@veilio-inc/cli 0.5.4 → 0.6.1

package/dist/client/projects.js

@@ -0,0 +1,129 @@
+// Projects: which one this sign-in works in (spec 052 US3, research §4).
+//
+// The choice is a field on the credential, not a file in the project
+// directory: a project is something the ACCOUNT's team works in, and the MCP
+// server started later for the same sign-in must find the same answer without
+// being told (FR-012). A second sign-in, to another instance, has its own.
+//
+// Choosing one the team does not work in is refused here, against the server's
+// own list, and changes nothing (FR-014). The server refuses it as well - 404
+// on every map call that names it - so a client that skipped this check would
+// still not reach another team's maps; this is about saying so up front.
+import { listProjects } from '../cloud.js';
+import { readCredential, writeCredential } from '../credential.js';
+import { refuse, refusalFromCloudError } from './wording.js';
+// VEILIO_PROJECT, when it is set, as this listing resolves it (FR-012a). The
+// listing is the one command that does not refuse a value that matches
+// nothing: it is how somebody finds the value to set instead.
+import { PROJECT_ENV, matchProject, overrideSentence, projectOverride, } from './project-scope.js';
+export async function listTeamProjects(ctx) {
+    const credential = readCredential(ctx.home);
+    if (!credential)
+        return refuse('not_signed_in');
+    let answer;
+    try {
+        answer = await listProjects(credential);
+    }
+    catch (err) {
+        return { ok: false, refusal: refusalFromCloudError(err, { project: credential.project }) };
+    }
+    const rows = Array.isArray(answer?.projects) ? answer.projects : [];
+    if (rows.length === 0)
+        return refuse('no_projects');
+    const fallback = answer.defaultProjectId ?? rows[0].id;
+    // Resolved against THIS listing - the server's answer, just read - so the
+    // mark costs no second request.
+    const value = projectOverride(ctx.env);
+    let override = null;
+    if (value !== null) {
+        const found = matchProject(rows, value);
+        override = found.ok
+            ? { value, id: found.project.id }
+            : found.reason === 'ambiguous'
+                ? { value, id: null, reason: 'ambiguous', count: found.count }
+                : { value, id: null, reason: 'not_found' };
+    }
+    const inUse = override ? override.id : (credential.project ?? null);
+    return {
+        ok: true,
+        value: {
+            chosen: credential.project ?? null,
+            override,
+            projects: rows.map((p) => ({
+                id: p.id,
+                name: p.name,
+                maps: typeof p.maps === 'number' ? p.maps : null,
+                inUse: p.id === inUse,
+                isDefault: p.id === fallback,
+            })),
+        },
+    };
+}
+/**
+ * The listing as text, once for both surfaces: one line per project (the one
+ * in use marked `*`, and saying so when the variable chose it), and the note
+ * that follows - the variable's sentence, or that none is chosen. The only
+ * thing a surface supplies is how it names the way to choose one.
+ */
+export function formatProjectsList(listing, opts) {
+    const { projects, chosen, override } = listing;
+    const lines = projects.map((p) => {
+        const marks = [
+            ...(p.inUse ? [override ? `in use, from ${PROJECT_ENV}` : 'in use'] : []),
+            ...(p.isDefault ? ['default'] : []),
+            ...(p.maps !== null ? [`${p.maps} team map${p.maps === 1 ? '' : 's'}`] : []),
+        ];
+        return `${p.inUse ? '*' : ' '} ${p.id}  ${p.name}  (${marks.join(', ')})`;
+    });
+    if (override)
+        return { lines, note: overrideSentence(override, chosen) };
+    if (chosen !== null)
+        return { lines, note: null };
+    return {
+        lines,
+        note: opts.surface === 'cli'
+            ? 'No project is chosen, so team maps from every project are listed and used, and a new ' +
+                'team map lands in the default. Run `veilio projects use <name>` to work in one.'
+            : 'No project is chosen, so team maps from every project are used. projects_use chooses one.',
+    };
+}
+/** What `projects use` says on stdout: where the work happens now, or - when
+ *  the variable overrides the choice just stored - that it does not. */
+export function usedSentence(used, opts) {
+    if (used.overriddenBy !== null)
+        return (`Saved project ${used.name} (${used.id}) for this sign-in. ${PROJECT_ENV} (=${used.overriddenBy}) ` +
+            `is in use here, so ${opts.surface === 'cli' ? 'this shell' : 'this server'} keeps working in that project.`);
+    return opts.surface === 'cli'
+        ? `Now working in project ${used.name} (${used.id}). Team maps, pushes, updates and ` +
+            '`scrub --team` use this project only; the MCP server picks it up on its next call.'
+        : `Now working in project ${used.name} (${used.id}). Team maps and masking with the team's names use this project only.`;
+}
+/** Choose a project by its id or its name. A name two projects share is
+ *  refused rather than guessed: guessing is how two projects' maps meet. */
+export async function useProject(ctx, ref) {
+    const credential = readCredential(ctx.home);
+    if (!credential)
+        return refuse('not_signed_in');
+    if (!ref)
+        return refuse('which_project');
+    // The project list is asked without the current choice, so a chosen
+    // project that is gone never stops somebody choosing another.
+    const listed = await listTeamProjects(ctx);
+    if (!listed.ok)
+        return listed;
+    const found = matchProject(listed.value.projects, ref);
+    if (!found.ok) {
+        return found.reason === 'ambiguous'
+            ? refuse('project_ambiguous', { project: ref, count: found.count })
+            : refuse('project_not_found', { project: ref });
+    }
+    const chosen = found.project;
+    writeCredential({ ...credential, project: chosen.id }, ctx.home);
+    // Stored all the same - it is what applies once the variable is unset - but
+    // whoever chose it must hear that this shell goes on using the variable's.
+    return {
+        ok: true,
+        value: { id: chosen.id, name: chosen.name, overriddenBy: listed.value.override?.value ?? null },
+    };
+}
+//# sourceMappingURL=projects.js.map

package/dist/client/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/client/projects.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,qEAAqE;AACrE,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAgB,MAAM,cAAc,CAAA;AAE1E,6EAA6E;AAC7E,uEAAuE;AACvE,8DAA8D;AAC9D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAEhB,MAAM,oBAAoB,CAAA;AAa3B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAkB;IAIlB,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IAC/C,IAAI,MAAgD,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAA;IACvD,0EAA0E;IAC1E,gCAAgC;IAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,QAAQ,GAA2B,IAAI,CAAA;IAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvC,QAAQ,GAAG,KAAK,CAAC,EAAE;YACjB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE;YACjC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW;gBAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAC9D,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,CAAA;IACnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,MAAM,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;YAClC,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBAChD,KAAK,EAAE,CAAC,CAAC,EAAE,KAAK,KAAK;gBACrB,SAAS,EAAE,CAAC,CAAC,EAAE,KAAK,QAAQ;aAC7B,CAAC,CAAC;SACJ;KACF,CAAA;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAwB,EACxB,IAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAA;QACD,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IAC3E,CAAC,CAAC,CAAA;IACF,IAAI,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAA;IACxE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACjD,OAAO;QACL,KAAK;QACL,IAAI,EACF,IAAI,CAAC,OAAO,KAAK,KAAK;YACpB,CAAC,CAAC,uFAAuF;gBACvF,iFAAiF;YACnF,CAAC,CAAC,2FAA2F;KAClG,CAAA;AACH,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,YAAY,CAC1B,IAA+D,EAC/D,IAAgC;IAEhC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;QAC5B,OAAO,CACL,iBAAiB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,uBAAuB,WAAW,MAAM,IAAI,CAAC,YAAY,IAAI;YACnG,sBAAsB,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,iCAAiC,CAC7G,CAAA;IACH,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK;QAC3B,CAAC,CAAC,0BAA0B,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,oCAAoC;YACjF,oFAAoF;QACxF,CAAC,CAAC,0BAA0B,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,uEAAuE,CAAA;AAC5H,CAAC;AAED;4EAC4E;AAC5E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAkB,EAClB,GAAkB;IAElB,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IACxC,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,MAAM,KAAK,WAAW;YACjC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAA;IAC5B,eAAe,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IAChE,4EAA4E;IAC5E,2EAA2E;IAC3E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,IAAI,EAAE;KAChG,CAAA;AACH,CAAC"}

package/dist/client/status.d.ts

@@ -0,0 +1,21 @@
+import { PROJECT_ENV } from './project-scope.js';
+import { type Outcome } from './wording.js';
+import type { ClientContext } from './maps.js';
+export interface TeamStatus {
+    account: string;
+    instance: string;
+    teamId: string | null;
+    /** The chosen project, with its name when the server could say it. */
+    project: {
+        id: string;
+        name: string | null;
+        from?: typeof PROJECT_ENV;
+    } | null;
+    teamKeyUntil: string | null;
+    personalKeyUntil: string | null;
+    /** Since when a rotation is owed; null when none is; undefined when the
+     *  server did not say (an older instance, or no team). */
+    rotationOwedSince: string | null | undefined;
+}
+export declare function teamStatus(ctx: ClientContext): Promise<Outcome<TeamStatus>>;
+//# sourceMappingURL=status.d.ts.map

package/dist/client/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/client/status.ts"],"names":[],"mappings":"AAQA,OAAO,EAAsC,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGpF,OAAO,EAAyB,KAAK,OAAO,EAAE,MAAM,cAAc,CAAA;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAE9C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,sEAAsE;IACtE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,WAAW,CAAA;KAAE,GAAG,IAAI,CAAA;IAC9E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B;8DAC0D;IAC1D,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAC7C;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAuDjF"}

package/dist/client/status.js

@@ -0,0 +1,71 @@
+// Where this sign-in stands: the state `veilio whoami` and `team unlock`
+// report, in one answer, for the MCP server's `team_status` (spec 052 FR-008).
+//
+// It says whether keys are unlocked HERE and until when - never the keys. And
+// whether the team owes a key rotation, read from the team's key status; the
+// rest of that answer names teammates, and stays out of this one.
+import { getTeamKeyPending, listMaps, listProjects } from '../cloud.js';
+import { readScopedCredential, refusalScope } from './project-scope.js';
+import { readTeamUnlock } from '../team-unlock.js';
+import { personalMapsKeyExpiry } from './personal-maps-key.js';
+import { refusalFromCloudError } from './wording.js';
+export async function teamStatus(ctx) {
+    const scoped = await readScopedCredential(ctx);
+    if (!scoped.ok)
+        return scoped;
+    const credential = scoped.value;
+    let teamId;
+    try {
+        teamId = (await listMaps(credential)).team?.id ?? null;
+    }
+    catch (err) {
+        return { ok: false, refusal: refusalFromCloudError(err, refusalScope(credential)) };
+    }
+    let project = null;
+    if (credential.projectFrom) {
+        // Named by the listing that resolved VEILIO_PROJECT: no second one.
+        project = {
+            id: credential.project,
+            name: credential.projectName ?? null,
+            from: credential.projectFrom,
+        };
+    }
+    else if (credential.project) {
+        let name = null;
+        try {
+            name =
+                (await listProjects(credential)).projects.find((p) => p.id === credential.project)?.name ??
+                    null;
+        }
+        catch {
+            // The id alone is still the answer to "which project".
+        }
+        project = { id: credential.project, name };
+    }
+    const binding = { instance: credential.instance, account: credential.account };
+    const unlock = readTeamUnlock(binding, ctx.home);
+    let rotationOwedSince;
+    if (teamId) {
+        try {
+            const pending = await getTeamKeyPending(credential, teamId);
+            rotationOwedSince =
+                typeof pending?.rotationNeededSince === 'string' ? pending.rotationNeededSince : null;
+        }
+        catch {
+            rotationOwedSince = undefined;
+        }
+    }
+    return {
+        ok: true,
+        value: {
+            account: credential.account,
+            instance: credential.instance,
+            teamId,
+            project,
+            teamKeyUntil: unlock && teamId && unlock.teamId === teamId ? unlock.expiresAt : null,
+            personalKeyUntil: personalMapsKeyExpiry(binding, ctx.home),
+            rotationOwedSince,
+        },
+    };
+}
+//# sourceMappingURL=status.js.map

package/dist/client/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/client/status.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,kEAAkE;AAElE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAA;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,qBAAqB,EAAgB,MAAM,cAAc,CAAA;AAgBlE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAkB;IACjD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAA;IAC/B,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAA;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,CAAA;IACrF,CAAC;IAED,IAAI,OAAO,GAA0B,IAAI,CAAA;IACzC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,oEAAoE;QACpE,OAAO,GAAG;YACR,EAAE,EAAE,UAAU,CAAC,OAAQ;YACvB,IAAI,EAAE,UAAU,CAAC,WAAW,IAAI,IAAI;YACpC,IAAI,EAAE,UAAU,CAAC,WAAW;SAC7B,CAAA;IACH,CAAC;SAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,IAAI,GAAkB,IAAI,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI;gBACF,CAAC,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI;oBACxF,IAAI,CAAA;QACR,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;QACD,OAAO,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAA;IAC9E,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,iBAAkD,CAAA;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;YAC3D,iBAAiB;gBACf,OAAO,OAAO,EAAE,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAA;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,GAAG,SAAS,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM;YACN,OAAO;YACP,YAAY,EAAE,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACpF,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC;YAC1D,iBAAiB;SAClB;KACF,CAAA;AACH,CAAC"}

package/dist/client/team-key-bootstrap.d.ts

@@ -0,0 +1,55 @@
+import { type CryptoKeyLike } from '@veilio-inc/engine';
+import type { Credential } from '../credential.js';
+/** Wrap a team key for one recipient - the browser's `wrapTeamKeyFor`.
+ *  `iv` is for the test vector only. */
+export declare function wrapTeamKeyFor(teamKeyRaw: Uint8Array, myPrivateKey: CryptoKeyLike, myPublicKey: string, recipientPublicKey: string, ctx: {
+    teamId: string;
+    version: number;
+}, iv?: Uint8Array): Promise<string>;
+/**
+ * This account's keypair, opened with the vault key - and its public half
+ * DERIVED HERE from the private half, never taken from the server.
+ *
+ * Why (security review): the first team key is wrapped to this account's own
+ * public key. Taken as `GET /api/auth/keys` returned it, a dishonest or
+ * compromised server could hand back ITS public key and be wrapped the team
+ * key, which ends end-to-end confidentiality for every team map after. The
+ * private key comes out of a blob only the vault key opens, so the public key
+ * computed from it is the account's, whatever the server says. A server
+ * answer that differs is refused, fail closed.
+ */
+export declare function openOwnKeypair(vaultKey: CryptoKeyLike, privateKeyEncrypted: string, servedPublicKey: string): Promise<{
+    ok: true;
+    privateKey: CryptoKeyLike;
+    publicKey: string;
+} | {
+    ok: false;
+    reason: 'mismatch';
+}>;
+export type Bootstrap = 
+/** Minted and granted to this account: the team's key, raw. */
+{
+    status: 'created';
+    version: number;
+    raw: Uint8Array;
+}
+/** The server refused: the team already has a key, or this account may not
+ *  start one. `reason` is the server's own words when it gave some. */
+ | {
+    status: 'refused';
+    reason: string | null;
+}
+/** Granted, but what the server hands back is not the key minted here:
+ *  nothing may be sealed under it. */
+ | {
+    status: 'readback_mismatch';
+};
+/**
+ * Try to mint the team's first key. Throws only for a failure that is not an
+ * answer (the network, the server's own error), which the caller reports.
+ */
+export declare function bootstrapTeamKey(credential: Credential, teamId: string, me: {
+    privateKey: CryptoKeyLike;
+    publicKey: string;
+}): Promise<Bootstrap>;
+//# sourceMappingURL=team-key-bootstrap.d.ts.map

package/dist/client/team-key-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-key-bootstrap.d.ts","sourceRoot":"","sources":["../../src/client/team-key-bootstrap.ts"],"names":[],"mappings":"AAqBA,OAAO,EASL,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAElD;wCACwC;AACxC,wBAAsB,cAAc,CAClC,UAAU,EAAE,UAAU,EACtB,YAAY,EAAE,aAAa,EAC3B,WAAW,EAAE,MAAM,EACnB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACxC,EAAE,GAAE,UAA4B,GAC/B,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,aAAa,EACvB,mBAAmB,EAAE,MAAM,EAC3B,eAAe,EAAE,MAAM,GACtB,OAAO,CACR;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAC/F,CAsCA;AAED,MAAM,MAAM,SAAS;AACnB,+DAA+D;AAC7D;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AACzD;uEACuE;GACrE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAC9C;sCACsC;GACpC;IAAE,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAA;AAEnC;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE;IAAE,UAAU,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,SAAS,CAAC,CA6CpB"}

package/dist/client/team-key-bootstrap.js

@@ -0,0 +1,127 @@
+// The team's FIRST key, minted here when the team has none (spec 052 FR-016).
+//
+// Somebody has to mint it, and it cannot be the server: by design it holds no
+// team key and could not make one that meant anything. The web app does it for
+// the first owner or admin who opens it (frontend `bootstrapTeamKey.ts`). A
+// solo developer's team of one may never get there: with no maps the web app
+// no longer asks for the vault, so no key was ever minted, and `team unlock`
+// sent them to ask a teammate who does not exist (staging, 2026-10-26).
+//
+// So `team unlock`, which holds the vault key anyway, does what the browser
+// does, byte for byte: a fresh 32-byte AES-GCM key, wrapped to this account's
+// OWN public key with the same ECDH + HKDF context and the same
+// `{v, iv, data, from}` wrap, posted as the next unused version.
+//
+// THE SERVER DECIDES whether it really is a bootstrap - no wraps at all, the
+// next version, recipient = granter, an owner or admin. This client cannot
+// check the first: `GET /key` returns only its own wraps. So it tries, and a
+// refusal is the answer. Two members unlocking at once cannot both succeed; the
+// loser stands down rather than mint a rival key that would strand every map
+// sealed under the winner's.
+import { deriveWrappingKey, exportTeamKey, fromBase64, importPublicKey, unwrapTeamKey, randomBytes, toBase64, webCryptoSubtle, } from '@veilio-inc/engine';
+import { CloudError, getMe, getTeamKeyPending, getTeamKeyWraps, grantTeamKey } from '../cloud.js';
+/** Wrap a team key for one recipient - the browser's `wrapTeamKeyFor`.
+ *  `iv` is for the test vector only. */
+export async function wrapTeamKeyFor(teamKeyRaw, myPrivateKey, myPublicKey, recipientPublicKey, ctx, iv = randomBytes(12)) {
+    const wrappingKey = await deriveWrappingKey(myPrivateKey, await importPublicKey(recipientPublicKey), {
+        teamId: ctx.teamId,
+        version: ctx.version,
+        granterPublicKey: myPublicKey,
+        recipientPublicKey,
+    });
+    const data = await webCryptoSubtle().encrypt({ name: 'AES-GCM', iv }, wrappingKey, teamKeyRaw);
+    return JSON.stringify({ v: 1, iv: toBase64(iv), data: toBase64(data), from: myPublicKey });
+}
+/**
+ * This account's keypair, opened with the vault key - and its public half
+ * DERIVED HERE from the private half, never taken from the server.
+ *
+ * Why (security review): the first team key is wrapped to this account's own
+ * public key. Taken as `GET /api/auth/keys` returned it, a dishonest or
+ * compromised server could hand back ITS public key and be wrapped the team
+ * key, which ends end-to-end confidentiality for every team map after. The
+ * private key comes out of a blob only the vault key opens, so the public key
+ * computed from it is the account's, whatever the server says. A server
+ * answer that differs is refused, fail closed.
+ */
+export async function openOwnKeypair(vaultKey, privateKeyEncrypted, servedPublicKey) {
+    const env = JSON.parse(privateKeyEncrypted);
+    if (env.v !== 1 ||
+        env.alg !== 'AES-GCM' ||
+        typeof env.iv !== 'string' ||
+        typeof env.data !== 'string') {
+        throw new Error('the stored private key is not an envelope this client knows');
+    }
+    const subtle = webCryptoSubtle();
+    const pkcs8 = await subtle.decrypt({ name: 'AES-GCM', iv: fromBase64(env.iv) }, vaultKey, fromBase64(env.data));
+    // Extractable only for this one export of the public half; the key used
+    // from here on is imported again, non-extractable.
+    const exportable = await subtle.importKey('pkcs8', pkcs8, { name: 'X25519' }, true, [
+        'deriveBits',
+    ]);
+    const jwk = await subtle.exportKey('jwk', exportable);
+    if (typeof jwk.x !== 'string')
+        throw new Error('the private key did not yield a public key');
+    const derived = toBase64(fromBase64(jwk.x.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (jwk.x.length % 4)) % 4)));
+    if (derived !== servedPublicKey)
+        return { ok: false, reason: 'mismatch' };
+    const privateKey = await subtle.importKey('pkcs8', pkcs8, { name: 'X25519' }, false, [
+        'deriveBits',
+    ]);
+    return { ok: true, privateKey: privateKey, publicKey: derived };
+}
+/**
+ * Try to mint the team's first key. Throws only for a failure that is not an
+ * answer (the network, the server's own error), which the caller reports.
+ */
+export async function bootstrapTeamKey(credential, teamId, me) {
+    const user = await getMe(credential);
+    const userId = user.user?.id;
+    if (typeof userId !== 'string' || userId === '') {
+        throw new CloudError('server', 'the instance did not say which account this is');
+    }
+    // Not always 1: when the last holder of a key left, its number is leaked,
+    // and the server refuses a new key under it (spec 014).
+    const pending = await getTeamKeyPending(credential, teamId);
+    const version = typeof pending?.nextVersion === 'number' ? pending.nextVersion : 1;
+    const raw = randomBytes(32);
+    // Wrapped to ourselves; our own public key is not pinned (pinning is for
+    // teammates). A substituted key would give a wrap we cannot open, which the
+    // unwrap right after this reports at once.
+    const wrapped = await wrapTeamKeyFor(raw, me.privateKey, me.publicKey, me.publicKey, {
+        teamId,
+        version,
+    });
+    try {
+        await grantTeamKey(credential, teamId, { userId, version, wrappedKey: wrapped });
+    }
+    catch (err) {
+        // 403: the team has wraps already, or this member may not start one.
+        // 409: a wrap for this version exists. Somebody got there first.
+        if (err instanceof CloudError && (err.status === 403 || err.status === 409)) {
+            return { status: 'refused', reason: err.message || null };
+        }
+        throw err;
+    }
+    // Read back and opened, and compared byte for byte with the key minted: the
+    // proof that what the team's maps will be sealed under is this key, and not
+    // one the server swapped in (security review). Anything else fails closed.
+    const { wraps } = await getTeamKeyWraps(credential, teamId);
+    const wrap = wraps.find((w) => w.version === version);
+    if (!wrap)
+        return { status: 'readback_mismatch' };
+    try {
+        const opened = await unwrapTeamKey(wrap.wrapped_key, me.privateKey, {
+            teamId,
+            version,
+            myPublicKey: me.publicKey,
+        });
+        if ((await exportTeamKey(opened)) !== toBase64(raw))
+            return { status: 'readback_mismatch' };
+    }
+    catch {
+        return { status: 'readback_mismatch' };
+    }
+    return { status: 'created', version, raw };
+}
+//# sourceMappingURL=team-key-bootstrap.js.map

package/dist/client/team-key-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-key-bootstrap.js","sourceRoot":"","sources":["../../src/client/team-key-bootstrap.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,wEAAwE;AACxE,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,6BAA6B;AAE7B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,WAAW,EACX,QAAQ,EACR,eAAe,GAEhB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAGjG;wCACwC;AACxC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAsB,EACtB,YAA2B,EAC3B,WAAmB,EACnB,kBAA0B,EAC1B,GAAwC,EACxC,KAAiB,WAAW,CAAC,EAAE,CAAC;IAEhC,MAAM,WAAW,GAAG,MAAM,iBAAiB,CACzC,YAAY,EACZ,MAAM,eAAe,CAAC,kBAAkB,CAAC,EACzC;QACE,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,gBAAgB,EAAE,WAAW;QAC7B,kBAAkB;KACnB,CACF,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;IAC9F,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;AAC5F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAuB,EACvB,mBAA2B,EAC3B,eAAuB;IAIvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAKzC,CAAA;IACD,IACE,GAAG,CAAC,CAAC,KAAK,CAAC;QACX,GAAG,CAAC,GAAG,KAAK,SAAS;QACrB,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,EAA6B,CAAA;IAC3D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAChC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAA4B,EAAE,EACtE,QAAgC,EAChC,UAAU,CAAC,GAAG,CAAC,IAAI,CAA4B,CAChD,CAAA;IACD,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;QAClF,YAAY;KACb,CAAC,CAAA;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC5F,MAAM,OAAO,GAAG,QAAQ,CACtB,UAAU,CACR,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CACvF,CACF,CAAA;IACD,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACzE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE;QACnF,YAAY;KACb,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAsC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC7F,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAsB,EACtB,MAAc,EACd,EAAoD;IAEpD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAA;IAClF,CAAC;IACD,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAG,OAAO,OAAO,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;IAC3B,yEAAyE;IACzE,4EAA4E;IAC5E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE;QACnF,MAAM;QACN,OAAO;KACR,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,iEAAiE;QACjE,IAAI,GAAG,YAAY,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC;YAC5E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAA;QAC3D,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,EAAE;YAClE,MAAM;YACN,OAAO;YACP,WAAW,EAAE,EAAE,CAAC,SAAS;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IACxC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AAC5C,CAAC"}

package/dist/client/vault-key.d.ts

@@ -0,0 +1,5 @@
+import { type CryptoKeyLike } from '@veilio-inc/engine';
+import type { Credential } from '../credential.js';
+import { type Outcome } from './wording.js';
+export declare function vaultKeyFor(credential: Credential, passphrase: (() => Promise<string>) | undefined): Promise<Outcome<CryptoKeyLike>>;
+//# sourceMappingURL=vault-key.d.ts.map

package/dist/client/vault-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-key.d.ts","sourceRoot":"","sources":["../../src/client/vault-key.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAiC,KAAK,OAAO,EAAE,MAAM,cAAc,CAAA;AAE1E,wBAAsB,WAAW,CAC/B,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,GAC9C,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAsBjC"}

package/dist/client/vault-key.js

@@ -0,0 +1,35 @@
+// The vault key, derived here from the passphrase and checked - once, for
+// every caller: `team unlock`, `vault unlock`, and a personal map opened or
+// sealed with the passphrase. Three copies of this had grown, and a KDF change
+// or a new check fixed in one would have left the other two wrong (review).
+//
+// The server holds the salt, the KDF cost and a verifier - all it can hold.
+// The passphrase never leaves this machine, and the key is never sent or
+// written: it is non-extractable, used in memory and dropped.
+import { checkVaultVerifier, deriveVaultKey, fromBase64, } from '@veilio-inc/engine';
+import { getVault } from '../cloud.js';
+import { refuse, refusalFromCloudError } from './wording.js';
+export async function vaultKeyFor(credential, passphrase) {
+    let vault;
+    try {
+        vault = await getVault(credential);
+    }
+    catch (err) {
+        return { ok: false, refusal: refusalFromCloudError(err, { project: credential.project }) };
+    }
+    // Said plainly rather than as a decryption failure: there is nothing to try
+    // a passphrase against.
+    if (!vault.initialized)
+        return refuse('no_vault');
+    const typed = passphrase ? await passphrase() : '';
+    if (typed === '')
+        return refuse('no_passphrase');
+    const key = await deriveVaultKey(typed, fromBase64(vault.salt), vault.kdf ? { name: 'PBKDF2-SHA256', iterations: vault.kdf.iterations } : undefined);
+    // Before anything is opened, sealed or written: a wrong passphrase is named
+    // as one, rather than surfacing later as an authentication-tag failure that
+    // reads like corruption - or as a key wrapped for good under the wrong one.
+    if (!(await checkVaultVerifier(key, vault.verifier)))
+        return refuse('wrong_passphrase');
+    return { ok: true, value: key };
+}
+//# sourceMappingURL=vault-key.js.map

package/dist/client/vault-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-key.js","sourceRoot":"","sources":["../../src/client/vault-key.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,8DAA8D;AAE9D,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,UAAU,GAEX,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAgB,MAAM,cAAc,CAAA;AAE1E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAsB,EACtB,UAA+C;IAE/C,IAAI,KAAK,CAAA;IACT,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAA;IAC5F,CAAC;IACD,4EAA4E;IAC5E,wBAAwB;IACxB,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAA;IAChD,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,KAAK,EACL,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EACtB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACpF,CAAA;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AACjC,CAAC"}

package/dist/client/wording.d.ts

@@ -0,0 +1,62 @@
+export declare const REFUSAL_CODES: readonly ["not_signed_in", "which_map", "map_not_found", "map_not_in_project", "not_yours_remove", "not_yours_update", "no_local_map", "no_vault", "no_passphrase", "wrong_passphrase", "vault_locked", "no_pmk_yet", "pmk_unopenable", "keys_not_set_up", "team_key_waiting", "own_public_key_mismatch", "team_key_readback_mismatch", "team_key_not_startable", "team_key_solo_unavailable", "personal_old_seal", "personal_unopenable", "not_envelope", "team_locked", "team_key_unreadable", "team_key_mismatch", "not_in_team", "team_maps_unreadable", "team_map_unopenable", "clash", "would_drop", "pull_would_drop", "diverged", "stale", "rotation_owed", "too_large", "abuse_limit", "which_project", "project_not_found", "project_ambiguous", "project_gone", "project_env_not_found", "project_env_ambiguous", "no_projects", "destructive_off", "confirm_name", "confirm_unknown", "session_rejected", "unentitled", "suspended", "forbidden", "unreachable", "server"];
+export type RefusalCode = (typeof REFUSAL_CODES)[number];
+/** What a sentence may be filled with. Every field is optional; each entry
+ *  uses the ones it needs. */
+export interface WordingParams {
+    id?: string;
+    name?: string;
+    count?: number;
+    detail?: string;
+    path?: string;
+    from?: string;
+    to?: string;
+    /** A short, already-joined list - placeholders, map names, ids. */
+    list?: string;
+    project?: string;
+    /** The project came from VEILIO_PROJECT rather than the stored choice. */
+    override?: boolean;
+}
+export interface Refusal {
+    code: RefusalCode;
+    /** The reason, as a sentence. */
+    message: string;
+    /** What resolves it, as a sentence that names something a person can do. */
+    resolve: string;
+    /** Extra lines for the terminal only - they may hold real identifiers, so the
+     *  MCP server never renders them. */
+    details?: string[];
+}
+export type Outcome<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    refusal: Refusal;
+};
+type Words = (p: WordingParams) => {
+    message: string;
+    resolve: string;
+};
+export declare const WORDING: Record<RefusalCode, Words>;
+/** A refusal outcome, worded from the table. */
+export declare function refuse(code: RefusalCode, params?: WordingParams, details?: string[]): {
+    ok: false;
+    refusal: Refusal;
+};
+export declare function refusal(code: RefusalCode, params?: WordingParams, details?: string[]): Refusal;
+/** How the terminal prints one. The MCP server has its own (no details). */
+export declare function renderRefusal(r: Refusal): string;
+/**
+ * A failed request, as a refusal with the remedy that fits it.
+ *
+ * `project` is the project the call carried. The server answers a project that
+ * is not the team's - or no longer is - with 404 "Project not found", and that
+ * must be said as such, never as "the instance reported an error", or nobody
+ * thinks to choose another (spec 052 edge case: the chosen project removed).
+ */
+export declare function refusalFromCloudError(err: unknown, ctx?: {
+    project?: string;
+    override?: boolean;
+}): Refusal;
+export {};
+//# sourceMappingURL=wording.d.ts.map

package/dist/client/wording.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wording.d.ts","sourceRoot":"","sources":["../../src/client/wording.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,aAAa,w7BAqDhB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD;8BAC8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,WAAW,CAAA;IACjB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAA;IACf;yCACqC;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAA;AAajF,KAAK,KAAK,GAAG,CAAC,CAAC,EAAE,aAAa,KAAK;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAIvE,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CA8P9C,CAAA;AAED,gDAAgD;AAChD,wBAAgB,MAAM,CACpB,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,aAAkB,EAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAEjC;AAED,wBAAgB,OAAO,CACrB,IAAI,EAAE,WAAW,EACjB,MAAM,GAAE,aAAkB,EAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAGT;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,GAAG,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GACjD,OAAO,CA2BT"}