@veilio-inc/cli 0.2.0 → 0.3.0

package/dist/rules.js

@@ -0,0 +1,103 @@
+// The account's custom rules, cached on this machine.
+//
+// Custom rules are defined in the web app and live in Cloud. Before this file
+// the terminal and the MCP server never applied them: the same code masked
+// differently in the browser than in `veilio scrub`, and a whitelisted name
+// that the browser left readable came back as a placeholder here (found on
+// staging, 2026-09-26).
+//
+// `veilio scrub` must stay offline (see offline.test.ts), so it cannot ask Cloud
+// for them. `veilio rules pull` fetches them and writes this cache; `scrub`
+// applies what the cache holds and says how old it is. Reads tolerate absence
+// and damage the way credential.ts does: a broken cache reads as "no rules",
+// never as a failed scrub.
+import { chmodSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { STORE_DIR } from '@veilio-inc/engine';
+export const RULES_FILE = 'rules.json';
+export function rulesPath(home = homedir()) {
+    return join(home, STORE_DIR, RULES_FILE);
+}
+/**
+ * Personal and team rules in the order the web app applies them:
+ * team whitelist, personal whitelist, team replace, personal replace.
+ *
+ * Whitelists first so a name either list keeps readable is never renamed by a
+ * replace rule; team before personal so the team's naming wins on a clash,
+ * which is what keeps two members' output interchangeable. Disabled rules are
+ * dropped and sort_order renumbered 0..n-1, so the engine sees one sequence.
+ * Must match `useMergedRules` in the Cloud frontend.
+ */
+export function mergeRules(personal, team) {
+    const byOrder = (a, b) => a.sort_order - b.sort_order;
+    const on = (list, type) => list.filter((r) => r.enabled && r.type === type).sort(byOrder);
+    return [
+        ...on(team, 'whitelist'),
+        ...on(personal, 'whitelist'),
+        ...on(team, 'replace'),
+        ...on(personal, 'replace'),
+    ].map((r, i) => ({ ...r, sort_order: i }));
+}
+function isRule(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const r = value;
+    if (typeof r.pattern !== 'string' || typeof r.sort_order !== 'number')
+        return false;
+    if (r.type === 'whitelist')
+        return true;
+    return r.type === 'replace' && typeof r.placeholder === 'string';
+}
+/** The cached rules for this account, or null. Null for every kind of failure. */
+export function readRules(owner, home = homedir()) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(rulesPath(home), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return null;
+    const c = parsed;
+    if (c.instance !== owner.instance || c.account !== owner.account)
+        return null;
+    if (typeof c.pulledAt !== 'string' || !Array.isArray(c.rules) || !c.rules.every(isRule)) {
+        return null;
+    }
+    return parsed;
+}
+/** 0600: the patterns name what a team considers sensitive. */
+export function writeRules(cached, home = homedir()) {
+    const path = rulesPath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(cached, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/** Remove the cache. Missing is not an error; failing to delete is. */
+export function removeRules(home = homedir()) {
+    const path = rulesPath(home);
+    try {
+        statSync(path);
+    }
+    catch {
+        return false;
+    }
+    rmSync(path, { recursive: true, force: true });
+    return true;
+}
+/** "3 hours ago" - coarse on purpose; it answers "is this stale", no more. */
+export function describeAge(pulledAt, now = new Date()) {
+    const ms = now.getTime() - new Date(pulledAt).getTime();
+    if (!Number.isFinite(ms))
+        return 'at an unknown time';
+    const minutes = Math.max(0, Math.floor(ms / 60_000));
+    if (minutes < 60)
+        return minutes <= 1 ? 'just now' : `${minutes} minutes ago`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 48)
+        return `${hours} hour${hours === 1 ? '' : 's'} ago`;
+    return `${Math.floor(hours / 24)} days ago`;
+}
+//# sourceMappingURL=rules.js.map

package/dist/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,wBAAwB;AACxB,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,2BAA2B;AAE3B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAA;AAE/D,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAA;AAYtC,MAAM,UAAU,SAAS,CAAC,OAAe,OAAO,EAAE;IAChD,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,QAA+B,EAC/B,IAA2B;IAE3B,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,CAAa,EAAU,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAA;IACrF,MAAM,EAAE,GAAG,CAAC,IAA2B,EAAE,IAAwB,EAAgB,EAAE,CACjF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChE,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;QACxB,GAAG,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC;QACtB,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC3B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACnF,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAA;AAClE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,SAAS,CACvB,KAA4C,EAC5C,OAAe,OAAO,EAAE;IAExB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,CAAC,GAAG,MAAiC,CAAA;IAC3C,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAC7E,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,MAAqB,CAAA;AAC9B,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,UAAU,CAAC,MAAmB,EAAE,OAAe,OAAO,EAAE;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5E,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,OAAe,OAAO,EAAE;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAY,IAAI,IAAI,EAAE;IAClE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,oBAAoB,CAAA;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAA;IACpD,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,cAAc,CAAA;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACtC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;IACnE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAA;AAC7C,CAAC"}

package/dist/team-unlock.d.ts

@@ -0,0 +1,49 @@
+export declare const TEAM_UNLOCK_FILE = "team-keys.json";
+/** How long an unlock lasts unless asked for something shorter. */
+export declare const DEFAULT_UNLOCK_DAYS = 7;
+export interface StoredTeamKey {
+    version: number;
+    /** Raw AES-256 key, base64. */
+    key: string;
+}
+export interface TeamUnlock {
+    v: 1;
+    /** Bound to the instance and account that unlocked it, so a file left behind
+     *  by one sign-in is never used by another. The same reasoning as the wrap
+     *  context: material that is valid somewhere must not be valid everywhere. */
+    instance: string;
+    account: string;
+    teamId: string;
+    /** ISO-8601. Past this, reads return null and the file is ignored. */
+    expiresAt: string;
+    keys: StoredTeamKey[];
+}
+/** Where the unlocked keys live: beside the credential, not in a project. */
+export declare function teamUnlockPath(home?: string): string;
+/**
+ * The unlocked keys, or null.
+ *
+ * Null means "not unlocked", for every reason it can mean that. `now` is
+ * injectable so the expiry can be tested without waiting a week.
+ */
+export declare function readTeamUnlock(binding: {
+    instance: string;
+    account: string;
+}, home?: string, now?: Date): TeamUnlock | null;
+/** Write the unlocked keys, readable only by this user. */
+export declare function writeTeamUnlock(unlock: TeamUnlock, home?: string): void;
+/**
+ * Remove the unlocked keys. Returns whether there were any to remove.
+ *
+ * Called by `team lock` and by `logout` — signing out must not leave live team
+ * keys behind, which would be exactly the gap between what a person believes
+ * they revoked and what is still readable on disk.
+ *
+ * A failure to DELETE throws rather than returning false, for the reason
+ * `removeCredential` gives: reporting "nothing to remove" while key material
+ * sits there inverts the whole point of the call.
+ */
+export declare function removeTeamUnlock(home?: string): boolean;
+/** When an unlock made now should expire. */
+export declare function expiryFrom(now: Date, days?: number): string;
+//# sourceMappingURL=team-unlock.d.ts.map

package/dist/team-unlock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-unlock.d.ts","sourceRoot":"","sources":["../src/team-unlock.ts"],"names":[],"mappings":"AAwCA,eAAO,MAAM,gBAAgB,mBAAmB,CAAA;AAEhD,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAEpC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,CAAC,CAAA;IACJ;;kFAE8E;IAC9E,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,aAAa,EAAE,CAAA;CACtB;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE/D;AAiBD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC9C,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,IAAiB,GACrB,UAAU,GAAG,IAAI,CAyBnB;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAQlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAkB,GAAG,OAAO,CASlE;AAED,6CAA6C;AAC7C,wBAAgB,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,GAAE,MAA4B,GAAG,MAAM,CAEhF"}

package/dist/team-unlock.js

@@ -0,0 +1,134 @@
+// The team keys, unlocked for processes that have nobody to ask.
+//
+// An MCP server starts inside a coding agent. There is no terminal attached and
+// no one present to type a vault passphrase, so a key it needs must have been
+// put here by an earlier run in a terminal where somebody was. `veilio team
+// unlock` is that run.
+//
+// WHAT THIS FILE HOLDS, AND WHY IT IS THE NARROWER OF TWO BAD OPTIONS
+//
+// It holds unwrapped TEAM keys. The obvious alternative — storing the vault key
+// and re-deriving everything per process — is worse in every direction that
+// matters: the vault key also opens every personal map, and unwraps the private
+// key, which in turn opens any wrap ever addressed to this account, including
+// ones granted after the file was written. A team key opens team maps and
+// nothing else, and a team already shares them by construction.
+//
+// It is still real key material at rest. Whoever holds this file can read the
+// team's maps until the keys rotate. It is written 0600 beside the session
+// token, which is the same posture the token itself gets, and it expires — so a
+// machine compromised weeks after somebody ran `unlock` does not hand over a
+// live key for a forgotten session.
+//
+// WHAT IT DOES NOT SURVIVE
+//
+// A rotation. Removing a member mints a new version, and the copy here is of
+// the old one, so maps rewritten under the new key stop opening. That is
+// deliberate: the stale file degrades into "some maps cannot be read", which
+// `decryptTeamMapWithAny` already handles by skipping them, rather than into
+// continued access a rotation was meant to end. Re-running `unlock` picks up
+// the new version.
+//
+// Reads tolerate everything, exactly as `credential.ts` does: a missing file,
+// a corrupt one, an expired one and one belonging to another account all mean
+// the same thing to every caller — not unlocked, resolve locally.
+import { chmodSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { STORE_DIR } from '@veilio-inc/engine';
+export const TEAM_UNLOCK_FILE = 'team-keys.json';
+/** How long an unlock lasts unless asked for something shorter. */
+export const DEFAULT_UNLOCK_DAYS = 7;
+/** Where the unlocked keys live: beside the credential, not in a project. */
+export function teamUnlockPath(home = homedir()) {
+    return join(home, STORE_DIR, TEAM_UNLOCK_FILE);
+}
+function isTeamUnlock(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const u = value;
+    if (u.v !== 1)
+        return false;
+    for (const field of ['instance', 'account', 'teamId', 'expiresAt']) {
+        if (typeof u[field] !== 'string' || u[field] === '')
+            return false;
+    }
+    if (!Array.isArray(u.keys) || u.keys.length === 0)
+        return false;
+    return u.keys.every((k) => {
+        if (typeof k !== 'object' || k === null)
+            return false;
+        const key = k;
+        return typeof key.version === 'number' && typeof key.key === 'string' && key.key !== '';
+    });
+}
+/**
+ * The unlocked keys, or null.
+ *
+ * Null means "not unlocked", for every reason it can mean that. `now` is
+ * injectable so the expiry can be tested without waiting a week.
+ */
+export function readTeamUnlock(binding, home = homedir(), now = new Date()) {
+    let raw;
+    try {
+        raw = readFileSync(teamUnlockPath(home), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!isTeamUnlock(parsed))
+        return null;
+    // Someone else's unlock, or one from another instance. Not an error — a
+    // machine can be signed in to a self-hosted instance today and to the hosted
+    // one tomorrow, and the leftover file is simply not ours.
+    if (parsed.instance !== binding.instance || parsed.account !== binding.account)
+        return null;
+    const expiresAt = Date.parse(parsed.expiresAt);
+    if (Number.isNaN(expiresAt) || expiresAt <= now.getTime())
+        return null;
+    return parsed;
+}
+/** Write the unlocked keys, readable only by this user. */
+export function writeTeamUnlock(unlock, home = homedir()) {
+    const path = teamUnlockPath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    // `chmodSync` after the write for the same reason `writeCredential` does it:
+    // `mode` applies only when the file is created, so re-unlocking over a
+    // world-readable file left from an earlier mistake would keep it that way.
+    writeFileSync(path, `${JSON.stringify(unlock, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/**
+ * Remove the unlocked keys. Returns whether there were any to remove.
+ *
+ * Called by `team lock` and by `logout` — signing out must not leave live team
+ * keys behind, which would be exactly the gap between what a person believes
+ * they revoked and what is still readable on disk.
+ *
+ * A failure to DELETE throws rather than returning false, for the reason
+ * `removeCredential` gives: reporting "nothing to remove" while key material
+ * sits there inverts the whole point of the call.
+ */
+export function removeTeamUnlock(home = homedir()) {
+    const path = teamUnlockPath(home);
+    try {
+        statSync(path);
+    }
+    catch {
+        return false;
+    }
+    rmSync(path, { recursive: true, force: true });
+    return true;
+}
+/** When an unlock made now should expire. */
+export function expiryFrom(now, days = DEFAULT_UNLOCK_DAYS) {
+    return new Date(now.getTime() + days * 24 * 60 * 60 * 1000).toISOString();
+}
+//# sourceMappingURL=team-unlock.js.map

package/dist/team-unlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-unlock.js","sourceRoot":"","sources":["../src/team-unlock.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,4EAA4E;AAC5E,uBAAuB;AACvB,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,gEAAgE;AAChE,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,oCAAoC;AACpC,EAAE;AACF,2BAA2B;AAC3B,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,mBAAmB;AACnB,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,kEAAkE;AAElE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAA;AAEhD,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAqBpC,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,OAAe,OAAO,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3B,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAU,EAAE,CAAC;QAC5E,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;IACnE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACjC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QACrD,MAAM,GAAG,GAAG,CAA4B,CAAA;QACxC,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,CAAA;IACzF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA8C,EAC9C,OAAe,OAAO,EAAE,EACxB,MAAY,IAAI,IAAI,EAAE;IAEtB,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtC,wEAAwE;IACxE,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAE3F,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,IAAI,CAAA;IAEtE,OAAO,MAAM,CAAA;AACf,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,MAAkB,EAAE,OAAe,OAAO,EAAE;IAC1E,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAC3E,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5E,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,OAAO,EAAE;IACvD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,UAAU,CAAC,GAAS,EAAE,OAAe,mBAAmB;IACtE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;AAC3E,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@veilio-inc/cli",
-  "version": "0.2.0",
-  "description": "Anonymize identifiers and redact credentials in source code before it reaches an LLM — from the terminal, a pipe, or a pre-commit hook.",
+  "version": "0.3.0",
+  "description": "Anonymize identifiers and redact credentials in source code before it reaches an LLM \u2014 from the terminal, a pipe, or a pre-commit hook.",
   "type": "module",
   "bin": {
     "veilio": "dist/index.js"
@@ -28,7 +28,7 @@
   ],
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@veilio-inc/engine": "^1.6.0"
+    "@veilio-inc/engine": "^1.6.2"
   },
   "scripts": {
     "build": "tsc",
@@ -47,7 +47,9 @@
     ".": "./dist/index.js",
     "./store": "./dist/store.js",
     "./credential": "./dist/credential.js",
-    "./cloud": "./dist/cloud.js"
+    "./cloud": "./dist/cloud.js",
+    "./team-unlock": "./dist/team-unlock.js",
+    "./rules": "./dist/rules.js"
   },
   "repository": {
     "type": "git",