@did-btcr2/cli 0.16.0 → 0.17.0

package/dist/esm/src/keystore/session.js

@@ -0,0 +1,250 @@
+import { closeSync, constants, existsSync, fstatSync, openSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { utf8ToBytes } from '@noble/hashes/utils.js';
+import { base64urlnopad } from '@scure/base';
+import { ensureDir, writeFileAtomic } from './atomic.js';
+/**
+ * The session unlock agent (ADR 081). `keystore unlock` caches the verified
+ * keystore passphrase in a single `<home>/session.json`, and subsequent commands
+ * read it in place of a prompt until it expires or `keystore lock` revokes it.
+ *
+ * This is an on-disk v1 design. The cached passphrase is base64url-*encoded*, not
+ * encrypted: its only protection at rest is the file's `0600` mode. That is the
+ * deliberate, documented cost of a portable, minimal-diff convenience; a future
+ * in-memory agent (v2) that never persists the secret is the real fix. Every read
+ * here is defensive and never throws, so a bad or hostile session degrades to a
+ * passphrase prompt rather than a crash.
+ */
+/** Current session-file format version. */
+export const SESSION_VERSION = 1;
+/** Default session lifetime: one hour. */
+export const DEFAULT_SESSION_TTL_MS = 60 * 60 * 1000;
+/** Hard cap on a cached-passphrase lifetime: 24 hours. A longer TTL is refused. */
+export const MAX_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+/** Environment variable supplying a default TTL below the `--ttl` flag. */
+export const ENV_KEYSTORE_TTL = 'BTCR2_KEYSTORE_TTL';
+/**
+ * Writes the session file atomically at `0600` (temp sibling + rename), returning
+ * the written record so the caller can report expiry without re-reading. The
+ * caller is responsible for verifying the passphrase first; this only persists it.
+ */
+export function writeSession(sessionPath, input) {
+    const createdAt = Date.now();
+    const session = {
+        v: SESSION_VERSION,
+        keystore: resolve(input.keystorePath),
+        verifierId: input.verifierId,
+        passphrase: base64urlnopad.encode(utf8ToBytes(input.passphrase)),
+        allowMainnet: input.allowMainnet ?? false,
+        createdAt,
+        expiresAt: createdAt + input.ttlMs,
+        ttlSeconds: Math.round(input.ttlMs / 1000),
+    };
+    ensureDir(dirname(sessionPath), 0o700);
+    writeFileAtomic(sessionPath, `${JSON.stringify(session, null, 2)}\n`, 0o600);
+    return session;
+}
+/**
+ * Deletes the session file and any crash-orphaned `writeFileAtomic` temp sibling
+ * (each of which would hold a plaintext passphrase). Idempotent; needs no
+ * passphrase. Returns whether a session file was present. Unlink is best-effort:
+ * it removes the name, it does not securely erase the bytes (see ADR 081).
+ */
+export function clearSession(sessionPath) {
+    let existed = false;
+    try {
+        existed = existsSync(sessionPath);
+        if (existed)
+            rmSync(sessionPath, { force: true });
+    }
+    catch {
+        // Best effort: a session we cannot remove is reported as not-cleared below.
+        existed = false;
+    }
+    sweepSessionTemps(sessionPath);
+    return existed;
+}
+/** Removes `.session.json.<pid>.<n>.tmp` leftovers from an interrupted atomic write. */
+function sweepSessionTemps(sessionPath) {
+    const dir = dirname(sessionPath);
+    const prefix = `.${basename(sessionPath)}.`;
+    try {
+        for (const name of readdirSync(dir)) {
+            if (name.startsWith(prefix) && name.endsWith('.tmp')) {
+                try {
+                    rmSync(join(dir, name), { force: true });
+                }
+                catch {
+                    // A temp file we cannot remove is left for the next sweep.
+                }
+            }
+        }
+    }
+    catch {
+        // Directory unreadable or absent: nothing to sweep.
+    }
+}
+/**
+ * Returns the cached passphrase for `keystorePath` when a live, matching session
+ * exists, else `undefined`. Never throws. A session that is expired, stale (the
+ * keystore passphrase rotated), future-dated, or malformed is pruned on read; a
+ * live session bound to a *different* keystore is left in place (it prompts for
+ * the current keystore instead).
+ *
+ * `isMainnetOperation` gates the one case the network is known at consumption: a
+ * live session that was not unlocked with `--allow-mainnet` is withheld from a
+ * `bitcoin` operation (returning `undefined` so the caller falls through to a
+ * per-use prompt) but *not* pruned, since it remains valid for the non-mainnet
+ * operations the operator unlocked for (ADR 081).
+ */
+export function readLiveSessionPassphrase(sessionPath, keystorePath, currentVerifierId, isMainnetOperation = false) {
+    const verdict = evaluateSession(sessionPath, keystorePath, currentVerifierId, Date.now());
+    if (verdict.status === 'live') {
+        // Withhold a session lacking mainnet allowance from a mainnet operation, so
+        // signing a `bitcoin` DID still authenticates per use. Leave it in place: it
+        // is a valid session, just not for this operation (like a foreign keystore).
+        if (isMainnetOperation && !verdict.session.allowMainnet)
+            return undefined;
+        try {
+            return Buffer.from(base64urlnopad.decode(verdict.session.passphrase)).toString('utf-8');
+        }
+        catch {
+            clearSession(sessionPath);
+            return undefined;
+        }
+    }
+    // Prune a session that is dead for everyone or dead for this keystore. A
+    // 'foreign' (live, different keystore) or 'none' session is left untouched.
+    if (verdict.status === 'expired' || verdict.status === 'stale'
+        || verdict.status === 'future' || verdict.status === 'malformed') {
+        clearSession(sessionPath);
+    }
+    return undefined;
+}
+/**
+ * Reports whether a live session exists for `keystorePath` and its remaining
+ * lifetime, without decrypting, prompting, throwing, or emitting the passphrase.
+ * An expired, foreign, stale, or malformed session reports inactive. Read-only:
+ * unlike {@link readLiveSessionPassphrase}, it does not prune.
+ */
+export function readSessionStatus(sessionPath, keystorePath, currentVerifierId) {
+    const now = Date.now();
+    const verdict = evaluateSession(sessionPath, keystorePath, currentVerifierId, now);
+    if (verdict.status !== 'live')
+        return { active: false };
+    return {
+        active: true,
+        expiresAt: verdict.session.expiresAt,
+        secondsRemaining: Math.max(0, Math.round((verdict.session.expiresAt - now) / 1000)),
+        allowMainnet: verdict.session.allowMainnet,
+    };
+}
+/**
+ * Parses a TTL string into milliseconds: a bare integer is seconds; an `s`, `m`,
+ * or `h` suffix scales it. Returns `undefined` for any malformed input. The
+ * caller applies the default, the 24h cap, and the `<= 0` rejection.
+ */
+export function parseTtlToMs(raw) {
+    const match = /^(\d+)([smh]?)$/.exec(raw.trim());
+    if (!match)
+        return undefined;
+    const n = Number(match[1]);
+    if (!Number.isFinite(n))
+        return undefined;
+    const unitMs = match[2] === 'h' ? 3_600_000 : match[2] === 'm' ? 60_000 : 1_000;
+    return n * unitMs;
+}
+/**
+ * Classifies the session file: read it securely, then check version, shape,
+ * clock, keystore binding, and verifier fingerprint in that order. Ordering
+ * `expired` before `foreign` means an expired session is pruned regardless of
+ * which keystore it was for. Never throws.
+ */
+function evaluateSession(sessionPath, keystorePath, currentVerifierId, now) {
+    const session = secureReadSession(sessionPath);
+    if (!session)
+        return { status: 'none' };
+    if (session.v !== SESSION_VERSION)
+        return { status: 'malformed' };
+    if (typeof session.passphrase !== 'string' || typeof session.keystore !== 'string'
+        || typeof session.verifierId !== 'string' || typeof session.allowMainnet !== 'boolean'
+        || typeof session.createdAt !== 'number' || typeof session.expiresAt !== 'number') {
+        return { status: 'malformed' };
+    }
+    if (session.createdAt > now)
+        return { status: 'future' };
+    if (now >= session.expiresAt)
+        return { status: 'expired' };
+    if (resolve(session.keystore) !== resolve(keystorePath))
+        return { status: 'foreign' };
+    if (currentVerifierId === undefined || session.verifierId !== currentVerifierId)
+        return { status: 'stale' };
+    return { status: 'live', session };
+}
+/**
+ * Reads and parses the session file with a plaintext secret in mind. On POSIX,
+ * opens with `O_NOFOLLOW` (refusing a symlink) and refuses a non-regular file, a
+ * file not owned by this user, or one accessible by group or other, best-effort
+ * deleting a rejected file and reading only from the opened descriptor (no TOCTOU
+ * re-open). On Windows those POSIX guards are skipped (they would throw), so the
+ * file is read normally under the same directory ACL the keystore trusts, keeping
+ * the session usable rather than silently ignored. Returns `undefined` on any
+ * failure; never throws.
+ */
+function secureReadSession(sessionPath) {
+    let raw;
+    if (process.platform === 'win32') {
+        try {
+            raw = readFileSync(sessionPath, 'utf-8');
+        }
+        catch {
+            return undefined;
+        }
+    }
+    else {
+        let fd;
+        try {
+            fd = openSync(sessionPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch {
+            // ENOENT (no session), ELOOP (symlink refused by O_NOFOLLOW), or any other
+            // open failure: no usable session.
+            return undefined;
+        }
+        try {
+            const st = fstatSync(fd);
+            const myUid = typeof process.getuid === 'function' ? process.getuid() : undefined;
+            if (!st.isFile() || (myUid !== undefined && st.uid !== myUid) || (st.mode & 0o077) !== 0) {
+                // Not a regular file we own with 0600 perms: it was not written by this
+                // process. Best-effort remove it (it may hold a plaintext passphrase) and
+                // fall back to a prompt.
+                try {
+                    rmSync(sessionPath, { force: true });
+                }
+                catch {
+                    // Cannot remove a file we do not own; ignoring it is enough.
+                }
+                return undefined;
+            }
+            raw = readFileSync(fd, 'utf-8');
+        }
+        catch {
+            return undefined;
+        }
+        finally {
+            try {
+                closeSync(fd);
+            }
+            catch {
+                // Descriptor already gone; nothing to close.
+            }
+        }
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/esm/src/keystore/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../../src/keystore/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACnH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;;;;;;;;GAWG;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAU,CAAC;AAE1C,0CAA0C;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACrD,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAwCrD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,KAAwB;IACxE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAgB;QAC3B,CAAC,EAAc,eAAe;QAC9B,QAAQ,EAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QAC1C,UAAU,EAAK,KAAK,CAAC,UAAU;QAC/B,UAAU,EAAK,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,YAAY,EAAG,KAAK,CAAC,YAAY,IAAI,KAAK;QAC1C,SAAS;QACT,SAAS,EAAM,SAAS,GAAG,KAAK,CAAC,KAAK;QACtC,UAAU,EAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;KAC9C,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,eAAe,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC;IAC5C,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,2DAA2D;gBAC7D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA2B,EAC3B,YAA2B,EAC3B,iBAAuC,EACvC,kBAAkB,GAAG,KAAK;IAE1B,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,IAAI,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAC1E,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;WACzD,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnE,YAAY,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA0B,EAC1B,YAA0B,EAC1B,iBAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACxD,OAAO;QACL,MAAM,EAAa,IAAI;QACvB,SAAS,EAAU,OAAO,CAAC,OAAO,CAAC,SAAS;QAC5C,gBAAgB,EAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACpF,YAAY,EAAO,OAAO,CAAC,OAAO,CAAC,YAAY;KAChD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,CAAC,GAAG,MAAM,CAAC;AACpB,CAAC;AAOD;;;;;GAKG;AACH,SAAS,eAAe,CACtB,WAA0B,EAC1B,YAA0B,EAC1B,iBAAsC,EACtC,GAA0B;IAE1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxC,IAAI,OAAO,CAAC,CAAC,KAAK,eAAe;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClE,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;WAC7E,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,SAAS;WACnF,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzD,IAAI,GAAG,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC3D,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtF,IAAI,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5G,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,mCAAmC;YACnC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzF,wEAAwE;gBACxE,0EAA0E;gBAC1E,yBAAyB;gBACzB,IAAI,CAAC;oBACH,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC;oBACP,6DAA6D;gBAC/D,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/esm/src/paths.js

@@ -6,6 +6,8 @@ export const ENV_HOME = 'BTCR2_HOME';
 /** The config and keystore file names, kept side by side under the home root. */
 export const CONFIG_FILENAME = 'config.json';
 export const KEYSTORE_FILENAME = 'keystore.json';
+/** The session file name, holding the unlock agent's cached passphrase (ADR 081). */
+export const SESSION_FILENAME = 'session.json';
 /**
  * Resolves the CLI home directory: the single root that holds `config.json` and
  * `keystore.json` side by side (ADR 079). Resolution order, highest wins:
@@ -56,4 +58,14 @@ export function defaultConfigPath(overrides) {
 export function defaultKeystorePath(overrides) {
     return join(resolveHome(overrides), KEYSTORE_FILENAME);
 }
+/**
+ * Session file path: `<home>/session.json`, where the unlock agent caches the
+ * keystore passphrase (ADR 081). Deliberately derived from the home root alone,
+ * never from `--config` / `--keystore` or the config file, so `keystore lock`
+ * can revoke a session even under a malformed config, and so the read and write
+ * paths always agree on one location per home.
+ */
+export function defaultSessionPath(overrides) {
+    return join(resolveHome(overrides), SESSION_FILENAME);
+}
 //# sourceMappingURL=paths.js.map

package/dist/esm/src/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAiB1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,SAAyB;IACnD,OAAO,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;WAC/B,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WACnC,mBAAmB,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;eAC9C,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;eACjC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAyB;IACzD,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAyB;IAC3D,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAiB1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,SAAyB;IACnD,OAAO,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;WAC/B,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WACnC,mBAAmB,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;eAC9C,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;eACjC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAyB;IACzD,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAyB;IAC3D,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAyB;IAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC"}

package/dist/esm/src/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAiBA,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAkBA,MAAM,CAAC,MAAM,kBAAkB,GAAoB;IACjD,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS;CACpE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC"}

package/dist/types/src/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,GAAG,IAAI,CAsDxF"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/commands/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASzC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,GAAG,IAAI,CA2DxF"}

package/dist/types/src/commands/keystore.d.ts

@@ -1,10 +1,11 @@
 import type { Command } from 'commander';
-import type { GlobalOptions } from '../types.js';
+import { type GlobalOptions } from '../types.js';
 /**
  * Registers the `keystore` command group: establish, inspect, and re-key the
- * encrypted keystore (ADR 080). These operate on the keystore file directly (no
- * Bitcoin connection or KeyManager) and never decrypt a key except when
- * re-sealing during `change-passphrase`.
+ * encrypted keystore (ADR 080), plus the session unlock agent (ADR 081). These
+ * operate on the keystore and session files directly (no Bitcoin connection or
+ * KeyManager) and never decrypt a key except when re-sealing during
+ * `change-passphrase`.
  */
 export declare function registerKeystoreCommand(program: Command, globals: () => GlobalOptions): void;
 //# sourceMappingURL=keystore.d.ts.map

package/dist/types/src/commands/keystore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../../../src/commands/keystore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,GAAG,IAAI,CAkF5F"}
+{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../../../src/commands/keystore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuBzC,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEnF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,GAAG,IAAI,CA0K5F"}

package/dist/types/src/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8E,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGrK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAS1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAoC,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnI,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,8EAA8E;IAC9E,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,+EAA+E;IAC/E,aAAa,CAAC,EAAI,MAAM,EAAE,CAAC;IAC3B,2DAA2D;IAC3D,YAAY,CAAC,EAAK,MAAM,CAAC;IACzB,mFAAmF;IACnF,YAAY,CAAC,EAAK,MAAM,EAAE,CAAC;IAC3B,oFAAoF;IACpF,IAAI,CAAC,EAAa,MAAM,CAAC;IACzB,MAAM,CAAC,EAAW,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,EAAS,MAAM,CAAC;IACzB,2EAA2E;IAC3E,cAAc,CAAC,EAAG,MAAM,CAAC;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAO,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,aAAa,CAAC;QACxB,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB;;;;;WAKG;QACH,OAAO,CAAC,EAAG,aAAa,CAAC;QACzB,GAAG,CAAC,EAAE;YACJ,IAAI,CAAC,EAAY,MAAM,CAAC;YACxB,MAAM,CAAC,EAAU,MAAM,CAAC;YACxB,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,0EAA0E;YAC1E,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,8EAA8E;YAC9E,aAAa,CAAC,EAAG,MAAM,CAAC;YACxB,kFAAkF;YAClF,SAAS,CAAC,EAAO,MAAM,CAAC;YACxB,sEAAsE;YACtE,OAAO,CAAC,EAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxC,uDAAuD;YACvD,MAAM,CAAC,EAAU,MAAM,CAAC;YACxB,uDAAuD;YACvD,UAAU,CAAC,EAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,mDAAmD;YACnD,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,kEAAkE;YAClE,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,uFAAuF;YACvF,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,gGAAgG;QAChG,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC,CAAC;CACJ,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAMlG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpF;AAYD,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAWjG;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAWnF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,KAAK,WAAW,CAAC;AAEnG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;CAUX,CAAC;AAEX;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,mBAAmB,CAUtD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAsBpF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAKnE;AAsBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAQ,UAAU,EACxB,WAAW,EAAG,MAAM,GACnB,mBAAmB,CAWrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAQ,UAAU,GAAG,SAAS,EAClC,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;CAAE,CASlE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAWpF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAK,aAAa,EACzB,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAAG,SAAS,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAe9G;AA4CD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,CAAC,EAAI,aAAa,EACzB,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,CAyF7C;AAwBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,SAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAgB1G;AAeD,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAoB3D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAI,aAAa,EACxB,SAAS,EAAE,mBAAmB,GAAG,SAAS,EAC1C,KAAK,EAAM;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,gBAAgB,GAAG,SAAS,CAgB9B;AAeD,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAI,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,MAAM,EAAG,UAAU,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAG,aAAa,CAAC;IACxB,OAAO,EAAG,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,EAAG;QACJ,IAAI,EAAQ,cAAc,CAAC;QAC3B,MAAM,EAAM,cAAc,CAAC;QAC3B,OAAO,EAAK,cAAc,CAAC;QAC3B,OAAO,EAAK,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;KAC5B,CAAC;IACF,GAAG,EAAG;QACJ,OAAO,EAAK,cAAc,CAAC;QAC3B,MAAM,EAAM,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;KAC5B,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,eAAe,CAmD/G;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAG,UAAU,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1C,MAAM,EAAK,MAAM,CAAC;IAClB,EAAE,EAAS,OAAO,CAAC;IACnB,MAAM,CAAC,EAAI,MAAM,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAO,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,CAAC;CACpF;AAmCD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmC9G;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAEvG;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,uBAAuB,CAElG;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAW7G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAa5G;AAoBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAKxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAUxD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8E,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGrK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAU1D,OAAO,EAAE,iBAAiB,EAAsB,MAAM,YAAY,CAAC;AACnE,OAAO,EAAoC,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnI,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,8EAA8E;IAC9E,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,+EAA+E;IAC/E,aAAa,CAAC,EAAI,MAAM,EAAE,CAAC;IAC3B,2DAA2D;IAC3D,YAAY,CAAC,EAAK,MAAM,CAAC;IACzB,mFAAmF;IACnF,YAAY,CAAC,EAAK,MAAM,EAAE,CAAC;IAC3B,oFAAoF;IACpF,IAAI,CAAC,EAAa,MAAM,CAAC;IACzB,MAAM,CAAC,EAAW,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,EAAS,MAAM,CAAC;IACzB,2EAA2E;IAC3E,cAAc,CAAC,EAAG,MAAM,CAAC;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAO,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,aAAa,CAAC;QACxB,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB;;;;;WAKG;QACH,OAAO,CAAC,EAAG,aAAa,CAAC;QACzB,GAAG,CAAC,EAAE;YACJ,IAAI,CAAC,EAAY,MAAM,CAAC;YACxB,MAAM,CAAC,EAAU,MAAM,CAAC;YACxB,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,0EAA0E;YAC1E,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,8EAA8E;YAC9E,aAAa,CAAC,EAAG,MAAM,CAAC;YACxB,kFAAkF;YAClF,SAAS,CAAC,EAAO,MAAM,CAAC;YACxB,sEAAsE;YACtE,OAAO,CAAC,EAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxC,uDAAuD;YACvD,MAAM,CAAC,EAAU,MAAM,CAAC;YACxB,uDAAuD;YACvD,UAAU,CAAC,EAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,mDAAmD;YACnD,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,kEAAkE;YAClE,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,uFAAuF;YACvF,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,gGAAgG;QAChG,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC,CAAC;CACJ,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAMlG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpF;AAYD,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAWjG;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAWnF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,KAAK,WAAW,CAAC;AAEnG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;CAUX,CAAC;AAEX;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,mBAAmB,CAUtD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAsBpF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAKnE;AAsBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAQ,UAAU,EACxB,WAAW,EAAG,MAAM,GACnB,mBAAmB,CAWrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAQ,UAAU,GAAG,SAAS,EAClC,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;CAAE,CASlE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAWpF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAK,aAAa,EACzB,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAAG,SAAS,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAe9G;AA4CD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,CAAC,EAAI,aAAa,EACzB,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,CAyF7C;AAwBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,SAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAgB1G;AAeD,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAoB3D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAI,aAAa,EACxB,SAAS,EAAE,mBAAmB,GAAG,SAAS,EAC1C,KAAK,EAAM;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,gBAAgB,GAAG,SAAS,CAgB9B;AAeD,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAI,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,MAAM,EAAG,UAAU,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAG,aAAa,CAAC;IACxB,OAAO,EAAG,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,EAAG;QACJ,IAAI,EAAQ,cAAc,CAAC;QAC3B,MAAM,EAAM,cAAc,CAAC;QAC3B,OAAO,EAAK,cAAc,CAAC;QAC3B,OAAO,EAAK,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;KAC5B,CAAC;IACF,GAAG,EAAG;QACJ,OAAO,EAAK,cAAc,CAAC;QAC3B,MAAM,EAAM,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;KAC5B,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,eAAe,CAmD/G;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAG,UAAU,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1C,MAAM,EAAK,MAAM,CAAC;IAClB,EAAE,EAAS,OAAO,CAAC;IACnB,MAAM,CAAC,EAAI,MAAM,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAO,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,CAAC;CACpF;AAmCD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmC9G;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAEvG;AAwCD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,uBAAuB,CAElG;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAW7G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAa5G;AAoBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAKxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAUxD"}

package/dist/types/src/keystore/file-key-store.d.ts

@@ -115,6 +115,22 @@ export interface KeystoreSummary {
 export declare function keystoreSummary(path: string): KeystoreSummary;
 /** The protection label of a keystore file, without decrypting or prompting. */
 export declare function keystoreProtection(path: string): KeystoreProtectionLabel;
+/**
+ * A stable fingerprint of a keystore's passphrase verifier, or `undefined` when
+ * the file is absent, unparsable, or carries no verifier. Compared by equality
+ * to detect a rotated passphrase (`change-passphrase`, `init --force`) or a
+ * re-established keystore, so a cached session (ADR 081) stops matching a
+ * keystore whose passphrase has changed. Never decrypts, never throws.
+ */
+export declare function keystoreVerifierId(path: string): string | undefined;
+/**
+ * Checks a candidate passphrase against the keystore's verifier without
+ * constructing a store or opening any key. Returns `false` for an absent,
+ * unparsable, dev, or verifier-less keystore and for a wrong passphrase; `true`
+ * only when the passphrase opens the verifier sentinel. Never throws. Used by
+ * `keystore unlock` (ADR 081) to refuse caching a wrong passphrase.
+ */
+export declare function verifyKeystorePassphrase(path: string, passphrase: string): boolean;
 /** Options for {@link initKeystore}. */
 export interface InitKeystoreOptions {
     protection: KeystoreProtection;

package/dist/types/src/keystore/file-key-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-key-store.d.ts","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG3D,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,MAAM,CAAC;AAuDvD,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG;IAChC,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,CAAC;IACxD,wGAAwG;IACxG,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2FAA2F;IAC3F,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,YAAa,YAAW,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;;gBAW7D,OAAO,EAAE,mBAAmB;IAoPxC,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS;IAiC5C,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAI/B,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI;IA2D7C,MAAM,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAWlC,KAAK,IAAI,IAAI;IAOb,iFAAiF;IACjF,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;IAIvB;;;;;;OAMG;IACH,OAAO,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAW3C,KAAK,IAAI,IAAI;IAQb,wEAAwE;IACxE,SAAS,IAAI,MAAM,GAAG,SAAS;IAI/B;;;OAGG;IACH,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAW9C,sCAAsC;IACtC,IAAI,UAAU,IAAI,kBAAkB,CAEnC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM;CA0DvE;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAI,uBAAuB,CAAC;IACtC,WAAW,EAAG,OAAO,CAAC;IACtB,QAAQ,EAAM,MAAM,CAAC;IACrB,MAAM,EAAQ,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CA0B7D;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAExE;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAM,kBAAkB,CAAC;IACnC,aAAa,EAAG,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,CAAC;IACzD,WAAW,CAAC,EAAI,WAAW,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAW7E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAY,MAAM,EACtB,aAAa,EAAG,MAAM,EACtB,aAAa,EAAG,MAAM,EACtB,WAAW,CAAC,EAAI,WAAW,GAC1B,MAAM,CAaR"}
+{"version":3,"file":"file-key-store.d.ts","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG3D,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,MAAM,CAAC;AAuDvD,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG;IAChC,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,CAAC;IACxD,wGAAwG;IACxG,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2FAA2F;IAC3F,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,YAAa,YAAW,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;;gBAW7D,OAAO,EAAE,mBAAmB;IAoPxC,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS;IAiC5C,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAI/B,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI;IA2D7C,MAAM,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAWlC,KAAK,IAAI,IAAI;IAOb,iFAAiF;IACjF,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;IAIvB;;;;;;OAMG;IACH,OAAO,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAW3C,KAAK,IAAI,IAAI;IAQb,wEAAwE;IACxE,SAAS,IAAI,MAAM,GAAG,SAAS;IAI/B;;;OAGG;IACH,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAW9C,sCAAsC;IACtC,IAAI,UAAU,IAAI,kBAAkB,CAEnC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM;CA0DvE;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAI,uBAAuB,CAAC;IACtC,WAAW,EAAG,OAAO,CAAC;IACtB,QAAQ,EAAM,MAAM,CAAC;IACrB,MAAM,EAAQ,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CA0B7D;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnE;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAclF;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAM,kBAAkB,CAAC;IACnC,aAAa,EAAG,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,CAAC;IACzD,WAAW,CAAC,EAAI,WAAW,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAW7E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAY,MAAM,EACtB,aAAa,EAAG,MAAM,EACtB,aAAa,EAAG,MAAM,EACtB,WAAW,CAAC,EAAI,WAAW,GAC1B,MAAM,CAaR"}

package/dist/types/src/keystore/passphrase.d.ts

@@ -15,6 +15,16 @@ export type PassphraseOptions = {
      * satisfy the new one (which would make the change a no-op).
      */
     forcePrompt?: boolean;
+    /**
+     * An optional non-interactive source consulted *after* the env var and
+     * passphrase file and *before* the terminal prompt (and before the "no TTY"
+     * failure). The session unlock agent (ADR 081) wires this to a cached
+     * passphrase, so a returning command consumes the session instead of
+     * prompting, and a non-interactive follow-on command does not hard-fail. It
+     * returns `undefined` when no session is available. Skipped when `forcePrompt`
+     * is set, and never wired during passphrase establishment (`confirm`).
+     */
+    beforePrompt?: () => string | undefined;
 };
 /**
  * Acquires a passphrase without ever reading it from a command-line flag value

package/dist/types/src/keystore/passphrase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passphrase.d.ts","sourceRoot":"","sources":["../../../../src/keystore/passphrase.ts"],"names":[],"mappings":"AAGA,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CA2BzE;AAuBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAGtD"}
+{"version":3,"file":"passphrase.d.ts","sourceRoot":"","sources":["../../../../src/keystore/passphrase.ts"],"names":[],"mappings":"AAGA,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAwCzE;AAuBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAGtD"}

package/dist/types/src/keystore/session.d.ts

@@ -0,0 +1,105 @@
+/**
+ * The session unlock agent (ADR 081). `keystore unlock` caches the verified
+ * keystore passphrase in a single `<home>/session.json`, and subsequent commands
+ * read it in place of a prompt until it expires or `keystore lock` revokes it.
+ *
+ * This is an on-disk v1 design. The cached passphrase is base64url-*encoded*, not
+ * encrypted: its only protection at rest is the file's `0600` mode. That is the
+ * deliberate, documented cost of a portable, minimal-diff convenience; a future
+ * in-memory agent (v2) that never persists the secret is the real fix. Every read
+ * here is defensive and never throws, so a bad or hostile session degrades to a
+ * passphrase prompt rather than a crash.
+ */
+/** Current session-file format version. */
+export declare const SESSION_VERSION: 1;
+/** Default session lifetime: one hour. */
+export declare const DEFAULT_SESSION_TTL_MS: number;
+/** Hard cap on a cached-passphrase lifetime: 24 hours. A longer TTL is refused. */
+export declare const MAX_SESSION_TTL_MS: number;
+/** Environment variable supplying a default TTL below the `--ttl` flag. */
+export declare const ENV_KEYSTORE_TTL = "BTCR2_KEYSTORE_TTL";
+/**
+ * The on-disk session file. `passphrase` is base64url(utf8(passphrase)): an
+ * encoding, not encryption. `keystore` binds the session to one keystore, and
+ * `verifierId` (a hash of that keystore's verifier) invalidates the session when
+ * the passphrase is rotated. `allowMainnet` records whether the operator unlocked
+ * with `--allow-mainnet`; a session without it is withheld from a `bitcoin`
+ * operation so mainnet keeps per-use authentication (ADR 081). No derived key,
+ * keystore ciphertext, or signing-key bytes ever appear here.
+ */
+export interface SessionFile {
+    v: typeof SESSION_VERSION;
+    keystore: string;
+    verifierId: string;
+    passphrase: string;
+    allowMainnet: boolean;
+    createdAt: number;
+    expiresAt: number;
+    ttlSeconds: number;
+}
+/** Inputs for {@link writeSession}. */
+export interface WriteSessionInput {
+    /** The keystore this session unlocks (stored resolved/normalized). */
+    keystorePath: string;
+    /** Fingerprint of the keystore verifier, from `keystoreVerifierId`. */
+    verifierId: string;
+    /** The verified passphrase to cache. */
+    passphrase: string;
+    /** Lifetime in milliseconds. */
+    ttlMs: number;
+    /**
+     * Whether this session may be consumed for a mainnet (`bitcoin`) operation,
+     * from the `unlock --allow-mainnet` flag. Defaults to `false` (deny), so
+     * mainnet operations fall through to a per-use passphrase prompt (ADR 081).
+     */
+    allowMainnet?: boolean;
+}
+/**
+ * Writes the session file atomically at `0600` (temp sibling + rename), returning
+ * the written record so the caller can report expiry without re-reading. The
+ * caller is responsible for verifying the passphrase first; this only persists it.
+ */
+export declare function writeSession(sessionPath: string, input: WriteSessionInput): SessionFile;
+/**
+ * Deletes the session file and any crash-orphaned `writeFileAtomic` temp sibling
+ * (each of which would hold a plaintext passphrase). Idempotent; needs no
+ * passphrase. Returns whether a session file was present. Unlink is best-effort:
+ * it removes the name, it does not securely erase the bytes (see ADR 081).
+ */
+export declare function clearSession(sessionPath: string): boolean;
+/**
+ * Returns the cached passphrase for `keystorePath` when a live, matching session
+ * exists, else `undefined`. Never throws. A session that is expired, stale (the
+ * keystore passphrase rotated), future-dated, or malformed is pruned on read; a
+ * live session bound to a *different* keystore is left in place (it prompts for
+ * the current keystore instead).
+ *
+ * `isMainnetOperation` gates the one case the network is known at consumption: a
+ * live session that was not unlocked with `--allow-mainnet` is withheld from a
+ * `bitcoin` operation (returning `undefined` so the caller falls through to a
+ * per-use prompt) but *not* pruned, since it remains valid for the non-mainnet
+ * operations the operator unlocked for (ADR 081).
+ */
+export declare function readLiveSessionPassphrase(sessionPath: string, keystorePath: string, currentVerifierId: string | undefined, isMainnetOperation?: boolean): string | undefined;
+/** Public, redacted view of the session state for `keystore status`. Never emits the passphrase. */
+export interface SessionStatus {
+    active: boolean;
+    expiresAt?: number;
+    secondsRemaining?: number;
+    /** Whether the session may sign a mainnet operation prompt-free (unlocked with `--allow-mainnet`). */
+    allowMainnet?: boolean;
+}
+/**
+ * Reports whether a live session exists for `keystorePath` and its remaining
+ * lifetime, without decrypting, prompting, throwing, or emitting the passphrase.
+ * An expired, foreign, stale, or malformed session reports inactive. Read-only:
+ * unlike {@link readLiveSessionPassphrase}, it does not prune.
+ */
+export declare function readSessionStatus(sessionPath: string, keystorePath: string, currentVerifierId: string | undefined): SessionStatus;
+/**
+ * Parses a TTL string into milliseconds: a bare integer is seconds; an `s`, `m`,
+ * or `h` suffix scales it. Returns `undefined` for any malformed input. The
+ * caller applies the default, the 24h cap, and the `<= 0` rejection.
+ */
+export declare function parseTtlToMs(raw: string): number | undefined;
+//# sourceMappingURL=session.d.ts.map

package/dist/types/src/keystore/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/keystore/session.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;GAWG;AAEH,2CAA2C;AAC3C,eAAO,MAAM,eAAe,EAAG,CAAU,CAAC;AAE1C,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,QAAiB,CAAC;AACrD,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AACtD,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAc,OAAO,eAAe,CAAC;IACtC,QAAQ,EAAO,MAAM,CAAC;IACtB,UAAU,EAAK,MAAM,CAAC;IACtB,UAAU,EAAK,MAAM,CAAC;IACtB,YAAY,EAAG,OAAO,CAAC;IACvB,SAAS,EAAM,MAAM,CAAC;IACtB,SAAS,EAAM,MAAM,CAAC;IACtB,UAAU,EAAK,MAAM,CAAC;CACvB;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,YAAY,EAAI,MAAM,CAAC;IACvB,uEAAuE;IACvE,UAAU,EAAM,MAAM,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAM,MAAM,CAAC;IACvB,gCAAgC;IAChC,KAAK,EAAW,MAAM,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAG,OAAO,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,WAAW,CAevF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAWzD;AAqBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAU,MAAM,EAC3B,YAAY,EAAS,MAAM,EAC3B,iBAAiB,EAAI,MAAM,GAAG,SAAS,EACvC,kBAAkB,UAAQ,GACzB,MAAM,GAAG,SAAS,CAqBpB;AAED,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAc,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAU,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAG,MAAM,CAAC;IAC3B,sGAAsG;IACtG,YAAY,CAAC,EAAO,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAS,MAAM,EAC1B,YAAY,EAAQ,MAAM,EAC1B,iBAAiB,EAAG,MAAM,GAAG,SAAS,GACrC,aAAa,CAUf;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO5D"}

package/dist/types/src/paths.d.ts

@@ -17,6 +17,8 @@ export declare const ENV_HOME = "BTCR2_HOME";
 /** The config and keystore file names, kept side by side under the home root. */
 export declare const CONFIG_FILENAME = "config.json";
 export declare const KEYSTORE_FILENAME = "keystore.json";
+/** The session file name, holding the unlock agent's cached passphrase (ADR 081). */
+export declare const SESSION_FILENAME = "session.json";
 /**
  * Resolves the CLI home directory: the single root that holds `config.json` and
  * `keystore.json` side by side (ADR 079). Resolution order, highest wins:
@@ -51,4 +53,12 @@ export declare function defaultConfigPath(overrides?: PathOverrides): string;
  * function is the final fallback in that chain.
  */
 export declare function defaultKeystorePath(overrides?: PathOverrides): string;
+/**
+ * Session file path: `<home>/session.json`, where the unlock agent caches the
+ * keystore passphrase (ADR 081). Deliberately derived from the home root alone,
+ * never from `--config` / `--keystore` or the config file, so `keystore lock`
+ * can revoke a session even under a malformed config, and so the read and write
+ * paths always agree on one location per home.
+ */
+export declare function defaultSessionPath(overrides?: PathOverrides): string;
 //# sourceMappingURL=paths.d.ts.map

package/dist/types/src/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/paths.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,CAAC,EAAO,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAK,MAAM,CAAC;IACnB,qFAAqF;IACrF,QAAQ,CAAC,EAAG,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,iFAAiF;AACjF,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAI7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAErE"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/paths.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,IAAI,CAAC,EAAO,MAAM,CAAC;IACnB,sFAAsF;IACtF,MAAM,CAAC,EAAK,MAAM,CAAC;IACnB,qFAAqF;IACrF,QAAQ,CAAC,EAAG,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,iFAAiF;AACjF,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAI7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAQ5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,MAAM,CAEpE"}

package/dist/types/src/types.d.ts

@@ -4,6 +4,7 @@ import type { Btcr2DidDocument, ResolutionOptions } from '@did-btcr2/method';
 import type { DidResolutionResult } from '@web5/dids';
 import type { DoctorReport, EffectiveConfig } from './config.js';
 import type { ConfigIssue } from './config-schema.js';
+import type { SessionStatus } from './keystore/session.js';
 export type NetworkOption = 'bitcoin' | 'testnet3' | 'testnet4' | 'signet' | 'mutinynet' | 'regtest';
 export type OutputFormat = 'json' | 'text';
 /**
@@ -157,6 +158,7 @@ export type CommandResult = {
         established: boolean;
         keyCount: number;
         active: string | undefined;
+        session: SessionStatus;
     };
 } | {
     action: 'keystore-change-passphrase';
@@ -164,6 +166,19 @@ export type CommandResult = {
         path: string;
         rekeyed: number;
     };
+} | {
+    action: 'keystore-unlock';
+    data: {
+        keystore: string;
+        expiresAt: number;
+        ttlSeconds: number;
+    };
+} | {
+    action: 'keystore-lock';
+    data: {
+        path: string;
+        cleared: boolean;
+    };
 } | {
     action: 'profile-add';
     data: {

package/dist/types/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AACrG,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;AAErE,eAAO,MAAM,kBAAkB,EAAE,aAAa,EAE7C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG1E;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAG,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAS,gBAAgB,CAAC;IACxC,OAAO,EAAgB,cAAc,EAAE,CAAC;IACxC,eAAe,EAAQ,MAAM,CAAC;IAC9B,oBAAoB,EAAG,MAAM,CAAC;IAC9B,QAAQ,EAAe,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACvF;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GACjG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACzG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/F;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAChE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,uBAAuB,CAAA;KAAE,CAAA;CAAE,GACpI;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,WAAW,GAAG,KAAK,CAAA;KAAE,CAAA;CAAE,GACpF;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,uBAAuB,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GAC9J;IAAE,MAAM,EAAE,4BAA4B,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjF;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAW,YAAY,CAAC;IAC9B,OAAO,EAAU,OAAO,CAAC;IACzB,KAAK,EAAY,OAAO,CAAC;IACzB,IAAI,CAAC,EAAY,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,aAAa,CAAC,EAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAI,MAAM,CAAC;IACxB,YAAY,CAAC,EAAI,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAQ,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AACrG,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;AAErE,eAAO,MAAM,kBAAkB,EAAE,aAAa,EAE7C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG1E;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAG,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAS,gBAAgB,CAAC;IACxC,OAAO,EAAgB,cAAc,EAAE,CAAC;IACxC,eAAe,EAAQ,MAAM,CAAC;IAC9B,oBAAoB,EAAG,MAAM,CAAC;IAC9B,QAAQ,EAAe,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACvF;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GACjG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACzG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/F;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAChE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,uBAAuB,CAAA;KAAE,CAAA;CAAE,GACpI;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,WAAW,GAAG,KAAK,CAAA;KAAE,CAAA;CAAE,GACpF;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,uBAAuB,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,GACtL;IAAE,MAAM,EAAE,4BAA4B,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjF;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACrE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAW,YAAY,CAAC;IAC9B,OAAO,EAAU,OAAO,CAAC;IACzB,KAAK,EAAY,OAAO,CAAC;IACzB,IAAI,CAAC,EAAY,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,aAAa,CAAC,EAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAI,MAAM,CAAC;IACxB,YAAY,CAAC,EAAI,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAQ,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;CACzB"}