@dotrino/vault 0.92.0 → 0.93.1

package/src/enroll.js

@@ -272,7 +272,7 @@ export function createEnrollDesk ({
       return { ignored: true }
     }
     if (!pend || Date.now() > pend.exp) {
-      audit('rejected', { what: 'hello', reason: 'sin-sesion' })
+      audit('rejected', { what: 'hello', reason: 'no-session' })
       return fail(from, 'no pairing session open for that code', String(p?.sn || ''))
     }
     // La respuesta va FIRMADA por la maestra y el `sn` va dentro de lo firmado. Eso ata

package/src/env.js

@@ -64,14 +64,14 @@ export function serviceDir (vault, ns) {
   // Con dos, en cambio, elegir por el usuario sería adivinar cuál de sus cuentas usar — así
   // que se para y se dice cuáles hay. Eso es lo contrario de un repliegue: no se resuelve
   // una ambigüedad a la brava, se señala.
-  const donde = listEnrolled().filter((e) => !e.legacy && e.ns === ns)
-  if (donde.length === 1) return path.join(serviceRoot(), donde[0].vault, ns)
-  if (donde.length > 1) {
-    throw new Error(`"${ns}" is enrolled in more than one vault (${donde.map((e) => e.vault).join(', ')}): pick one with --vault <label>`)
+  const where = listEnrolled().filter((e) => !e.legacy && e.ns === ns)
+  if (where.length === 1) return path.join(serviceRoot(), where[0].vault, ns)
+  if (where.length > 1) {
+    throw new Error(`"${ns}" is enrolled in more than one vault (${where.map((e) => e.vault).join(', ')}): pick one with --vault <label>`)
   }
-  const otros = listEnrolled().filter((e) => !e.legacy)
-  throw new Error(otros.length
-    ? `"${ns}" is not enrolled on this machine (there is: ${otros.map((e) => `${e.vault}/${e.ns}`).join(', ')})`
+  const others = listEnrolled().filter((e) => !e.legacy)
+  throw new Error(others.length
+    ? `"${ns}" is not enrolled on this machine (there is: ${others.map((e) => `${e.vault}/${e.ns}`).join(', ')})`
     : `"${ns}" is not enrolled on this machine: run \`dotrino-env enroll --vault <label> --ns ${ns}\` first`)
 }
 
@@ -94,9 +94,9 @@ export function listEnrolled () {
     // Un enrolamiento del formato viejo es un directorio con `service-identity.json`
     // DENTRO; uno del nuevo tiene subdirectorios. Así se distinguen sin adivinar.
     if (readServiceIdentity(path.join(serviceRoot(), d.name))) { out.push({ legacy: true, ns: d.name }); continue }
-    let hijos = []
-    try { hijos = fs.readdirSync(path.join(serviceRoot(), d.name)) } catch (_) { continue }
-    for (const ns of hijos) {
+    let children = []
+    try { children = fs.readdirSync(path.join(serviceRoot(), d.name)) } catch (_) { continue }
+    for (const ns of children) {
       if (isValidSecretsNs(ns) && readServiceIdentity(path.join(serviceRoot(), d.name, ns))) out.push({ vault: d.name, ns })
     }
   }

package/src/index.js

@@ -72,7 +72,7 @@ export async function startDeviceVault (identity, { proxyUrl, client: injectedCl
    * Sin acta van nulos y `verifyDelegation` contesta `no-acta`: no hay con qué decidir, así
    * que no se decide que sí.
    */
-  async function contextoActa () {
+  async function actaContext () {
     const acta = (await identity.profileActa?.().catch(() => null))?.acta || null
     if (!acta) return { actaSeq: null, sealers: null }
     return { actaSeq: acta.seq, sealers: sealersOf(acta) }
@@ -81,7 +81,7 @@ export async function startDeviceVault (identity, { proxyUrl, client: injectedCl
   let _selfCert = null
   const getSelfCert = async () => {
     // Se rehace cuando el acta cambia, no cuando pasa el tiempo: el papel ya no caduca.
-    const { actaSeq } = await contextoActa()
+    const { actaSeq } = await actaContext()
     if (_selfCert && _selfCert.seq === actaSeq) return _selfCert
     const { cert } = await identity.signDelegation(iss, SIGN_SCOPE)
     _selfCert = cert
@@ -187,7 +187,7 @@ export async function startDeviceVault (identity, { proxyUrl, client: injectedCl
     if (typeof d.ts !== 'number' || Math.abs(Date.now() - d.ts) > FRESH_WINDOW_MS) {
       return send(from, { type: MSG.ERROR, error: 'stale request: ts outside the ±5 min window (possible replay, or the device clock is off)' })
     }
-    const chk = await verifyChain({ data: d, signature: p.signature, cert: p.cert, ...(await contextoActa()), revoked: await revocationSet() })
+    const chk = await verifyChain({ data: d, signature: p.signature, cert: p.cert, ...(await actaContext()), revoked: await revocationSet() })
     if (!chk.ok) return send(from, { type: MSG.ERROR, error: 'unauthorized: ' + chk.reason })
     // Reusar el label del cert original (si sigue registrado en delegations).
     const { issued } = await identity.listDelegations()
@@ -210,7 +210,7 @@ export async function startDeviceVault (identity, { proxyUrl, client: injectedCl
     const d = p?.data
     if (!d || !p.signature || !p.cert) return send(from, { type: MSG.ERROR, error: 'invalid request' })
     if (typeof d.ts !== 'number' || Math.abs(Date.now() - d.ts) > FRESH_WINDOW_MS) return
-    const chk = await verifyChain({ data: d, signature: p.signature, cert: p.cert, ...(await contextoActa()) })
+    const chk = await verifyChain({ data: d, signature: p.signature, cert: p.cert, ...(await actaContext()) })
     if (!chk.ok) return send(from, { type: MSG.ERROR, error: 'unauthorized: ' + chk.reason })
     const { issued, revoked, revokedCerts } = await identity.listDelegations()
     const devices = await Promise.all((issued || []).map(async (x) => ({
@@ -248,7 +248,7 @@ export async function startDeviceVault (identity, { proxyUrl, client: injectedCl
     const chk = await verifyChain({
       data: d, signature: p.signature, cert: p.cert,
       ...(expectedScope ? { expectedScope } : {}),
-      ...(await contextoActa()), revoked: await revocationSet(),
+      ...(await actaContext()), revoked: await revocationSet(),
     })
     if (!chk.ok) {
       send(from, { type: MSG.ERROR, error: 'unauthorized: ' + chk.reason })
@@ -261,7 +261,7 @@ export async function startDeviceVault (identity, { proxyUrl, client: injectedCl
     if (expectedScope) {
       const record = (await identity.profileActa?.().catch(() => null))?.acta || null
       if (record && !memberCanScope(record, chk.device, expectedScope)) {
-        send(from, { type: MSG.ERROR, error: 'unauthorized: acta — this member no longer has that permission' })
+        send(from, { type: MSG.ERROR, error: 'unauthorized: record — this member no longer has that permission' })
         return null
       }
     }
@@ -356,7 +356,7 @@ export async function startDeviceVault (identity, { proxyUrl, client: injectedCl
     if (p.type === MSG.HELLO) handle('hello', desk.handleHello(_from, p), _from)
     else if (p.type === MSG.ENROLL) handle('enroll', desk.handleEnroll(_from, p), _from)
     // Camino A: el aparato devuelve su acta sellada admitiendo a esta bóveda.
-    else if (p.type === MSG.ACTA_SEALED) handle('acta', desk.handleActaSealed(_from, p), _from)
+    else if (p.type === MSG.ACTA_SEALED) handle('record-sealed', desk.handleActaSealed(_from, p), _from)
     else if (p.type === MSG.RENEW) handle('renew', handleRenew(_from, p), _from)
     else if (p.type === MSG.DEVICES) handle('devices', handleDevices(_from, p), _from)
     // Lo que faltaba para que un aparato enrolado aquí pueda hacer lo mismo que contra

package/src/kek.js

@@ -182,21 +182,21 @@ function commandKey (dir, cfg, magic) {
  */
 export function assertSameMachine (dir, material, hasData) {
   const f = path.join(dir, MACHINE_FILE)
-  const huella = crypto.createHash('sha256').update('dotrino-atrest-machine\u0000' + material).digest('hex').slice(0, 32)
-  let previa = null
-  try { previa = fs.readFileSync(f, 'utf8').trim() } catch (_) {}
+  const fingerprint = crypto.createHash('sha256').update('dotrino-atrest-machine\u0000' + material).digest('hex').slice(0, 32)
+  let previous = null
+  try { previous = fs.readFileSync(f, 'utf8').trim() } catch (_) {}
 
-  if (previa && previa !== huella && hasData) {
+  if (previous && previous !== fingerprint && hasData) {
     throw new KekError('kek-machine-changed',
       'this data was written by a DIFFERENT machine and the key is derived from the machine itself, so it cannot be opened here. ' +
       'In a container this is usually the container id changing on every run: the fix is to stop deriving the key from the machine — ' +
       'give the profile a KMS provider (see docs/llaves-de-hardware.md) and re-create it, or restore this volume on the original host. ' +
       'Nothing was modified.')
   }
-  if (!previa) {
+  if (!previous) {
     try {
       fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
-      fs.writeFileSync(f, huella + '\n', { mode: 0o600 })
+      fs.writeFileSync(f, fingerprint + '\n', { mode: 0o600 })
     } catch (_) { /* si no se puede escribir la huella, no se bloquea el arranque */ }
   }
 }

package/src/localdesk.js

@@ -60,28 +60,28 @@ export async function connectLocal ({ masterId, timeoutMs = 3000 } = {}) {
     s.once('error', (e) => { clearTimeout(t); reject(new Error('no local vault desk at ' + socketPath + ': ' + e.message)) })
   })
 
-  const oyentes = new Set()
+  const listeners = new Set()
   let buf = ''
   sock.setEncoding('utf8')
   sock.on('data', (chunk) => {
     buf += chunk
     let i
     while ((i = buf.indexOf('\n')) >= 0) {
-      const linea = buf.slice(0, i); buf = buf.slice(i + 1)
-      if (!linea.trim()) continue
+      const line = buf.slice(0, i); buf = buf.slice(i + 1)
+      if (!line.trim()) continue
       let p = null
-      try { p = JSON.parse(linea) } catch (_) { continue }
+      try { p = JSON.parse(line) } catch (_) { continue }
       // `from` es el mismo para todo: al otro lado solo hay una bóveda.
-      for (const fn of oyentes) { try { fn('local', p) } catch (_) {} }
+      for (const fn of listeners) { try { fn('local', p) } catch (_) {} }
     }
   })
 
-  const enviar = (obj) => { sock.write(JSON.stringify(obj) + '\n') }
+  const send = (obj) => { sock.write(JSON.stringify(obj) + '\n') }
   return {
     local: true,
     token: 'local',
-    send: (_to, obj) => enviar(obj),
-    sendByPubkey: (_pub, obj) => enviar(obj),
+    send: (_to, obj) => send(obj),
+    sendByPubkey: (_pub, obj) => send(obj),
     // El mostrador local no pide identificarse: la puerta la abre el certificado que va
     // dentro de cada mensaje, igual que por el proxio. Identificarse ahí sirve para ser
     // DIRECCIONABLE, y aquí no hay a quién direccionar.
@@ -96,8 +96,8 @@ export async function connectLocal ({ masterId, timeoutMs = 3000 } = {}) {
     identifyAs: async () => ({ ok: true }),
     on: (ev, fn) => {
       if (ev !== 'message') return () => {}
-      oyentes.add(fn)
-      return () => oyentes.delete(fn)
+      listeners.add(fn)
+      return () => listeners.delete(fn)
     },
     close: () => { try { sock.destroy() } catch (_) {} }
   }

package/src/lock.js

@@ -42,7 +42,7 @@ export const HEARTBEAT_MS = 10_000
  *  carga o un disco de red lento no pueden costar que otro le quite el candado a uno vivo. */
 export const STALE_MS = 60_000
 
-const quienSoy = () => ({ pid: process.pid, host: os.hostname(), desde: Date.now() })
+const whoAmI = () => ({ pid: process.pid, host: os.hostname(), desde: Date.now() })
 
 /**
  * Toma el candado del directorio, o explica quién lo tiene y se rinde.
@@ -52,12 +52,12 @@ export function takeLock (dir, { staleMs = STALE_MS, heartbeatMs = HEARTBEAT_MS
   const f = path.join(dir, LOCK_FILE)
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
 
-  const intentar = () => {
+  const attemptOnce = () => {
     try {
       // 'wx' = O_CREAT|O_EXCL: o lo creo yo, o alguien lo tiene. Esa atomicidad es lo
       // único que aquí hace de exclusión.
       const fd = fs.openSync(f, 'wx', 0o600)
-      fs.writeSync(fd, JSON.stringify(quienSoy()))
+      fs.writeSync(fd, JSON.stringify(whoAmI()))
       fs.closeSync(fd)
       return true
     } catch (e) {
@@ -66,44 +66,44 @@ export function takeLock (dir, { staleMs = STALE_MS, heartbeatMs = HEARTBEAT_MS
     }
   }
 
-  if (!intentar()) {
-    const edad = (() => {
+  if (!attemptOnce()) {
+    const age = (() => {
       try { return Date.now() - fs.statSync(f).mtimeMs } catch (_) { return Infinity }
     })()
-    let dueño = null
-    try { dueño = JSON.parse(fs.readFileSync(f, 'utf8')) } catch (_) {}
+    let owner = null
+    try { owner = JSON.parse(fs.readFileSync(f, 'utf8')) } catch (_) {}
 
-    if (edad <= staleMs) {
+    if (age <= staleMs) {
       const e = new Error(
-        `another vault is running on this data (host ${dueño?.host || '?'}, process ${dueño?.pid ?? '?'}, ` +
-        `last heartbeat ${Math.round(edad / 1000)}s ago)`
+        `another vault is running on this data (host ${owner?.host || '?'}, process ${owner?.pid ?? '?'}, ` +
+        `last heartbeat ${Math.round(age / 1000)}s ago)`
       )
       e.code = 'vault-locked'
-      e.owner = dueño
+      e.owner = owner
       throw e
     }
     // Abandonado: se quita y se vuelve a intentar UNA vez. Si en ese hueco entró otro,
     // pierde este — que es lo correcto: dos que ven el candado viejo a la vez, solo uno
     // gana el `O_EXCL`.
     try { fs.unlinkSync(f) } catch (_) {}
-    if (!intentar()) {
+    if (!attemptOnce()) {
       const e = new Error('another vault took this data first')
       e.code = 'vault-locked'
       throw e
     }
   }
 
-  const latido = setInterval(() => {
+  const heartbeat = setInterval(() => {
     // `utimes` y no reescribir: tocar la fecha basta y no puede dejar el archivo a medias.
     try { fs.utimesSync(f, new Date(), new Date()) } catch (_) {}
   }, heartbeatMs)
-  latido.unref?.()
+  heartbeat.unref?.()
 
-  let suelto = false
+  let loose = false
   const release = () => {
-    if (suelto) return
-    suelto = true
-    clearInterval(latido)
+    if (loose) return
+    loose = true
+    clearInterval(heartbeat)
     // Solo se borra SI SIGUE SIENDO MÍO. Si otro me lo quitó por viejo, borrarlo aquí le
     // quitaría a él un candado que sí es suyo.
     try {

package/src/loginClient.js

@@ -54,18 +54,18 @@ export const WAKE_WAIT_MS = 30_000
  */
 function waitFor (transport, from, match, timeoutMs) {
   return new Promise((resolve, reject) => {
-    let listo = false
-    const fin = (fn, arg) => { if (!listo) { listo = true; clearTimeout(reloj); quitar(); fn(arg) } }
-    const reloj = setTimeout(() => fin(reject, err('no-answer', 'the vault did not answer in time')), timeoutMs)
-    const oyente = (quien, payload) => {
-      if (from && quien !== from) return
+    let ready = false
+    const fin = (fn, arg) => { if (!ready) { ready = true; clearTimeout(clock); remove(); fn(arg) } }
+    const clock = setTimeout(() => fin(reject, err('no-answer', 'the vault did not answer in time')), timeoutMs)
+    const listener = (who, payload) => {
+      if (from && who !== from) return
       const p = typeof payload === 'string' ? parseJson(payload) : payload
       if (p && match(p)) fin(resolve, p)
     }
-    const off = transport.on('message', oyente)
-    const quitar = () => {
+    const off = transport.on('message', listener)
+    const remove = () => {
       if (typeof off === 'function') return off()
-      transport.off?.('message', oyente)
+      transport.off?.('message', listener)
     }
   })
 }
@@ -103,8 +103,8 @@ export async function loginWithPassword ({ transport, address, password, label =
   let tokens = await transport.list(vaultChannel(code))
   // UNA BÓVEDA QUE DUERME (la de una Lambda): el proxio la está despertando y lo dice. Se
   // espera a que se anuncie en vez de contestar que esa cuenta no existe.
-  const hasta = Date.now() + WAKE_WAIT_MS
-  while (!tokens.length && tokens.waking && Date.now() < hasta) {
+  const until = Date.now() + WAKE_WAIT_MS
+  while (!tokens.length && tokens.waking && Date.now() < until) {
     await new Promise((resolve) => setTimeout(resolve, 2000))
     tokens = await transport.list(vaultChannel(code))
   }
@@ -115,25 +115,25 @@ export async function loginWithPassword ({ transport, address, password, label =
   // De una en una, y parando en cuanto la contraseña resulte estar mal: cada intento GASTA
   // uno del freno en la bóveda que lo atiende (`passwordLogins.js`), así que repartir el
   // mismo error entre las réplicas solo sirve para bloquearse en todas a la vez.
-  let ultimo = null
+  let last = null
   for (const token of tokens) {
     try {
-      return await unIntento({ transport, token, user, code, dir, password, label, timeoutMs, opaque })
+      return await oneAttempt({ transport, token, user, code, dir, password, label, timeoutMs, opaque })
     } catch (e) {
       // Se para: son cosas del que entra, y probar con otra bóveda no las arregla.
       if (e?.code === 'login-failed' || e?.code === 'too-many-tries' || e?.code === 'wrong-account' ||
           e?.code === 'bad-blob' || e?.code === 'bad-keys' || e?.code === 'bad-reply') throw e
-      ultimo = e   // «esa no atiende inicios de sesión», «no contestó»: quizá la siguiente sí
+      last = e   // «esa no atiende inicios de sesión», «no contestó»: quizá la siguiente sí
     }
   }
-  throw ultimo || err('no-vault', 'none of the vaults on that address could let you in')
+  throw last || err('no-vault', 'none of the vaults on that address could let you in')
 }
 
-async function unIntento ({ transport, token, user, code, dir, password, label, timeoutMs, opaque }) {
+async function oneAttempt ({ transport, token, user, code, dir, password, label, timeoutMs, opaque }) {
   const start = await opaque.loginStart({ password })
   transport.send(token, { type: MSG.LOGIN_START, user, request: start.request })
   const r1 = await waitFor(transport, token, (p) => p.type === MSG.LOGIN_RESPONSE || p.type === MSG.ERROR, timeoutMs)
-  if (r1.type === MSG.ERROR) throw deVuelta(r1)
+  if (r1.type === MSG.ERROR) throw back(r1)
 
   let fin
   try {
@@ -148,7 +148,7 @@ async function unIntento ({ transport, token, user, code, dir, password, label,
 
   transport.send(token, { type: MSG.LOGIN_FINISH, lid: r1.lid, finalization: fin.finalization, label })
   const ok = await waitFor(transport, token, (p) => p.type === MSG.LOGIN_OK || p.type === MSG.ERROR, timeoutMs)
-  if (ok.type === MSG.ERROR) throw deVuelta(ok)
+  if (ok.type === MSG.ERROR) throw back(ok)
 
   const acta = ok.acta
   const cert = ok.cert
@@ -168,9 +168,9 @@ async function unIntento ({ transport, token, user, code, dir, password, label,
   if (!keys?.sign) throw err('bad-blob', 'the key package does not carry a signing key')
 
   // 4. La llave que salió del paquete tiene que SER la del papel. Se prueba firmando.
-  const reto = { op: 'login.proof', sub: cert.sub, sid: ok.sid, ts: Date.now() }
-  const { signature } = await signWithDevice({ privateJwk: keys.sign, data: reto })
-  if (!(await verifyDeviceSig({ publickey: cert.sub, data: reto, signature }))) {
+  const challenge = { op: 'login.proof', sub: cert.sub, sid: ok.sid, ts: Date.now() }
+  const { signature } = await signWithDevice({ privateJwk: keys.sign, data: challenge })
+  if (!(await verifyDeviceSig({ publickey: cert.sub, data: challenge, signature }))) {
     throw err('bad-keys', 'the keys in the package are not the ones this certificate is for')
   }
 
@@ -196,7 +196,7 @@ async function unIntento ({ transport, token, user, code, dir, password, label,
 }
 
 /** Un error de la bóveda con su `code` intacto: `too-many-tries` se arregla esperando. */
-function deVuelta (p) {
+function back (p) {
   const code = p.code || 'login-error'
   const e = err(code, p.error || 'the vault refused the login')
   if (typeof p.waitMs === 'number') e.waitMs = p.waitMs
@@ -227,10 +227,10 @@ export async function closeLogin ({ transport, token, user, sid, publickey, priv
   if (typeof sign !== 'function' && !privateJwk && !privateKey) {
     throw err('no-signature', 'closeLogin: give it the device key (privateJwk/privateKey) or a sign(data)')
   }
-  const firmado = typeof sign === 'function'
+  const signed = typeof sign === 'function'
     ? await sign(data)
     : await signWithDevice({ privateJwk, privateKey, publickey, data })
-  const signature = typeof firmado === 'string' ? firmado : firmado?.signature
+  const signature = typeof signed === 'string' ? signed : signed?.signature
   if (typeof signature !== 'string') throw err('no-signature', 'closeLogin: sign(data) returned no signature')
   transport.send(token, { type: MSG.LOGIN_CLOSE, data, signature })
   try {

package/src/passwordLogins.js

@@ -67,7 +67,7 @@ export const loginAddress = (user, fingerprint) => `${user}@${accountCode(finger
  */
 export async function accountFingerprint (identity) {
   const pid = (await identity?.profileActa?.().catch(() => null))?.acta?.profileId
-  if (!pid) throw err('no-acta', 'this vault has no account record yet: there is no address to build')
+  if (!pid) throw err('no-record', 'this vault has no account record yet: there is no address to build')
   return (await pubkeyId(pid)).slice(0, 16)
 }
 
@@ -489,14 +489,14 @@ export async function registerLogin ({
   if (scope !== undefined) {
     throw Object.assign(new Error('registerLogin takes `caps` (account record permissions), not `scope`'), { code: 'use-caps' })
   }
-  const pedidos = [...new Set(Array.isArray(caps) ? caps : [])]
-  const raros = pedidos.filter((c) => !DEVICE_CAPS.includes(c))
-  if (!pedidos.length || raros.length) {
-    throw Object.assign(new Error(`not device permissions: ${raros.join(', ') || '(none)'} — expected any of ${DEVICE_CAPS.join(', ')}`), { code: 'bad-caps' })
+  const requests = [...new Set(Array.isArray(caps) ? caps : [])]
+  const oddOnes = requests.filter((c) => !DEVICE_CAPS.includes(c))
+  if (!requests.length || oddOnes.length) {
+    throw Object.assign(new Error(`not device permissions: ${oddOnes.join(', ') || '(none)'} — expected any of ${DEVICE_CAPS.join(', ')}`), { code: 'bad-caps' })
   }
   // El certificado lleva el scope de los permisos que lo tienen; los demás (`unattended`,
   // `passkeys`) viven solo en el acta, que es quien decide.
-  const scopes = pedidos.map((c) => capScope(c)).filter(Boolean)
+  const scopes = requests.map((c) => capScope(c)).filter(Boolean)
   if (typeof identity?.admitMember !== 'function') {
     throw Object.assign(new Error('this vault cannot add devices to the account record: no login was created'), { code: 'admit-unavailable' })
   }
@@ -504,9 +504,9 @@ export async function registerLogin ({
   await logins.registerFinish({ user, upload, pub, encPub, deviceId, label, blob })
   try {
     const { cert } = await identity.signDelegation(pub, scopes, { label: label || `login:${user}` })
-    await identity.admitMember({ pub, encPub, label: label || `login:${user}`, cn: null, caps: pedidos, cert })
+    await identity.admitMember({ pub, encPub, label: label || `login:${user}`, cn: null, caps: requests, cert })
     logins.setCert({ user, cert, iss: identity.me?.publickey || null })
-    return { ok: true, user, deviceId, cert, caps: pedidos }
+    return { ok: true, user, deviceId, cert, caps: requests }
   } catch (e) {
     // NADA DE MEDIAS ALTAS: si no entra en el acta, no queda un usuario que pueda entrar a
     // una cuenta que no lo reconoce. Se deshace y se dice.

package/src/proc.js

@@ -89,8 +89,8 @@ export function readProcContext (pid) {
  * Node, y entonces no hay nada que comprobar al otro lado.
  */
 export function selfContext () {
-  const medido = readProcContext(process.pid)
-  if (medido) return { ...medido, user: userName(), host: os.hostname() }
+  const measured = readProcContext(process.pid)
+  if (measured) return { ...measured, user: userName(), host: os.hostname() }
   const { argv, truncated } = trimArgv([process.execPath, ...process.argv.slice(1)])
   return {
     pid: process.pid,
@@ -111,9 +111,9 @@ export function selfContext () {
  * secretos, así que se refresca solo cuando cambia de máquina o de sistema.
  */
 export function selfMachine () {
-  const tipo = os.type()
-  const sistema = tipo === 'Darwin' ? 'macOS' : tipo === 'Windows_NT' ? 'Windows' : tipo
-  return cleanMachine({ kind: 'node', os: `${sistema} ${os.release()}`, name: os.hostname() })
+  const kind = os.type()
+  const system = kind === 'Darwin' ? 'macOS' : kind === 'Windows_NT' ? 'Windows' : kind
+  return cleanMachine({ kind: 'node', os: `${system} ${os.release()}`, name: os.hostname() })
 }
 
 const safeCwd = () => { try { return process.cwd() } catch (_) { return '' } }

package/src/procContext.js

@@ -90,8 +90,8 @@ export const sameCommand = (a, b) => {
 /** El comando en una línea, para un log o una pantalla estrecha. */
 export function commandLine (ctx, max = 160) {
   const argv = Array.isArray(ctx?.argv) ? ctx.argv : []
-  const linea = argv.length ? argv.join(' ') : (ctx?.exe || '')
-  return linea.length > max ? linea.slice(0, max - 1) + '…' : linea
+  const line = argv.length ? argv.join(' ') : (ctx?.exe || '')
+  return line.length > max ? line.slice(0, max - 1) + '…' : line
 }
 
 export default { sanitizeContext, commandFingerprint, sameCommand, commandLine, trimArgv }