@veilio-inc/cli 0.1.0 → 0.3.0

package/dist/credential.d.ts

@@ -0,0 +1,52 @@
+export declare const CREDENTIAL_FILE = "credential.json";
+export interface Credential {
+    /** The session bearer token, exactly as issued. */
+    token: string;
+    /** The email it belongs to, so `whoami` need not make a request. */
+    account: string;
+    /** Base URL it was issued by, so a self-hosted instance is addressable. */
+    instance: string;
+}
+/**
+ * Where the credential lives.
+ *
+ * Under the user's home directory, not the project store: a token authorises a
+ * person, not a repository, and putting it beside `.veilio/map.json` would drop
+ * it into whatever directory the CLI happened to run in — including, eventually,
+ * one somebody commits.
+ *
+ * `home` is injectable so tests do not write to the real one.
+ */
+export declare function credentialPath(home?: string): string;
+/** https, or a loopback address for local development. Nothing else. */
+export declare function isSafeInstance(value: string): boolean;
+/**
+ * The stored credential, or null.
+ *
+ * Null means "not signed in", and it means that for every reason a read can
+ * fail. Callers get one case to handle, and no caller has to decide whether a
+ * particular kind of breakage is worth reporting — none of them is.
+ */
+export declare function readCredential(home?: string): Credential | null;
+/**
+ * Write the credential, 0600.
+ *
+ * Called only after the server has accepted a sign-in — validate, then persist
+ * (Constitution IV). A file written before the check leaves a credential behind
+ * for an attempt that failed.
+ *
+ * `chmodSync` after the write because `mode` on `writeFileSync` applies only
+ * when the file is created; without it, re-signing in over a world-readable file
+ * left from some earlier mistake would leave it world-readable.
+ */
+export declare function writeCredential(credential: Credential, home?: string): void;
+/**
+ * Remove the credential. Returns whether there was one to remove.
+ *
+ * Never throws, for the same reason reads do not: `logout` on a machine that was
+ * never signed in should say so and exit cleanly, not fail. Note the ordering
+ * this does NOT own — `logout` revokes server-side FIRST and only then calls
+ * this, because deleting first leaves a live session the user believes is gone.
+ */
+export declare function removeCredential(home?: string): boolean;
+//# sourceMappingURL=credential.d.ts.map

package/dist/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAEhD,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE/D;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CASrD;AAqBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAkB,GAAG,UAAU,GAAG,IAAI,CAc1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAKtF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkB,GAAG,OAAO,CAiBlE"}

package/dist/credential.js

@@ -0,0 +1,135 @@
+// The signed-in credential, on disk.
+//
+// One file per machine per instance, holding the session token the server
+// issued, the account it belongs to, and the instance that issued it. It is
+// never transmitted and never sent anywhere — `whoami` answers from it, which is
+// why it carries the account and the instance rather than the token alone.
+//
+// EVERY read tolerates absence and corruption, and that is the whole design.
+// This file sits underneath commands that must work for someone who has never
+// heard of the Cloud edition (FR-001, FR-003). A reader that throws on a
+// truncated file turns a half-written credential into a broken `veilio scrub`,
+// and the person it breaks for is the one who never signed in.
+//
+// So there is exactly one failure mode here: "not signed in". Missing file,
+// unreadable file, a directory where the file should be, invalid JSON, JSON of
+// the wrong shape, an empty token — all of it reads as signed out, because every
+// one of them means the same thing to the caller and none of them is worth
+// stopping a local command over.
+import { chmodSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { STORE_DIR } from '@veilio-inc/engine';
+export const CREDENTIAL_FILE = 'credential.json';
+/**
+ * Where the credential lives.
+ *
+ * Under the user's home directory, not the project store: a token authorises a
+ * person, not a repository, and putting it beside `.veilio/map.json` would drop
+ * it into whatever directory the CLI happened to run in — including, eventually,
+ * one somebody commits.
+ *
+ * `home` is injectable so tests do not write to the real one.
+ */
+export function credentialPath(home = homedir()) {
+    return join(home, STORE_DIR, CREDENTIAL_FILE);
+}
+/** https, or a loopback address for local development. Nothing else. */
+export function isSafeInstance(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol === 'https:')
+        return true;
+    return url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]';
+}
+function isCredential(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const c = value;
+    return (typeof c.token === 'string' &&
+        c.token !== '' &&
+        typeof c.account === 'string' &&
+        c.account !== '' &&
+        typeof c.instance === 'string' &&
+        c.instance !== '' &&
+        // A credential naming an `http://` instance would put the bearer token on
+        // the wire in the clear, on every request, for ever — and self-hosted LAN
+        // setups are exactly where somebody writes one by hand. Refusing to read it
+        // reads as "not signed in", which is the safe direction and the one the
+        // rest of this module already takes.
+        isSafeInstance(c.instance));
+}
+/**
+ * The stored credential, or null.
+ *
+ * Null means "not signed in", and it means that for every reason a read can
+ * fail. Callers get one case to handle, and no caller has to decide whether a
+ * particular kind of breakage is worth reporting — none of them is.
+ */
+export function readCredential(home = homedir()) {
+    let raw;
+    try {
+        raw = readFileSync(credentialPath(home), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    return isCredential(parsed) ? parsed : null;
+}
+/**
+ * Write the credential, 0600.
+ *
+ * Called only after the server has accepted a sign-in — validate, then persist
+ * (Constitution IV). A file written before the check leaves a credential behind
+ * for an attempt that failed.
+ *
+ * `chmodSync` after the write because `mode` on `writeFileSync` applies only
+ * when the file is created; without it, re-signing in over a world-readable file
+ * left from some earlier mistake would leave it world-readable.
+ */
+export function writeCredential(credential, home = homedir()) {
+    const path = credentialPath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(credential, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/**
+ * Remove the credential. Returns whether there was one to remove.
+ *
+ * Never throws, for the same reason reads do not: `logout` on a machine that was
+ * never signed in should say so and exit cleanly, not fail. Note the ordering
+ * this does NOT own — `logout` revokes server-side FIRST and only then calls
+ * this, because deleting first leaves a live session the user believes is gone.
+ */
+export function removeCredential(home = homedir()) {
+    const path = credentialPath(home);
+    try {
+        statSync(path);
+    }
+    catch {
+        // Genuinely not signed in. Nothing to do, and not an error.
+        return false;
+    }
+    // A failure to DELETE is a different thing entirely, and it throws.
+    //
+    // Returning false for both meant `logout` would print "you weren't signed in"
+    // while a live bearer token sat on disk — an unsearchable parent directory, a
+    // read-only mount, a file held open on Windows. That inverts FR-005 and
+    // contradicts the whole reason this function is called before the file is
+    // considered gone. The caller catches and reports the path.
+    rmSync(path, { recursive: true, force: true });
+    return true;
+}
+//# sourceMappingURL=credential.js.map

package/dist/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,iFAAiF;AACjF,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,+EAA+E;AAC/E,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,iFAAiF;AACjF,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAWhD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,OAAO,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;AAC/C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1C,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAA;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,CAAC,CAAC,KAAK,KAAK,EAAE;QACd,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,CAAC,CAAC,OAAO,KAAK,EAAE;QAChB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,CAAC,CAAC,QAAQ,KAAK,EAAE;QACjB,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,qCAAqC;QACrC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC3B,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,OAAO,EAAE;IACrD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,UAAsB,EAAE,OAAe,OAAO,EAAE;IAC9E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,OAAO,EAAE;IACvD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,oEAAoE;IACpE,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,wEAAwE;IACxE,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { type Io } from './commands.js';
-export declare const VERSION = "0.1.0";
+export declare const VERSION: string;
 /** Testable entry point: everything that touches the process is injected. */
 export declare function main(argv: readonly string[], io: Io): Promise<number>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAA2D,KAAK,EAAE,EAAE,MAAM,eAAe,CAAA;AAIhG,eAAO,MAAM,OAAO,UAAU,CAAA;AAE9B,6EAA6E;AAC7E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAGA,OAAO,EAA2D,KAAK,EAAE,EAAE,MAAM,eAAe,CAAA;AAqBhG,eAAO,MAAM,OAAO,EAAE,MAEb,CAAA;AAET,6EAA6E;AAC7E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoE3E"}

package/dist/index.js

@@ -1,9 +1,17 @@
 #!/usr/bin/env node
+import { createRequire } from 'node:module';
 import { parseArgs, UsageError } from './args.js';
 import { EXIT_ERROR, HELP, runMap, runRestore, runScan, runScrub } from './commands.js';
+import { runLogin, runLogout, runWhoami, runMapsList, runMapsPull, runMapsPush, runTeamUnlock, runTeamLock, runRulesPull, } from './cloud-commands.js';
+import { resolveMapPath } from './store.js';
+import { createInterface } from 'node:readline';
 import { realpathSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
-export const VERSION = '0.1.0';
+// Read from the package, not typed here: changesets bump package.json only, so
+// a literal drifted - the published 0.2.0 reported 0.1.0 (found 2026-09-26).
+// npm always ships package.json, and ../package.json resolves from src/ and
+// dist/ alike.
+export const VERSION = createRequire(import.meta.url)('../package.json').version;
 /** Testable entry point: everything that touches the process is injected. */
 export async function main(argv, io) {
     let args;
@@ -33,6 +41,42 @@ export async function main(argv, io) {
                 return await runScan(args, io);
             case 'map':
                 return await runMap(args, io);
+            case 'login':
+                return await runLogin(args.instance, io);
+            case 'logout':
+                return await runLogout(io);
+            case 'whoami':
+                return runWhoami(io);
+            case 'maps': {
+                const mapPath = resolveMapPath(args.mapPath, io.cwd);
+                switch (args.mapsAction) {
+                    case 'list':
+                        return await runMapsList(io);
+                    case 'pull':
+                        return await runMapsPull(args.files[0] ?? null, mapPath, io, { force: args.force });
+                    case 'push':
+                        return await runMapsPush(args.files[0] ?? null, mapPath, io);
+                    default:
+                        io.stderr('veilio: maps needs an action — list, pull or push.\n');
+                        return EXIT_ERROR;
+                }
+            }
+            case 'team': {
+                switch (args.teamAction) {
+                    case 'unlock':
+                        return await runTeamUnlock(io);
+                    case 'lock':
+                        return runTeamLock(io);
+                    default:
+                        io.stderr('veilio: team needs an action — unlock or lock.\n');
+                        return EXIT_ERROR;
+                }
+            }
+            case 'rules':
+                if (args.rulesAction === 'pull')
+                    return await runRulesPull(io);
+                io.stderr('veilio: rules needs an action — pull.\n');
+                return EXIT_ERROR;
         }
     }
     catch (err) {
@@ -40,6 +84,117 @@ export async function main(argv, io) {
         return EXIT_ERROR;
     }
 }
+// A piped/scripted session (no TTY) commonly delivers every line in ONE data
+// chunk — `echo "email\npassword" | veilio login`, or any single-`input`
+// spawn. `readline.Interface` parses every complete line out of a chunk
+// synchronously as that chunk arrives, emitting one 'line' event per line
+// BEFORE returning control to the event loop — so if the first line's
+// `question()` callback resolves a promise and only THEN (on a later
+// microtask) calls `question()` again for the next line, that second line's
+// 'line' event already fired with no listener attached to catch it and is
+// simply dropped. `question()` recreating the interface per call has the
+// same failure one layer up: a fresh interface attaches to an
+// already-ended stream with nothing left to read, and its `question()`
+// never answers — with nothing else keeping the event loop alive, the
+// process just exits 0 having attempted nothing.
+//
+// The fix: one interface for the whole process's non-TTY prompts, with a
+// PERMANENT 'line' listener attached from the moment stdin starts flowing,
+// so a line that arrives before anything is waiting for it is queued
+// instead of dropped.
+let pipedInterface;
+const pipedQueuedLines = [];
+const pipedWaiters = [];
+function ensurePipedInterface() {
+    if (pipedInterface)
+        return;
+    pipedInterface = createInterface({ input: process.stdin, output: process.stderr });
+    pipedInterface.on('line', (line) => {
+        const waiter = pipedWaiters.shift();
+        if (waiter)
+            waiter(line);
+        else
+            pipedQueuedLines.push(line);
+    });
+    // EOF with a prompt still pending (fewer lines piped than the command
+    // asked for) resolves it to '' rather than hanging forever — matches the
+    // existing "no email/password given" handling in the callers.
+    pipedInterface.on('close', () => {
+        let waiter;
+        while ((waiter = pipedWaiters.shift()))
+            waiter('');
+    });
+}
+function readPipedLine(label) {
+    process.stderr.write(label);
+    ensurePipedInterface();
+    const queued = pipedQueuedLines.shift();
+    if (queued !== undefined)
+        return Promise.resolve(queued);
+    return new Promise((resolvePromise) => pipedWaiters.push(resolvePromise));
+}
+/** Read one line from the terminal. */
+function readLine(label) {
+    if (!process.stdin.isTTY)
+        return readPipedLine(label);
+    // A TTY closes and recreates the interface per prompt — safe there
+    // because a human necessarily delivers each line in its own chunk (typed,
+    // then Enter), so the drop above never has a second buffered line to lose
+    // — and closing hands raw stdin control back cleanly to `readSecret`'s
+    // manual raw-mode path for the password prompt that follows.
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    return new Promise((resolvePromise) => {
+        rl.question(label, (answer) => {
+            rl.close();
+            resolvePromise(answer);
+        });
+    });
+}
+/**
+ * Read a line without echoing it.
+ *
+ * The prompt goes to stderr, not stdout, for the same reason every other message
+ * in this CLI does: stdout is the pipe, and a password prompt appearing in
+ * `veilio scrub x.ts | pbcopy` would be a bug. The echo is suppressed by putting
+ * the TTY in raw mode; without a TTY there is nothing to suppress and the line
+ * is read normally, which is what a scripted `echo pw | veilio login` needs.
+ */
+function readSecret(label) {
+    if (!process.stdin.isTTY)
+        return readLine(label);
+    process.stderr.write(label);
+    return new Promise((resolvePromise, rejectPromise) => {
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        let value = '';
+        const done = (err) => {
+            stdin.setRawMode(false);
+            stdin.pause();
+            stdin.removeListener('data', onData);
+            process.stderr.write('\n');
+            if (err)
+                rejectPromise(err);
+            else
+                resolvePromise(value);
+        };
+        const onData = (chunk) => {
+            for (const ch of chunk) {
+                if (ch === '\n' || ch === '\r' || ch === '\u0004')
+                    return done();
+                // Ctrl-C must still abort, or raw mode traps the terminal.
+                if (ch === '\u0003')
+                    return done(new Error('cancelled'));
+                if (ch === '\u007f' || ch === '\b')
+                    value = value.slice(0, -1);
+                else
+                    value += ch;
+            }
+        };
+        stdin.on('data', onData);
+    });
+}
 function readStdin() {
     return new Promise((resolvePromise, rejectPromise) => {
         // A TTY with no piped input would hang forever waiting for EOF. Fail with
@@ -90,6 +245,8 @@ if (invokedAsProgram()) {
         stdin: readStdin,
         stdout: (text) => process.stdout.write(text),
         stderr: (text) => process.stderr.write(text),
+        prompt: readLine,
+        password: readSecret,
     };
     main(process.argv.slice(2), io).then((code) => {
         process.exitCode = code;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAW,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAA;AAE9B,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB,EAAE,EAAM;IACxD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YAC9B,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,OAAO,sCAAsC,CAAC,CAAA;YACvE,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACf,OAAO,CAAC,CAAA;YACV,KAAK,SAAS;gBACZ,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACV,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACjC,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACnC,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAChC,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1E,OAAO,UAAU,CAAA;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAA;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QACnD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,IAAI,gBAAgB,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,GAAO;QACb,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAC7C,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA;IACzB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrF,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAA;IAC/B,CAAC,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAW,MAAM,eAAe,CAAA;AAChG,OAAO,EACL,QAAQ,EACR,SAAS,EACT,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,eAAe;AACf,MAAM,CAAC,MAAM,OAAO,GAClB,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CACjD,CAAC,OAAO,CAAA;AAET,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB,EAAE,EAAM;IACxD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YAC9B,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,OAAO,sCAAsC,CAAC,CAAA;YACvE,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBACf,OAAO,CAAC,CAAA;YACV,KAAK,SAAS;gBACZ,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACV,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACjC,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACnC,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAChC,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC/B,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC1C,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,EAAE,CAAC,CAAA;YAC5B,KAAK,QAAQ;gBACX,OAAO,SAAS,CAAC,EAAE,CAAC,CAAA;YACtB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;gBACpD,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxB,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,EAAE,CAAC,CAAA;oBAC9B,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;oBACrF,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;oBAC9D;wBACE,EAAE,CAAC,MAAM,CAAC,sDAAsD,CAAC,CAAA;wBACjE,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxB,KAAK,QAAQ;wBACX,OAAO,MAAM,aAAa,CAAC,EAAE,CAAC,CAAA;oBAChC,KAAK,MAAM;wBACT,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;oBACxB;wBACE,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAA;wBAC7D,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM;oBAAE,OAAO,MAAM,YAAY,CAAC,EAAE,CAAC,CAAA;gBAC9D,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAA;gBACpD,OAAO,UAAU,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1E,OAAO,UAAU,CAAA;IACnB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,sEAAsE;AACtE,qEAAqE;AACrE,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,8DAA8D;AAC9D,uEAAuE;AACvE,sEAAsE;AACtE,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,sBAAsB;AACtB,IAAI,cAA8D,CAAA;AAClE,MAAM,gBAAgB,GAAa,EAAE,CAAA;AACrC,MAAM,YAAY,GAAkC,EAAE,CAAA;AAEtD,SAAS,oBAAoB;IAC3B,IAAI,cAAc;QAAE,OAAM;IAC1B,cAAc,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAA;QACnC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,CAAA;;YACnB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IACF,sEAAsE;IACtE,yEAAyE;IACzE,8DAA8D;IAC9D,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC9B,IAAI,MAA4C,CAAA;QAChD,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC;YAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3B,oBAAoB,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED,uCAAuC;AACvC,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IACrD,mEAAmE;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5B,EAAE,CAAC,KAAK,EAAE,CAAA;YACV,cAAc,CAAC,MAAM,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtB,KAAK,CAAC,MAAM,EAAE,CAAA;QACd,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACzB,IAAI,KAAK,GAAG,EAAE,CAAA;QACd,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;YACjC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YACvB,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC1B,IAAI,GAAG;gBAAE,aAAa,CAAC,GAAG,CAAC,CAAA;;gBACtB,cAAc,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ;oBAAE,OAAO,IAAI,EAAE,CAAA;gBAChE,2DAA2D;gBAC3D,IAAI,EAAE,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;gBACxD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI;oBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;;oBACzD,KAAK,IAAI,EAAE,CAAA;YAClB,CAAC;QACH,CAAC,CAAA;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAA;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QACnD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,IAAI,gBAAgB,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,GAAO;QACb,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,UAAU;KACrB,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA;IACzB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrF,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAA;IAC/B,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/rules.d.ts

@@ -0,0 +1,35 @@
+import { type CustomRule } from '@veilio-inc/engine';
+export declare const RULES_FILE = "rules.json";
+export interface CachedRules {
+    /** Which account these belong to - a different sign-in does not inherit them. */
+    instance: string;
+    account: string;
+    /** ISO time of the pull, so `scrub` can say how old they are. */
+    pulledAt: string;
+    /** Already merged into the order the engine applies them in. */
+    rules: CustomRule[];
+}
+export declare function rulesPath(home?: string): string;
+/**
+ * Personal and team rules in the order the web app applies them:
+ * team whitelist, personal whitelist, team replace, personal replace.
+ *
+ * Whitelists first so a name either list keeps readable is never renamed by a
+ * replace rule; team before personal so the team's naming wins on a clash,
+ * which is what keeps two members' output interchangeable. Disabled rules are
+ * dropped and sort_order renumbered 0..n-1, so the engine sees one sequence.
+ * Must match `useMergedRules` in the Cloud frontend.
+ */
+export declare function mergeRules(personal: readonly CustomRule[], team: readonly CustomRule[]): CustomRule[];
+/** The cached rules for this account, or null. Null for every kind of failure. */
+export declare function readRules(owner: {
+    instance: string;
+    account: string;
+}, home?: string): CachedRules | null;
+/** 0600: the patterns name what a team considers sensitive. */
+export declare function writeRules(cached: CachedRules, home?: string): void;
+/** Remove the cache. Missing is not an error; failing to delete is. */
+export declare function removeRules(home?: string): boolean;
+/** "3 hours ago" - coarse on purpose; it answers "is this stale", no more. */
+export declare function describeAge(pulledAt: string, now?: Date): string;
+//# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/D,eAAO,MAAM,UAAU,eAAe,CAAA;AAEtC,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAA;IAChB,gEAAgE;IAChE,KAAK,EAAE,UAAU,EAAE,CAAA;CACpB;AAED,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,SAAS,UAAU,EAAE,EAC/B,IAAI,EAAE,SAAS,UAAU,EAAE,GAC1B,UAAU,EAAE,CAUd;AAUD,kFAAkF;AAClF,wBAAgB,SAAS,CACvB,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC5C,IAAI,GAAE,MAAkB,GACvB,WAAW,GAAG,IAAI,CAcpB;AAED,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAK9E;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,IAAI,GAAE,MAAkB,GAAG,OAAO,CAS7D;AAED,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAQ5E"}

package/dist/rules.js

@@ -0,0 +1,103 @@
+// The account's custom rules, cached on this machine.
+//
+// Custom rules are defined in the web app and live in Cloud. Before this file
+// the terminal and the MCP server never applied them: the same code masked
+// differently in the browser than in `veilio scrub`, and a whitelisted name
+// that the browser left readable came back as a placeholder here (found on
+// staging, 2026-09-26).
+//
+// `veilio scrub` must stay offline (see offline.test.ts), so it cannot ask Cloud
+// for them. `veilio rules pull` fetches them and writes this cache; `scrub`
+// applies what the cache holds and says how old it is. Reads tolerate absence
+// and damage the way credential.ts does: a broken cache reads as "no rules",
+// never as a failed scrub.
+import { chmodSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { STORE_DIR } from '@veilio-inc/engine';
+export const RULES_FILE = 'rules.json';
+export function rulesPath(home = homedir()) {
+    return join(home, STORE_DIR, RULES_FILE);
+}
+/**
+ * Personal and team rules in the order the web app applies them:
+ * team whitelist, personal whitelist, team replace, personal replace.
+ *
+ * Whitelists first so a name either list keeps readable is never renamed by a
+ * replace rule; team before personal so the team's naming wins on a clash,
+ * which is what keeps two members' output interchangeable. Disabled rules are
+ * dropped and sort_order renumbered 0..n-1, so the engine sees one sequence.
+ * Must match `useMergedRules` in the Cloud frontend.
+ */
+export function mergeRules(personal, team) {
+    const byOrder = (a, b) => a.sort_order - b.sort_order;
+    const on = (list, type) => list.filter((r) => r.enabled && r.type === type).sort(byOrder);
+    return [
+        ...on(team, 'whitelist'),
+        ...on(personal, 'whitelist'),
+        ...on(team, 'replace'),
+        ...on(personal, 'replace'),
+    ].map((r, i) => ({ ...r, sort_order: i }));
+}
+function isRule(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const r = value;
+    if (typeof r.pattern !== 'string' || typeof r.sort_order !== 'number')
+        return false;
+    if (r.type === 'whitelist')
+        return true;
+    return r.type === 'replace' && typeof r.placeholder === 'string';
+}
+/** The cached rules for this account, or null. Null for every kind of failure. */
+export function readRules(owner, home = homedir()) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(rulesPath(home), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return null;
+    const c = parsed;
+    if (c.instance !== owner.instance || c.account !== owner.account)
+        return null;
+    if (typeof c.pulledAt !== 'string' || !Array.isArray(c.rules) || !c.rules.every(isRule)) {
+        return null;
+    }
+    return parsed;
+}
+/** 0600: the patterns name what a team considers sensitive. */
+export function writeRules(cached, home = homedir()) {
+    const path = rulesPath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(cached, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/** Remove the cache. Missing is not an error; failing to delete is. */
+export function removeRules(home = homedir()) {
+    const path = rulesPath(home);
+    try {
+        statSync(path);
+    }
+    catch {
+        return false;
+    }
+    rmSync(path, { recursive: true, force: true });
+    return true;
+}
+/** "3 hours ago" - coarse on purpose; it answers "is this stale", no more. */
+export function describeAge(pulledAt, now = new Date()) {
+    const ms = now.getTime() - new Date(pulledAt).getTime();
+    if (!Number.isFinite(ms))
+        return 'at an unknown time';
+    const minutes = Math.max(0, Math.floor(ms / 60_000));
+    if (minutes < 60)
+        return minutes <= 1 ? 'just now' : `${minutes} minutes ago`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 48)
+        return `${hours} hour${hours === 1 ? '' : 's'} ago`;
+    return `${Math.floor(hours / 24)} days ago`;
+}
+//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,wBAAwB;AACxB,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,2BAA2B;AAE3B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAA;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAYtC,MAAM,UAAU,SAAS,CAAC,OAAe,OAAO,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,QAA+B,EAC/B,IAA2B;IAE3B,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,CAAa,EAAU,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAA;IACrF,MAAM,EAAE,GAAG,CAAC,IAA2B,EAAE,IAAwB,EAAgB,EAAE,CACjF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChE,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;QACxB,GAAG,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;QACtB,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC3B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnF,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAA;AAClE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,SAAS,CACvB,KAA4C,EAC5C,OAAe,OAAO,EAAE;IAExB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,CAAC,GAAG,MAAiC,CAAA;IAC3C,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAC7E,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,MAAqB,CAAA;AAC9B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CAAC,MAAmB,EAAE,OAAe,OAAO,EAAE;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5E,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,OAAe,OAAO,EAAE;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAY,IAAI,IAAI,EAAE;IAClE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,oBAAoB,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAA;IACpD,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,cAAc,CAAA;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACtC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;IACnE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAA;AAC7C,CAAC"}

package/dist/store.d.ts

@@ -12,7 +12,31 @@ export interface StoredMap {
     /** Schema marker so a future format change can be detected rather than
      *  silently misread as a map. */
     version: 1;
+    /**
+     * Where this map came from in Cloud, if it came from Cloud.
+     *
+     * Present only for a map that was pulled or pushed. Its whole purpose is to
+     * make divergence DETECTABLE: without it, `pull` cannot tell "this is the map
+     * I pulled and have not touched" from "this is a different map with the same
+     * name", and the only safe behaviour left would be to overwrite or to refuse
+     * always. Neither is the answer — the contract says a conflict is reported.
+     */
+    remote?: {
+        id: string;
+        /** Cloud's `updated_at` at the moment we pulled. */
+        updatedAt: string;
+        pulledAt?: string;
+        pushedAt?: string;
+    };
 }
+/**
+ * The Cloud provenance recorded alongside the local map, if any.
+ *
+ * Separate from `loadMap` because every existing caller wants the map and
+ * nothing else, and because a store written before this existed simply has no
+ * `remote` — which reads correctly as "this map did not come from Cloud".
+ */
+export declare function loadRemote(path: string): StoredMap['remote'] | undefined;
 /** Read the stored map, or an empty map when there is none. Throws only when a
  *  file exists but cannot be understood — silently starting from empty there
  *  would orphan every placeholder the user already has in flight. */
@@ -36,6 +60,7 @@ export declare class MapOverwriteError extends Error {
  */
 export declare function saveMap(path: string, map: SymbolMap, options?: {
     force?: boolean;
+    remote?: StoredMap['remote'];
 }): void;
 export declare function clearMap(path: string): boolean;
 //# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9D,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,eAAO,MAAM,UAAU,aAAa,CAAA;AAEpC;;oCAEoC;AACpC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,SAAS,CAAA;IACd;qCACiC;IACjC,OAAO,EAAE,CAAC,CAAA;CACX;AAOD;;qEAEqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAgB/C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CA8B7F;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI9C"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9D,OAAO,EAAE,SAAS,EAAE,CAAA;AACpB,eAAO,MAAM,UAAU,aAAa,CAAA;AAEpC;;oCAEoC;AACpC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQpD;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3E;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,SAAS,CAAA;IACd;qCACiC;IACjC,OAAO,EAAE,CAAC,CAAA;IACV;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE;QACP,EAAE,EAAE,MAAM,CAAA;QACV,oDAAoD;QACpD,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAOD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,SAAS,CAYxE;AAED;;qEAEqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAgB/C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,CACrB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,SAAS,EACd,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;CAAO,GAC9D,IAAI,CAiCN;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI9C"}