@veilio-inc/cli 0.1.0 → 0.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 # Veilio Community License
 
-_Version 1.0 · Effective 2026-08-08_
+_Version 1.1 · Effective 2026-09-25_
 
 **Copyright © 2026 Veilio**
 
@@ -10,7 +10,8 @@ _Version 1.0 · Effective 2026-08-08_
 > The one thing you may not do without written permission is sell Veilio itself:
 > reselling it, white-labeling it, or running it as a hosted service for other
 > people. Contributions are welcome. For a commercial or redistribution license,
-> email `hello@veilio.dev`.
+> email `hello@veilio.dev`. Veilio is not licensed for use in or from Russia or
+> Belarus, or by sanctioned persons (Section 5A).
 
 ---
 
@@ -48,11 +49,17 @@ For the purposes of this License:
 
 **"Competing Product"** means a commercially offered product or service whose primary purpose and core functionality substantially overlap with the Software or Cloud Edition.
 
+**"Applicable Sanctions"** means any economic, financial, trade or other restrictive measures applicable to Veilio or the relevant transaction under the laws of the European Union or the Republic of Poland, including applicable asset-freezing and prohibition-on-making-available measures, and any other sanctions or trade restrictions that are legally binding on Veilio.
+
+**"Restricted Person"** means any natural or legal person, entity or body that: (a) is designated or otherwise subject to restrictive measures under Applicable Sanctions, (b) is directly or indirectly owned or controlled by such a person, entity or body, (c) acts on behalf of or at the direction of such a person, entity or body; or (d) is otherwise a person to whom Veilio is prohibited under Applicable Sanctions from providing the Software, funds or economic resources.
+
+**"Restricted Territory"** means the Russian Federation and the Republic of Belarus.
+
 ---
 
 ## 3. Permissions
 
-Subject to the restrictions in this License, you are granted a worldwide, royalty-free, non-exclusive license to:
+Subject to the restrictions in this License, including Section 5A, you are granted a worldwide, royalty-free, non-exclusive license to:
 
 * use the Software for personal purposes;
 * use the Software for internal commercial purposes;
@@ -114,6 +121,24 @@ Requests for written permission may be sent to `hello@veilio.dev`.
 
 ---
 
+## 5A. Restricted Territories and Sanctions
+
+**5A.1.** No license or other right to the Software is granted to:
+
+* persons or entities incorporated, registered, established or headquartered in a Restricted Territory;
+* natural persons whose principal place of business or ordinary residence is in a Restricted Territory; or
+* Restricted Persons.
+
+**5A.2.** You must not access or use the Software from a Restricted Territory, make the Software available to any person located in a Restricted Territory, or use the Software directly or indirectly for the benefit of a Restricted Person or a person or entity incorporated, registered, established or headquartered in a Restricted Territory.
+
+**5A.3.** By using the Software, you represent and warrant, both when you first use it and throughout your use of it, that you are not a Restricted Person and do not fall within any of the territorial restrictions set out in this Section.
+
+**5A.4.** You must not use an intermediary, affiliate, nominee, proxy, VPN or other arrangement for the purpose of circumventing the restrictions set out in this Section or Applicable Sanctions.
+
+**5A.5.** Any breach of this Section is a material violation of this License and terminates your rights under it (Section 14). Veilio does not grant written permission for exceptions to this Section.
+
+---
+
 ## 6. Cloud Edition
 
 The Cloud Edition is the official commercial hosted offering of the project.
@@ -218,7 +243,7 @@ TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AUTHORS
 
 ## 14. Termination
 
-Your rights under this License terminate automatically if you materially violate its terms.
+Your rights under this License terminate automatically if you materially violate its terms. Any breach of Section 5A is a material violation.
 
 Upon termination, you must cease the activities that are prohibited by this License.
 
@@ -244,5 +269,5 @@ Each version will be identified by a version number. Unless explicitly stated ot
 
 **Project:** Veilio
 **Copyright:** © 2026 Veilio
-**License:** Veilio Community License, Version 1.0
+**License:** Veilio Community License, Version 1.1
 **Contact:** `hello@veilio.dev`

package/README.md

@@ -8,6 +8,8 @@ pbpaste | veilio restore                 # bring the answer back
 git diff --cached | veilio scan          # refuse to commit a live key
 ```
 
+Full guide - terminal, Cloud sign-in, and connecting AI assistants (Claude Code, Claude Desktop, Xcode, Cursor, VS Code): [docs/USING-THE-CLI-AND-MCP.md](../../docs/USING-THE-CLI-AND-MCP.md).
+
 ## Install
 
 ```bash
@@ -15,9 +17,11 @@ npm install -g @veilio-inc/cli     # or run it without installing:
 npx @veilio-inc/cli scrub src/billing.ts
 ```
 
-Requires Node 24 or newer. No account, no API key, and no network call on any of
-the commands below — `packages/cli/tests/purity.test.ts` traps the network
-globals and fails if one is ever introduced.
+Requires Node 24 or newer. No account, no API key, and no network call on
+`scrub`, `restore`, `scan` or `map` — `packages/cli/tests/purity.test.ts` and
+`offline.test.ts` walk the import graph and trap the network globals to keep it
+that way. Signing in is entirely optional and adds nothing to those commands'
+behavior; it only unlocks the four commands below that name Cloud explicitly.
 
 ## Commands
 
@@ -28,6 +32,41 @@ globals and fails if one is ever introduced.
 | `scan [files...]`    | Detect credentials only. Never rewrites. Exits 1 on findings.         |
 | `map`                | Show the symbol map (`--clear` to wipe it).                           |
 
+## Cloud sync (Individual plan and above)
+
+```bash
+veilio login                    # email, password, and the authentication code if 2FA is on
+veilio whoami                   # who you're signed in as, no request made
+veilio maps list                # ids, scope and symbol counts for everything in Cloud
+veilio maps pull <id>           # decrypt locally, write second — never a partial write
+veilio maps push <name>         # upload the local map under a new Cloud name
+veilio team unlock              # open the team key with your vault passphrase (kept 7 days)
+veilio team lock                # remove the unlocked team key from this machine
+veilio rules pull               # fetch your custom rules; scrub then applies them offline
+veilio logout                   # revokes server-side, then removes the local credential
+```
+
+The session token lives in a single file under your home directory
+(`~/.veilio/credential.json` on Linux/macOS, `%USERPROFILE%\.veilio\credential.json`
+on Windows), created at mode `0600` and never written until the server has
+accepted the sign-in. `0600` is the floor, not the final answer — the OS
+keychain is a stronger option and a planned follow-up. A personal map is
+zero-knowledge: pulling or pushing one prompts for the vault passphrase and
+derives the key here, on your machine — the passphrase and the key never
+leave it. A team map is sealed under the team key, which the server cannot
+read either; `veilio team unlock` opens it here with your vault passphrase.
+
+Custom rules (whitelist and replace, set in the web app) are applied by
+`scrub` from a local copy that `veilio rules pull` writes to
+`~/.veilio/rules.json` (`0600`). `scrub` never fetches them itself - it stays
+offline - and says on every run how many rules it applied and how old the copy
+is. Pull again after the rules change; `logout` removes the copy.
+
+The map commands are clients of `GET /api/maps`, `GET /api/maps/:id` and
+`POST /api/maps` — the exact same routes the browser uses, behind the exact
+same entitlement check. There is no CLI-shaped API and nothing here can reach
+a plan feature the web app couldn't.
+
 ## Options
 
 ```

package/dist/args.d.ts

@@ -1,6 +1,6 @@
 import { type LanguageOption } from '@veilio-inc/engine';
 import type { SecretPolicy } from '@veilio-inc/engine';
-export type Command = 'scrub' | 'restore' | 'scan' | 'map' | 'help' | 'version';
+export type Command = 'scrub' | 'restore' | 'scan' | 'map' | 'login' | 'logout' | 'whoami' | 'maps' | 'team' | 'rules' | 'help' | 'version';
 export interface ParsedArgs {
     command: Command;
     /** Positional file paths. Empty means read stdin (or, for `scan`, error). */
@@ -23,8 +23,42 @@ export interface ParsedArgs {
     keepDocs: boolean;
     /** Allow a map write that would drop entries already on disk. */
     force: boolean;
+    /**
+     * `maps` subcommand: list, pull or push. Null when `maps` was given alone.
+     *
+     * A subcommand rather than three top-level commands, because `map` (singular,
+     * the local store) already exists and `veilio push` next to `veilio map`
+     * reads like they are the same thing. `maps <verb>` keeps the cloud surface
+     * visibly separate from the offline one.
+     */
+    mapsAction: 'list' | 'pull' | 'push' | null;
+    /**
+     * `team unlock` / `team lock`.
+     *
+     * A subcommand for the same reason `maps` is one: `veilio unlock` alone would
+     * not say what it unlocks, and what it unlocks is specifically the team's
+     * keys rather than the account or the local store.
+     */
+    teamAction: 'unlock' | 'lock' | null;
+    /** `rules pull`. */
+    rulesAction: 'pull' | null;
+    /**
+     * Base URL of the Veilio instance to sign in to. Null means the public Cloud.
+     *
+     * Only meaningful to `login`: once signed in, the instance is read back from
+     * the stored credential, so a later command cannot be pointed at a different
+     * host while still holding the first one's token.
+     */
+    instance: string | null;
 }
 export declare class UsageError extends Error {
 }
+/**
+ * The commands that reach the network. Named here so the split is one list
+ * rather than a condition repeated at each call site — and so that adding a
+ * command without deciding which side of the line it falls on is a compile
+ * error rather than an accident.
+ */
+export declare const CLOUD_COMMANDS: Set<Command>;
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;
 //# sourceMappingURL=args.d.ts.map

package/dist/args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;AAE/E,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,QAAQ,EAAE,cAAc,CAAA;IACxB,OAAO,EAAE,YAAY,CAAA;IACrB,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAA;IACjB,uCAAuC;IACvC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,sCAAsC;IACtC,IAAI,EAAE,OAAO,CAAA;IACb,qDAAqD;IACrD,KAAK,EAAE,OAAO,CAAA;IACd,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAA;IACd,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAA;IACf,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAA;CACf;AAED,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAaxC,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAgG7D"}
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,MAAM,OAAO,GACf,OAAO,GACP,SAAS,GACT,MAAM,GACN,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,MAAM,GACN,MAAM,GACN,OAAO,GACP,MAAM,GACN,SAAS,CAAA;AAEb,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,QAAQ,EAAE,cAAc,CAAA;IACxB,OAAO,EAAE,YAAY,CAAA;IACrB,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAA;IACjB,uCAAuC;IACvC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,sCAAsC;IACtC,IAAI,EAAE,OAAO,CAAA;IACb,qDAAqD;IACrD,KAAK,EAAE,OAAO,CAAA;IACd,qCAAqC;IACrC,KAAK,EAAE,OAAO,CAAA;IACd,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAA;IACf,wCAAwC;IACxC,QAAQ,EAAE,OAAO,CAAA;IACjB,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAA;IACd;;;;;;;OAOG;IACH,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAE3C;;;;;;OAMG;IACH,UAAU,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAA;IACpC,oBAAoB;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1B;;;;;;OAMG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAiBxC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,cAOzB,CAAA;AAWF,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CA0J7D"}

package/dist/args.js

@@ -4,7 +4,34 @@
 import { LANGUAGES } from '@veilio-inc/engine';
 export class UsageError extends Error {
 }
-const COMMANDS = new Set(['scrub', 'restore', 'scan', 'map', 'help', 'version']);
+const COMMANDS = new Set([
+    'scrub',
+    'restore',
+    'scan',
+    'map',
+    'login',
+    'logout',
+    'whoami',
+    'maps',
+    'team',
+    'rules',
+    'help',
+    'version',
+]);
+/**
+ * The commands that reach the network. Named here so the split is one list
+ * rather than a condition repeated at each call site — and so that adding a
+ * command without deciding which side of the line it falls on is a compile
+ * error rather than an accident.
+ */
+export const CLOUD_COMMANDS = new Set([
+    'login',
+    'logout',
+    'whoami',
+    'maps',
+    'team',
+    'rules',
+]);
 const SECRET_POLICIES = new Set(['redact', 'warn', 'off']);
 const LANGUAGE_VALUES = new Set([...LANGUAGES, 'auto']);
 function requireValue(flag, value) {
@@ -27,6 +54,10 @@ export function parseArgs(argv) {
         strict: false,
         keepDocs: false,
         force: false,
+        instance: null,
+        mapsAction: null,
+        teamAction: null,
+        rulesAction: null,
     };
     if (argv.length === 0)
         return parsed;
@@ -38,6 +69,38 @@ export function parseArgs(argv) {
         }
         parsed.command = first;
         i = 1;
+        // `maps` takes a verb. Read here rather than as a positional later, so that
+        // `veilio maps pull abc` does not treat `pull` as a file to anonymize.
+        if (parsed.command === 'maps') {
+            const verb = argv[1];
+            if (verb !== undefined && !verb.startsWith('-')) {
+                if (verb !== 'list' && verb !== 'pull' && verb !== 'push') {
+                    throw new UsageError(`unknown maps action "${verb}" — expected list, pull or push`);
+                }
+                parsed.mapsAction = verb;
+                i = 2;
+            }
+        }
+        if (parsed.command === 'team') {
+            const verb = argv[1];
+            if (verb !== undefined && !verb.startsWith('-')) {
+                if (verb !== 'unlock' && verb !== 'lock') {
+                    throw new UsageError(`unknown team action "${verb}" — expected unlock or lock`);
+                }
+                parsed.teamAction = verb;
+                i = 2;
+            }
+        }
+        if (parsed.command === 'rules') {
+            const verb = argv[1];
+            if (verb !== undefined && !verb.startsWith('-')) {
+                if (verb !== 'pull') {
+                    throw new UsageError(`unknown rules action "${verb}" — expected pull`);
+                }
+                parsed.rulesAction = verb;
+                i = 2;
+            }
+        }
     }
     for (; i < argv.length; i++) {
         const arg = argv[i];
@@ -96,6 +159,24 @@ export function parseArgs(argv) {
             case '--force':
                 parsed.force = true;
                 break;
+            case '--instance': {
+                const value = requireValue(arg, argv[++i]);
+                // Parsed here rather than at use, so a typo is a usage error before any
+                // password is typed rather than a confusing failure after.
+                let url;
+                try {
+                    url = new URL(value);
+                }
+                catch {
+                    throw new UsageError(`--instance must be a URL (got "${value}")`);
+                }
+                if (url.protocol !== 'https:' && url.hostname !== 'localhost') {
+                    throw new UsageError(`--instance must be https (got "${value}") — a password and a session token over ` +
+                        'plain http are readable by anything on the path. localhost is allowed for development.');
+                }
+                parsed.instance = value;
+                break;
+            }
             default:
                 if (arg.startsWith('-') && arg !== '-') {
                     throw new UsageError(`unknown flag "${arg}"`);

package/dist/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,8DAA8D;AAE9D,OAAO,EAAE,SAAS,EAAsC,MAAM,oBAAoB,CAAA;AA6BlF,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AACxE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;AAE/D,SAAS,YAAY,CAAC,IAAY,EAAE,KAAyB;IAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;KACb,CAAA;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAEpC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAgB,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,KAAgB,CAAA;QACjC,CAAC,GAAG,CAAC,CAAA;IACP,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;gBACvB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,MAAM,CAAC,OAAO,GAAG,SAAS,CAAA;gBAC1B,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,UAAU,CAClB,qBAAqB,KAAK,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjF,CAAA;gBACH,CAAC;gBACD,MAAM,CAAC,QAAQ,GAAG,KAA0B,CAAA;gBAC5C,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAqB,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,UAAU,CAAC,gDAAgD,KAAK,IAAI,CAAC,CAAA;gBACjF,CAAC;gBACD,MAAM,CAAC,OAAO,GAAG,KAAqB,CAAA;gBACtC,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,OAAO;gBACV,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC7C,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,YAAY;gBACf,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;gBAClB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,UAAU;gBACb,MAAM,CAAC,MAAM,GAAG,IAAI,CAAA;gBACpB,MAAK;YACP,KAAK,aAAa;gBAChB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;oBACvC,MAAM,IAAI,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,8DAA8D;AAE9D,OAAO,EAAE,SAAS,EAAsC,MAAM,oBAAoB,CAAA;AAsElF,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAU;IAChC,OAAO;IACP,SAAS;IACT,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;CACV,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAU;IAC7C,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;CACR,CAAC,CAAA;AACF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AACxE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;AAE/D,SAAS,YAAY,CAAC,IAAY,EAAE,KAAyB;IAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,IAAI;KAClB,CAAA;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAEpC,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAgB,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,UAAU,CAAC,oBAAoB,KAAK,GAAG,CAAC,CAAA;QACpD,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,KAAgB,CAAA;QACjC,CAAC,GAAG,CAAC,CAAA;QAEL,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1D,MAAM,IAAI,UAAU,CAAC,wBAAwB,IAAI,iCAAiC,CAAC,CAAA;gBACrF,CAAC;gBACD,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;gBACxB,CAAC,GAAG,CAAC,CAAA;YACP,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzC,MAAM,IAAI,UAAU,CAAC,wBAAwB,IAAI,6BAA6B,CAAC,CAAA;gBACjF,CAAC;gBACD,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;gBACxB,CAAC,GAAG,CAAC,CAAA;YACP,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACpB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,MAAM,IAAI,UAAU,CAAC,yBAAyB,IAAI,mBAAmB,CAAC,CAAA;gBACxE,CAAC;gBACD,MAAM,CAAC,WAAW,GAAG,IAAI,CAAA;gBACzB,CAAC,GAAG,CAAC,CAAA;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,MAAM,CAAC,OAAO,GAAG,MAAM,CAAA;gBACvB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,MAAM,CAAC,OAAO,GAAG,SAAS,CAAA;gBAC1B,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,UAAU,CAClB,qBAAqB,KAAK,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjF,CAAA;gBACH,CAAC;gBACD,MAAM,CAAC,QAAQ,GAAG,KAA0B,CAAA;gBAC5C,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAqB,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,UAAU,CAAC,gDAAgD,KAAK,IAAI,CAAC,CAAA;gBACjF,CAAC;gBACD,MAAM,CAAC,OAAO,GAAG,KAAqB,CAAA;gBACtC,MAAK;YACP,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,OAAO;gBACV,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC7C,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,YAAY;gBACf,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,KAAK,QAAQ;gBACX,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;gBAClB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,UAAU;gBACb,MAAM,CAAC,MAAM,GAAG,IAAI,CAAA;gBACpB,MAAK;YACP,KAAK,aAAa;gBAChB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,KAAK,IAAI,CAAC;YACV,KAAK,SAAS;gBACZ,MAAM,CAAC,KAAK,GAAG,IAAI,CAAA;gBACnB,MAAK;YACP,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;gBAC1C,wEAAwE;gBACxE,2DAA2D;gBAC3D,IAAI,GAAQ,CAAA;gBACZ,IAAI,CAAC;oBACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,UAAU,CAAC,kCAAkC,KAAK,IAAI,CAAC,CAAA;gBACnE,CAAC;gBACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBAC9D,MAAM,IAAI,UAAU,CAClB,kCAAkC,KAAK,2CAA2C;wBAChF,wFAAwF,CAC3F,CAAA;gBACH,CAAC;gBACD,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAA;gBACvB,MAAK;YACP,CAAC;YACD;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;oBACvC,MAAM,IAAI,UAAU,CAAC,iBAAiB,GAAG,GAAG,CAAC,CAAA;gBAC/C,CAAC;gBACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/cloud-commands.d.ts

@@ -0,0 +1,90 @@
+import { type Io } from './commands.js';
+/**
+ * Sign in, and store the credential only if the account can actually use it.
+ *
+ * Two requests, and the second one is the interesting one.
+ *
+ * `POST /api/auth/login` answers "is this the right password". It does NOT
+ * answer "does this plan include the terminal" — a free account signs in
+ * perfectly well, because signing in is how you reach the billing page. So a
+ * CLI that stopped after the first request would store a credential for an
+ * account that gets refused by every command that follows, and would report
+ * that refusal as though the sign-in had worked.
+ *
+ * The obvious shortcut is to read `user.plan` out of the login response and
+ * decide locally. That is exactly what FR-009 forbids: entitlement is the
+ * server's answer on each request, never the client's reading of a plan name.
+ * A copy of the rule shipped to other people's laptops is a second definition of
+ * it, and the one that goes stale first.
+ *
+ * So the second request asks the server a real question and lets it refuse. Only
+ * then is anything written — validate, then persist (Constitution IV). A
+ * credential written first and validated after leaves a file behind for an
+ * attempt that failed, and everything looks signed in until the first command
+ * that isn't.
+ */
+export declare function runLogin(instance: string | null, io: Io): Promise<number>;
+/**
+ * Sign out: revoke server-side, THEN remove the file.
+ *
+ * The order is the control. Removing the file first makes `logout` always look
+ * like it worked, while leaving a live session on the server that the user has
+ * been told is gone — and nothing anywhere reports that. So a failed revocation
+ * keeps the credential and says so, which is the loud failure rather than the
+ * quiet one (Constitution V).
+ */
+export declare function runLogout(io: Io): Promise<number>;
+/**
+ * Who is signed in, answered from disk.
+ *
+ * Makes no request, on purpose. Its job is "am I signed in", not "is Cloud up" —
+ * an answer that needs the network is useless at exactly the moment somebody is
+ * trying to work out why the network isn't working.
+ */
+export declare function runWhoami(io: Io): number;
+/**
+ * List what the account holds.
+ *
+ * Prints the id, because `pull` takes one. A name would be friendlier and is
+ * wrong: names are not unique, and picking "the first one that matches" is how
+ * somebody pulls a different map over the one they were using.
+ */
+export declare function runMapsList(io: Io): Promise<number>;
+/**
+ * Pull a map into the local store: decrypt FIRST, write second.
+ *
+ * The ordering is the control (Constitution IV). Writing before decrypting means
+ * a wrong passphrase leaves a half-built store behind — and the store is the one
+ * thing that can restore text already anonymized, so a partial write there is
+ * not an inconvenience, it is unrecoverable text.
+ *
+ * A personal map is opened HERE. The server holds the salt and a verifier and
+ * nothing else; the passphrase never leaves this machine, and there is no code
+ * path in this package that could send it.
+ */
+export declare function runMapsPull(id: string | null, mapPath: string, io: Io, options?: {
+    force?: boolean;
+}): Promise<number>;
+/** Upload the local map. Same endpoint, same quotas, same validation. */
+export declare function runMapsPush(name: string | null, mapPath: string, io: Io): Promise<number>;
+/**
+ * Fetch the account's custom rules so `veilio scrub` can apply them offline.
+ *
+ * Merged here, in the web app's order, so every later scrub applies exactly
+ * what the browser would. A plan without custom rules REMOVES any cache left
+ * from before: rules the account can no longer use must not go on shaping
+ * its output. Any other failure keeps the cache and says so.
+ */
+export declare function runRulesPull(io: Io): Promise<number>;
+/**
+ * Unlock this team's keys for processes that cannot ask for a passphrase.
+ *
+ * The MCP server starts inside a coding agent with no terminal attached, so the
+ * keys it needs have to be put on disk by a run like this one, where a person
+ * is present to type the passphrase. See `team-unlock.ts` for what is stored
+ * and why it is the team key rather than the vault key.
+ */
+export declare function runTeamUnlock(io: Io, days?: number): Promise<number>;
+/** Remove the unlocked team keys. */
+export declare function runTeamLock(io: Io): number;
+//# sourceMappingURL=cloud-commands.d.ts.map

package/dist/cloud-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-commands.d.ts","sourceRoot":"","sources":["../src/cloud-commands.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAuB,KAAK,EAAE,EAAE,MAAM,eAAe,CAAA;AAc5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA2E/E;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgFvD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAQxC;AAyDD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBzD;AA+CD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,EAAE,EACN,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,MAAM,CAAC,CA+GjB;AAED,yEAAyE;AACzE,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAgE/F;AAcD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqC1D;AAID;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmH1E;AAED,qCAAqC;AACrC,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAgB1C"}