@veilio-inc/cli 0.5.3 → 0.6.0

package/dist/client/team-key-bootstrap.js

@@ -0,0 +1,127 @@
+// The team's FIRST key, minted here when the team has none (spec 052 FR-016).
+//
+// Somebody has to mint it, and it cannot be the server: by design it holds no
+// team key and could not make one that meant anything. The web app does it for
+// the first owner or admin who opens it (frontend `bootstrapTeamKey.ts`). A
+// solo developer's team of one may never get there: with no maps the web app
+// no longer asks for the vault, so no key was ever minted, and `team unlock`
+// sent them to ask a teammate who does not exist (staging, 2026-10-26).
+//
+// So `team unlock`, which holds the vault key anyway, does what the browser
+// does, byte for byte: a fresh 32-byte AES-GCM key, wrapped to this account's
+// OWN public key with the same ECDH + HKDF context and the same
+// `{v, iv, data, from}` wrap, posted as the next unused version.
+//
+// THE SERVER DECIDES whether it really is a bootstrap - no wraps at all, the
+// next version, recipient = granter, an owner or admin. This client cannot
+// check the first: `GET /key` returns only its own wraps. So it tries, and a
+// refusal is the answer. Two members unlocking at once cannot both succeed; the
+// loser stands down rather than mint a rival key that would strand every map
+// sealed under the winner's.
+import { deriveWrappingKey, exportTeamKey, fromBase64, importPublicKey, unwrapTeamKey, randomBytes, toBase64, webCryptoSubtle, } from '@veilio-inc/engine';
+import { CloudError, getMe, getTeamKeyPending, getTeamKeyWraps, grantTeamKey } from '../cloud.js';
+/** Wrap a team key for one recipient - the browser's `wrapTeamKeyFor`.
+ *  `iv` is for the test vector only. */
+export async function wrapTeamKeyFor(teamKeyRaw, myPrivateKey, myPublicKey, recipientPublicKey, ctx, iv = randomBytes(12)) {
+    const wrappingKey = await deriveWrappingKey(myPrivateKey, await importPublicKey(recipientPublicKey), {
+        teamId: ctx.teamId,
+        version: ctx.version,
+        granterPublicKey: myPublicKey,
+        recipientPublicKey,
+    });
+    const data = await webCryptoSubtle().encrypt({ name: 'AES-GCM', iv }, wrappingKey, teamKeyRaw);
+    return JSON.stringify({ v: 1, iv: toBase64(iv), data: toBase64(data), from: myPublicKey });
+}
+/**
+ * This account's keypair, opened with the vault key - and its public half
+ * DERIVED HERE from the private half, never taken from the server.
+ *
+ * Why (security review): the first team key is wrapped to this account's own
+ * public key. Taken as `GET /api/auth/keys` returned it, a dishonest or
+ * compromised server could hand back ITS public key and be wrapped the team
+ * key, which ends end-to-end confidentiality for every team map after. The
+ * private key comes out of a blob only the vault key opens, so the public key
+ * computed from it is the account's, whatever the server says. A server
+ * answer that differs is refused, fail closed.
+ */
+export async function openOwnKeypair(vaultKey, privateKeyEncrypted, servedPublicKey) {
+    const env = JSON.parse(privateKeyEncrypted);
+    if (env.v !== 1 ||
+        env.alg !== 'AES-GCM' ||
+        typeof env.iv !== 'string' ||
+        typeof env.data !== 'string') {
+        throw new Error('the stored private key is not an envelope this client knows');
+    }
+    const subtle = webCryptoSubtle();
+    const pkcs8 = await subtle.decrypt({ name: 'AES-GCM', iv: fromBase64(env.iv) }, vaultKey, fromBase64(env.data));
+    // Extractable only for this one export of the public half; the key used
+    // from here on is imported again, non-extractable.
+    const exportable = await subtle.importKey('pkcs8', pkcs8, { name: 'X25519' }, true, [
+        'deriveBits',
+    ]);
+    const jwk = await subtle.exportKey('jwk', exportable);
+    if (typeof jwk.x !== 'string')
+        throw new Error('the private key did not yield a public key');
+    const derived = toBase64(fromBase64(jwk.x.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (jwk.x.length % 4)) % 4)));
+    if (derived !== servedPublicKey)
+        return { ok: false, reason: 'mismatch' };
+    const privateKey = await subtle.importKey('pkcs8', pkcs8, { name: 'X25519' }, false, [
+        'deriveBits',
+    ]);
+    return { ok: true, privateKey: privateKey, publicKey: derived };
+}
+/**
+ * Try to mint the team's first key. Throws only for a failure that is not an
+ * answer (the network, the server's own error), which the caller reports.
+ */
+export async function bootstrapTeamKey(credential, teamId, me) {
+    const user = await getMe(credential);
+    const userId = user.user?.id;
+    if (typeof userId !== 'string' || userId === '') {
+        throw new CloudError('server', 'the instance did not say which account this is');
+    }
+    // Not always 1: when the last holder of a key left, its number is leaked,
+    // and the server refuses a new key under it (spec 014).
+    const pending = await getTeamKeyPending(credential, teamId);
+    const version = typeof pending?.nextVersion === 'number' ? pending.nextVersion : 1;
+    const raw = randomBytes(32);
+    // Wrapped to ourselves; our own public key is not pinned (pinning is for
+    // teammates). A substituted key would give a wrap we cannot open, which the
+    // unwrap right after this reports at once.
+    const wrapped = await wrapTeamKeyFor(raw, me.privateKey, me.publicKey, me.publicKey, {
+        teamId,
+        version,
+    });
+    try {
+        await grantTeamKey(credential, teamId, { userId, version, wrappedKey: wrapped });
+    }
+    catch (err) {
+        // 403: the team has wraps already, or this member may not start one.
+        // 409: a wrap for this version exists. Somebody got there first.
+        if (err instanceof CloudError && (err.status === 403 || err.status === 409)) {
+            return { status: 'refused', reason: err.message || null };
+        }
+        throw err;
+    }
+    // Read back and opened, and compared byte for byte with the key minted: the
+    // proof that what the team's maps will be sealed under is this key, and not
+    // one the server swapped in (security review). Anything else fails closed.
+    const { wraps } = await getTeamKeyWraps(credential, teamId);
+    const wrap = wraps.find((w) => w.version === version);
+    if (!wrap)
+        return { status: 'readback_mismatch' };
+    try {
+        const opened = await unwrapTeamKey(wrap.wrapped_key, me.privateKey, {
+            teamId,
+            version,
+            myPublicKey: me.publicKey,
+        });
+        if ((await exportTeamKey(opened)) !== toBase64(raw))
+            return { status: 'readback_mismatch' };
+    }
+    catch {
+        return { status: 'readback_mismatch' };
+    }
+    return { status: 'created', version, raw };
+}
+//# sourceMappingURL=team-key-bootstrap.js.map

package/dist/client/team-key-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-key-bootstrap.js","sourceRoot":"","sources":["../../src/client/team-key-bootstrap.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,6BAA6B;AAE7B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,QAAQ,EACR,eAAe,GAEhB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGjG;wCACwC;AACxC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAsB,EACtB,YAA2B,EAC3B,WAAmB,EACnB,kBAA0B,EAC1B,GAAwC,EACxC,KAAiB,WAAW,CAAC,EAAE,CAAC;IAEhC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CACzC,YAAY,EACZ,MAAM,eAAe,CAAC,kBAAkB,CAAC,EACzC;QACE,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,gBAAgB,EAAE,WAAW;QAC7B,kBAAkB;KACnB,CACF,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;IAC9F,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;AAC5F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAuB,EACvB,mBAA2B,EAC3B,eAAuB;IAIvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAKzC,CAAA;IACD,IACE,GAAG,CAAC,CAAC,KAAK,CAAC;QACX,GAAG,CAAC,GAAG,KAAK,SAAS;QACrB,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,EAA6B,CAAA;IAC3D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAA4B,EAAE,EACtE,QAAgC,EAChC,UAAU,CAAC,GAAG,CAAC,IAAI,CAA4B,CAChD,CAAA;IACD,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;QAClF,YAAY;KACb,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC5F,MAAM,OAAO,GAAG,QAAQ,CACtB,UAAU,CACR,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CACvF,CACF,CAAA;IACD,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACzE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE;QACnF,YAAY;KACb,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAsC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC7F,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAsB,EACtB,MAAc,EACd,EAAoD;IAEpD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAA;IAClF,CAAC;IACD,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,OAAO,OAAO,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC3B,yEAAyE;IACzE,4EAA4E;IAC5E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE;QACnF,MAAM;QACN,OAAO;KACR,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,GAAG,YAAY,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAC5E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAA;QAC3D,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,EAAE;YAClE,MAAM;YACN,OAAO;YACP,WAAW,EAAE,EAAE,CAAC,SAAS;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACxC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AAC5C,CAAC"}

package/dist/client/vault-key.d.ts

@@ -0,0 +1,5 @@
+import { type CryptoKeyLike } from '@veilio-inc/engine';
+import type { Credential } from '../credential.js';
+import { type Outcome } from './wording.js';
+export declare function vaultKeyFor(credential: Credential, passphrase: (() => Promise<string>) | undefined): Promise<Outcome<CryptoKeyLike>>;
+//# sourceMappingURL=vault-key.d.ts.map

package/dist/client/vault-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-key.d.ts","sourceRoot":"","sources":["../../src/client/vault-key.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAiC,KAAK,OAAO,EAAE,MAAM,cAAc,CAAA;AAE1E,wBAAsB,WAAW,CAC/B,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,GAC9C,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAsBjC"}

package/dist/client/vault-key.js

@@ -0,0 +1,35 @@
+// The vault key, derived here from the passphrase and checked - once, for
+// every caller: `team unlock`, `vault unlock`, and a personal map opened or
+// sealed with the passphrase. Three copies of this had grown, and a KDF change
+// or a new check fixed in one would have left the other two wrong (review).
+//
+// The server holds the salt, the KDF cost and a verifier - all it can hold.
+// The passphrase never leaves this machine, and the key is never sent or
+// written: it is non-extractable, used in memory and dropped.
+import { checkVaultVerifier, deriveVaultKey, fromBase64, } from '@veilio-inc/engine';
+import { getVault } from '../cloud.js';
+import { refuse, refusalFromCloudError } from './wording.js';
+export async function vaultKeyFor(credential, passphrase) {
+    let vault;
+    try {
+        vault = await getVault(credential);
+    }
+    catch (err) {
+        return { ok: false, refusal: refusalFromCloudError(err, { project: credential.project }) };
+    }
+    // Said plainly rather than as a decryption failure: there is nothing to try
+    // a passphrase against.
+    if (!vault.initialized)
+        return refuse('no_vault');
+    const typed = passphrase ? await passphrase() : '';
+    if (typed === '')
+        return refuse('no_passphrase');
+    const key = await deriveVaultKey(typed, fromBase64(vault.salt), vault.kdf ? { name: 'PBKDF2-SHA256', iterations: vault.kdf.iterations } : undefined);
+    // Before anything is opened, sealed or written: a wrong passphrase is named
+    // as one, rather than surfacing later as an authentication-tag failure that
+    // reads like corruption - or as a key wrapped for good under the wrong one.
+    if (!(await checkVaultVerifier(key, vault.verifier)))
+        return refuse('wrong_passphrase');
+    return { ok: true, value: key };
+}
+//# sourceMappingURL=vault-key.js.map

package/dist/client/vault-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-key.js","sourceRoot":"","sources":["../../src/client/vault-key.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,8DAA8D;AAE9D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,UAAU,GAEX,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAgB,MAAM,cAAc,CAAA;AAE1E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAsB,EACtB,UAA+C;IAE/C,IAAI,KAAK,CAAA;IACT,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;IAC5F,CAAC;IACD,4EAA4E;IAC5E,wBAAwB;IACxB,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,KAAK,EACL,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EACtB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACpF,CAAA;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AACjC,CAAC"}

package/dist/client/wording.d.ts

@@ -0,0 +1,59 @@
+export declare const REFUSAL_CODES: readonly ["not_signed_in", "which_map", "map_not_found", "map_not_in_project", "not_yours_remove", "not_yours_update", "no_local_map", "no_vault", "no_passphrase", "wrong_passphrase", "vault_locked", "no_pmk_yet", "pmk_unopenable", "keys_not_set_up", "team_key_waiting", "own_public_key_mismatch", "team_key_readback_mismatch", "team_key_not_startable", "team_key_solo_unavailable", "personal_old_seal", "personal_unopenable", "not_envelope", "team_locked", "team_key_unreadable", "team_key_mismatch", "not_in_team", "team_maps_unreadable", "team_map_unopenable", "clash", "would_drop", "pull_would_drop", "diverged", "stale", "rotation_owed", "too_large", "abuse_limit", "which_project", "project_not_found", "project_ambiguous", "project_gone", "no_projects", "destructive_off", "confirm_name", "confirm_unknown", "session_rejected", "unentitled", "suspended", "forbidden", "unreachable", "server"];
+export type RefusalCode = (typeof REFUSAL_CODES)[number];
+/** What a sentence may be filled with. Every field is optional; each entry
+ *  uses the ones it needs. */
+export interface WordingParams {
+    id?: string;
+    name?: string;
+    count?: number;
+    detail?: string;
+    path?: string;
+    from?: string;
+    to?: string;
+    /** A short, already-joined list - placeholders, map names, ids. */
+    list?: string;
+    project?: string;
+}
+export interface Refusal {
+    code: RefusalCode;
+    /** The reason, as a sentence. */
+    message: string;
+    /** What resolves it, as a sentence that names something a person can do. */
+    resolve: string;
+    /** Extra lines for the terminal only - they may hold real identifiers, so the
+     *  MCP server never renders them. */
+    details?: string[];
+}
+export type Outcome<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    refusal: Refusal;
+};
+type Words = (p: WordingParams) => {
+    message: string;
+    resolve: string;
+};
+export declare const WORDING: Record<RefusalCode, Words>;
+/** A refusal outcome, worded from the table. */
+export declare function refuse(code: RefusalCode, params?: WordingParams, details?: string[]): {
+    ok: false;
+    refusal: Refusal;
+};
+export declare function refusal(code: RefusalCode, params?: WordingParams, details?: string[]): Refusal;
+/** How the terminal prints one. The MCP server has its own (no details). */
+export declare function renderRefusal(r: Refusal): string;
+/**
+ * A failed request, as a refusal with the remedy that fits it.
+ *
+ * `project` is the project the call carried. The server answers a project that
+ * is not the team's - or no longer is - with 404 "Project not found", and that
+ * must be said as such, never as "the instance reported an error", or nobody
+ * thinks to choose another (spec 052 edge case: the chosen project removed).
+ */
+export declare function refusalFromCloudError(err: unknown, ctx?: {
+    project?: string;
+}): Refusal;
+export {};
+//# sourceMappingURL=wording.d.ts.map

package/dist/client/wording.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wording.d.ts","sourceRoot":"","sources":["../../src/client/wording.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,aAAa,s4BAmDhB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD;8BAC8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,WAAW,CAAA;IACjB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAA;IACf;yCACqC;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAA;AAajF,KAAK,KAAK,GAAG,CAAC,CAAC,EAAE,aAAa,KAAK;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAIvE,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAyO9C,CAAA;AAED,gDAAgD;AAChD,wBAAgB,MAAM,CACpB,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,aAAkB,EAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAEjC;AAED,wBAAgB,OAAO,CACrB,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,aAAkB,EAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAGT;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAwB3F"}

package/dist/client/wording.js

@@ -0,0 +1,336 @@
+// Every refusal the Cloud commands and the MCP map tools can give, in one table
+// (spec 052 FR-019).
+//
+// WHY ONE TABLE
+//
+// The CLI and the MCP server do the same things to the same maps, and a person
+// who meets a refusal in an agent's reply will often go and try the command
+// themselves. If the two said different things for the same reason, the second
+// reads as a second problem. So both renderers take their words from here, and
+// a test checks the table as a table: one entry per code, each naming its
+// reason AND what resolves it. "Not permitted" alone leaves somebody exactly
+// where they were (Constitution V).
+//
+// The words never carry the `veilio:` prefix. That belongs to the renderer -
+// the terminal prints `veilio: ...` and the MCP server `Veilio: ...` - so the
+// sentence itself is the same everywhere.
+//
+// Real identifiers never go in `message` or `resolve`. A clash names the
+// placeholders; the names behind them go in `details`, which only the terminal
+// prints, because the MCP server's reader is the model whose context the names
+// must stay out of (spec 052, founder decision 2026-10-25).
+import { CloudError } from '../cloud.js';
+export const REFUSAL_CODES = [
+    'not_signed_in',
+    'which_map',
+    'map_not_found',
+    'map_not_in_project',
+    'not_yours_remove',
+    'not_yours_update',
+    'no_local_map',
+    'no_vault',
+    'no_passphrase',
+    'wrong_passphrase',
+    'vault_locked',
+    'no_pmk_yet',
+    'pmk_unopenable',
+    'keys_not_set_up',
+    'team_key_waiting',
+    'own_public_key_mismatch',
+    'team_key_readback_mismatch',
+    'team_key_not_startable',
+    'team_key_solo_unavailable',
+    'personal_old_seal',
+    'personal_unopenable',
+    'not_envelope',
+    'team_locked',
+    'team_key_unreadable',
+    'team_key_mismatch',
+    'not_in_team',
+    'team_maps_unreadable',
+    'team_map_unopenable',
+    'clash',
+    'would_drop',
+    'pull_would_drop',
+    'diverged',
+    'stale',
+    'rotation_owed',
+    'too_large',
+    'abuse_limit',
+    'which_project',
+    'project_not_found',
+    'project_ambiguous',
+    'project_gone',
+    'no_projects',
+    'destructive_off',
+    'confirm_name',
+    'confirm_unknown',
+    'session_rejected',
+    'unentitled',
+    'suspended',
+    'forbidden',
+    'unreachable',
+    'server',
+];
+/** A trailing full stop, unless the text already ends a sentence. Server
+ *  messages arrive both ways. */
+function sentence(text) {
+    const t = (text ?? '').trim();
+    return /[.!?…]$/.test(t) ? t : `${t}.`;
+}
+function plural(n, one, many) {
+    return n === 1 ? one : many;
+}
+const label = (p) => (p.name ? `"${p.name}" (${p.id})` : `${p.id}`);
+export const WORDING = {
+    not_signed_in: () => ({
+        message: 'not signed in.',
+        resolve: 'Run `veilio login` first.',
+    }),
+    which_map: () => ({
+        message: 'which map? No id was given, so nothing was done.',
+        resolve: 'Run `veilio maps list` for the ids.',
+    }),
+    map_not_found: (p) => ({
+        message: `there is no map ${p.id} on this account.`,
+        resolve: 'Run `veilio maps list` for the ids.',
+    }),
+    map_not_in_project: (p) => ({
+        message: `No map ${p.id} in project ${p.project} (the project in use).`,
+        resolve: '`veilio projects use <other>` to work in another one.',
+    }),
+    not_yours_remove: (p) => ({
+        message: `${label(p)} belongs to someone else on your team, so it is theirs to remove.`,
+        resolve: 'Ask whoever published it to remove it.',
+    }),
+    not_yours_update: (p) => ({
+        message: `${label(p)} belongs to someone else on your team, so only they can update it. Nothing was written.`,
+        resolve: 'Ask whoever published it to update it, or publish your own with `veilio maps push --team`.',
+    }),
+    no_local_map: (p) => ({
+        message: `there is no local map at ${p.path}, so there is nothing to send.`,
+        resolve: 'Run `veilio scrub` on the project first, or pass --map with the map to use.',
+    }),
+    no_vault: () => ({
+        message: 'this account has no vault, so there is no key to open or seal its personal maps.',
+        resolve: 'Create one in the web app first — it is the passphrase your maps are encrypted under.',
+    }),
+    no_passphrase: () => ({
+        message: 'no passphrase given, so nothing was changed.',
+        resolve: 'Run the command again and type the vault passphrase you use in the web app.',
+    }),
+    wrong_passphrase: () => ({
+        message: 'that vault passphrase is not right. Nothing was written or uploaded.',
+        resolve: 'Run the command again with the passphrase you use in the web app.',
+    }),
+    vault_locked: () => ({
+        message: 'the personal-maps key is not unlocked on this machine, so personal maps cannot be opened or sealed here. Nothing was changed.',
+        resolve: 'Run `veilio vault unlock` in a terminal first.',
+    }),
+    no_pmk_yet: () => ({
+        message: 'this account has no personal-maps key yet, so a personal map cannot be sealed for it.',
+        resolve: 'Run `veilio vault unlock`, which creates it.',
+    }),
+    pmk_unopenable: () => ({
+        message: "the account's personal-maps key could not be opened with this vault key, so it looks damaged. Nothing was changed.",
+        resolve: 'Contact Veilio support with the account email; do not create a new vault.',
+    }),
+    keys_not_set_up: () => ({
+        message: "this account's keys are not set up yet (it has no keypair), so nothing was changed.",
+        resolve: 'Open the web app and unlock your vault once to set up your keys, then run the command again.',
+    }),
+    own_public_key_mismatch: () => ({
+        message: 'the public key Cloud returned for this account does not belong to its private key, so no team key was made, wrapped or unlocked.',
+        resolve: 'Contact Veilio support, and do not grant or unlock team keys for this account until it is explained.',
+    }),
+    team_key_readback_mismatch: () => ({
+        message: 'the team key Cloud handed back (read back after it was set up) is not the one made here, so nothing was unlocked and nothing will be sealed under it.',
+        resolve: 'Contact Veilio support, and do not publish team maps until it is explained.',
+    }),
+    team_key_waiting: () => ({
+        message: 'no one in the team has granted this account the team key yet, so nothing was unlocked.',
+        resolve: 'Ask a team member who holds it to open the web app, which performs the grant, then run `veilio team unlock` again.',
+    }),
+    team_key_not_startable: (p) => ({
+        message: `the team has no key yet, and this account may not set one up: ${sentence(p.detail)}`,
+        resolve: 'Ask the team owner or an admin to open Veilio once, then run `veilio team unlock` again.',
+    }),
+    team_key_solo_unavailable: (p) => ({
+        message: `this account is the team's only member, and its key could not be set up from here (${p.detail}). Nothing was unlocked.`,
+        resolve: 'Open the team page in the web app, which sets the key up, then run `veilio team unlock` again.',
+    }),
+    personal_old_seal: (p) => ({
+        message: `${label(p)} is still sealed with the vault key, which this machine does not hold. Nothing was written.`,
+        resolve: 'Run `veilio vault unlock`, which re-seals it under the personal-maps key.',
+    }),
+    personal_unopenable: (p) => ({
+        message: `${label(p)} could not be opened — ${sentence(p.detail)} Nothing was written.`,
+        resolve: 'Check whether it opens in the web app; if it does not, it is damaged and `veilio maps rm` removes it.',
+    }),
+    not_envelope: () => ({
+        message: 'that map is not an encrypted envelope, so it was not written.',
+        resolve: 'Open it in the web app and save it again, which seals it.',
+    }),
+    team_locked: () => ({
+        message: 'no team key is unlocked on this machine, so team maps cannot be opened or sealed here. Nothing was written or uploaded.',
+        resolve: 'Run `veilio team unlock` first.',
+    }),
+    team_key_unreadable: (p) => ({
+        message: `the unlocked team key could not be read (${p.detail}). Nothing was written or uploaded.`,
+        resolve: 'Run `veilio team unlock` again.',
+    }),
+    team_key_mismatch: () => ({
+        message: 'the team key on this machine does not match this team. Nothing was written or uploaded.',
+        resolve: 'Run `veilio team unlock` again.',
+    }),
+    not_in_team: () => ({
+        message: 'this account is not in a team, so there is no shared map to publish to. Nothing was uploaded.',
+        resolve: "Open the team page in the web app, where the account's team is set up.",
+    }),
+    team_maps_unreadable: (p) => ({
+        message: `could not read the team's maps (${p.detail}), so whether this map conflicts with the team cannot be known. Nothing was uploaded.`,
+        resolve: 'Run `veilio team unlock` again; a named map that still does not open can be removed by its publisher with `veilio maps rm <id>`.',
+    }),
+    team_map_unopenable: (p) => ({
+        message: `that team map, ${label(p)}, could not be opened with the unlocked team keys — ${sentence(p.detail)} Nothing was written.`,
+        resolve: 'If the team key was rotated since, run `veilio team unlock` again.',
+    }),
+    clash: (p) => ({
+        message: `${p.count} ${plural(p.count, 'placeholder', 'placeholders')} in this map already ` +
+            `${plural(p.count, 'means', 'mean')} something else to the team (${p.list}). Publishing would leave ` +
+            `${plural(p.count, 'it', 'them')} unrestorable for every member, so nothing was uploaded.`,
+        resolve: 'Re-run `veilio scrub --team` to number this project out of the team’s own allocation, then push the result.',
+    }),
+    would_drop: (p) => ({
+        message: `updating ${label(p)} would drop ${p.count} ${plural(p.count, 'entry', 'entries')} the Cloud map holds and this project's map does not (${p.list}). Nothing was written.`,
+        resolve: 'Pass --allow-drop (for the MCP tool, allowDrop: true) to drop them deliberately, or pull the map first with `veilio maps pull <id>`.',
+    }),
+    pull_would_drop: (p) => ({
+        message: `pulling "${p.name}" would drop ${p.count} placeholder(s) this project's map has: ${p.list}. Nothing was written.`,
+        resolve: 'Push this map first (`veilio maps push`), pass --force to replace it, or export it with `veilio map --json`.',
+    }),
+    diverged: (p) => ({
+        message: `this map changed in Cloud (${p.from} → ${p.to}) and locally since it was pulled. Neither copy has been touched.`,
+        resolve: 'Pass --force to overwrite the local copy, or export it first with `veilio map --json`.',
+    }),
+    stale: (p) => ({
+        message: `${label(p)} changed in Cloud since it was read (now ${p.to}), so this update was not written over it.`,
+        resolve: 'Pull it (`veilio maps pull <id>`), check the change, then update again.',
+    }),
+    rotation_owed: () => ({
+        message: 'a teammate left while holding the team key, so no new team content may be written until the key is changed. Nothing was uploaded.',
+        resolve: 'A member who holds the current key has to change it in the web app — it cannot be done from here. Ask one of them.',
+    }),
+    too_large: () => ({
+        message: 'this map is too large for Cloud to accept, so nothing was stored.',
+        resolve: 'Split it, or remove entries you no longer need.',
+    }),
+    abuse_limit: (p) => ({
+        message: `${sentence(p.detail)} This ceiling is the same on every paid plan, so upgrading will not raise it. Nothing was uploaded.`,
+        resolve: 'Remove maps you no longer need with `veilio maps rm <id>`.',
+    }),
+    which_project: () => ({
+        message: 'which project? None was named, so nothing was changed.',
+        resolve: 'Run `veilio projects` for their names, then `veilio projects use <name>`.',
+    }),
+    project_not_found: (p) => ({
+        message: `"${p.project}" is not a project your team works in, so nothing was changed.`,
+        resolve: 'Run `veilio projects` to see the ones it does.',
+    }),
+    project_ambiguous: (p) => ({
+        message: `${p.count} projects are called "${p.project}", so nothing was changed.`,
+        resolve: 'Choose one by its id: `veilio projects` lists them.',
+    }),
+    project_gone: (p) => ({
+        message: `the project chosen for this sign-in (${p.project}) is not one your team works in any more, so nothing was done. No other project was used instead.`,
+        resolve: 'Run `veilio projects`, then `veilio projects use <name>`.',
+    }),
+    no_projects: () => ({
+        message: "this account's team works in no project yet, so there is none to choose.",
+        resolve: 'Share a first team map with `veilio maps push --team`, which creates the default project, or make one in the web app.',
+    }),
+    destructive_off: () => ({
+        message: 'removing a map, or an update that drops entries, is turned off for this MCP server, so nothing was removed or dropped.',
+        resolve: 'The person running it can allow it by starting the server with VEILIO_MCP_DESTRUCTIVE=1, or do it in a terminal with `veilio maps rm` or `veilio maps update --allow-drop`.',
+    }),
+    confirm_name: (p) => ({
+        message: `confirmName must repeat the map's exact name ("${p.name}"), so nothing was removed.`,
+        resolve: 'Ask the person to confirm which map, then call again with its exact name.',
+    }),
+    confirm_unknown: (p) => ({
+        message: `the name of ${p.id} could not be read to check confirmName against, so nothing was removed.`,
+        resolve: 'Check the id with maps_list, then call again.',
+    }),
+    session_rejected: () => ({
+        message: 'not signed in, or the session was revoked or expired.',
+        resolve: 'Run `veilio login` again.',
+    }),
+    unentitled: (p) => ({
+        message: `this account’s plan does not include that — ${sentence(p.detail)}`,
+        resolve: 'Change the plan in the web app to use it from here.',
+    }),
+    suspended: (p) => ({
+        message: sentence(p.detail),
+        resolve: 'Export and deletion still work in the web app; nothing else will until the review ends. Contact Veilio support about the review.',
+    }),
+    forbidden: (p) => ({
+        message: sentence(p.detail),
+        resolve: 'Ask a team owner or admin for the access this needs.',
+    }),
+    unreachable: (p) => ({
+        message: sentence(p.detail),
+        resolve: 'Check the network and the instance address, then run the command again.',
+    }),
+    server: (p) => ({
+        message: `the instance reported an error — ${sentence(p.detail)}`,
+        resolve: 'Run the command again in a minute; if it keeps failing, contact the instance’s support.',
+    }),
+};
+/** A refusal outcome, worded from the table. */
+export function refuse(code, params = {}, details) {
+    return { ok: false, refusal: refusal(code, params, details) };
+}
+export function refusal(code, params = {}, details) {
+    const words = WORDING[code](params);
+    return details && details.length > 0 ? { code, ...words, details } : { code, ...words };
+}
+/** How the terminal prints one. The MCP server has its own (no details). */
+export function renderRefusal(r) {
+    const lines = (r.details ?? []).map((d) => `  ${d}\n`).join('');
+    return `veilio: ${r.message} ${r.resolve}\n${lines}`;
+}
+/**
+ * A failed request, as a refusal with the remedy that fits it.
+ *
+ * `project` is the project the call carried. The server answers a project that
+ * is not the team's - or no longer is - with 404 "Project not found", and that
+ * must be said as such, never as "the instance reported an error", or nobody
+ * thinks to choose another (spec 052 edge case: the chosen project removed).
+ */
+export function refusalFromCloudError(err, ctx = {}) {
+    if (!(err instanceof CloudError)) {
+        return refusal('server', { detail: err instanceof Error ? err.message : String(err) });
+    }
+    if (err.status === 404 && /project not found/i.test(err.message)) {
+        return refusal('project_gone', { project: ctx.project ?? 'the default' });
+    }
+    switch (err.kind) {
+        case 'unauthenticated':
+            return refusal('session_rejected');
+        case 'unentitled':
+            return refusal('unentitled', { detail: err.message });
+        case 'suspended':
+            return refusal('suspended', { detail: err.message });
+        case 'forbidden':
+            // The ceiling is an abuse limit, not a plan feature. Saying "upgrade"
+            // here would take money for a change that does nothing.
+            if (/limit/i.test(err.message))
+                return refusal('abuse_limit', { detail: err.message });
+            return refusal('forbidden', { detail: err.message });
+        case 'unreachable':
+            return refusal('unreachable', { detail: err.message });
+        case 'server':
+            return refusal('server', { detail: err.message });
+    }
+}
+//# sourceMappingURL=wording.js.map

package/dist/client/wording.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wording.js","sourceRoot":"","sources":["../../src/client/wording.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,qBAAqB;AACrB,EAAE;AACF,gBAAgB;AAChB,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,6EAA6E;AAC7E,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,0CAA0C;AAC1C,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,4DAA4D;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,eAAe;IACf,WAAW;IACX,eAAe;IACf,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,UAAU;IACV,eAAe;IACf,kBAAkB;IAClB,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,yBAAyB;IACzB,4BAA4B;IAC5B,wBAAwB;IACxB,2BAA2B;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,cAAc;IACd,aAAa;IACb,qBAAqB;IACrB,mBAAmB;IACnB,aAAa;IACb,sBAAsB;IACtB,qBAAqB;IACrB,OAAO;IACP,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,OAAO;IACP,eAAe;IACf,WAAW;IACX,aAAa;IACb,eAAe;IACf,mBAAmB;IACnB,mBAAmB;IACnB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,WAAW;IACX,aAAa;IACb,QAAQ;CACA,CAAA;AAgCV;iCACiC;AACjC,SAAS,QAAQ,CAAC,IAAwB;IACxC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAA;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,CAAqB,EAAE,GAAW,EAAE,IAAY;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7B,CAAC;AAID,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAE1F,MAAM,CAAC,MAAM,OAAO,GAA+B;IACjD,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QACpB,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,2BAA2B;KACrC,CAAC;IACF,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,kDAAkD;QAC3D,OAAO,EAAE,qCAAqC;KAC/C,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrB,OAAO,EAAE,mBAAmB,CAAC,CAAC,EAAE,mBAAmB;QACnD,OAAO,EAAE,qCAAqC;KAC/C,CAAC;IACF,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,OAAO,wBAAwB;QACvE,OAAO,EAAE,uDAAuD;KACjE,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,mEAAmE;QACvF,OAAO,EAAE,wCAAwC;KAClD,CAAC;IACF,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxB,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,yFAAyF;QAC7G,OAAO,EACL,4FAA4F;KAC/F,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpB,OAAO,EAAE,4BAA4B,CAAC,CAAC,IAAI,gCAAgC;QAC3E,OAAO,EAAE,6EAA6E;KACvF,CAAC;IACF,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACf,OAAO,EAAE,kFAAkF;QAC3F,OAAO,EACL,uFAAuF;KAC1F,CAAC;IACF,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QACpB,OAAO,EAAE,8CAA8C;QACvD,OAAO,EAAE,6EAA6E;KACvF,CAAC;IACF,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,sEAAsE;QAC/E,OAAO,EAAE,mEAAmE;KAC7E,CAAC;IACF,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QACnB,OAAO,EACL,+HAA+H;QACjI,OAAO,EAAE,gDAAgD;KAC1D,CAAC;IACF,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjB,OAAO,EACL,uFAAuF;QACzF,OAAO,EAAE,8CAA8C;KACxD,CAAC;IACF,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;QACrB,OAAO,EACL,oHAAoH;QACtH,OAAO,EAAE,2EAA2E;KACrF,CAAC;IACF,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QACtB,OAAO,EAAE,qFAAqF;QAC9F,OAAO,EACL,8FAA8F;KACjG,CAAC;IACF,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9B,OAAO,EACL,kIAAkI;QACpI,OAAO,EACL,sGAAsG;KACzG,CAAC;IACF,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,OAAO,EACL,uJAAuJ;QACzJ,OAAO,EAAE,6EAA6E;KACvF,CAAC;IACF,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;QACvB,OAAO,EACL,wFAAwF;QAC1F,OAAO,EACL,oHAAoH;KACvH,CAAC;IACF,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,OAAO,EAAE,iEAAiE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QAC9F,OAAO,EACL,0FAA0F;KAC7F,CAAC;IACF,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,OAAO,EAAE,sFAAsF,CAAC,CAAC,MAAM,0BAA0B;QACjI,OAAO,EACL,gGAAgG;KACnG,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,6FAA6F;QACjH,OAAO,EAAE,2EAA2E;KACrF,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,0BAA0B,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB;QACvF,OAAO,EACL,uGAAuG;KAC1G,CAAC;IACF,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;QACnB,OAAO,EAAE,+DAA+D;QACxE,OAAO,EAAE,2DAA2D;KACrE,CAAC;IACF,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAClB,OAAO,EACL,yHAAyH;QAC3H,OAAO,EAAE,iCAAiC;KAC3C,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,EAAE,4CAA4C,CAAC,CAAC,MAAM,qCAAqC;QAClG,OAAO,EAAE,iCAAiC;KAC3C,CAAC;IACF,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC;QACxB,OAAO,EACL,yFAAyF;QAC3F,OAAO,EAAE,iCAAiC;KAC3C,CAAC;IACF,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAClB,OAAO,EACL,+FAA+F;QACjG,OAAO,EAAE,wEAAwE;KAClF,CAAC;IACF,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,EAAE,mCAAmC,CAAC,CAAC,MAAM,uFAAuF;QAC3I,OAAO,EACL,kIAAkI;KACrI,CAAC;IACF,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3B,OAAO,EAAE,kBAAkB,KAAK,CAAC,CAAC,CAAC,uDAAuD,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,uBAAuB;QACnI,OAAO,EAAE,oEAAoE;KAC9E,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACb,OAAO,EACL,GAAG,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,cAAc,CAAC,uBAAuB;YACnF,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,gCAAgC,CAAC,CAAC,IAAI,4BAA4B;YACrG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,0DAA0D;QAC5F,OAAO,EACL,6GAA6G;KAChH,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,OAAO,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,yDAAyD,CAAC,CAAC,IAAI,yBAAyB;QAClL,OAAO,EACL,sIAAsI;KACzI,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,YAAY,CAAC,CAAC,IAAI,gBAAgB,CAAC,CAAC,KAAK,2CAA2C,CAAC,CAAC,IAAI,wBAAwB;QAC3H,OAAO,EACL,8GAA8G;KACjH,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,8BAA8B,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,mEAAmE;QAC1H,OAAO,EACL,wFAAwF;KAC3F,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACb,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,EAAE,4CAA4C;QAChH,OAAO,EAAE,yEAAyE;KACnF,CAAC;IACF,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QACpB,OAAO,EACL,mIAAmI;QACrI,OAAO,EACL,oHAAoH;KACvH,CAAC;IACF,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,mEAAmE;QAC5E,OAAO,EAAE,iDAAiD;KAC3D,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,qGAAqG;QACnI,OAAO,EAAE,4DAA4D;KACtE,CAAC;IACF,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QACpB,OAAO,EAAE,wDAAwD;QACjE,OAAO,EAAE,2EAA2E;KACrF,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,gEAAgE;QACtF,OAAO,EAAE,gDAAgD;KAC1D,CAAC;IACF,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,yBAAyB,CAAC,CAAC,OAAO,4BAA4B;QACjF,OAAO,EAAE,qDAAqD;KAC/D,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpB,OAAO,EAAE,wCAAwC,CAAC,CAAC,OAAO,mGAAmG;QAC7J,OAAO,EAAE,2DAA2D;KACrE,CAAC;IACF,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAClB,OAAO,EAAE,0EAA0E;QACnF,OAAO,EACL,uHAAuH;KAC1H,CAAC;IACF,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QACtB,OAAO,EACL,wHAAwH;QAC1H,OAAO,EACL,6KAA6K;KAChL,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpB,OAAO,EAAE,kDAAkD,CAAC,CAAC,IAAI,6BAA6B;QAC9F,OAAO,EAAE,2EAA2E;KACrF,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,eAAe,CAAC,CAAC,EAAE,0EAA0E;QACtG,OAAO,EAAE,+CAA+C;KACzD,CAAC;IACF,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;QACvB,OAAO,EAAE,uDAAuD;QAChE,OAAO,EAAE,2BAA2B;KACrC,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,OAAO,EAAE,+CAA+C,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QAC5E,OAAO,EAAE,qDAAqD;KAC/D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,OAAO,EACL,kIAAkI;KACrI,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,sDAAsD;KAChE,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,yEAAyE;KACnF,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACd,OAAO,EAAE,oCAAoC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QACjE,OAAO,EACL,yFAAyF;KAC5F,CAAC;CACH,CAAA;AAED,gDAAgD;AAChD,MAAM,UAAU,MAAM,CACpB,IAAiB,EACjB,SAAwB,EAAE,EAC1B,OAAkB;IAElB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAiB,EACjB,SAAwB,EAAE,EAC1B,OAAkB;IAElB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAA;AACzF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/D,OAAO,WAAW,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAA;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY,EAAE,MAA4B,EAAE;IAChF,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,iBAAiB;YACpB,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAA;QACpC,KAAK,YAAY;YACf,OAAO,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACvD,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACtD,KAAK,WAAW;YACd,sEAAsE;YACtE,wDAAwD;YACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACtF,OAAO,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACtD,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;QACxD,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC"}