(home2);
+  if (result.kind === "divergent") {
+    throw new VaultError(`Vault layout divergence detected at boot: ${result.details.oldPath} and ${result.details.newPath} are both regular files with different content. An older switchroom CLI may have written to the legacy path after migration ran. Run \`switchroom apply\` from the host to surface the recovery recipe (state E refusal with literal \`mv\` commands). See docs/operators/state-e-recovery.md.`);
+  }
+}
 var _globalBroker = null;
 function registerShutdownHandlers(broker) {
   _globalBroker = broker;
@@ -15815,8 +16281,8 @@ async function main() {
   const vaultPath = process.env.SWITCHROOM_VAULT_PATH;
   let perAgentTargets = [];
   try {
-    if (existsSync5(perAgentDir)) {
-      const entries = readdirSync(perAgentDir, { withFileTypes: true });
+    if (existsSync7(perAgentDir)) {
+      const entries = readdirSync2(perAgentDir, { withFileTypes: true });
       const flat = [];
       const subdirs = [];
       for (const e of entries) {