@getmarrow/mcp 3.9.103 → 3.9.107

package/dist/seatbelt/env-names.js

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_NAME_CORPUS = void 0;
+exports.lastSegment = lastSegment;
+exports.secretEnvBase = secretEnvBase;
+exports.volumeHost = volumeHost;
+exports.mountSources = mountSources;
+exports.regexMatchesAny = regexMatchesAny;
+// Secret env file names in the forms the mapper reads besides a plain operand: the host side of a container bind mount, the names a find primary matches
+// and the names the stage in front of xargs lists. Pure string work (the mapper turns its words into these strings); no I/O, nothing from the command is
+// ever run, and the one pattern language it reads (find -regex) is matched by a bounded matcher, never by a RegExp built from the command.
+const tables_1 = require("./tables");
+/** The basename of a path as written (the last segment, a trailing slash ignored). */
+function lastSegment(text) {
+    const t = text.replace(/\/+$/, '');
+    return t.slice(t.lastIndexOf('/') + 1);
+}
+/**
+ * A basename the shared secret table reads as an env file: `.env`, `.env.<word>` (a template such as `.env.example` is not) and `.dev.vars`, whatever the case
+ * (the same case-blind reading the keyed policy has); `<name>.env` is `present`. The table stays the one source (src/secret-paths.ts): this only repeats
+ * its name rules for a word that is not yet a path.
+ */
+function secretEnvBase(base) {
+    const b = base.toLowerCase();
+    if (/^\.env(?:\.|$)/.test(b))
+        return tables_1.ENV_TEMPLATE_SUFFIX.test(b) ? null : 'secret';
+    if (b === '.dev.vars')
+        return 'secret';
+    if (b.length > 4 && b.endsWith('.env'))
+        return 'present';
+    return null;
+}
+/** Names a glob that cannot be listed is judged against, besides the mapper's own samples: common secret env names a project holds. */
+exports.ENV_NAME_CORPUS = [
+    '.env.staging', '.env.development', '.env.dev', '.env.prod', '.env.test', '.env.ci', '.env.dist', '.env.defaults', '.env.default', '.env.backup', '.env.bak',
+    '.env.old', '.env.secret', '.env.secrets', '.env.private', '.env.production.local', '.env.development.local', '.env.test.local', '.env.local.bak',
+    '.env.myapp', '.env.docker', '.env.compose', 'config.env', 'prod.env', 'dev.env', 'staging.env', 'local.env', 'secrets.env', 'docker.env',
+];
+/** The host side of a `-v`/`--volume` value `host:container[:options]`: the text before the first colon; null with no colon (an anonymous volume) or an empty host. */
+function volumeHost(value) {
+    const at = value.indexOf(':');
+    return at > 0 ? value.slice(0, at) : null;
+}
+/** The `source=` / `src=` values of a `--mount` value (comma-separated `key=value` fields): every one, a repeated key included, whatever the mount type. */
+function mountSources(value) {
+    const out = [];
+    for (const field of value.split(',')) {
+        const m = field.trim().replace(/^["']|["']$/g, '').match(/^(?:source|src)\s*=\s*([\s\S]*)$/i);
+        if (m)
+            out.push(m[1].trim().replace(/^["']|["']$/g, ''));
+    }
+    return out;
+}
+class Unreadable extends Error {
+}
+class OutOfSteps extends Error {
+}
+const MAX_PATTERN = 400;
+const MAX_STEPS = 200_000;
+const MAX_INTERVAL = 32;
+const CLASSES = {
+    alpha: [['a', 'z'], ['A', 'Z']], digit: [['0', '9']], alnum: [['a', 'z'], ['A', 'Z'], ['0', '9']], upper: [['A', 'Z']], lower: [['a', 'z']],
+    punct: [['!', '/'], [':', '@'], ['[', '`'], ['{', '~']], space: [[' ', ' '], ['\t', '\r']], blank: [[' ', ' '], ['\t', '\t']], xdigit: [['0', '9'], ['a', 'f'], ['A', 'F']],
+    word: [['a', 'z'], ['A', 'Z'], ['0', '9'], ['_', '_']], cntrl: [['\u0000', '\u001f']], graph: [['!', '~']], print: [[' ', '~']],
+};
+const ESCAPE_SETS = {
+    w: { neg: false, cls: 'word' }, W: { neg: true, cls: 'word' }, s: { neg: false, cls: 'space' }, S: { neg: true, cls: 'space' }, d: { neg: false, cls: 'digit' }, D: { neg: true, cls: 'digit' },
+};
+function parseRegex(p, emacs) {
+    if (p.length > MAX_PATTERN)
+        throw new Unreadable();
+    let i = 0;
+    let depth = 0;
+    const atAlt = () => (emacs ? p.startsWith('\\|', i) : p[i] === '|');
+    const atClose = () => depth > 0 && (emacs ? p.startsWith('\\)', i) : p[i] === ')');
+    const parseAlt = () => {
+        const branches = [parseCat()];
+        while (i < p.length && atAlt()) {
+            i += emacs ? 2 : 1;
+            branches.push(parseCat());
+        }
+        return branches.length === 1 ? branches[0] : { t: 'alt', n: branches };
+    };
+    const parseBracket = () => {
+        i += 1;
+        let neg = false;
+        if (p[i] === '^') {
+            neg = true;
+            i += 1;
+        }
+        const items = [];
+        let first = true;
+        for (;;) {
+            if (i >= p.length)
+                throw new Unreadable();
+            const c = p[i];
+            if (c === ']' && !first) {
+                i += 1;
+                break;
+            }
+            first = false;
+            if (c === '[' && p[i + 1] === ':') {
+                const end = p.indexOf(':]', i + 2);
+                const cls = end < 0 ? undefined : CLASSES[p.slice(i + 2, end)];
+                if (!cls)
+                    throw new Unreadable();
+                items.push(...cls);
+                i = end + 2;
+                continue;
+            }
+            if (c === '[' && (p[i + 1] === '.' || p[i + 1] === '='))
+                throw new Unreadable();
+            if (c === '\\' && i + 1 < p.length && ESCAPE_SETS[p[i + 1]] && !ESCAPE_SETS[p[i + 1]].neg) {
+                items.push(...CLASSES[ESCAPE_SETS[p[i + 1]].cls]);
+                i += 2;
+                continue;
+            }
+            if (p[i + 1] === '-' && i + 2 < p.length && p[i + 2] !== ']') {
+                items.push([c, p[i + 2]]);
+                i += 3;
+                continue;
+            }
+            items.push([c, c]);
+            i += 1;
+        }
+        return { t: 'set', neg, items };
+    };
+    const interval = () => {
+        const m = (emacs ? p.slice(i).match(/^\\\{(\d+)(,(\d*))?\\\}/) : p.slice(i).match(/^\{(\d+)(,(\d*))?\}/));
+        if (!m)
+            return null;
+        const min = Number(m[1]);
+        const max = m[2] === undefined ? min : m[3] === '' ? Number.POSITIVE_INFINITY : Number(m[3]);
+        if (min > MAX_INTERVAL || (Number.isFinite(max) && max > MAX_INTERVAL) || max < min)
+            throw new Unreadable();
+        i += m[0].length;
+        return { min, max };
+    };
+    const parseAtom = () => {
+        const c = p[i];
+        if (c === '.') {
+            i += 1;
+            return { t: 'any' };
+        }
+        if (c === '[')
+            return parseBracket();
+        if (c === '^' || c === '$') {
+            i += 1;
+            return { t: 'empty' };
+        }
+        if (!emacs && c === '(') {
+            i += 1;
+            depth += 1;
+            const n = parseAlt();
+            if (p[i] !== ')')
+                throw new Unreadable();
+            i += 1;
+            depth -= 1;
+            return n;
+        }
+        if (c === '\\') {
+            if (i + 1 >= p.length)
+                throw new Unreadable();
+            const d = p[i + 1];
+            if (emacs && d === '(') {
+                i += 2;
+                depth += 1;
+                const n = parseAlt();
+                if (!p.startsWith('\\)', i))
+                    throw new Unreadable();
+                i += 2;
+                depth -= 1;
+                return n;
+            }
+            if (/[1-9]/.test(d))
+                throw new Unreadable();
+            if (ESCAPE_SETS[d]) {
+                i += 2;
+                return { t: 'set', neg: ESCAPE_SETS[d].neg, items: CLASSES[ESCAPE_SETS[d].cls] };
+            }
+            if (d === 'b' || d === 'B' || d === '<' || d === '>' || d === '`' || d === "'") {
+                i += 2;
+                return { t: 'empty' };
+            }
+            i += 2;
+            return { t: 'lit', c: d };
+        }
+        i += 1;
+        return { t: 'lit', c };
+    };
+    const parseCat = () => {
+        const items = [];
+        while (i < p.length && !atAlt() && !atClose()) {
+            let atom;
+            // an operator with nothing in front of it is an ordinary character
+            if ((p[i] === '*' || p[i] === '+' || p[i] === '?') && items.length === 0) {
+                atom = { t: 'lit', c: p[i] };
+                i += 1;
+            }
+            else
+                atom = parseAtom();
+            for (;;) {
+                const c = p[i];
+                if (c === '*') {
+                    i += 1;
+                    atom = { t: 'rep', n: atom, min: 0, max: Number.POSITIVE_INFINITY };
+                    continue;
+                }
+                if (c === '+') {
+                    i += 1;
+                    atom = { t: 'rep', n: atom, min: 1, max: Number.POSITIVE_INFINITY };
+                    continue;
+                }
+                if (c === '?') {
+                    i += 1;
+                    atom = { t: 'rep', n: atom, min: 0, max: 1 };
+                    continue;
+                }
+                if (emacs && (p.startsWith('\\+', i) || p.startsWith('\\?', i))) {
+                    atom = { t: 'rep', n: atom, min: p[i + 1] === '+' ? 1 : 0, max: p[i + 1] === '+' ? Number.POSITIVE_INFINITY : 1 };
+                    i += 2;
+                    continue;
+                }
+                const iv = c === '{' || c === '\\' ? interval() : null;
+                if (iv) {
+                    atom = { t: 'rep', n: atom, min: iv.min, max: iv.max };
+                    continue;
+                }
+                break;
+            }
+            items.push(atom);
+        }
+        return items.length === 1 ? items[0] : { t: 'cat', n: items };
+    };
+    const node = parseAlt();
+    if (i < p.length)
+        throw new Unreadable();
+    return node;
+}
+function matchNode(node, s, i, k, st) {
+    st.steps += 1;
+    if (st.steps > MAX_STEPS)
+        throw new OutOfSteps();
+    switch (node.t) {
+        case 'empty': return k(i);
+        case 'any': return i < s.length && k(i + 1);
+        case 'lit': return i < s.length && (st.ci ? s[i].toLowerCase() === node.c.toLowerCase() : s[i] === node.c) && k(i + 1);
+        case 'set': {
+            if (i >= s.length)
+                return false;
+            const ch = s[i];
+            const chs = st.ci ? [ch.toLowerCase(), ch.toUpperCase()] : [ch];
+            const inSet = chs.some((c) => node.items.some(([lo, hi]) => c >= lo && c <= hi));
+            return inSet !== node.neg && k(i + 1);
+        }
+        case 'cat': {
+            const step = (idx, at) => (idx === node.n.length ? k(at) : matchNode(node.n[idx], s, at, (j) => step(idx + 1, j), st));
+            return step(0, i);
+        }
+        case 'alt': return node.n.some((alt) => matchNode(alt, s, i, k, st));
+        case 'rep': {
+            const again = (count, at) => {
+                if (count < node.max && matchNode(node.n, s, at, (j) => (j === at && count >= node.min ? false : again(count + 1, j)), st))
+                    return true;
+                return count >= node.min && k(at);
+            };
+            return again(0, i);
+        }
+    }
+}
+/**
+ * Whether a find `-regex` pattern matches any of the candidate paths (the whole path, as find matches it), read as emacs and as extended syntax.
+ * `unsure`: neither reading could be completed (unreadable syntax, too large, out of steps) and none matched.
+ */
+function regexMatchesAny(pattern, candidates) {
+    let unsure = false;
+    for (const emacs of [true, false]) {
+        let node;
+        try {
+            node = parseRegex(pattern, emacs);
+        }
+        catch {
+            unsure = true;
+            continue;
+        }
+        const st = { steps: 0, ci: true };
+        try {
+            for (const c of candidates)
+                if (c.length <= 300 && matchNode(node, c, 0, (j) => j === c.length, st))
+                    return 'yes';
+        }
+        catch {
+            unsure = true;
+        }
+    }
+    return unsure ? 'unsure' : 'no';
+}
+//# sourceMappingURL=env-names.js.map

package/dist/seatbelt/env-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-names.js","sourceRoot":"","sources":["../../src/seatbelt/env-names.ts"],"names":[],"mappings":";;;AASA,kCAGC;AAOD,sCAMC;AAUD,gCAGC;AAGD,oCAOC;AAwKD,0CAWC;AAnOD,yJAAyJ;AACzJ,yJAAyJ;AACzJ,2IAA2I;AAC3I,qCAA+C;AAK/C,sFAAsF;AACtF,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,4BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnF,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uIAAuI;AAC1H,QAAA,eAAe,GAAsB;IAChD,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU;IAC5J,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,gBAAgB;IACjJ,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY;CAC1I,CAAC;AAEF,uKAAuK;AACvK,SAAgB,UAAU,CAAC,KAAa;IACtC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,4JAA4J;AAC5J,SAAgB,YAAY,CAAC,KAAa;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC9F,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD,MAAM,UAAW,SAAQ,KAAK;CAAG;AACjC,MAAM,UAAW,SAAQ,KAAK;CAAG;AAEjC,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,OAAO,GAA4C;IACvD,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3I,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3K,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;CAChI,CAAC;AACF,MAAM,WAAW,GAAkD;IACjE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;CAChM,CAAC;AAEF,SAAS,UAAU,CAAC,CAAS,EAAE,KAAc;IAC3C,IAAI,CAAC,CAAC,MAAM,GAAG,WAAW;QAAE,MAAM,IAAI,UAAU,EAAE,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,MAAM,QAAQ,GAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,EAAE,EAAE,CAAC;YAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC;QAClF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,GAAS,EAAE;QAC9B,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,IAAI,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACzC,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,SAAS,CAAC;YACR,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,IAAI,UAAU,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;YAC3C,KAAK,GAAG,KAAK,CAAC;YACd,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACnC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/D,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,UAAU,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBACnB,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,MAAM,IAAI,UAAU,EAAE,CAAC;YAChF,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC9G,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAwC,EAAE;QACzD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC1G,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,GAAG,GAAG,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,YAAY,CAAC,IAAI,GAAG,GAAG,GAAG;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAC5G,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,YAAY,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,CAAC,IAAI,CAAC,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC;YACnB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,MAAM,IAAI,UAAU,EAAE,CAAC;YACzC,CAAC,IAAI,CAAC,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC;YACnB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,MAAM,IAAI,UAAU,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,IAAI,KAAK,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACvB,CAAC,IAAI,CAAC,CAAC;gBAAC,KAAK,IAAI,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;oBAAE,MAAM,IAAI,UAAU,EAAE,CAAC;gBACpD,CAAC,IAAI,CAAC,CAAC;gBAAC,KAAK,IAAI,CAAC,CAAC;gBACnB,OAAO,CAAC,CAAC;YACX,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,UAAU,EAAE,CAAC;YAC5C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,CAAC;YACjH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;YAAC,CAAC;YAClH,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;QACP,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,MAAM,KAAK,GAAW,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,IAAU,CAAC;YACf,mEAAmE;YACnE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;;gBAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YAC5I,SAAS,CAAC;gBACR,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;oBAAC,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;oBAAC,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;oBAAC,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAClF,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzM,MAAM,EAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACvD,IAAI,EAAE,EAAE,CAAC;oBAAC,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC7E,MAAM;YACR,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAU,EAAE,CAAS,EAAE,CAAS,EAAE,CAAyB,EAAE,EAAkC;IAChH,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC;IACd,IAAI,EAAE,CAAC,KAAK,GAAG,SAAS;QAAE,MAAM,IAAI,UAAU,EAAE,CAAC;IACjD,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC;QACf,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvH,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAChC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,OAAO,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAU,EAAW,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAChJ,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAU,EAAW,EAAE;gBACnD,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACxI,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACpC,CAAC,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,OAAe,EAAE,UAA6B;IAC5E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAClC,IAAI,IAAU,CAAC;QACf,IAAI,CAAC;YAAC,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7E,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,UAAU;gBAAE,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;QACpH,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC"}

package/dist/seatbelt/fallback-copy.d.ts

@@ -0,0 +1,16 @@
+/** The reason codes of the resolver that can explain a fallback, in the order the text picks one. */
+declare const REASON_ORDER: readonly ["strict", "key_rejected", "home_unknown", "home_unusable", "env_home_unusable", "home_mismatch", "evidence_unknown"];
+export type FallbackReason = typeof REASON_ORDER[number];
+export declare const FALLBACK_OTHER = "setup_unconfirmed";
+/** The one code that explains the fallback: the first of the resolver's reasons in the fixed order, else the generic code. */
+export declare function pickFallbackReason(reasons: unknown): FallbackReason | typeof FALLBACK_OTHER;
+/** The sentence both fallback texts share. Fixed words only: no path, value or user name. */
+export declare function fallbackSentence(code?: string | null): string;
+/** The code printed after "Code:" / "mode:" for a pick. */
+export declare function fallbackCode(code?: string | null): string;
+/** The hold text for a protected action when the fallback is on and the seatbelt did not answer. */
+export declare function setupUnconfirmedText(code?: string | null): string;
+/** Every hold text setupUnconfirmedText can return: one per row of the table, generated from it and from no input. */
+export declare function setupUnconfirmedTexts(): string[];
+export {};
+//# sourceMappingURL=fallback-copy.d.ts.map

package/dist/seatbelt/fallback-copy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback-copy.d.ts","sourceRoot":"","sources":["../../src/seatbelt/fallback-copy.ts"],"names":[],"mappings":"AAOA,qGAAqG;AACrG,QAAA,MAAM,YAAY,gIAAiI,CAAC;AACpJ,MAAM,MAAM,cAAc,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,cAAc,sBAAsB,CAAC;AA0BlD,8HAA8H;AAC9H,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,GAAG,OAAO,cAAc,CAI3F;AAMD,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAG7D;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEzD;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEjE;AAED,sHAAsH;AACtH,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD"}

package/dist/seatbelt/fallback-copy.js

@@ -0,0 +1,68 @@
+"use strict";
+// Words for the keyless fallback: why a machine without a key is in the stricter `claimed_no_key`
+// mode with no sign of an account, and what the person at the machine can do about it.
+//
+// Text only. The mode itself is decided by resolveSeatbeltMode() (src/seatbelt-mode.ts); this module
+// reads the reason codes it already computed and never changes a mode or a decision. A resolution
+// without a known reason gets the generic row (code `setup_unconfirmed`).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FALLBACK_OTHER = void 0;
+exports.pickFallbackReason = pickFallbackReason;
+exports.fallbackSentence = fallbackSentence;
+exports.fallbackCode = fallbackCode;
+exports.setupUnconfirmedText = setupUnconfirmedText;
+exports.setupUnconfirmedTexts = setupUnconfirmedTexts;
+/** The reason codes of the resolver that can explain a fallback, in the order the text picks one. */
+const REASON_ORDER = ['strict', 'key_rejected', 'home_unknown', 'home_unusable', 'env_home_unusable', 'home_mismatch', 'evidence_unknown'];
+exports.FALLBACK_OTHER = 'setup_unconfirmed';
+const DOCTOR = 'npx -y @getmarrow/install@latest doctor';
+const REASON_TEXT = {
+    strict: 'MARROW_SEATBELT_STRICT=1 is set',
+    key_rejected: 'the Marrow key on this machine was rejected',
+    home_unknown: 'it cannot find your login home folder (common in containers that run as a user with no home)',
+    home_unusable: 'your login home folder is missing, is not a folder, or is /',
+    env_home_unusable: 'HOME points to a folder that is missing, is not a folder, or is /',
+    home_mismatch: 'HOME is not your login home folder',
+    evidence_unknown: 'a folder or file it checks (your home folder, ~/.marrow, or an agent folder such as ~/.claude) belongs to another user, can be written by other users, or could not be read',
+    [exports.FALLBACK_OTHER]: 'it could not confirm this machine\'s setup',
+};
+const FIX_TEXT = {
+    strict: 'unset MARROW_SEATBELT_STRICT',
+    key_rejected: `run ${DOCTOR}`,
+    home_unknown: 'run the agent as a user that has a home folder',
+    home_unusable: 'give this user a real home folder',
+    env_home_unusable: 'set HOME to your login home folder',
+    home_mismatch: 'start the agent with HOME set to your login home folder',
+    evidence_unknown: 'make sure your home folder, ~/.marrow and your agent folders (such as ~/.claude) belong to you and can be read, then run chmod go-w on them',
+    [exports.FALLBACK_OTHER]: `run ${DOCTOR}`,
+};
+/** The one code that explains the fallback: the first of the resolver's reasons in the fixed order, else the generic code. */
+function pickFallbackReason(reasons) {
+    if (!Array.isArray(reasons))
+        return exports.FALLBACK_OTHER;
+    for (const code of REASON_ORDER)
+        if (reasons.includes(code))
+            return code;
+    return exports.FALLBACK_OTHER;
+}
+function known(code) {
+    return typeof code === 'string' && Object.prototype.hasOwnProperty.call(REASON_TEXT, code) ? code : exports.FALLBACK_OTHER;
+}
+/** The sentence both fallback texts share. Fixed words only: no path, value or user name. */
+function fallbackSentence(code) {
+    const picked = known(code);
+    return `Marrow uses its stricter no-key mode here because ${REASON_TEXT[picked]}. Fix (for the person at this machine, not the agent): ${FIX_TEXT[picked]}, or add a Marrow key (getmarrow.ai/docs#start-here).`;
+}
+/** The code printed after "Code:" / "mode:" for a pick. */
+function fallbackCode(code) {
+    return known(code);
+}
+/** The hold text for a protected action when the fallback is on and the seatbelt did not answer. */
+function setupUnconfirmedText(code) {
+    return `Marrow stopped this action: there is no Marrow key on this machine, and ${fallbackSentence(code)} Agent: do not retry it another way and do not edit Marrow settings; tell the user why it was stopped. Code: ${fallbackCode(code)}.`;
+}
+/** Every hold text setupUnconfirmedText can return: one per row of the table, generated from it and from no input. */
+function setupUnconfirmedTexts() {
+    return Object.keys(REASON_TEXT).map((code) => setupUnconfirmedText(code));
+}
+//# sourceMappingURL=fallback-copy.js.map

package/dist/seatbelt/fallback-copy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fallback-copy.js","sourceRoot":"","sources":["../../src/seatbelt/fallback-copy.ts"],"names":[],"mappings":";AAAA,kGAAkG;AAClG,uFAAuF;AACvF,EAAE;AACF,qGAAqG;AACrG,kGAAkG;AAClG,0EAA0E;;;AAiC1E,gDAIC;AAOD,4CAGC;AAGD,oCAEC;AAGD,oDAEC;AAGD,sDAEC;AA5DD,qGAAqG;AACrG,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,CAAU,CAAC;AAGvI,QAAA,cAAc,GAAG,mBAAmB,CAAC;AAElD,MAAM,MAAM,GAAG,yCAAyC,CAAC;AAEzD,MAAM,WAAW,GAA2D;IAC1E,MAAM,EAAE,iCAAiC;IACzC,YAAY,EAAE,6CAA6C;IAC3D,YAAY,EAAE,8FAA8F;IAC5G,aAAa,EAAE,6DAA6D;IAC5E,iBAAiB,EAAE,mEAAmE;IACtF,aAAa,EAAE,oCAAoC;IACnD,gBAAgB,EAAE,6KAA6K;IAC/L,CAAC,sBAAc,CAAC,EAAE,4CAA4C;CAC/D,CAAC;AAEF,MAAM,QAAQ,GAA2D;IACvE,MAAM,EAAE,8BAA8B;IACtC,YAAY,EAAE,OAAO,MAAM,EAAE;IAC7B,YAAY,EAAE,gDAAgD;IAC9D,aAAa,EAAE,mCAAmC;IAClD,iBAAiB,EAAE,oCAAoC;IACvD,aAAa,EAAE,yDAAyD;IACxE,gBAAgB,EAAE,6IAA6I;IAC/J,CAAC,sBAAc,CAAC,EAAE,OAAO,MAAM,EAAE;CAClC,CAAC;AAEF,8HAA8H;AAC9H,SAAgB,kBAAkB,CAAC,OAAgB;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,sBAAc,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACzE,OAAO,sBAAc,CAAC;AACxB,CAAC;AAED,SAAS,KAAK,CAAC,IAAa;IAC1B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAsB,CAAC,CAAC,CAAC,sBAAc,CAAC;AACvI,CAAC;AAED,6FAA6F;AAC7F,SAAgB,gBAAgB,CAAC,IAAoB;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,qDAAqD,WAAW,CAAC,MAAM,CAAC,0DAA0D,QAAQ,CAAC,MAAM,CAAC,uDAAuD,CAAC;AACnN,CAAC;AAED,2DAA2D;AAC3D,SAAgB,YAAY,CAAC,IAAoB;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,oGAAoG;AACpG,SAAgB,oBAAoB,CAAC,IAAoB;IACvD,OAAO,2EAA2E,gBAAgB,CAAC,IAAI,CAAC,gHAAgH,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;AAChP,CAAC;AAED,sHAAsH;AACtH,SAAgB,qBAAqB;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC"}

package/dist/seatbelt/hook.d.ts

@@ -16,9 +16,11 @@ export declare const CLAIMED_NO_KEY_TEXT = "Marrow is linked to an account but h
  * `claimed_no_key` with no account evidence and no rejected key: a fallback because the machine's
  * setup could not be confirmed (an evidence dir others can write, an unreadable probe, a home
  * mismatch, strict mode). Same holds as CLAIMED_NO_KEY_TEXT, but it never claims an account exists.
+ * This constant is the generic wording; a hold names its reason (setupUnconfirmedText, fallback-copy.ts).
  */
-export declare const SETUP_UNCONFIRMED_TEXT = "Marrow has no working key on this machine and its keyless mode is off here (strict mode, or a home folder it cannot trust); owner: run `npx -y @getmarrow/install@latest doctor`.";
-export declare function seatbeltStopText(category: string, rule: string, reason: string, mode: 'seatbelt' | 'claimed_no_key' | 'account', accountLinked?: boolean): string;
+export declare const SETUP_UNCONFIRMED_TEXT: string;
+/** `modeReason`: the fixed code that explains a fallback (pickFallbackReason); only read when the machine is not account-linked. */
+export declare function seatbeltStopText(category: string, rule: string, reason: string, mode: 'seatbelt' | 'claimed_no_key' | 'account', accountLinked?: boolean, modeReason?: string): string;
 /** §4.2: an S0-S5 floor stop is lifted only by an enforced server allow (a verified permit); an advisory allow never lifts it. */
 export declare function accountFloorStops(rollout: 'watch' | 'on', floor: Pick<SeatbeltDecision, 'decision'> | null, server: 'enforced_allow' | 'advisory_allow' | 'deny' | 'none'): boolean;
 /** The mapper's file view over the host. Missing: null. A failure the mapper must not guess about throws (it stops on fs_error). */
@@ -49,9 +51,26 @@ export interface KeylessOutcome {
      * the hook gives master's answer for that host instead of the seatbelt pass.
      */
     recognized: boolean;
+    /**
+     * Why the machine is in the stricter fallback: one fixed code from the resolver's reasons, or
+     * `setup_unconfirmed`. Words only: it never changes the mode or a decision.
+     */
+    modeReason: string;
 }
 /** The keyless branch of the hook: mode (U4), then the mapper (U2) with the U3 resolvers. Never throws. */
 export declare function keylessSeatbelt(harness: string, event: SeatbeltHookEvent): KeylessOutcome;
+export interface SeatbeltStatus {
+    mode: 'seatbelt' | 'claimed_no_key' | 'account';
+    reasons: string[];
+}
+/**
+ * What `marrow-mcp seatbelt-status` prints (the installer's doctor reads it): the mode this machine's
+ * hook would be in right now, from the same resolution the keyless hook runs (same key lookup, same
+ * rollout table), and the resolver's reason codes that are on a closed list. Reads only; writes no file
+ * or state, opens no connection, and names no key, path, user or environment value. Throws when the
+ * resolution does (the caller prints the unknown line).
+ */
+export declare function seatbeltStatus(): SeatbeltStatus;
 /**
  * The account floor. `watch`: computed after the answer, for the record only; it never throws and
  * never writes output. `on` (not active): run before the server flow; a returned text is a stop.

package/dist/seatbelt/hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/seatbelt/hook.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAe,UAAU,IAAI,QAAQ,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;CAGrG,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,eAAO,MAAM,mBAAmB,iHAAiH,CAAC;AAClJ;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,sLAAsL,CAAC;AAmB1N,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,EAAE,aAAa,UAAO,GAAG,MAAM,CAO9J;AAED,kIAAkI;AAClI,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG,IAAI,EAChD,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAC5D,OAAO,CAGT;AAuBD,oIAAoI;AACpI,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,CA+BtD;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,WAAW,CA6ElG;AAcD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,4GAA4G;IAC5G,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA6BD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oHAAoH;IACpH,aAAa,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,cAAc,CA8BzF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwBzG;AAKD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,CAmBlI"}
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/seatbelt/hook.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAe,UAAU,IAAI,QAAQ,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAIjD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,KAAK,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;CAGrG,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,eAAO,MAAM,mBAAmB,iHAAiH,CAAC;AAClJ;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AA8B3E,oIAAoI;AACpI,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,EAAE,aAAa,UAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAQnL;AAED,kIAAkI;AAClI,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,GAAG,IAAI,EACvB,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG,IAAI,EAChD,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAC5D,OAAO,CAGT;AAuBD,oIAAoI;AACpI,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,CA+BtD;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,WAAW,CA6ElG;AAcD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,4GAA4G;IAC5G,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AA6BD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oHAAoH;IACpH,aAAa,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,cAAc,CAiCzF;AAKD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,cAAc,CAM/C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAwBzG;AAKD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;CAAE,CAmBlI"}

package/dist/seatbelt/hook.js

@@ -6,8 +6,10 @@ exports.accountFloorStops = accountFloorStops;
 exports.hostMapperFs = hostMapperFs;
 exports.hostSeatbeltGit = hostSeatbeltGit;
 exports.keylessSeatbelt = keylessSeatbelt;
+exports.seatbeltStatus = seatbeltStatus;
 exports.accountFloor = accountFloor;
 exports.outageRisk = outageRisk;
+const fallback_copy_1 = require("./fallback-copy");
 /**
  * Compiled-in rollout table. Not env, not a file: changing a value is a one-line, reviewed code
  * change. `keyless: 'off'` makes every keyless machine `claimed_no_key` (3.9.103 holds plus the
@@ -24,14 +26,15 @@ exports.CLAIMED_NO_KEY_TEXT = 'Marrow is linked to an account but has no working
  * `claimed_no_key` with no account evidence and no rejected key: a fallback because the machine's
  * setup could not be confirmed (an evidence dir others can write, an unreadable probe, a home
  * mismatch, strict mode). Same holds as CLAIMED_NO_KEY_TEXT, but it never claims an account exists.
+ * This constant is the generic wording; a hold names its reason (setupUnconfirmedText, fallback-copy.ts).
  */
-exports.SETUP_UNCONFIRMED_TEXT = 'Marrow has no working key on this machine and its keyless mode is off here (strict mode, or a home folder it cannot trust); owner: run `npx -y @getmarrow/install@latest doctor`.';
+exports.SETUP_UNCONFIRMED_TEXT = (0, fallback_copy_1.setupUnconfirmedText)(fallback_copy_1.FALLBACK_OTHER);
 const LABELS = {
     S0: 'a change to Marrow seatbelt settings or an owner-only command',
     S1: 'force-push or delete of a protected branch',
     S2: 'production deploy',
     S3: 'package publish',
-    S4: 'credential or secret access',
+    S4: 'reading, copying or writing secrets (like .env files or private keys)',
     S5: 'recursive delete outside the workspace',
     Sx: 'obfuscated execution',
     hook: 'a safety check that could not finish',
@@ -40,14 +43,26 @@ const CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
 function codes(list) {
     return Array.isArray(list) ? list.filter((item) => typeof item === 'string' && CODE.test(item)).slice(0, 16) : [];
 }
-function seatbeltStopText(category, rule, reason, mode, accountLinked = true) {
+/** What the agent and the person read after the label, in every stop. */
+const STOP_ADVICE = 'If you (the person at this machine) meant it, run it yourself in your own terminal. Agent: do not retry it another way and do not edit Marrow settings; tell the user it was stopped.';
+/** Keyless (no account): the way to approval prompts. The plugin path is the one the plugin's own docs give. */
+const KEYLESS_KEY_ADVICE = 'For approval prompts instead of stops, add a Marrow key: getmarrow.ai/docs#start-here (Claude Code plugin: put MARROW_API_KEY in ~/.marrow/env, chmod 600, then /reload-plugins).';
+/** The label of a stop. A script Marrow could not read is named as such: it is not known to be what its name says. */
+function stopLabel(category, reason) {
     const label = LABELS[category] || LABELS.hook;
-    const head = `MARROW SEATBELT stopped this action: ${label} (${CODE.test(rule) ? rule : 'unknown'}, ${CODE.test(reason) ? reason : 'unknown'}). This needs the machine owner. Do not retry it another way or edit Marrow settings.`;
+    return reason === 'script_unreadable' ? `a script Marrow could not read (treated as ${label})` : label;
+}
+/** `modeReason`: the fixed code that explains a fallback (pickFallbackReason); only read when the machine is not account-linked. */
+function seatbeltStopText(category, rule, reason, mode, accountLinked = true, modeReason) {
+    const head = `MARROW SEATBELT stopped this action: ${stopLabel(category, reason)}. ${STOP_ADVICE}`;
+    const code = `Code: ${CODE.test(rule) ? rule : 'unknown'}/${CODE.test(reason) ? reason : 'unknown'}`;
     if (mode === 'account')
-        return `${head} Tell the owner: run it yourself in your own terminal.`;
-    return mode === 'seatbelt'
-        ? `${head} Tell the owner: run it yourself in your own terminal, or link a Marrow account with "npx -y @getmarrow/install@latest activate" (it needs MARROW_API_KEY set first) so these become approval prompts.`
-        : `${head} ${accountLinked ? exports.CLAIMED_NO_KEY_TEXT : exports.SETUP_UNCONFIRMED_TEXT}`;
+        return `${head} ${code}.`;
+    if (mode === 'seatbelt')
+        return `${head} ${KEYLESS_KEY_ADVICE} ${code}.`;
+    return accountLinked
+        ? `${head} ${exports.CLAIMED_NO_KEY_TEXT} ${code}.`
+        : `${head} ${(0, fallback_copy_1.fallbackSentence)(modeReason)} ${code}; mode: ${(0, fallback_copy_1.fallbackCode)(modeReason)}.`;
 }
 /** §4.2: an S0-S5 floor stop is lifted only by an enforced server allow (a verified permit); an advisory allow never lifts it. */
 function accountFloorStops(rollout, floor, server) {
@@ -260,16 +275,19 @@ function keylessSeatbelt(harness, event) {
     const started = Date.now();
     let mode = 'claimed_no_key';
     let accountLinked = false;
+    // A resolution that fails or has no reason keeps the generic code.
+    let modeReason = fallback_copy_1.FALLBACK_OTHER;
     let trustedHome;
     const stop = (reason) => {
         record({ v: 1, mode, enforcement: 'enforce', harness, decision: 'stop', category: 'hook', rule: 'U5.fail_closed', reasons: [reason], flags: [], parse: 'unparsed', latency_ms: Date.now() - started }, event, trustedHome);
-        return { mode, accountLinked, recognized: true, stopText: seatbeltStopText('hook', 'U5.fail_closed', reason, mode, accountLinked) };
+        return { mode, accountLinked, recognized: true, modeReason, stopText: seatbeltStopText('hook', 'U5.fail_closed', reason, mode, accountLinked, modeReason) };
     };
     try {
         const { resolveSeatbeltModeOnHost } = require('../seatbelt-mode');
         const resolution = resolveSeatbeltModeOnHost();
         mode = resolution.mode === 'seatbelt' && exports.SEATBELT_ROLLOUT.keyless === 'on' ? 'seatbelt' : 'claimed_no_key';
         accountLinked = resolution.reasons.includes('account_evidence') || resolution.reasons.includes('key_rejected');
+        modeReason = (0, fallback_copy_1.pickFallbackReason)(resolution.reasons);
         if (event.truncated)
             return stop('input_truncated');
         const home = resolution.homes[0] || passwdHome() || '/nonexistent-home';
@@ -284,13 +302,29 @@ function keylessSeatbelt(harness, event) {
             reasons, flags: codes(decision.flags), parse: CODE.test(decision.parse) ? decision.parse : 'unknown', latency_ms: Date.now() - started,
         }, event, home);
         if (decision.decision === 'pass')
-            return { mode, accountLinked, recognized: decision.recognized === true, stopText: null };
-        return { mode, accountLinked, recognized: true, stopText: seatbeltStopText(decision.category, decision.rule, reasons[0] || 'unspecified', mode, accountLinked) };
+            return { mode, accountLinked, recognized: decision.recognized === true, modeReason, stopText: null };
+        return { mode, accountLinked, recognized: true, modeReason, stopText: seatbeltStopText(decision.category, decision.rule, reasons[0] || 'unspecified', mode, accountLinked, modeReason) };
     }
     catch {
         return stop('hook_error');
     }
 }
+/** The reason codes mode resolution can emit (src/seatbelt-mode.ts), the only ones the status line may print. */
+const STATUS_REASONS = ['strict', 'key_rejected', 'home_unknown', 'home_unusable', 'env_home_unusable', 'home_mismatch', 'account_evidence', 'evidence_unknown'];
+/**
+ * What `marrow-mcp seatbelt-status` prints (the installer's doctor reads it): the mode this machine's
+ * hook would be in right now, from the same resolution the keyless hook runs (same key lookup, same
+ * rollout table), and the resolver's reason codes that are on a closed list. Reads only; writes no file
+ * or state, opens no connection, and names no key, path, user or environment value. Throws when the
+ * resolution does (the caller prints the unknown line).
+ */
+function seatbeltStatus() {
+    const { resolveSeatbeltModeOnHost } = require('../seatbelt-mode');
+    const resolution = resolveSeatbeltModeOnHost({ argv: [] });
+    const mode = resolution.mode === 'seatbelt' && exports.SEATBELT_ROLLOUT.keyless !== 'on' ? 'claimed_no_key' : resolution.mode;
+    const reasons = STATUS_REASONS.filter((code) => resolution.reasons.includes(code));
+    return { mode, reasons };
+}
 /**
  * The account floor. `watch`: computed after the answer, for the record only; it never throws and
  * never writes output. `on` (not active): run before the server flow; a returned text is a stop.