cli

config.rs (127283B)

---

 use std::collections::BTreeMap;
 use std::fs;
 use std::io::IsTerminal;
 use std::path::Path;
 use std::path::PathBuf;
 
 use radroots_local_events::{RelayUrlValidationError, normalize_relay_url};
 use radroots_runtime::{parse_bool_value, parse_strict_env_file, parse_u64_value};
 use radroots_runtime_paths::{
     RadrootsLegacyPathCandidate, RadrootsMigrationReport, RadrootsPathResolver,
     inspect_legacy_paths,
 };
 use radroots_secret_vault::{RadrootsHostVaultPolicy, RadrootsSecretBackend};
 use serde::Deserialize;
 use url::Url;
 
 use crate::cli::global::RuntimeInvocationArgs;
 use crate::runtime::RuntimeError;
 pub use crate::runtime::paths::PathsConfig;
 use crate::runtime::paths::{ENV_CLI_PATHS_PROFILE, ENV_CLI_PATHS_REPO_LOCAL_ROOT, resolve_paths};
 
 const DEFAULT_LOG_FILTER: &str = "info";
 const DEFAULT_ENV_PATH: &str = ".env";
 const DEFAULT_LOCAL_STATE_DIR: &str = "replica";
 const DEFAULT_LOCAL_DB_FILE: &str = "replica.sqlite";
 const DEFAULT_LOCAL_BACKUPS_DIR: &str = "backups";
 const DEFAULT_LOCAL_EXPORTS_DIR: &str = "exports";
 const DEFAULT_SHARED_ACCOUNTS_STORE_FILE: &str = "store.json";
 const DEFAULT_MYC_STATUS_TIMEOUT_MS: u64 = 2_000;
 const DEFAULT_HYF_EXECUTABLE: &str = "hyfd";
 const DEFAULT_RPC_URL: &str = "http://127.0.0.1:7070";
 const CLI_HOST_VAULT_POLICY: &str = "desktop";
 const CLI_DEFAULT_SECRET_BACKEND: &str = "host_vault";
 const CLI_DEFAULT_SECRET_FALLBACK: &str = "encrypted_file";
 const CLI_ALLOWED_SHARED_SECRET_BACKENDS: &[&str] = &["host_vault", "encrypted_file"];
 const CLI_USES_PROTECTED_STORE: bool = true;
 const ENV_CLI_FILE_PATH: &str = "RADROOTS_CLI_ENV_FILE";
 const ENV_CLI_OUTPUT_FORMAT: &str = "RADROOTS_CLI_OUTPUT_FORMAT";
 const ENV_CLI_LOG_FILTER: &str = "RADROOTS_CLI_LOGGING_FILTER";
 const ENV_CLI_LOG_DIR: &str = "RADROOTS_CLI_LOGGING_OUTPUT_DIR";
 const ENV_CLI_LOG_STDOUT: &str = "RADROOTS_CLI_LOGGING_STDOUT";
 const ENV_CLI_ACCOUNT_SELECTOR: &str = "RADROOTS_CLI_ACCOUNT_SELECTOR";
 const ENV_CLI_ACCOUNT_SECRET_BACKEND: &str = "RADROOTS_CLI_ACCOUNT_SECRET_BACKEND";
 const ENV_CLI_ACCOUNT_SECRET_FALLBACK: &str = "RADROOTS_CLI_ACCOUNT_SECRET_FALLBACK";
 const ENV_CLI_IDENTITY_PATH: &str = "RADROOTS_CLI_IDENTITY_PATH";
 const ENV_CLI_SIGNER_BACKEND: &str = "RADROOTS_CLI_SIGNER_BACKEND";
 const ENV_CLI_PUBLISH_TRANSPORT: &str = "RADROOTS_CLI_PUBLISH_TRANSPORT";
 const ENV_CLI_RELAYS_URLS: &str = "RADROOTS_CLI_RELAYS_URLS";
 const ENV_CLI_RADROOTSD_PROXY_URL: &str = "RADROOTS_CLI_RADROOTSD_PROXY_URL";
 const ENV_CLI_RADROOTSD_PROXY_TOKEN_FILE: &str = "RADROOTS_CLI_RADROOTSD_PROXY_TOKEN_FILE";
 const ENV_CLI_RADROOTSD_PROXY_TOKEN_SECRET_ID: &str =
     "RADROOTS_CLI_RADROOTSD_PROXY_TOKEN_SECRET_ID";
 const ENV_CLI_MYC_EXECUTABLE: &str = "RADROOTS_CLI_MYC_EXECUTABLE";
 const ENV_CLI_MYC_STATUS_TIMEOUT_MS: &str = "RADROOTS_CLI_MYC_STATUS_TIMEOUT_MS";
 const ENV_CLI_HYF_ENABLED: &str = "RADROOTS_CLI_HYF_ENABLED";
 const ENV_CLI_HYF_EXECUTABLE: &str = "RADROOTS_CLI_HYF_EXECUTABLE";
 const ENV_CLI_RHI_TRUSTED_WORKER_PUBKEYS: &str = "RADROOTS_CLI_RHI_TRUSTED_WORKER_PUBKEYS";
 const SUPPORTED_ENV_FILE_KEYS: &[&str] = &[
     ENV_CLI_OUTPUT_FORMAT,
     ENV_CLI_LOG_FILTER,
     ENV_CLI_LOG_DIR,
     ENV_CLI_LOG_STDOUT,
     ENV_CLI_PATHS_PROFILE,
     ENV_CLI_PATHS_REPO_LOCAL_ROOT,
     ENV_CLI_ACCOUNT_SELECTOR,
     ENV_CLI_ACCOUNT_SECRET_BACKEND,
     ENV_CLI_ACCOUNT_SECRET_FALLBACK,
     ENV_CLI_IDENTITY_PATH,
     ENV_CLI_SIGNER_BACKEND,
     ENV_CLI_PUBLISH_TRANSPORT,
     ENV_CLI_RELAYS_URLS,
     ENV_CLI_RADROOTSD_PROXY_URL,
     ENV_CLI_RADROOTSD_PROXY_TOKEN_FILE,
     ENV_CLI_RADROOTSD_PROXY_TOKEN_SECRET_ID,
     ENV_CLI_MYC_EXECUTABLE,
     ENV_CLI_MYC_STATUS_TIMEOUT_MS,
     ENV_CLI_HYF_ENABLED,
     ENV_CLI_HYF_EXECUTABLE,
     ENV_CLI_RHI_TRUSTED_WORKER_PUBKEYS,
 ];
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum OutputFormat {
     Human,
     Json,
     Ndjson,
 }
 
 impl OutputFormat {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::Human => "human",
             Self::Json => "json",
             Self::Ndjson => "ndjson",
         }
     }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Verbosity {
     Quiet,
     Normal,
     Verbose,
     Trace,
 }
 
 impl Verbosity {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::Quiet => "quiet",
             Self::Normal => "normal",
             Self::Verbose => "verbose",
             Self::Trace => "trace",
         }
     }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct OutputConfig {
     pub format: OutputFormat,
     pub verbosity: Verbosity,
     pub color: bool,
     pub dry_run: bool,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct InteractionConfig {
     pub input_enabled: bool,
     pub assume_yes: bool,
     pub stdin_tty: bool,
     pub stdout_tty: bool,
     pub prompts_allowed: bool,
     pub confirmations_allowed: bool,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LoggingConfig {
     pub filter: String,
     pub directory: Option<PathBuf>,
     pub stdout: bool,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct IdentityConfig {
     pub path: PathBuf,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountConfig {
     pub selector: Option<String>,
     pub store_path: PathBuf,
     pub secrets_dir: PathBuf,
     pub secret_backend: RadrootsSecretBackend,
     pub secret_fallback: Option<RadrootsSecretBackend>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountSecretContractConfig {
     pub default_backend: String,
     pub default_fallback: Option<String>,
     pub allowed_backends: Vec<String>,
     pub host_vault_policy: Option<String>,
     pub uses_protected_store: bool,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum SignerBackend {
     Local,
     Myc,
 }
 
 impl SignerBackend {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::Local => "local",
             Self::Myc => "myc",
         }
     }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct SignerConfig {
     pub backend: SignerBackend,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PublishTransport {
     DirectNostrRelay,
     RadrootsdProxy,
 }
 
 impl PublishTransport {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::DirectNostrRelay => "direct_nostr_relay",
             Self::RadrootsdProxy => "radrootsd_proxy",
         }
     }
 
     pub fn transport_family(self) -> &'static str {
         match self {
             Self::DirectNostrRelay => "direct_nostr_relay",
             Self::RadrootsdProxy => "radrootsd_proxy",
         }
     }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PublishTransportSource {
     Flags,
     Environment,
     UserConfig,
     WorkspaceConfig,
     Defaults,
 }
 
 impl PublishTransportSource {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::Flags => "cli flags · local first",
             Self::Environment => "environment · local first",
             Self::UserConfig => "user config · local first",
             Self::WorkspaceConfig => "workspace config · local first",
             Self::Defaults => "defaults · local first",
         }
     }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct PublishConfig {
     pub transport: PublishTransport,
     pub source: PublishTransportSource,
     pub radrootsd_proxy: RadrootsdProxyConfig,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RadrootsdProxyConfig {
     pub url: String,
     pub token_file: Option<PathBuf>,
     pub token_secret_id: Option<String>,
 }
 
 impl Default for RadrootsdProxyConfig {
     fn default() -> Self {
         Self {
             url: DEFAULT_RPC_URL.to_owned(),
             token_file: None,
             token_secret_id: None,
         }
     }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum RelayPublishPolicy {
     Any,
 }
 
 impl RelayPublishPolicy {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::Any => "any",
         }
     }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum RelayConfigSource {
     Flags,
     Environment,
     UserConfig,
     WorkspaceConfig,
     Defaults,
 }
 
 impl RelayConfigSource {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::Flags => "cli flags · local first",
             Self::Environment => "environment · local first",
             Self::UserConfig => "user config · local first",
             Self::WorkspaceConfig => "workspace config · local first",
             Self::Defaults => "defaults · local first",
         }
     }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RelayConfig {
     pub urls: Vec<String>,
     pub publish_policy: RelayPublishPolicy,
     pub source: RelayConfigSource,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LocalConfig {
     pub root: PathBuf,
     pub replica_db_path: PathBuf,
     pub backups_dir: PathBuf,
     pub exports_dir: PathBuf,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct MycConfig {
     pub executable: PathBuf,
     pub status_timeout_ms: u64,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct HyfConfig {
     pub enabled: bool,
     pub executable: PathBuf,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum CapabilityBindingTargetKind {
     ManagedInstance,
     ExplicitEndpoint,
 }
 
 impl CapabilityBindingTargetKind {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::ManagedInstance => "managed_instance",
             Self::ExplicitEndpoint => "explicit_endpoint",
         }
     }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum CapabilityBindingSource {
     UserConfig,
     WorkspaceConfig,
 }
 
 impl CapabilityBindingSource {
     pub fn as_str(self) -> &'static str {
         match self {
             Self::UserConfig => "user config [[capability_binding]]",
             Self::WorkspaceConfig => "workspace config [[capability_binding]]",
         }
     }
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct CapabilityBindingConfig {
     pub capability_id: String,
     pub provider_runtime_id: String,
     pub binding_model: String,
     pub target_kind: CapabilityBindingTargetKind,
     pub target: String,
     pub managed_account_ref: Option<String>,
     pub signer_session_ref: Option<String>,
     pub source: CapabilityBindingSource,
 }
 
 #[cfg(test)]
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum CapabilityBindingInspectionState {
     Configured,
     NotConfigured,
     Disabled,
 }
 
 #[cfg(test)]
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct CapabilityBindingInspection {
     pub capability_id: String,
     pub provider_runtime_id: String,
     pub binding_model: String,
     pub state: CapabilityBindingInspectionState,
     pub source: String,
     pub target_kind: Option<String>,
     pub target: Option<String>,
     pub managed_account_ref: Option<String>,
     pub signer_session_ref: Option<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RpcConfig {
     pub url: String,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RhiConfig {
     pub trusted_worker_pubkeys: Vec<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RuntimeConfig {
     pub output: OutputConfig,
     pub interaction: InteractionConfig,
     pub paths: PathsConfig,
     pub migration: MigrationConfig,
     pub logging: LoggingConfig,
     pub account: AccountConfig,
     pub account_secret_contract: AccountSecretContractConfig,
     pub identity: IdentityConfig,
     pub signer: SignerConfig,
     pub publish: PublishConfig,
     pub relay: RelayConfig,
     pub local: LocalConfig,
     pub myc: MycConfig,
     pub hyf: HyfConfig,
     pub rpc: RpcConfig,
     pub rhi: RhiConfig,
     pub capability_bindings: Vec<CapabilityBindingConfig>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct MigrationConfig {
     pub report: RadrootsMigrationReport,
 }
 
 #[derive(Debug, Default)]
 pub(crate) struct EnvFileValues(BTreeMap<String, String>);
 
 impl EnvFileValues {
     pub(crate) fn get(&self, key: &str) -> Option<&str> {
         self.0.get(key).map(String::as_str)
     }
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct CliConfigFile {
     output: Option<OutputFileConfig>,
     logging: Option<LoggingFileConfig>,
     account: Option<AccountFileConfig>,
     identity: Option<IdentityFileConfig>,
     relays: Option<RelayFileConfig>,
     publish: Option<PublishFileConfig>,
     signer: Option<SignerFileConfig>,
     myc: Option<MycFileConfig>,
     hyf: Option<HyfFileConfig>,
     rpc: Option<RpcFileConfig>,
     rhi: Option<RhiFileConfig>,
     capability_binding: Option<Vec<CapabilityBindingFileConfig>>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct OutputFileConfig {
     format: Option<String>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct LoggingFileConfig {
     filter: Option<String>,
     output_dir: Option<PathBuf>,
     stdout: Option<bool>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct AccountFileConfig {
     selector: Option<String>,
     secret: Option<AccountSecretFileConfig>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct AccountSecretFileConfig {
     backend: Option<String>,
     fallback: Option<String>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct IdentityFileConfig {
     path: Option<PathBuf>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct RelayFileConfig {
     urls: Option<Vec<String>>,
     publish_policy: Option<String>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct PublishFileConfig {
     transport: Option<String>,
     radrootsd_proxy: Option<RadrootsdProxyFileConfig>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct RadrootsdProxyFileConfig {
     url: Option<String>,
     token_file: Option<PathBuf>,
     token_secret_id: Option<String>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct RpcFileConfig {
     url: Option<String>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct RhiFileConfig {
     trusted_worker_pubkeys: Option<Vec<String>>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct MycFileConfig {
     executable: Option<PathBuf>,
     status_timeout_ms: Option<u64>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct SignerFileConfig {
     backend: Option<String>,
 }
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 struct HyfFileConfig {
     enabled: Option<bool>,
     executable: Option<PathBuf>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct CapabilityBindingFileConfig {
     capability: String,
     provider: String,
     target_kind: String,
     target: String,
     managed_account_ref: Option<String>,
     signer_session_ref: Option<String>,
 }
 
 #[derive(Debug, Clone, Copy)]
 struct CapabilityBindingSpec {
     capability_id: &'static str,
     provider_runtime_id: &'static str,
     binding_model: &'static str,
 }
 
 pub(crate) const SIGNER_REMOTE_NIP46_CAPABILITY: &str = "signer.remote_nip46";
 pub(crate) const INFERENCE_HYF_STDIO_CAPABILITY: &str = "inference.hyf_stdio";
 const CAPABILITY_BINDING_SPECS: &[CapabilityBindingSpec] = &[
     CapabilityBindingSpec {
         capability_id: SIGNER_REMOTE_NIP46_CAPABILITY,
         provider_runtime_id: "myc",
         binding_model: "session_authorized_remote_signer",
     },
     CapabilityBindingSpec {
         capability_id: INFERENCE_HYF_STDIO_CAPABILITY,
         provider_runtime_id: "hyf",
         binding_model: "stdio_service",
     },
 ];
 
 pub(crate) trait Environment {
     fn var(&self, key: &str) -> Option<String>;
     fn current_dir(&self) -> Result<PathBuf, RuntimeError>;
     fn path_resolver(&self) -> RadrootsPathResolver;
     fn stdin_is_tty(&self) -> bool;
     fn stdout_is_tty(&self) -> bool;
 }
 
 pub struct SystemEnvironment;
 
 impl Environment for SystemEnvironment {
     fn var(&self, key: &str) -> Option<String> {
         std::env::var(key).ok()
     }
 
     fn current_dir(&self) -> Result<PathBuf, RuntimeError> {
         std::env::current_dir().map_err(|err| {
             RuntimeError::Config(format!("failed to resolve current directory: {err}"))
         })
     }
 
     fn path_resolver(&self) -> RadrootsPathResolver {
         RadrootsPathResolver::current()
     }
 
     fn stdin_is_tty(&self) -> bool {
         std::io::stdin().is_terminal()
     }
 
     fn stdout_is_tty(&self) -> bool {
         std::io::stdout().is_terminal()
     }
 }
 
 impl RuntimeConfig {
     pub fn from_system(args: &RuntimeInvocationArgs) -> Result<Self, RuntimeError> {
         let system = SystemEnvironment;
         let env_file_path = resolve_env_file_path(args, &system);
         let env_file = load_env_file_values(env_file_path.as_deref())?;
         Self::resolve_with_env_file(args, &system, &env_file)
     }
 
     fn resolve_with_env_file(
         args: &RuntimeInvocationArgs,
         env: &dyn Environment,
         env_file: &EnvFileValues,
     ) -> Result<Self, RuntimeError> {
         let paths = resolve_paths(env, env_file)?;
         let migration = resolve_migration(paths.clone(), env);
         let workspace_config = paths
             .workspace_config_path
             .as_deref()
             .map(load_cli_config_file)
             .transpose()?
             .flatten();
         let app_config = load_cli_config_file(paths.app_config_path.as_path())?;
         let account_secret_backend = resolve_account_secret_backend(
             env,
             env_file,
             app_config.as_ref(),
             workspace_config.as_ref(),
         )?
         .unwrap_or(RadrootsSecretBackend::HostVault(
             RadrootsHostVaultPolicy::desktop(),
         ));
         let account_secret_fallback = resolve_account_secret_fallback(
             env,
             env_file,
             app_config.as_ref(),
             workspace_config.as_ref(),
         )?
         .unwrap_or(match account_secret_backend {
             RadrootsSecretBackend::HostVault(_) => Some(RadrootsSecretBackend::EncryptedFile),
             _ => None,
         });
         let output = OutputConfig {
             format: resolve_output_format(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
             verbosity: resolve_verbosity(args)?,
             color: !args.no_color,
             dry_run: args.dry_run,
         };
         let logging = LoggingConfig {
             filter: resolve_logging_filter(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             ),
             directory: resolve_logging_directory(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
                 paths.app_logs_root.as_path(),
             ),
             stdout: resolve_logging_stdout(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
         };
         validate_logging_output_contract(&output, &logging)?;
         Ok(Self {
             capability_bindings: resolve_capability_bindings(
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
             output,
             interaction: resolve_interaction_config(args, env),
             paths: paths.clone(),
             migration,
             logging,
             account: AccountConfig {
                 selector: args
                     .account
                     .clone()
                     .or_else(|| env_value(env, env_file, &[ENV_CLI_ACCOUNT_SELECTOR]))
                     .or_else(|| {
                         app_config
                             .as_ref()
                             .and_then(|config| config.account.as_ref())
                             .and_then(|account| account.selector.clone())
                     })
                     .or_else(|| {
                         workspace_config
                             .as_ref()
                             .and_then(|config| config.account.as_ref())
                             .and_then(|account| account.selector.clone())
                     }),
                 store_path: paths
                     .shared_accounts_data_root
                     .join(DEFAULT_SHARED_ACCOUNTS_STORE_FILE),
                 secrets_dir: paths.shared_accounts_secrets_root.clone(),
                 secret_backend: account_secret_backend,
                 secret_fallback: account_secret_fallback,
             },
             account_secret_contract: AccountSecretContractConfig {
                 default_backend: CLI_DEFAULT_SECRET_BACKEND.to_owned(),
                 default_fallback: Some(CLI_DEFAULT_SECRET_FALLBACK.to_owned()),
                 allowed_backends: CLI_ALLOWED_SHARED_SECRET_BACKENDS
                     .iter()
                     .map(|value| (*value).to_owned())
                     .collect(),
                 host_vault_policy: Some(CLI_HOST_VAULT_POLICY.to_owned()),
                 uses_protected_store: CLI_USES_PROTECTED_STORE,
             },
             identity: IdentityConfig {
                 path: args
                     .identity_path
                     .clone()
                     .or_else(|| {
                         env_value(env, env_file, &[ENV_CLI_IDENTITY_PATH]).map(PathBuf::from)
                     })
                     .or_else(|| {
                         app_config
                             .as_ref()
                             .and_then(|config| config.identity.as_ref())
                             .and_then(|identity| identity.path.clone())
                     })
                     .or_else(|| {
                         workspace_config
                             .as_ref()
                             .and_then(|config| config.identity.as_ref())
                             .and_then(|identity| identity.path.clone())
                     })
                     .unwrap_or_else(|| paths.default_identity_path.clone()),
             },
             signer: resolve_signer_config(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
             publish: resolve_publish_config(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
             relay: resolve_relay_config(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
             local: LocalConfig {
                 root: paths.app_data_root.join(DEFAULT_LOCAL_STATE_DIR),
                 replica_db_path: paths
                     .app_data_root
                     .join(DEFAULT_LOCAL_STATE_DIR)
                     .join(DEFAULT_LOCAL_DB_FILE),
                 backups_dir: paths
                     .app_data_root
                     .join(DEFAULT_LOCAL_STATE_DIR)
                     .join(DEFAULT_LOCAL_BACKUPS_DIR),
                 exports_dir: paths
                     .app_data_root
                     .join(DEFAULT_LOCAL_STATE_DIR)
                     .join(DEFAULT_LOCAL_EXPORTS_DIR),
             },
             myc: resolve_myc_config(
                 args,
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
             hyf: HyfConfig {
                 enabled: resolve_hyf_enabled(
                     args,
                     env,
                     env_file,
                     app_config.as_ref(),
                     workspace_config.as_ref(),
                 )?,
                 executable: resolve_hyf_executable(
                     args,
                     env,
                     env_file,
                     app_config.as_ref(),
                     workspace_config.as_ref(),
                 ),
             },
             rpc: resolve_rpc_config(
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
             rhi: resolve_rhi_config(
                 env,
                 env_file,
                 app_config.as_ref(),
                 workspace_config.as_ref(),
             )?,
         })
     }
 
     #[cfg(test)]
     pub fn inspect_capability_bindings(&self) -> Vec<CapabilityBindingInspection> {
         CAPABILITY_BINDING_SPECS
             .iter()
             .map(|spec| {
                 if let Some(binding) = self
                     .capability_bindings
                     .iter()
                     .find(|binding| binding.capability_id == spec.capability_id)
                 {
                     return CapabilityBindingInspection {
                         capability_id: binding.capability_id.clone(),
                         provider_runtime_id: binding.provider_runtime_id.clone(),
                         binding_model: binding.binding_model.clone(),
                         state: CapabilityBindingInspectionState::Configured,
                         source: binding.source.as_str().to_owned(),
                         target_kind: Some(binding.target_kind.as_str().to_owned()),
                         target: Some(binding.target.clone()),
                         managed_account_ref: binding.managed_account_ref.clone(),
                         signer_session_ref: binding.signer_session_ref.clone(),
                     };
                 }
 
                 let (state, source) = match spec.capability_id {
                     SIGNER_REMOTE_NIP46_CAPABILITY
                         if matches!(self.signer.backend, SignerBackend::Local) =>
                     {
                         (
                             CapabilityBindingInspectionState::Disabled,
                             "independent local signer mode".to_owned(),
                         )
                     }
                     INFERENCE_HYF_STDIO_CAPABILITY if !self.hyf.enabled => (
                         CapabilityBindingInspectionState::Disabled,
                         "hyf disabled by config".to_owned(),
                     ),
                     _ => (
                         CapabilityBindingInspectionState::NotConfigured,
                         "no explicit capability binding".to_owned(),
                     ),
                 };
 
                 CapabilityBindingInspection {
                     capability_id: spec.capability_id.to_owned(),
                     provider_runtime_id: spec.provider_runtime_id.to_owned(),
                     binding_model: spec.binding_model.to_owned(),
                     state,
                     source,
                     target_kind: None,
                     target: None,
                     managed_account_ref: None,
                     signer_session_ref: None,
                 }
             })
             .collect()
     }
 
     pub fn capability_binding(&self, capability_id: &str) -> Option<&CapabilityBindingConfig> {
         self.capability_bindings
             .iter()
             .find(|binding| binding.capability_id == capability_id)
     }
 }
 
 fn resolve_migration(paths: PathsConfig, env: &dyn Environment) -> MigrationConfig {
     MigrationConfig {
         report: inspect_legacy_paths(legacy_path_candidates(&paths, env)),
     }
 }
 
 fn legacy_path_candidates(
     paths: &PathsConfig,
     env: &dyn Environment,
 ) -> Vec<RadrootsLegacyPathCandidate> {
     let Some(home_dir) = env.var("HOME").map(PathBuf::from) else {
         return Vec::new();
     };
     let old_user_config = home_dir.join(".config/radroots/config.toml");
     let old_user_state_root = home_dir.join(".local/share/radroots");
 
     vec![
         RadrootsLegacyPathCandidate::new(
             "cli_user_config_v0",
             "legacy cli user config",
             old_user_config,
             Some(paths.app_config_path.clone()),
             "merge this config into the canonical app config path; the cli will not copy it on startup",
         ),
         RadrootsLegacyPathCandidate::new(
             "cli_user_state_root_v0",
             "legacy cli user state root",
             old_user_state_root,
             Some(paths.app_data_root.clone()),
             "export/import the old local state into the canonical app and shared namespaces; the cli will not move it on startup",
         ),
     ]
 }
 
 fn load_cli_config_file(path: &Path) -> Result<Option<CliConfigFile>, RuntimeError> {
     if !path.exists() {
         return Ok(None);
     }
 
     let raw = fs::read_to_string(path).map_err(|err| {
         RuntimeError::Config(format!(
             "failed to read config file {}: {err}",
             path.display()
         ))
     })?;
 
     if raw.trim().is_empty() {
         return Ok(Some(CliConfigFile::default()));
     }
 
     toml::from_str::<CliConfigFile>(&raw)
         .map(Some)
         .map_err(|err| {
             RuntimeError::Config(format!(
                 "failed to parse config file {}: {err}",
                 path.display()
             ))
         })
 }
 
 fn resolve_rpc_config(
     _env: &dyn Environment,
     _env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<RpcConfig, RuntimeError> {
     let url = user_config
         .and_then(|config| config.rpc.as_ref())
         .and_then(|rpc| rpc.url.clone())
         .or_else(|| {
             workspace_config
                 .and_then(|config| config.rpc.as_ref())
                 .and_then(|rpc| rpc.url.clone())
         })
         .unwrap_or_else(|| DEFAULT_RPC_URL.to_owned());
 
     Ok(RpcConfig {
         url: validate_rpc_url(url.as_str())?,
     })
 }
 
 fn resolve_radrootsd_proxy_config(
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<RadrootsdProxyConfig, RuntimeError> {
     let user_proxy = user_config
         .and_then(|config| config.publish.as_ref())
         .and_then(|publish| publish.radrootsd_proxy.as_ref());
     let workspace_proxy = workspace_config
         .and_then(|config| config.publish.as_ref())
         .and_then(|publish| publish.radrootsd_proxy.as_ref());
     let url = env_value(env, env_file, &[ENV_CLI_RADROOTSD_PROXY_URL])
         .or_else(|| user_proxy.and_then(|proxy| proxy.url.clone()))
         .or_else(|| workspace_proxy.and_then(|proxy| proxy.url.clone()))
         .unwrap_or_else(|| DEFAULT_RPC_URL.to_owned());
     let token_file = env_value(env, env_file, &[ENV_CLI_RADROOTSD_PROXY_TOKEN_FILE])
         .map(PathBuf::from)
         .or_else(|| user_proxy.and_then(|proxy| proxy.token_file.clone()))
         .or_else(|| workspace_proxy.and_then(|proxy| proxy.token_file.clone()));
     let token_secret_id = env_value(env, env_file, &[ENV_CLI_RADROOTSD_PROXY_TOKEN_SECRET_ID])
         .or_else(|| user_proxy.and_then(|proxy| proxy.token_secret_id.clone()))
         .or_else(|| workspace_proxy.and_then(|proxy| proxy.token_secret_id.clone()));
 
     Ok(RadrootsdProxyConfig {
         url: validate_rpc_url(url.as_str())?,
         token_file,
         token_secret_id,
     })
 }
 
 fn resolve_rhi_config(
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<RhiConfig, RuntimeError> {
     let trusted_worker_pubkeys =
         if let Some(value) = env_value(env, env_file, &[ENV_CLI_RHI_TRUSTED_WORKER_PUBKEYS]) {
             parse_pubkey_env_value(value.as_str(), ENV_CLI_RHI_TRUSTED_WORKER_PUBKEYS)?
         } else if let Some(values) = user_config
             .and_then(|config| config.rhi.as_ref())
             .and_then(|rhi| rhi.trusted_worker_pubkeys.clone())
         {
             normalize_pubkeys(values, "user config [rhi].trusted_worker_pubkeys")?
         } else if let Some(values) = workspace_config
             .and_then(|config| config.rhi.as_ref())
             .and_then(|rhi| rhi.trusted_worker_pubkeys.clone())
         {
             normalize_pubkeys(values, "workspace config [rhi].trusted_worker_pubkeys")?
         } else {
             Vec::new()
         };
 
     Ok(RhiConfig {
         trusted_worker_pubkeys,
     })
 }
 
 fn parse_pubkey_env_value(value: &str, key: &str) -> Result<Vec<String>, RuntimeError> {
     let entries = value
         .split(',')
         .map(str::trim)
         .filter(|entry| !entry.is_empty())
         .map(ToOwned::to_owned)
         .collect::<Vec<_>>();
     normalize_pubkeys(entries, key)
 }
 
 fn normalize_pubkeys(values: Vec<String>, source: &str) -> Result<Vec<String>, RuntimeError> {
     let mut normalized = Vec::new();
     for value in values {
         let pubkey = validate_pubkey(value.as_str(), source)?;
         if !normalized.iter().any(|existing| existing == &pubkey) {
             normalized.push(pubkey);
         }
     }
     Ok(normalized)
 }
 
 fn validate_pubkey(value: &str, source: &str) -> Result<String, RuntimeError> {
     let trimmed = value.trim();
     if trimmed.len() != 64 || !trimmed.chars().all(|char| char.is_ascii_hexdigit()) {
         return Err(RuntimeError::Config(format!(
             "{source} must contain 64-character hex Nostr public keys"
         )));
     }
     Ok(trimmed.to_ascii_lowercase())
 }
 
 fn resolve_capability_bindings(
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<Vec<CapabilityBindingConfig>, RuntimeError> {
     let workspace = resolve_file_capability_bindings(
         workspace_config.and_then(|config| config.capability_binding.as_deref()),
         CapabilityBindingSource::WorkspaceConfig,
     )?;
     let user = resolve_file_capability_bindings(
         user_config.and_then(|config| config.capability_binding.as_deref()),
         CapabilityBindingSource::UserConfig,
     )?;
 
     let mut merged = BTreeMap::new();
     for binding in workspace.into_iter().chain(user) {
         merged.insert(binding.capability_id.clone(), binding);
     }
 
     Ok(CAPABILITY_BINDING_SPECS
         .iter()
         .filter_map(|spec| merged.remove(spec.capability_id))
         .collect())
 }
 
 fn resolve_file_capability_bindings(
     bindings: Option<&[CapabilityBindingFileConfig]>,
     source: CapabilityBindingSource,
 ) -> Result<Vec<CapabilityBindingConfig>, RuntimeError> {
     let Some(bindings) = bindings else {
         return Ok(Vec::new());
     };
 
     let mut seen = BTreeMap::new();
     let mut resolved = Vec::with_capacity(bindings.len());
 
     for binding in bindings {
         let capability = binding.capability.trim();
         let provider = binding.provider.trim();
         let Some(spec) = capability_binding_spec(capability) else {
             return Err(RuntimeError::Config(format!(
                 "unknown capability_binding capability `{capability}`"
             )));
         };
         if provider != spec.provider_runtime_id {
             return Err(RuntimeError::Config(format!(
                 "capability_binding `{capability}` must use provider `{}`, got `{provider}`",
                 spec.provider_runtime_id
             )));
         }
         if seen.insert(spec.capability_id.to_owned(), ()).is_some() {
             return Err(RuntimeError::Config(format!(
                 "capability_binding `{capability}` is duplicated in one config file"
             )));
         }
 
         let target = binding.target.trim();
         if target.is_empty() {
             return Err(RuntimeError::Config(format!(
                 "capability_binding `{capability}` target must not be empty"
             )));
         }
 
         let managed_account_ref = normalize_binding_ref(
             binding
                 .managed_account_ref
                 .as_deref()
                 .map(str::trim)
                 .filter(|value| !value.is_empty()),
         );
         let signer_session_ref = normalize_binding_ref(
             binding
                 .signer_session_ref
                 .as_deref()
                 .map(str::trim)
                 .filter(|value| !value.is_empty()),
         );
         if spec.capability_id != SIGNER_REMOTE_NIP46_CAPABILITY
             && (managed_account_ref.is_some() || signer_session_ref.is_some())
         {
             return Err(RuntimeError::Config(format!(
                 "capability_binding `{capability}` may not set managed_account_ref or signer_session_ref"
             )));
         }
 
         resolved.push(CapabilityBindingConfig {
             capability_id: spec.capability_id.to_owned(),
             provider_runtime_id: spec.provider_runtime_id.to_owned(),
             binding_model: spec.binding_model.to_owned(),
             target_kind: parse_capability_binding_target_kind(
                 binding.target_kind.as_str(),
                 spec.capability_id,
             )?,
             target: target.to_owned(),
             managed_account_ref,
             signer_session_ref,
             source,
         });
     }
 
     Ok(resolved)
 }
 
 fn capability_binding_spec(capability_id: &str) -> Option<CapabilityBindingSpec> {
     CAPABILITY_BINDING_SPECS
         .iter()
         .copied()
         .find(|spec| spec.capability_id == capability_id)
 }
 
 fn parse_capability_binding_target_kind(
     value: &str,
     capability_id: &str,
 ) -> Result<CapabilityBindingTargetKind, RuntimeError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "managed_instance" => Ok(CapabilityBindingTargetKind::ManagedInstance),
         "explicit_endpoint" => Ok(CapabilityBindingTargetKind::ExplicitEndpoint),
         other => Err(RuntimeError::Config(format!(
             "capability_binding `{capability_id}` target_kind must be `managed_instance` or `explicit_endpoint`, got `{other}`"
         ))),
     }
 }
 
 fn normalize_binding_ref(value: Option<&str>) -> Option<String> {
     value.map(ToOwned::to_owned)
 }
 
 fn resolve_relay_config(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<RelayConfig, RuntimeError> {
     let publish_policy = resolve_relay_publish_policy(user_config, workspace_config)?
         .unwrap_or(RelayPublishPolicy::Any);
 
     if !args.relay.is_empty() {
         return Ok(RelayConfig {
             urls: normalize_relay_urls(args.relay.clone(), "--relay")?,
             publish_policy,
             source: RelayConfigSource::Flags,
         });
     }
 
     if let Some(value) = env_value(env, env_file, &[ENV_CLI_RELAYS_URLS]) {
         return Ok(RelayConfig {
             urls: parse_relay_env_value(value.as_str(), ENV_CLI_RELAYS_URLS)?,
             publish_policy,
             source: RelayConfigSource::Environment,
         });
     }
 
     if let Some(relay) = user_config.and_then(|config| config.relays.as_ref()) {
         if let Some(urls) = relay.urls.clone() {
             return Ok(RelayConfig {
                 urls: normalize_relay_urls(urls, "user config [relays].urls")?,
                 publish_policy,
                 source: RelayConfigSource::UserConfig,
             });
         }
     }
 
     if let Some(relay) = workspace_config.and_then(|config| config.relays.as_ref()) {
         if let Some(urls) = relay.urls.clone() {
             return Ok(RelayConfig {
                 urls: normalize_relay_urls(urls, "workspace config [relays].urls")?,
                 publish_policy,
                 source: RelayConfigSource::WorkspaceConfig,
             });
         }
     }
 
     Ok(RelayConfig {
         urls: Vec::new(),
         publish_policy,
         source: RelayConfigSource::Defaults,
     })
 }
 
 fn resolve_signer_config(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<SignerConfig, RuntimeError> {
     let backend = if let Some(value) = args.signer.clone() {
         parse_signer_mode("internal invocation signer mode", value)?
     } else if let Some((key, value)) = env_value_entry(env, env_file, &[ENV_CLI_SIGNER_BACKEND]) {
         parse_signer_mode(key.as_str(), value)?
     } else if let Some(value) = user_config
         .and_then(|config| config.signer.as_ref())
         .and_then(|signer| signer.backend.clone())
     {
         parse_signer_mode("user config [signer].backend", value)?
     } else if let Some(value) = workspace_config
         .and_then(|config| config.signer.as_ref())
         .and_then(|signer| signer.backend.clone())
     {
         parse_signer_mode("workspace config [signer].backend", value)?
     } else {
         SignerBackend::Local
     };
 
     Ok(SignerConfig { backend })
 }
 
 fn resolve_publish_config(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<PublishConfig, RuntimeError> {
     let radrootsd_proxy =
         resolve_radrootsd_proxy_config(env, env_file, user_config, workspace_config)?;
     if let Some(value) = args.publish_transport.clone() {
         return Ok(PublishConfig {
             transport: parse_publish_transport("--publish-transport", value)?,
             source: PublishTransportSource::Flags,
             radrootsd_proxy,
         });
     }
 
     if let Some((key, value)) = env_value_entry(env, env_file, &[ENV_CLI_PUBLISH_TRANSPORT]) {
         return Ok(PublishConfig {
             transport: parse_publish_transport(key.as_str(), value)?,
             source: PublishTransportSource::Environment,
             radrootsd_proxy,
         });
     }
 
     if let Some(value) = user_config
         .and_then(|config| config.publish.as_ref())
         .and_then(|publish| publish.transport.clone())
     {
         return Ok(PublishConfig {
             transport: parse_publish_transport("user config [publish].transport", value)?,
             source: PublishTransportSource::UserConfig,
             radrootsd_proxy,
         });
     }
 
     if let Some(value) = workspace_config
         .and_then(|config| config.publish.as_ref())
         .and_then(|publish| publish.transport.clone())
     {
         return Ok(PublishConfig {
             transport: parse_publish_transport("workspace config [publish].transport", value)?,
             source: PublishTransportSource::WorkspaceConfig,
             radrootsd_proxy,
         });
     }
 
     Ok(PublishConfig {
         transport: PublishTransport::DirectNostrRelay,
         source: PublishTransportSource::Defaults,
         radrootsd_proxy,
     })
 }
 
 fn resolve_myc_config(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<MycConfig, RuntimeError> {
     let executable = args
         .myc_executable
         .clone()
         .or_else(|| env_value(env, env_file, &[ENV_CLI_MYC_EXECUTABLE]).map(PathBuf::from))
         .or_else(|| {
             user_config
                 .and_then(|config| config.myc.as_ref())
                 .and_then(|myc| myc.executable.clone())
         })
         .or_else(|| {
             workspace_config
                 .and_then(|config| config.myc.as_ref())
                 .and_then(|myc| myc.executable.clone())
         })
         .unwrap_or_else(|| PathBuf::from("myc"));
 
     Ok(MycConfig {
         executable,
         status_timeout_ms: resolve_myc_status_timeout_ms(
             args,
             env,
             env_file,
             user_config,
             workspace_config,
         )?,
     })
 }
 
 fn resolve_myc_status_timeout_ms(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<u64, RuntimeError> {
     if let Some(value) = args.myc_status_timeout_ms {
         return validate_myc_status_timeout_ms("--myc-status-timeout-ms", value);
     }
 
     if let Some((key, value)) = env_value_entry(env, env_file, &[ENV_CLI_MYC_STATUS_TIMEOUT_MS]) {
         let parsed = parse_u64_value(key.as_str(), value.as_str())
             .map_err(|err| RuntimeError::Config(err.to_string()))?;
         return validate_myc_status_timeout_ms(key.as_str(), parsed);
     }
 
     if let Some(value) = user_config
         .and_then(|config| config.myc.as_ref())
         .and_then(|myc| myc.status_timeout_ms)
     {
         return validate_myc_status_timeout_ms("user config [myc].status_timeout_ms", value);
     }
 
     if let Some(value) = workspace_config
         .and_then(|config| config.myc.as_ref())
         .and_then(|myc| myc.status_timeout_ms)
     {
         return validate_myc_status_timeout_ms("workspace config [myc].status_timeout_ms", value);
     }
 
     Ok(DEFAULT_MYC_STATUS_TIMEOUT_MS)
 }
 
 fn validate_myc_status_timeout_ms(source: &str, value: u64) -> Result<u64, RuntimeError> {
     if value == 0 {
         return Err(RuntimeError::Config(format!(
             "{source} must be greater than zero"
         )));
     }
     Ok(value)
 }
 
 fn resolve_hyf_enabled(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<bool, RuntimeError> {
     match (args.hyf_enabled, args.no_hyf_enabled) {
         (true, true) => {
             return Err(RuntimeError::Config(
                 "flags --hyf-enabled and --no-hyf-enabled cannot be used together".to_owned(),
             ));
         }
         (true, false) => return Ok(true),
         (false, true) => return Ok(false),
         (false, false) => {}
     }
 
     if let Some((key, value)) = env_value_entry(env, env_file, &[ENV_CLI_HYF_ENABLED]) {
         return parse_bool_env(key.as_str(), value.as_str());
     }
 
     if let Some(enabled) = user_config
         .and_then(|config| config.hyf.as_ref())
         .and_then(|hyf| hyf.enabled)
     {
         return Ok(enabled);
     }
 
     if let Some(enabled) = workspace_config
         .and_then(|config| config.hyf.as_ref())
         .and_then(|hyf| hyf.enabled)
     {
         return Ok(enabled);
     }
 
     Ok(false)
 }
 
 fn resolve_hyf_executable(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> PathBuf {
     args.hyf_executable
         .clone()
         .or_else(|| env_value(env, env_file, &[ENV_CLI_HYF_EXECUTABLE]).map(PathBuf::from))
         .or_else(|| {
             user_config
                 .and_then(|config| config.hyf.as_ref())
                 .and_then(|hyf| hyf.executable.clone())
         })
         .or_else(|| {
             workspace_config
                 .and_then(|config| config.hyf.as_ref())
                 .and_then(|hyf| hyf.executable.clone())
         })
         .unwrap_or_else(|| PathBuf::from(DEFAULT_HYF_EXECUTABLE))
 }
 
 fn resolve_relay_publish_policy(
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<Option<RelayPublishPolicy>, RuntimeError> {
     if let Some(value) = user_config
         .and_then(|config| config.relays.as_ref())
         .and_then(|relay| relay.publish_policy.as_deref())
     {
         return parse_relay_publish_policy(value).map(Some);
     }
 
     if let Some(value) = workspace_config
         .and_then(|config| config.relays.as_ref())
         .and_then(|relay| relay.publish_policy.as_deref())
     {
         return parse_relay_publish_policy(value).map(Some);
     }
 
     Ok(None)
 }
 
 fn parse_relay_publish_policy(value: &str) -> Result<RelayPublishPolicy, RuntimeError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "any" => Ok(RelayPublishPolicy::Any),
         other => Err(RuntimeError::Config(format!(
             "[relays].publish_policy must be `any`, got `{other}`"
         ))),
     }
 }
 
 fn validate_rpc_url(value: &str) -> Result<String, RuntimeError> {
     let trimmed = value.trim();
     if trimmed.is_empty() {
         return Err(RuntimeError::Config("rpc url must not be empty".to_owned()));
     }
     let parsed = Url::parse(trimmed)
         .map_err(|err| RuntimeError::Config(format!("rpc url `{trimmed}` is invalid: {err}")))?;
     if !matches!(parsed.scheme(), "http" | "https") || parsed.host_str().is_none() {
         return Err(RuntimeError::Config(format!(
             "rpc url must use http or https, got `{trimmed}`"
         )));
     }
     Ok(trimmed.to_owned())
 }
 
 fn parse_relay_env_value(value: &str, key: &str) -> Result<Vec<String>, RuntimeError> {
     let entries = value
         .split(',')
         .map(str::trim)
         .map(ToOwned::to_owned)
         .collect::<Vec<_>>();
 
     if entries.is_empty() {
         return Err(RuntimeError::Config(format!(
             "{key} must contain at least one websocket relay url"
         )));
     }
 
     normalize_relay_urls(entries, key)
 }
 
 fn normalize_relay_urls(values: Vec<String>, source: &str) -> Result<Vec<String>, RuntimeError> {
     let mut normalized = Vec::new();
     for value in values {
         let relay = validate_relay_url(value.as_str(), source)?;
         if !normalized.iter().any(|existing| existing == &relay) {
             normalized.push(relay);
         }
     }
     Ok(normalized)
 }
 
 fn validate_relay_url(value: &str, source: &str) -> Result<String, RuntimeError> {
     let trimmed = value.trim();
     if trimmed.is_empty() {
         return Err(RuntimeError::Config(format!(
             "{source} contains an empty relay url"
         )));
     }
     normalize_relay_url(trimmed).map_err(|error| match error {
         RelayUrlValidationError::UnsupportedScheme(_) => RuntimeError::Config(format!(
             "{source} must use websocket relay urls, got `{trimmed}`"
         )),
         _ => RuntimeError::Config(format!(
             "{source} contains invalid relay url `{trimmed}`: {error}"
         )),
     })
 }
 
 fn resolve_env_file_path(args: &RuntimeInvocationArgs, env: &dyn Environment) -> Option<PathBuf> {
     args.env_file
         .clone()
         .or_else(|| env.var(ENV_CLI_FILE_PATH).map(PathBuf::from))
         .or_else(|| {
             let default_path = PathBuf::from(DEFAULT_ENV_PATH);
             default_path.exists().then_some(default_path)
         })
 }
 
 fn resolve_output_format(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<OutputFormat, RuntimeError> {
     if args.output_format.is_some() && (args.json || args.ndjson) {
         return Err(RuntimeError::Config(
             "flags --output, --json, and --ndjson cannot be used together".to_owned(),
         ));
     }
 
     match (args.output_format, args.json, args.ndjson) {
         (_, true, true) => {
             return Err(RuntimeError::Config(
                 "flags --json and --ndjson cannot be used together".to_owned(),
             ));
         }
         (Some(format), false, false) => return Ok(format.as_output_format()),
         (None, true, false) => return Ok(OutputFormat::Json),
         (None, false, true) => return Ok(OutputFormat::Ndjson),
         (None, false, false) => {}
         (Some(_), true, false) | (Some(_), false, true) => unreachable!(),
     }
     if let Some(value) = env_value(env, env_file, &[ENV_CLI_OUTPUT_FORMAT]) {
         return parse_output_format(value.as_str());
     }
 
     if let Some(value) = user_config
         .and_then(|config| config.output.as_ref())
         .and_then(|output| output.format.as_deref())
     {
         return parse_output_format(value);
     }
 
     match workspace_config
         .and_then(|config| config.output.as_ref())
         .and_then(|output| output.format.as_deref())
     {
         Some(value) => parse_output_format(value),
         None => Ok(OutputFormat::Human),
     }
 }
 
 fn resolve_verbosity(args: &RuntimeInvocationArgs) -> Result<Verbosity, RuntimeError> {
     let selected = [args.quiet, args.verbose, args.trace]
         .into_iter()
         .filter(|selected| *selected)
         .count();
     if selected > 1 {
         return Err(RuntimeError::Config(
             "flags --quiet, --verbose, and --trace are mutually exclusive".to_owned(),
         ));
     }
 
     if args.quiet {
         Ok(Verbosity::Quiet)
     } else if args.trace {
         Ok(Verbosity::Trace)
     } else if args.verbose {
         Ok(Verbosity::Verbose)
     } else {
         Ok(Verbosity::Normal)
     }
 }
 
 fn resolve_interaction_config(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
 ) -> InteractionConfig {
     let stdin_tty = env.stdin_is_tty();
     let stdout_tty = env.stdout_is_tty();
     let input_enabled = !args.no_input;
     let prompts_allowed = input_enabled && stdin_tty && stdout_tty;
     let confirmations_allowed = prompts_allowed && !args.yes;
     InteractionConfig {
         input_enabled,
         assume_yes: args.yes,
         stdin_tty,
         stdout_tty,
         prompts_allowed,
         confirmations_allowed,
     }
 }
 
 fn resolve_logging_filter(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> String {
     args.log_filter
         .clone()
         .or_else(|| env_value(env, env_file, &[ENV_CLI_LOG_FILTER]))
         .or_else(|| {
             user_config
                 .and_then(|config| config.logging.as_ref())
                 .and_then(|logging| logging.filter.clone())
         })
         .or_else(|| {
             workspace_config
                 .and_then(|config| config.logging.as_ref())
                 .and_then(|logging| logging.filter.clone())
         })
         .unwrap_or_else(|| DEFAULT_LOG_FILTER.to_owned())
 }
 
 fn resolve_logging_directory(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
     default_logs_root: &Path,
 ) -> Option<PathBuf> {
     args.log_dir
         .clone()
         .or_else(|| env_value(env, env_file, &[ENV_CLI_LOG_DIR]).map(PathBuf::from))
         .or_else(|| {
             user_config
                 .and_then(|config| config.logging.as_ref())
                 .and_then(|logging| logging.output_dir.clone())
         })
         .or_else(|| {
             workspace_config
                 .and_then(|config| config.logging.as_ref())
                 .and_then(|logging| logging.output_dir.clone())
         })
         .or_else(|| Some(default_logs_root.to_path_buf()))
 }
 
 fn resolve_logging_stdout(
     args: &RuntimeInvocationArgs,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<bool, RuntimeError> {
     resolve_bool_pair(
         args.log_stdout,
         args.no_log_stdout,
         &[ENV_CLI_LOG_STDOUT],
         user_config
             .and_then(|config| config.logging.as_ref())
             .and_then(|logging| logging.stdout),
         workspace_config
             .and_then(|config| config.logging.as_ref())
             .and_then(|logging| logging.stdout),
         false,
         env,
         env_file,
         "--log-stdout",
         "--no-log-stdout",
     )
 }
 
 fn validate_logging_output_contract(
     output: &OutputConfig,
     logging: &LoggingConfig,
 ) -> Result<(), RuntimeError> {
     if logging.stdout && matches!(output.format, OutputFormat::Json | OutputFormat::Ndjson) {
         return Err(RuntimeError::Config(format!(
             "stdout logging cannot be used with {} output; unset {ENV_CLI_LOG_STDOUT} or use --no-log-stdout",
             output.format.as_str()
         )));
     }
 
     Ok(())
 }
 
 fn resolve_bool_pair(
     positive_flag: bool,
     negative_flag: bool,
     env_keys: &[&str],
     user_value: Option<bool>,
     workspace_value: Option<bool>,
     default: bool,
     env: &dyn Environment,
     env_file: &EnvFileValues,
     positive_label: &str,
     negative_label: &str,
 ) -> Result<bool, RuntimeError> {
     match (positive_flag, negative_flag) {
         (true, true) => Err(RuntimeError::Config(format!(
             "flags {positive_label} and {negative_label} cannot be used together"
         ))),
         (true, false) => Ok(true),
         (false, true) => Ok(false),
         (false, false) => match env_value_entry(env, env_file, env_keys) {
             Some((key, value)) => parse_bool_env(key.as_str(), value.as_str()),
             None => Ok(user_value.or(workspace_value).unwrap_or(default)),
         },
     }
 }
 
 fn env_value(env: &dyn Environment, env_file: &EnvFileValues, keys: &[&str]) -> Option<String> {
     env_value_entry(env, env_file, keys).map(|(_, value)| value)
 }
 
 fn env_value_entry(
     env: &dyn Environment,
     env_file: &EnvFileValues,
     keys: &[&str],
 ) -> Option<(String, String)> {
     keys.iter()
         .find_map(|key| env.var(key).map(|value| ((*key).to_owned(), value)))
         .or_else(|| {
             keys.iter().find_map(|key| {
                 env_file
                     .0
                     .get(*key)
                     .cloned()
                     .map(|value| ((*key).to_owned(), value))
             })
         })
 }
 
 fn load_env_file_values(path: Option<&Path>) -> Result<EnvFileValues, RuntimeError> {
     let Some(path) = path else {
         return Ok(EnvFileValues::default());
     };
     let raw = fs::read_to_string(path).map_err(|err| {
         RuntimeError::Config(format!("failed to read env file {}: {err}", path.display()))
     })?;
     parse_env_file_values(&raw, path)
 }
 
 fn parse_env_file_values(raw: &str, path: &Path) -> Result<EnvFileValues, RuntimeError> {
     parse_strict_env_file(raw, path, SUPPORTED_ENV_FILE_KEYS)
         .map(|values| EnvFileValues(values.into_inner()))
         .map_err(|err| RuntimeError::Config(err.to_string()))
 }
 
 fn parse_output_format(value: &str) -> Result<OutputFormat, RuntimeError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "human" => Ok(OutputFormat::Human),
         "json" => Ok(OutputFormat::Json),
         "ndjson" => Ok(OutputFormat::Ndjson),
         other => Err(RuntimeError::Config(format!(
             "{ENV_CLI_OUTPUT_FORMAT} must be `human`, `json`, or `ndjson`, got `{other}`"
         ))),
     }
 }
 
 fn parse_signer_mode(source: &str, value: String) -> Result<SignerBackend, RuntimeError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "local" => Ok(SignerBackend::Local),
         "myc" => Ok(SignerBackend::Myc),
         other => Err(RuntimeError::Config(format!(
             "{source} must be `local` or `myc`, got `{other}`"
         ))),
     }
 }
 
 fn parse_publish_transport(source: &str, value: String) -> Result<PublishTransport, RuntimeError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "direct_nostr_relay" => Ok(PublishTransport::DirectNostrRelay),
         "radrootsd_proxy" => Ok(PublishTransport::RadrootsdProxy),
         other => Err(RuntimeError::Config(format!(
             "{source} must be `{}` or `{}`, got `{other}`",
             PublishTransport::DirectNostrRelay.as_str(),
             PublishTransport::RadrootsdProxy.as_str()
         ))),
     }
 }
 
 fn resolve_account_secret_backend(
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<Option<RadrootsSecretBackend>, RuntimeError> {
     if let Some((key, value)) = env_value_entry(env, env_file, &[ENV_CLI_ACCOUNT_SECRET_BACKEND]) {
         return parse_account_secret_backend(key.as_str(), value.as_str()).map(Some);
     }
 
     if let Some(value) = user_config
         .and_then(|config| config.account.as_ref())
         .and_then(|account| account.secret.as_ref())
         .and_then(|secret| secret.backend.as_deref())
     {
         return parse_account_secret_backend("user config [account.secret].backend", value)
             .map(Some);
     }
 
     workspace_config
         .and_then(|config| config.account.as_ref())
         .and_then(|account| account.secret.as_ref())
         .and_then(|secret| secret.backend.as_deref())
         .map(|value| {
             parse_account_secret_backend("workspace config [account.secret].backend", value)
         })
         .transpose()
 }
 
 fn resolve_account_secret_fallback(
     env: &dyn Environment,
     env_file: &EnvFileValues,
     user_config: Option<&CliConfigFile>,
     workspace_config: Option<&CliConfigFile>,
 ) -> Result<Option<Option<RadrootsSecretBackend>>, RuntimeError> {
     if let Some((key, value)) = env_value_entry(env, env_file, &[ENV_CLI_ACCOUNT_SECRET_FALLBACK]) {
         return parse_account_secret_fallback(key.as_str(), value.as_str()).map(Some);
     }
 
     if let Some(value) = user_config
         .and_then(|config| config.account.as_ref())
         .and_then(|account| account.secret.as_ref())
         .and_then(|secret| secret.fallback.as_deref())
     {
         return parse_account_secret_fallback("user config [account.secret].fallback", value)
             .map(Some);
     }
 
     workspace_config
         .and_then(|config| config.account.as_ref())
         .and_then(|account| account.secret.as_ref())
         .and_then(|secret| secret.fallback.as_deref())
         .map(|value| {
             parse_account_secret_fallback("workspace config [account.secret].fallback", value)
         })
         .transpose()
 }
 
 fn parse_account_secret_fallback(
     key: &str,
     value: &str,
 ) -> Result<Option<RadrootsSecretBackend>, RuntimeError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "none" => Ok(None),
         "host_vault" => Ok(Some(RadrootsSecretBackend::HostVault(
             RadrootsHostVaultPolicy::desktop(),
         ))),
         "encrypted_file" => Ok(Some(RadrootsSecretBackend::EncryptedFile)),
         other => Err(RuntimeError::Config(format!(
             "{key} must be `host_vault`, `encrypted_file`, or `none`, got `{other}`"
         ))),
     }
 }
 
 fn parse_account_secret_backend(
     key: &str,
     value: &str,
 ) -> Result<RadrootsSecretBackend, RuntimeError> {
     match value.trim().to_ascii_lowercase().as_str() {
         "host_vault" => Ok(RadrootsSecretBackend::HostVault(
             RadrootsHostVaultPolicy::desktop(),
         )),
         "encrypted_file" => Ok(RadrootsSecretBackend::EncryptedFile),
         other => Err(RuntimeError::Config(format!(
             "{key} must be `host_vault` or `encrypted_file`, got `{other}`"
         ))),
     }
 }
 
 fn parse_bool_env(key: &str, value: &str) -> Result<bool, RuntimeError> {
     parse_bool_value(key, value).map_err(|err| RuntimeError::Config(err.to_string()))
 }
 
 #[cfg(test)]
 mod tests {
     use super::{
         AccountConfig, AccountSecretContractConfig, CapabilityBindingConfig,
         CapabilityBindingSource, CapabilityBindingTargetKind, DEFAULT_HYF_EXECUTABLE,
         DEFAULT_LOG_FILTER, DEFAULT_MYC_STATUS_TIMEOUT_MS, DEFAULT_RPC_URL, EnvFileValues,
         Environment, HyfConfig, INFERENCE_HYF_STDIO_CAPABILITY, InteractionConfig, OutputConfig,
         OutputFormat, PathsConfig, PublishConfig, PublishTransport, PublishTransportSource,
         RelayConfigSource, RelayPublishPolicy, RuntimeConfig, SignerBackend, Verbosity,
         parse_env_file_values,
     };
     use crate::cli::global::{RuntimeInvocationArgs, RuntimeOutputFormatArg};
     use radroots_runtime_paths::{RadrootsHostEnvironment, RadrootsPathResolver, RadrootsPlatform};
     use radroots_secret_vault::{RadrootsHostVaultPolicy, RadrootsSecretBackend};
     use std::collections::BTreeMap;
     use std::fs;
     use std::path::{Path, PathBuf};
     use tempfile::tempdir;
 
     struct MapEnvironment {
         values: BTreeMap<String, String>,
         current_dir: PathBuf,
         path_resolver: RadrootsPathResolver,
         stdin_tty: bool,
         stdout_tty: bool,
     }
 
     impl MapEnvironment {
         fn new(values: BTreeMap<String, String>) -> Self {
             Self {
                 values,
                 current_dir: PathBuf::from("/workspaces/radroots-cli"),
                 path_resolver: RadrootsPathResolver::new(
                     RadrootsPlatform::Linux,
                     RadrootsHostEnvironment {
                         home_dir: Some(PathBuf::from("/home/tester")),
                         ..RadrootsHostEnvironment::default()
                     },
                 ),
                 stdin_tty: false,
                 stdout_tty: false,
             }
         }
 
         fn with_tty(mut self, stdin_tty: bool, stdout_tty: bool) -> Self {
             self.stdin_tty = stdin_tty;
             self.stdout_tty = stdout_tty;
             self
         }
     }
 
     impl Environment for MapEnvironment {
         fn var(&self, key: &str) -> Option<String> {
             self.values.get(key).cloned()
         }
 
         fn current_dir(&self) -> Result<PathBuf, crate::runtime::RuntimeError> {
             Ok(self.current_dir.clone())
         }
 
         fn path_resolver(&self) -> RadrootsPathResolver {
             self.path_resolver.clone()
         }
 
         fn stdin_is_tty(&self) -> bool {
             self.stdin_tty
         }
 
         fn stdout_is_tty(&self) -> bool {
             self.stdout_tty
         }
     }
 
     fn repo_local_env(
         workspace_root: PathBuf,
         repo_local_root: PathBuf,
         user_home: PathBuf,
         mut values: BTreeMap<String, String>,
     ) -> MapEnvironment {
         values.insert(
             "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
             "repo_local".to_owned(),
         );
         values.insert(
             "RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned(),
             repo_local_root.display().to_string(),
         );
 
         MapEnvironment {
             values,
             current_dir: workspace_root,
             path_resolver: RadrootsPathResolver::new(
                 RadrootsPlatform::Linux,
                 RadrootsHostEnvironment {
                     home_dir: Some(user_home),
                     ..RadrootsHostEnvironment::default()
                 },
             ),
             stdin_tty: false,
             stdout_tty: false,
         }
     }
 
     fn runtime_args() -> RuntimeInvocationArgs {
         RuntimeInvocationArgs::default()
     }
 
     #[test]
     fn flags_override_environment_values() {
         let args = RuntimeInvocationArgs {
             output_format: Some(RuntimeOutputFormatArg::Human),
             verbose: true,
             dry_run: true,
             no_color: true,
             log_filter: Some("debug".to_owned()),
             log_stdout: true,
             identity_path: Some(PathBuf::from("custom-identity.json")),
             signer: Some("local".to_owned()),
             publish_transport: Some("direct_nostr_relay".to_owned()),
             relay: vec!["wss://relay.one".to_owned(), "wss://relay.two".to_owned()],
             myc_executable: Some(PathBuf::from("bin/myc-cli")),
             myc_status_timeout_ms: Some(2500),
             hyf_enabled: true,
             hyf_executable: Some(PathBuf::from("bin/hyfd-cli")),
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::from([
             ("RADROOTS_CLI_OUTPUT_FORMAT".to_owned(), "human".to_owned()),
             ("RADROOTS_CLI_LOGGING_FILTER".to_owned(), "trace".to_owned()),
             ("RADROOTS_CLI_LOGGING_STDOUT".to_owned(), "false".to_owned()),
             (
                 "RADROOTS_CLI_IDENTITY_PATH".to_owned(),
                 "env-identity.json".to_owned(),
             ),
             ("RADROOTS_CLI_SIGNER_BACKEND".to_owned(), "myc".to_owned()),
             (
                 "RADROOTS_CLI_PUBLISH_TRANSPORT".to_owned(),
                 "radrootsd_proxy".to_owned(),
             ),
             (
                 "RADROOTS_CLI_RELAYS_URLS".to_owned(),
                 "wss://relay.env".to_owned(),
             ),
             (
                 "RADROOTS_CLI_MYC_EXECUTABLE".to_owned(),
                 "env-myc".to_owned(),
             ),
             (
                 "RADROOTS_CLI_MYC_STATUS_TIMEOUT_MS".to_owned(),
                 "9000".to_owned(),
             ),
             ("RADROOTS_CLI_HYF_ENABLED".to_owned(), "false".to_owned()),
             (
                 "RADROOTS_CLI_HYF_EXECUTABLE".to_owned(),
                 "env-hyfd".to_owned(),
             ),
         ]));
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
         assert_eq!(
             resolved.output,
             OutputConfig {
                 format: OutputFormat::Human,
                 verbosity: Verbosity::Verbose,
                 color: false,
                 dry_run: true,
             }
         );
         assert_eq!(
             resolved.interaction,
             InteractionConfig {
                 input_enabled: true,
                 assume_yes: false,
                 stdin_tty: false,
                 stdout_tty: false,
                 prompts_allowed: false,
                 confirmations_allowed: false,
             }
         );
         assert_eq!(
             resolved.paths,
             PathsConfig {
                 profile: "interactive_user".to_owned(),
                 profile_source: "default".to_owned(),
                 allowed_profiles: vec!["interactive_user".to_owned(), "repo_local".to_owned(),],
                 root_source: "host_defaults".to_owned(),
                 repo_local_root: None,
                 repo_local_root_source: None,
                 subordinate_path_override_source: "runtime_config".to_owned(),
                 app_namespace: "apps/cli".to_owned(),
                 shared_accounts_namespace: "shared/accounts".to_owned(),
                 shared_identities_namespace: "shared/identities".to_owned(),
                 app_config_path: PathBuf::from(
                     "/home/tester/.radroots/config/apps/cli/config.toml"
                 ),
                 workspace_config_path: None,
                 app_data_root: PathBuf::from("/home/tester/.radroots/data/apps/cli"),
                 app_logs_root: PathBuf::from("/home/tester/.radroots/logs/apps/cli"),
                 shared_accounts_data_root: PathBuf::from(
                     "/home/tester/.radroots/data/shared/accounts"
                 ),
                 shared_accounts_secrets_root: PathBuf::from(
                     "/home/tester/.radroots/secrets/shared/accounts"
                 ),
                 default_identity_path: PathBuf::from(
                     "/home/tester/.radroots/secrets/shared/identities/default.json"
                 ),
             }
         );
         assert_eq!(resolved.logging.filter, "debug");
         assert!(resolved.logging.stdout);
         assert_eq!(
             resolved.identity.path,
             PathBuf::from("custom-identity.json")
         );
         assert_eq!(
             resolved.account,
             AccountConfig {
                 selector: None,
                 store_path: PathBuf::from("/home/tester/.radroots/data/shared/accounts/store.json"),
                 secrets_dir: PathBuf::from("/home/tester/.radroots/secrets/shared/accounts"),
                 secret_backend: RadrootsSecretBackend::HostVault(
                     RadrootsHostVaultPolicy::desktop(),
                 ),
                 secret_fallback: Some(RadrootsSecretBackend::EncryptedFile),
             }
         );
         assert_eq!(
             resolved.account_secret_contract,
             AccountSecretContractConfig {
                 default_backend: "host_vault".to_owned(),
                 default_fallback: Some("encrypted_file".to_owned()),
                 allowed_backends: vec!["host_vault".to_owned(), "encrypted_file".to_owned(),],
                 host_vault_policy: Some("desktop".to_owned()),
                 uses_protected_store: true,
             }
         );
         assert_eq!(resolved.signer.backend, SignerBackend::Local);
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::DirectNostrRelay,
                 source: PublishTransportSource::Flags,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
         assert_eq!(
             resolved.relay.urls,
             vec!["wss://relay.one".to_owned(), "wss://relay.two".to_owned()]
         );
         assert_eq!(resolved.relay.source, RelayConfigSource::Flags);
         assert_eq!(resolved.relay.publish_policy, RelayPublishPolicy::Any);
         assert_eq!(resolved.myc.executable, PathBuf::from("bin/myc-cli"));
         assert_eq!(resolved.myc.status_timeout_ms, 2500);
         assert_eq!(
             resolved.hyf,
             HyfConfig {
                 enabled: true,
                 executable: PathBuf::from("bin/hyfd-cli"),
             }
         );
     }
 
     #[test]
     fn environment_values_fill_missing_flags() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([
             ("RADROOTS_CLI_OUTPUT_FORMAT".to_owned(), "json".to_owned()),
             (
                 "RADROOTS_CLI_LOGGING_FILTER".to_owned(),
                 "debug,cli=trace".to_owned(),
             ),
             (
                 "RADROOTS_CLI_LOGGING_OUTPUT_DIR".to_owned(),
                 "logs/runtime".to_owned(),
             ),
             ("RADROOTS_CLI_LOGGING_STDOUT".to_owned(), "false".to_owned()),
             (
                 "RADROOTS_CLI_ACCOUNT_SELECTOR".to_owned(),
                 "acct_demo".to_owned(),
             ),
             (
                 "RADROOTS_CLI_IDENTITY_PATH".to_owned(),
                 "state/identity.json".to_owned(),
             ),
             ("RADROOTS_CLI_SIGNER_BACKEND".to_owned(), "myc".to_owned()),
             (
                 "RADROOTS_CLI_PUBLISH_TRANSPORT".to_owned(),
                 "radrootsd_proxy".to_owned(),
             ),
             (
                 "RADROOTS_CLI_RELAYS_URLS".to_owned(),
                 "wss://relay.one,wss://relay.two".to_owned(),
             ),
             (
                 "RADROOTS_CLI_MYC_EXECUTABLE".to_owned(),
                 "bin/myc".to_owned(),
             ),
             (
                 "RADROOTS_CLI_MYC_STATUS_TIMEOUT_MS".to_owned(),
                 "3500".to_owned(),
             ),
             ("RADROOTS_CLI_HYF_ENABLED".to_owned(), "true".to_owned()),
             (
                 "RADROOTS_CLI_HYF_EXECUTABLE".to_owned(),
                 "bin/hyfd".to_owned(),
             ),
         ]));
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
         assert_eq!(
             resolved.output,
             OutputConfig {
                 format: OutputFormat::Json,
                 verbosity: Verbosity::Normal,
                 color: true,
                 dry_run: false,
             }
         );
         assert_eq!(
             resolved.interaction,
             InteractionConfig {
                 input_enabled: true,
                 assume_yes: false,
                 stdin_tty: false,
                 stdout_tty: false,
                 prompts_allowed: false,
                 confirmations_allowed: false,
             }
         );
         assert_eq!(resolved.logging.filter, "debug,cli=trace");
         assert_eq!(
             resolved.logging.directory,
             Some(PathBuf::from("logs/runtime"))
         );
         assert!(!resolved.logging.stdout);
         assert_eq!(resolved.account.selector.as_deref(), Some("acct_demo"));
         assert_eq!(
             resolved.account.secret_backend,
             RadrootsSecretBackend::HostVault(RadrootsHostVaultPolicy::desktop())
         );
         assert_eq!(
             resolved.account.secret_fallback,
             Some(RadrootsSecretBackend::EncryptedFile)
         );
         assert_eq!(resolved.identity.path, PathBuf::from("state/identity.json"));
         assert_eq!(resolved.signer.backend, SignerBackend::Myc);
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::RadrootsdProxy,
                 source: PublishTransportSource::Environment,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
         assert_eq!(
             resolved.relay.urls,
             vec!["wss://relay.one".to_owned(), "wss://relay.two".to_owned()]
         );
         assert_eq!(resolved.relay.source, RelayConfigSource::Environment);
         assert_eq!(resolved.myc.executable, PathBuf::from("bin/myc"));
         assert_eq!(resolved.myc.status_timeout_ms, 3500);
         assert_eq!(
             resolved.hyf,
             HyfConfig {
                 enabled: true,
                 executable: PathBuf::from("bin/hyfd"),
             }
         );
     }
 
     #[test]
     fn old_process_environment_names_have_no_effect() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([
             ("RADROOTS_OUTPUT".to_owned(), "json".to_owned()),
             ("RADROOTS_LOG_FILTER".to_owned(), "trace".to_owned()),
             ("RADROOTS_LOG_DIR".to_owned(), "logs/old".to_owned()),
             ("RADROOTS_LOG_STDOUT".to_owned(), "true".to_owned()),
             ("RADROOTS_ACCOUNT".to_owned(), "old_account".to_owned()),
             (
                 "RADROOTS_ACCOUNT_SECRET_BACKEND".to_owned(),
                 "encrypted_file".to_owned(),
             ),
             (
                 "RADROOTS_ACCOUNT_SECRET_FALLBACK".to_owned(),
                 "none".to_owned(),
             ),
             (
                 "RADROOTS_IDENTITY_PATH".to_owned(),
                 "old-identity.json".to_owned(),
             ),
             ("RADROOTS_SIGNER".to_owned(), "myc".to_owned()),
             ("RADROOTS_PUBLISH_MODE".to_owned(), "radrootsd".to_owned()),
             (
                 "RADROOTS_RELAYS".to_owned(),
                 "wss://old-relay.example".to_owned(),
             ),
             ("RADROOTS_MYC_EXECUTABLE".to_owned(), "old-myc".to_owned()),
             (
                 "RADROOTS_MYC_STATUS_TIMEOUT_MS".to_owned(),
                 "9999".to_owned(),
             ),
             ("RADROOTS_HYF_ENABLED".to_owned(), "true".to_owned()),
             ("RADROOTS_HYF_EXECUTABLE".to_owned(), "old-hyfd".to_owned()),
             (
                 "RADROOTS_RPC_URL".to_owned(),
                 "http://127.0.0.1:9".to_owned(),
             ),
             (
                 "RADROOTS_RPC_BEARER_TOKEN".to_owned(),
                 "old-token".to_owned(),
             ),
             (
                 "RADROOTS_TRUSTED_RHI_WORKER_PUBKEYS".to_owned(),
                 "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef".to_owned(),
             ),
         ]));
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
 
         assert_eq!(resolved.output.format, OutputFormat::Human);
         assert_eq!(resolved.logging.filter, DEFAULT_LOG_FILTER);
         assert!(!resolved.logging.stdout);
         assert_eq!(resolved.account.selector, None);
         assert_eq!(
             resolved.account.secret_backend,
             RadrootsSecretBackend::HostVault(RadrootsHostVaultPolicy::desktop())
         );
         assert_eq!(
             resolved.account.secret_fallback,
             Some(RadrootsSecretBackend::EncryptedFile)
         );
         assert_eq!(resolved.signer.backend, SignerBackend::Local);
         assert_eq!(
             resolved.publish.transport,
             PublishTransport::DirectNostrRelay
         );
         assert_eq!(resolved.relay.urls, Vec::<String>::new());
         assert_eq!(resolved.myc.executable, PathBuf::from("myc"));
         assert_eq!(
             resolved.myc.status_timeout_ms,
             DEFAULT_MYC_STATUS_TIMEOUT_MS
         );
         assert!(!resolved.hyf.enabled);
         assert_eq!(
             resolved.hyf.executable,
             PathBuf::from(DEFAULT_HYF_EXECUTABLE)
         );
         assert_eq!(resolved.rpc.url, DEFAULT_RPC_URL);
         assert_eq!(resolved.rhi.trusted_worker_pubkeys, Vec::<String>::new());
     }
 
     #[test]
     fn toml_output_logging_account_and_identity_config_resolve() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             app_config_dir.join("config.toml"),
             r#"
 [output]
 format = "json"
 
 [logging]
 filter = "debug,cli=trace"
 output_dir = "logs/from-toml"
 stdout = false
 
 [account]
 selector = "acct_from_toml"
 
 [account.secret]
 backend = "encrypted_file"
 fallback = "none"
 
 [identity]
 path = "identity/from-toml.json"
 "#,
         )
         .expect("write user config");
 
         let env = repo_local_env(workspace_root, repo_local_root, user_home, BTreeMap::new());
         let resolved =
             RuntimeConfig::resolve_with_env_file(&runtime_args(), &env, &EnvFileValues::default())
                 .expect("resolve toml config");
 
         assert_eq!(resolved.output.format, OutputFormat::Json);
         assert_eq!(resolved.logging.filter, "debug,cli=trace");
         assert_eq!(
             resolved.logging.directory,
             Some(PathBuf::from("logs/from-toml"))
         );
         assert!(!resolved.logging.stdout);
         assert_eq!(resolved.account.selector.as_deref(), Some("acct_from_toml"));
         assert_eq!(
             resolved.account.secret_backend,
             RadrootsSecretBackend::EncryptedFile
         );
         assert_eq!(resolved.account.secret_fallback, None);
         assert_eq!(
             resolved.identity.path,
             PathBuf::from("identity/from-toml.json")
         );
     }
 
     #[test]
     fn conflicting_boolean_flags_fail() {
         let args = RuntimeInvocationArgs {
             log_stdout: true,
             no_log_stdout: true,
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::new());
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("conflicting flags");
         assert!(error.to_string().contains("cannot be used together"));
 
         let hyf_args = RuntimeInvocationArgs {
             hyf_enabled: true,
             no_hyf_enabled: true,
             ..runtime_args()
         };
         let error =
             RuntimeConfig::resolve_with_env_file(&hyf_args, &env, &EnvFileValues::default())
                 .expect_err("conflicting hyf flags");
         assert!(error.to_string().contains("--hyf-enabled"));
     }
 
     #[test]
     fn conflicting_output_and_verbosity_flags_fail() {
         let env = MapEnvironment::new(BTreeMap::new());
 
         let conflicting_output = RuntimeInvocationArgs {
             json: true,
             ndjson: true,
             ..runtime_args()
         };
         let error = RuntimeConfig::resolve_with_env_file(
             &conflicting_output,
             &env,
             &EnvFileValues::default(),
         )
         .expect_err("conflicting output flags");
         assert!(error.to_string().contains("--json and --ndjson"));
 
         let conflicting_verbosity = RuntimeInvocationArgs {
             quiet: true,
             trace: true,
             ..runtime_args()
         };
         let error = RuntimeConfig::resolve_with_env_file(
             &conflicting_verbosity,
             &env,
             &EnvFileValues::default(),
         )
         .expect_err("conflicting verbosity flags");
         assert!(
             error
                 .to_string()
                 .contains("--quiet, --verbose, and --trace")
         );
 
         let conflicting_aliases = RuntimeInvocationArgs {
             output_format: Some(RuntimeOutputFormatArg::Json),
             json: true,
             ..runtime_args()
         };
         let error = RuntimeConfig::resolve_with_env_file(
             &conflicting_aliases,
             &env,
             &EnvFileValues::default(),
         )
         .expect_err("conflicting output aliases");
         assert!(error.to_string().contains("--output, --json, and --ndjson"));
     }
 
     #[test]
     fn machine_output_rejects_stdout_logging_flags() {
         let env = MapEnvironment::new(BTreeMap::new());
 
         let json_args = RuntimeInvocationArgs {
             json: true,
             log_stdout: true,
             ..runtime_args()
         };
         let error =
             RuntimeConfig::resolve_with_env_file(&json_args, &env, &EnvFileValues::default())
                 .expect_err("json stdout logging should fail");
         let message = error.to_string();
         assert!(message.contains("stdout logging"));
         assert!(message.contains("json output"));
         assert!(message.contains("--no-log-stdout"));
 
         let ndjson_args = RuntimeInvocationArgs {
             ndjson: true,
             log_stdout: true,
             ..runtime_args()
         };
         let error =
             RuntimeConfig::resolve_with_env_file(&ndjson_args, &env, &EnvFileValues::default())
                 .expect_err("ndjson stdout logging should fail");
         let message = error.to_string();
         assert!(message.contains("stdout logging"));
         assert!(message.contains("ndjson output"));
     }
 
     #[test]
     fn machine_output_rejects_stdout_logging_environment() {
         let json_args = RuntimeInvocationArgs {
             json: true,
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_LOGGING_STDOUT".to_owned(),
             "true".to_owned(),
         )]));
         let error =
             RuntimeConfig::resolve_with_env_file(&json_args, &env, &EnvFileValues::default())
                 .expect_err("json stdout logging from env should fail");
         let message = error.to_string();
         assert!(message.contains("RADROOTS_CLI_LOGGING_STDOUT"));
         assert!(message.contains("RADROOTS_CLI_LOGGING_STDOUT"));
 
         let ndjson_env_args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([
             ("RADROOTS_CLI_OUTPUT_FORMAT".to_owned(), "ndjson".to_owned()),
             ("RADROOTS_CLI_LOGGING_STDOUT".to_owned(), "true".to_owned()),
         ]));
         let error =
             RuntimeConfig::resolve_with_env_file(&ndjson_env_args, &env, &EnvFileValues::default())
                 .expect_err("ndjson stdout logging from env should fail");
         assert!(error.to_string().contains("ndjson output"));
     }
 
     #[test]
     fn no_log_stdout_overrides_environment_for_machine_output() {
         let args = RuntimeInvocationArgs {
             json: true,
             no_log_stdout: true,
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_LOGGING_STDOUT".to_owned(),
             "true".to_owned(),
         )]));
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve machine output with stdout logging disabled");
         assert_eq!(resolved.output.format, OutputFormat::Json);
         assert!(!resolved.logging.stdout);
     }
 
     #[test]
     fn invalid_environment_value_fails() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_LOGGING_STDOUT".to_owned(),
             "maybe".to_owned(),
         )]));
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("invalid bool");
         assert!(error.to_string().contains("RADROOTS_CLI_LOGGING_STDOUT"));
 
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_MYC_STATUS_TIMEOUT_MS".to_owned(),
             "slow".to_owned(),
         )]));
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("invalid myc timeout");
         assert!(
             error
                 .to_string()
                 .contains("RADROOTS_CLI_MYC_STATUS_TIMEOUT_MS")
         );
 
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_PUBLISH_TRANSPORT".to_owned(),
             "relay".to_owned(),
         )]));
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("invalid publish transport");
         assert!(error.to_string().contains("RADROOTS_CLI_PUBLISH_TRANSPORT"));
         assert!(error.to_string().contains("direct_nostr_relay"));
         assert!(error.to_string().contains("radrootsd_proxy"));
 
         let args = RuntimeInvocationArgs {
             myc_status_timeout_ms: Some(0),
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::new());
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("zero myc timeout");
         assert!(error.to_string().contains("greater than zero"));
     }
 
     #[test]
     fn env_file_values_fill_missing_flags() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::new());
         let env_file = parse_env_file_values(
             r#"
 RADROOTS_CLI_OUTPUT_FORMAT=json
 RADROOTS_CLI_LOGGING_FILTER="debug,radroots_cli=trace"
 RADROOTS_CLI_LOGGING_OUTPUT_DIR=/tmp/radroots-cli-logs
 RADROOTS_CLI_LOGGING_STDOUT=false
 RADROOTS_CLI_ACCOUNT_SELECTOR=acct_env_file
 RADROOTS_CLI_IDENTITY_PATH=state/identity.json
 RADROOTS_CLI_SIGNER_BACKEND=myc
 RADROOTS_CLI_PUBLISH_TRANSPORT=radrootsd_proxy
 RADROOTS_CLI_RELAYS_URLS=wss://relay.env-file
 RADROOTS_CLI_MYC_EXECUTABLE=bin/myc
 RADROOTS_CLI_MYC_STATUS_TIMEOUT_MS=4500
 RADROOTS_CLI_HYF_ENABLED=true
 RADROOTS_CLI_HYF_EXECUTABLE=bin/hyfd
 "#,
             Path::new(".env.test"),
         )
         .expect("parse env file");
 
         let resolved =
             RuntimeConfig::resolve_with_env_file(&args, &env, &env_file).expect("resolve config");
         assert_eq!(resolved.output.format, OutputFormat::Json);
         assert_eq!(resolved.logging.filter, "debug,radroots_cli=trace");
         assert_eq!(
             resolved.logging.directory,
             Some(PathBuf::from("/tmp/radroots-cli-logs"))
         );
         assert!(!resolved.logging.stdout);
         assert_eq!(resolved.account.selector.as_deref(), Some("acct_env_file"));
         assert_eq!(resolved.identity.path, PathBuf::from("state/identity.json"));
         assert_eq!(resolved.signer.backend, SignerBackend::Myc);
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::RadrootsdProxy,
                 source: PublishTransportSource::Environment,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
         assert_eq!(resolved.relay.urls, vec!["wss://relay.env-file".to_owned()]);
         assert_eq!(resolved.relay.source, RelayConfigSource::Environment);
         assert_eq!(resolved.myc.executable, PathBuf::from("bin/myc"));
         assert_eq!(resolved.myc.status_timeout_ms, 4500);
         assert_eq!(
             resolved.hyf,
             HyfConfig {
                 enabled: true,
                 executable: PathBuf::from("bin/hyfd"),
             }
         );
     }
 
     #[test]
     fn explicit_output_flag_overrides_environment_output() {
         let args = RuntimeInvocationArgs {
             output_format: Some(RuntimeOutputFormatArg::Ndjson),
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_OUTPUT_FORMAT".to_owned(),
             "json".to_owned(),
         )]));
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
         assert_eq!(resolved.output.format, OutputFormat::Ndjson);
     }
 
     #[test]
     fn interaction_config_reflects_tty_and_flags() {
         let args = RuntimeInvocationArgs {
             no_input: true,
             yes: true,
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::new()).with_tty(true, true);
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
         assert_eq!(
             resolved.interaction,
             InteractionConfig {
                 input_enabled: false,
                 assume_yes: true,
                 stdin_tty: true,
                 stdout_tty: true,
                 prompts_allowed: false,
                 confirmations_allowed: false,
             }
         );
 
         let interactive_args = runtime_args();
         let interactive = RuntimeConfig::resolve_with_env_file(
             &interactive_args,
             &env,
             &EnvFileValues::default(),
         )
         .expect("resolve interactive runtime config");
         assert_eq!(
             interactive.interaction,
             InteractionConfig {
                 input_enabled: true,
                 assume_yes: false,
                 stdin_tty: true,
                 stdout_tty: true,
                 prompts_allowed: true,
                 confirmations_allowed: true,
             }
         );
     }
 
     #[test]
     fn process_environment_overrides_env_file_values() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([
             ("RADROOTS_CLI_LOGGING_FILTER".to_owned(), "info".to_owned()),
             ("RADROOTS_CLI_LOGGING_STDOUT".to_owned(), "true".to_owned()),
         ]));
         let env_file = parse_env_file_values(
             r#"
 RADROOTS_CLI_LOGGING_FILTER=debug
 RADROOTS_CLI_LOGGING_STDOUT=false
 "#,
             Path::new(".env.test"),
         )
         .expect("parse env file");
 
         let resolved =
             RuntimeConfig::resolve_with_env_file(&args, &env, &env_file).expect("resolve config");
         assert_eq!(resolved.output.format, OutputFormat::Human);
         assert_eq!(resolved.logging.filter, "info");
         assert!(resolved.logging.stdout);
     }
 
     #[test]
     fn user_relay_config_overrides_workspace_relay_config() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             "[relays]\nurls = [\"wss://relay.workspace\"]\npublish_policy = \"any\"\n",
         )
         .expect("write workspace config");
         fs::write(
             app_config_dir.join("config.toml"),
             "[relays]\nurls = [\"wss://relay.user\", \"wss://relay.workspace\"]\n",
         )
         .expect("write user config");
 
         let env = MapEnvironment {
             values: BTreeMap::from([
                 (
                     "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
                     "repo_local".to_owned(),
                 ),
                 (
                     "RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned(),
                     repo_local_root.display().to_string(),
                 ),
             ]),
             current_dir: workspace_root,
             path_resolver: RadrootsPathResolver::new(
                 RadrootsPlatform::Linux,
                 RadrootsHostEnvironment {
                     home_dir: Some(user_home),
                     ..RadrootsHostEnvironment::default()
                 },
             ),
             stdin_tty: false,
             stdout_tty: false,
         };
         let args = runtime_args();
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve config");
         assert_eq!(
             resolved.relay.urls,
             vec![
                 "wss://relay.user".to_owned(),
                 "wss://relay.workspace".to_owned()
             ]
         );
         assert_eq!(resolved.relay.source, RelayConfigSource::UserConfig);
         assert_eq!(resolved.relay.publish_policy, RelayPublishPolicy::Any);
     }
 
     #[test]
     fn publish_transport_precedence_tracks_source() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             "[publish]\ntransport = \"radrootsd_proxy\"\n",
         )
         .expect("write workspace config");
         fs::write(
             app_config_dir.join("config.toml"),
             "[publish]\ntransport = \"direct_nostr_relay\"\n",
         )
         .expect("write user config");
 
         let env = repo_local_env(
             workspace_root.clone(),
             repo_local_root.clone(),
             user_home.clone(),
             BTreeMap::from([(
                 "RADROOTS_CLI_PUBLISH_TRANSPORT".to_owned(),
                 "radrootsd_proxy".to_owned(),
             )]),
         );
         let args = RuntimeInvocationArgs {
             publish_transport: Some("direct_nostr_relay".to_owned()),
             ..runtime_args()
         };
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve flag publish transport");
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::DirectNostrRelay,
                 source: PublishTransportSource::Flags,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
 
         let env = repo_local_env(
             workspace_root.clone(),
             repo_local_root.clone(),
             user_home.clone(),
             BTreeMap::from([(
                 "RADROOTS_CLI_PUBLISH_TRANSPORT".to_owned(),
                 "radrootsd_proxy".to_owned(),
             )]),
         );
         let resolved =
             RuntimeConfig::resolve_with_env_file(&runtime_args(), &env, &EnvFileValues::default())
                 .expect("resolve environment publish transport");
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::RadrootsdProxy,
                 source: PublishTransportSource::Environment,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
 
         let env = repo_local_env(
             workspace_root.clone(),
             repo_local_root.clone(),
             user_home.clone(),
             BTreeMap::new(),
         );
         let resolved =
             RuntimeConfig::resolve_with_env_file(&runtime_args(), &env, &EnvFileValues::default())
                 .expect("resolve user publish transport");
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::DirectNostrRelay,
                 source: PublishTransportSource::UserConfig,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
 
         fs::remove_file(app_config_dir.join("config.toml")).expect("remove user config");
         let env = repo_local_env(
             workspace_root.clone(),
             repo_local_root.clone(),
             user_home.clone(),
             BTreeMap::new(),
         );
         let resolved =
             RuntimeConfig::resolve_with_env_file(&runtime_args(), &env, &EnvFileValues::default())
                 .expect("resolve workspace publish transport");
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::RadrootsdProxy,
                 source: PublishTransportSource::WorkspaceConfig,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
 
         fs::remove_file(repo_local_root.join("config.toml")).expect("remove workspace config");
         let env = repo_local_env(workspace_root, repo_local_root, user_home, BTreeMap::new());
         let resolved =
             RuntimeConfig::resolve_with_env_file(&runtime_args(), &env, &EnvFileValues::default())
                 .expect("resolve default publish transport");
         assert_eq!(
             resolved.publish,
             PublishConfig {
                 transport: PublishTransport::DirectNostrRelay,
                 source: PublishTransportSource::Defaults,
                 radrootsd_proxy: crate::runtime::config::RadrootsdProxyConfig::default(),
             }
         );
     }
 
     #[test]
     fn user_hyf_config_overrides_workspace_hyf_config() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             "[hyf]\nenabled = false\nexecutable = \"workspace-hyfd\"\n",
         )
         .expect("write workspace config");
         fs::write(
             app_config_dir.join("config.toml"),
             "[hyf]\nenabled = true\nexecutable = \"user-hyfd\"\n",
         )
         .expect("write user config");
 
         let env = MapEnvironment {
             values: BTreeMap::from([
                 (
                     "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
                     "repo_local".to_owned(),
                 ),
                 (
                     "RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned(),
                     repo_local_root.display().to_string(),
                 ),
             ]),
             current_dir: workspace_root,
             path_resolver: RadrootsPathResolver::new(
                 RadrootsPlatform::Linux,
                 RadrootsHostEnvironment {
                     home_dir: Some(user_home),
                     ..RadrootsHostEnvironment::default()
                 },
             ),
             stdin_tty: false,
             stdout_tty: false,
         };
         let args = runtime_args();
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve config");
         assert_eq!(
             resolved.hyf,
             HyfConfig {
                 enabled: true,
                 executable: PathBuf::from("user-hyfd"),
             }
         );
     }
 
     #[test]
     fn user_myc_config_overrides_workspace_myc_config() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             "[myc]\nexecutable = \"workspace-myc\"\nstatus_timeout_ms = 9000\n",
         )
         .expect("write workspace config");
         fs::write(
             app_config_dir.join("config.toml"),
             "[myc]\nexecutable = \"user-myc\"\nstatus_timeout_ms = 3000\n",
         )
         .expect("write user config");
 
         let env = MapEnvironment {
             values: BTreeMap::from([
                 (
                     "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
                     "repo_local".to_owned(),
                 ),
                 (
                     "RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned(),
                     repo_local_root.display().to_string(),
                 ),
             ]),
             current_dir: workspace_root,
             path_resolver: RadrootsPathResolver::new(
                 RadrootsPlatform::Linux,
                 RadrootsHostEnvironment {
                     home_dir: Some(user_home),
                     ..RadrootsHostEnvironment::default()
                 },
             ),
             stdin_tty: false,
             stdout_tty: false,
         };
         let args = runtime_args();
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve config");
         assert_eq!(resolved.myc.executable, PathBuf::from("user-myc"));
         assert_eq!(resolved.myc.status_timeout_ms, 3000);
     }
 
     #[test]
     fn user_signer_config_overrides_workspace_signer_config() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             "[signer]\nbackend = \"myc\"\n",
         )
         .expect("write workspace config");
         fs::write(
             app_config_dir.join("config.toml"),
             "[signer]\nbackend = \"local\"\n",
         )
         .expect("write user config");
 
         let env = repo_local_env(workspace_root, repo_local_root, user_home, BTreeMap::new());
         let args = runtime_args();
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve config");
         assert_eq!(resolved.signer.backend, SignerBackend::Local);
     }
 
     #[test]
     fn environment_signer_overrides_user_signer_config() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             app_config_dir.join("config.toml"),
             "[signer]\nbackend = \"local\"\n",
         )
         .expect("write user config");
 
         let env = repo_local_env(
             workspace_root,
             repo_local_root,
             user_home,
             BTreeMap::from([("RADROOTS_CLI_SIGNER_BACKEND".to_owned(), "myc".to_owned())]),
         );
         let args = runtime_args();
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve config");
         assert_eq!(resolved.signer.backend, SignerBackend::Myc);
     }
 
     #[test]
     fn invalid_signer_config_reports_config_source() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             "[signer]\nbackend = \"remote\"\n",
         )
         .expect("write workspace config");
 
         let env = repo_local_env(workspace_root, repo_local_root, user_home, BTreeMap::new());
         let args = runtime_args();
 
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("invalid signer mode");
         let message = error.to_string();
         assert!(message.contains("workspace config [signer].backend"));
         assert!(!message.contains("--signer"));
     }
 
     #[test]
     fn invalid_publish_config_reports_config_source() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             "[publish]\ntransport = \"nostr\"\n",
         )
         .expect("write workspace config");
 
         let env = repo_local_env(workspace_root, repo_local_root, user_home, BTreeMap::new());
         let error =
             RuntimeConfig::resolve_with_env_file(&runtime_args(), &env, &EnvFileValues::default())
                 .expect_err("invalid publish transport");
         let message = error.to_string();
         assert!(message.contains("workspace config [publish].transport"));
         assert!(message.contains("direct_nostr_relay"));
         assert!(message.contains("radrootsd_proxy"));
     }
 
     #[test]
     fn user_capability_binding_overrides_workspace_binding() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let app_config_dir = repo_local_root.join("config/apps/cli");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::create_dir_all(&app_config_dir).expect("app config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             r#"
 [[capability_binding]]
 capability = "inference.hyf_stdio"
 provider = "hyf"
 target_kind = "managed_instance"
 target = "workspace-hyf"
 "#,
         )
         .expect("write workspace config");
         fs::write(
             app_config_dir.join("config.toml"),
             r#"
 [[capability_binding]]
 capability = "inference.hyf_stdio"
 provider = "hyf"
 target_kind = "explicit_endpoint"
 target = "bin/user-hyfd"
 "#,
         )
         .expect("write user config");
 
         let env = MapEnvironment {
             values: BTreeMap::from([
                 (
                     "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
                     "repo_local".to_owned(),
                 ),
                 (
                     "RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned(),
                     repo_local_root.display().to_string(),
                 ),
             ]),
             current_dir: workspace_root,
             path_resolver: RadrootsPathResolver::new(
                 RadrootsPlatform::Linux,
                 RadrootsHostEnvironment {
                     home_dir: Some(user_home),
                     ..RadrootsHostEnvironment::default()
                 },
             ),
             stdin_tty: false,
             stdout_tty: false,
         };
         let args = runtime_args();
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve config");
         assert_eq!(resolved.capability_bindings.len(), 1);
         assert_eq!(
             resolved.capability_bindings[0],
             CapabilityBindingConfig {
                 capability_id: INFERENCE_HYF_STDIO_CAPABILITY.to_owned(),
                 provider_runtime_id: "hyf".to_owned(),
                 binding_model: "stdio_service".to_owned(),
                 target_kind: CapabilityBindingTargetKind::ExplicitEndpoint,
                 target: "bin/user-hyfd".to_owned(),
                 managed_account_ref: None,
                 signer_session_ref: None,
                 source: CapabilityBindingSource::UserConfig,
             }
         );
     }
 
     #[test]
     fn daemon_and_workflow_capability_bindings_are_rejected() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
         fs::create_dir_all(user_home.join(".radroots/config/apps/cli")).expect("app config dir");
         fs::write(
             repo_local_root.join("config.toml"),
             r#"
 [[capability_binding]]
 capability = "write_plane.trade_jsonrpc"
 provider = "radrootsd"
 target_kind = "explicit_endpoint"
 target = "https://rpc.workspace.test/jsonrpc"
 "#,
         )
         .expect("write workspace config");
 
         let env = MapEnvironment {
             values: BTreeMap::from([
                 (
                     "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
                     "repo_local".to_owned(),
                 ),
                 (
                     "RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned(),
                     repo_local_root.display().to_string(),
                 ),
             ]),
             current_dir: workspace_root,
             path_resolver: RadrootsPathResolver::new(
                 RadrootsPlatform::Linux,
                 RadrootsHostEnvironment {
                     home_dir: Some(user_home),
                     ..RadrootsHostEnvironment::default()
                 },
             ),
             stdin_tty: false,
             stdout_tty: false,
         };
         let args = runtime_args();
 
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("rejected daemon capability binding");
         assert!(
             error
                 .to_string()
                 .contains("unknown capability_binding capability `write_plane.trade_jsonrpc`")
         );
 
         fs::write(
             repo_local_root.join("config.toml"),
             r#"
 [[capability_binding]]
 capability = "workflow.trade"
 provider = "rhi"
 target_kind = "managed_instance"
 target = "workflow-default"
 "#,
         )
         .expect("write workflow config");
 
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("rejected workflow capability binding");
         assert!(
             error
                 .to_string()
                 .contains("unknown capability_binding capability `workflow.trade`")
         );
     }
 
     #[test]
     fn invalid_relay_url_fails() {
         for relay in [
             "https://not-a-websocket.example.com",
             "wss://",
             "wss://user@relay.example",
             "wss://relay.example:abc",
             " ",
         ] {
             let args = RuntimeInvocationArgs {
                 relay: vec![relay.to_owned()],
                 ..runtime_args()
             };
             let env = MapEnvironment::new(BTreeMap::new());
             let error =
                 RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
                     .expect_err("invalid relay url");
             assert!(
                 error.to_string().contains("relay url")
                     || error.to_string().contains("websocket relay urls"),
                 "unexpected error for {relay}: {error}"
             );
         }
     }
 
     #[test]
     fn relay_env_value_rejects_empty_entries() {
         let env = MapEnvironment::new(BTreeMap::from([(
             super::ENV_CLI_RELAYS_URLS.to_owned(),
             "wss://relay.example,,wss://relay-two.example".to_owned(),
         )]));
         let error =
             RuntimeConfig::resolve_with_env_file(&runtime_args(), &env, &EnvFileValues::default())
                 .expect_err("empty relay entry");
 
         assert!(error.to_string().contains("empty relay url"));
     }
 
     #[test]
     fn valid_ipv6_relay_url_resolves() {
         let args = RuntimeInvocationArgs {
             relay: vec![" wss://[2001:db8::1]:443/relay ".to_owned()],
             ..runtime_args()
         };
         let env = MapEnvironment::new(BTreeMap::new());
         let config = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("valid relay url");
 
         assert_eq!(config.relay.urls, vec!["wss://[2001:db8::1]:443/relay"]);
     }
 
     #[test]
     fn state_roots_are_resolved_from_home_and_workspace() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::new());
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
 
         assert_eq!(
             resolved.paths.app_config_path,
             PathBuf::from("/home/tester/.radroots/config/apps/cli/config.toml")
         );
         assert_eq!(resolved.paths.profile_source, "default");
         assert_eq!(resolved.paths.root_source, "host_defaults");
         assert_eq!(resolved.paths.repo_local_root, None);
         assert_eq!(resolved.paths.repo_local_root_source, None);
         assert_eq!(
             resolved.paths.subordinate_path_override_source,
             "runtime_config"
         );
         assert_eq!(resolved.paths.app_namespace, "apps/cli");
         assert_eq!(resolved.paths.shared_accounts_namespace, "shared/accounts");
         assert_eq!(
             resolved.paths.shared_identities_namespace,
             "shared/identities"
         );
         assert_eq!(resolved.paths.workspace_config_path, None);
         assert_eq!(
             resolved.paths.app_data_root,
             PathBuf::from("/home/tester/.radroots/data/apps/cli")
         );
         assert_eq!(
             resolved.paths.allowed_profiles,
             vec!["interactive_user".to_owned(), "repo_local".to_owned(),]
         );
     }
 
     #[test]
     fn windows_roots_use_native_user_directories() {
         let args = runtime_args();
         let env = MapEnvironment {
             values: BTreeMap::new(),
             current_dir: PathBuf::from(r"C:\workspaces\radroots-cli"),
             path_resolver: RadrootsPathResolver::new(
                 RadrootsPlatform::Windows,
                 RadrootsHostEnvironment {
                     appdata_dir: Some(PathBuf::from(r"C:\Users\tester\AppData\Roaming")),
                     localappdata_dir: Some(PathBuf::from(r"C:\Users\tester\AppData\Local")),
                     ..RadrootsHostEnvironment::default()
                 },
             ),
             stdin_tty: false,
             stdout_tty: false,
         };
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
 
         assert_eq!(
             resolved.paths.app_config_path,
             PathBuf::from(r"C:\Users\tester\AppData\Roaming")
                 .join("Radroots")
                 .join("config")
                 .join("apps")
                 .join("cli")
                 .join("config.toml")
         );
         assert_eq!(
             resolved.paths.app_data_root,
             PathBuf::from(r"C:\Users\tester\AppData\Local")
                 .join("Radroots")
                 .join("data")
                 .join("apps")
                 .join("cli")
         );
         assert_eq!(
             resolved.paths.shared_accounts_data_root,
             PathBuf::from(r"C:\Users\tester\AppData\Local")
                 .join("Radroots")
                 .join("data")
                 .join("shared")
                 .join("accounts")
         );
         assert_eq!(
             resolved.paths.default_identity_path,
             PathBuf::from(r"C:\Users\tester\AppData\Roaming")
                 .join("Radroots")
                 .join("secrets")
                 .join("shared")
                 .join("identities")
                 .join("default.json")
         );
     }
 
     #[test]
     fn repo_local_profile_uses_explicit_repo_local_root() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([
             (
                 "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
                 "repo_local".to_owned(),
             ),
             (
                 "RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned(),
                 ".local/radroots/dev".to_owned(),
             ),
         ]));
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
 
         assert_eq!(resolved.paths.profile, "repo_local");
         assert_eq!(
             resolved.paths.profile_source,
             "process_env:RADROOTS_CLI_PATHS_PROFILE"
         );
         assert_eq!(resolved.paths.root_source, "repo_local_root");
         assert_eq!(
             resolved.paths.repo_local_root,
             Some(PathBuf::from(
                 "/workspaces/radroots-cli/.local/radroots/dev"
             ))
         );
         assert_eq!(
             resolved.paths.repo_local_root_source,
             Some("process_env:RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT".to_owned())
         );
         assert_eq!(
             resolved.paths.app_config_path,
             PathBuf::from(
                 "/workspaces/radroots-cli/.local/radroots/dev/config/apps/cli/config.toml"
             )
         );
         assert_eq!(
             resolved.paths.workspace_config_path,
             Some(PathBuf::from(
                 "/workspaces/radroots-cli/.local/radroots/dev/config.toml"
             ))
         );
         assert_eq!(
             resolved.paths.app_data_root,
             PathBuf::from("/workspaces/radroots-cli/.local/radroots/dev/data/apps/cli")
         );
         assert_eq!(
             resolved.paths.app_logs_root,
             PathBuf::from("/workspaces/radroots-cli/.local/radroots/dev/logs/apps/cli")
         );
         assert_eq!(
             resolved.paths.shared_accounts_data_root,
             PathBuf::from("/workspaces/radroots-cli/.local/radroots/dev/data/shared/accounts")
         );
         assert_eq!(
             resolved.paths.default_identity_path,
             PathBuf::from(
                 "/workspaces/radroots-cli/.local/radroots/dev/secrets/shared/identities/default.json"
             )
         );
     }
 
     #[test]
     fn repo_local_profile_requires_explicit_root() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_PATHS_PROFILE".to_owned(),
             "repo_local".to_owned(),
         )]));
 
         let error = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect_err("repo_local should require an explicit root");
         assert!(
             error
                 .to_string()
                 .contains("RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT")
         );
     }
 
     #[test]
     fn env_file_can_select_repo_local_profile() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::new());
         let env_file = parse_env_file_values(
             r#"
 RADROOTS_CLI_PATHS_PROFILE=repo_local
 RADROOTS_CLI_PATHS_REPO_LOCAL_ROOT=.local/radroots/dev
 "#,
             Path::new(".env.test"),
         )
         .expect("parse env file");
 
         let resolved =
             RuntimeConfig::resolve_with_env_file(&args, &env, &env_file).expect("resolve config");
         assert_eq!(resolved.paths.profile, "repo_local");
         assert_eq!(
             resolved.paths.app_data_root,
             PathBuf::from("/workspaces/radroots-cli/.local/radroots/dev/data/apps/cli")
         );
         assert_eq!(
             resolved.paths.workspace_config_path,
             Some(PathBuf::from(
                 "/workspaces/radroots-cli/.local/radroots/dev/config.toml"
             ))
         );
     }
 
     #[test]
     fn unknown_env_file_variable_fails() {
         let error = parse_env_file_values(
             "RADROOTS_CLI_LOGGING_FILTRE=debug\n",
             Path::new(".env.test"),
         )
         .expect_err("unknown env variable");
         assert!(
             error
                 .to_string()
                 .contains("unknown environment variable `RADROOTS_CLI_LOGGING_FILTRE`")
         );
     }
 
     #[test]
     fn old_env_file_variable_fails() {
         let error = parse_env_file_values("RADROOTS_OUTPUT=json\n", Path::new(".env.test"))
             .expect_err("old env variable should fail");
         assert!(
             error
                 .to_string()
                 .contains("unknown environment variable `RADROOTS_OUTPUT`")
         );
     }
 
     #[test]
     fn duplicate_env_file_variable_fails() {
         let error = parse_env_file_values(
             "RADROOTS_CLI_OUTPUT_FORMAT=json\nRADROOTS_CLI_OUTPUT_FORMAT=human\n",
             Path::new(".env.test"),
         )
         .expect_err("duplicate env variable should fail");
         assert!(
             error
                 .to_string()
                 .contains("duplicate environment variable `RADROOTS_CLI_OUTPUT_FORMAT`")
         );
     }
 
     #[test]
     fn old_toml_groups_and_fields_fail() {
         let temp = tempdir().expect("tempdir");
         let workspace_root = temp.path().join("workspace");
         let repo_local_root = workspace_root.join("infra/local/runtime/radroots");
         let user_home = temp.path().join("home");
         fs::create_dir_all(&repo_local_root).expect("workspace config dir");
 
         for (raw, expected) in [
             (
                 "[relay]\nurls = [\"wss://relay.old\"]\n",
                 "unknown field `relay`",
             ),
             ("[signer]\nmode = \"local\"\n", "unknown field `mode`"),
             (
                 "[relays]\nurls = [\"wss://relay.example\"]\nextra = true\n",
                 "unknown field `extra`",
             ),
         ] {
             fs::write(repo_local_root.join("config.toml"), raw).expect("write config");
             let env = repo_local_env(
                 workspace_root.clone(),
                 repo_local_root.clone(),
                 user_home.clone(),
                 BTreeMap::new(),
             );
             let error = RuntimeConfig::resolve_with_env_file(
                 &runtime_args(),
                 &env,
                 &EnvFileValues::default(),
             )
             .expect_err("old toml shape should fail");
             assert!(
                 error.to_string().contains(expected),
                 "expected {expected}, got {error}"
             );
         }
     }
 
     #[test]
     fn env_output_accepts_ndjson() {
         let args = runtime_args();
         let env = MapEnvironment::new(BTreeMap::from([(
             "RADROOTS_CLI_OUTPUT_FORMAT".to_owned(),
             "ndjson".to_owned(),
         )]));
 
         let resolved = RuntimeConfig::resolve_with_env_file(&args, &env, &EnvFileValues::default())
             .expect("resolve runtime config");
         assert_eq!(resolved.output.format, OutputFormat::Ndjson);
     }
 }