@veilio-inc/cli 0.7.1 → 0.9.0

package/README.md

@@ -30,7 +30,7 @@ signed-in `scrub` offline, `veilio logout` first.
 | Command              | Purpose                                                                                                                                                                                                 |
 | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `scrub [files...]`   | Mask identifiers, redact credentials. Reads stdin when given no file.                                                                                                                                   |
-| `restore [files...]` | Swap placeholders back, strip AI-generated noise. Signed in, also a teammate's placeholders — see below. Names anything it could not restore; `--strict` writes nothing if a placeholder would be left. |
+| `restore [files...]` | Swap placeholders back, strip AI-generated noise. Signed in, also a teammate's placeholders — see below. Names anything it could not restore, a redacted value included; `--strict` writes nothing if a placeholder or a redaction would be left. |
 | `scan [files...]`    | Detect credentials only. Never rewrites. Exits 1 on a credential; with `--strict`, on any finding.                                                                                                      |
 | `map`                | Show the symbol map (`--clear` to wipe it).                                                                                                                                                             |
 
@@ -49,9 +49,9 @@ veilio maps rm <id>             # remove a map from Cloud
 veilio projects                 # the projects your team works in; * marks the one in use
 veilio projects use <name>      # work in that project (kept with the sign-in)
 veilio team unlock              # open the team key with your vault passphrase (kept 7 days)
-veilio team lock                # remove the unlocked team key from this machine
+veilio team lock                # remove the unlocked team key, and the team rules, from this machine
 veilio vault unlock             # keep the personal-maps key here (7 days), for the MCP server
-veilio vault lock               # remove it from this machine
+veilio vault lock               # remove it, and the personal rules, from this machine
 veilio rules pull               # fetch your custom rules; scrub then applies them offline
 veilio logout                   # revokes server-side, then removes the local credential
 ```
@@ -119,6 +119,54 @@ Custom rules (whitelist and replace, set in the web app) are applied by
 offline - and says on every run how many rules it applied and how old the copy
 is. Pull again after the rules change; `logout` removes the copy.
 
+Cloud holds the rules sealed under your keys, so it cannot read them: personal
+rules under your personal-maps key, team rules under your team key. `rules pull`
+opens them on this machine, so it needs `veilio vault unlock` for personal rules
+and `veilio team unlock` for team rules. A rule it cannot open is skipped, never
+an error: `scrub` still masks, with the built-in engine and the rules that did
+open, and both commands say what was skipped and how to fix it, one sentence per
+cause (on every `scrub`, `--quiet` included).
+
+The opened rules last only as long as the key they were opened with.
+`veilio vault lock` removes the personal rules from `rules.json`, and
+`veilio team lock` the team rules, until the next unlock and `rules pull`; both
+say how many they removed, and the copy counts them as vault locked or team key
+locked. A key that expires, or is deleted by hand, has the same effect without
+a lock: `scrub` and the MCP server apply a cached rule only while its key is
+still on this machine, unexpired and for this account. A `rules pull` while
+locked does not bring them back:
+
+```
+2 custom rules not applied: vault locked - run `veilio vault unlock`, then `veilio rules pull`.
+1 custom rule not applied: team key locked - run `veilio team unlock`, then `veilio rules pull`.
+1 custom rule not applied: could not be opened with the keys on this machine, and skipped.
+1 custom rule not applied: refused as unsafe to apply (an engine placeholder or a pattern rules do not support), and skipped.
+```
+
+When some rules applied and others did not, `scrub` says both in one line:
+
+```
+veilio: applied 1 custom rule pulled just now; 2 not applied: vault locked - run `veilio vault unlock`, then `veilio rules pull`.
+```
+
+Under `--quiet` it prints only what was not applied, in the sentences above.
+
+"Could not be opened" is a rule sealed under a team-key version this machine
+does not hold (run `veilio team unlock` again after a rotation) or a damaged
+one. "Refused" is a rule no tool applies, whoever wrote it: a replace
+placeholder that reuses an engine base such as `__FN__`, a pattern the rule
+matcher does not support (a backreference, lookaround, `\b`, or a bound over
+50), or a sealed body moved to another rule's row.
+
+One `scrub` of one input spends a bounded amount of matching work on custom
+rules, all rules and names together. Rules that would take more stop matching
+part-way - the names after that point are masked as usual, none kept readable
+or given a rule's placeholder - and `scrub` says so, under `--quiet` too:
+
+```
+veilio: custom rules stopped matching: too much work. Names after that point were masked as usual, and no rule kept one readable or gave it a rule placeholder.
+```
+
 Four files, all `0600`, all under `~/.veilio/`: `credential.json` (the session
 and the chosen project, removed by `logout`), `rules.json` (the rules copy),
 `team-keys.json` (the keys `team unlock` opened, kept seven days) and
@@ -129,17 +177,90 @@ removes all of them.
 
 Signed in to a team with the team key unlocked, `veilio scrub` numbers from the
 team's maps, as the web app and the MCP server do: a name the team already knows
-gets the team's placeholder, and a new name is numbered above the team's and
-this project's highest, so it can never take a number that means something else
-to a teammate. Only the team entries the output uses are kept in this project's
-map. The summary says `Namespace: team`.
+gets the team's placeholder, and a new name is numbered inside this checkout's
+block of team numbers (`.veilio/reserved.json`, below) - or, with no usable
+block, in this checkout's local family `__LOCAL_<TAG>_<KIND>__n` - so it can
+never take a number that means something else to a teammate. It is never
+numbered above the team's highest: that is where the next teammate's block
+starts. Only the team entries the output uses are kept in this project's map.
+The summary says `Namespace: team`. `scrub` only reads `reserved.json`; it never
+reserves, except with `--team`.
 
 - **Locked or unreachable, it still masks** — from this project's map — and says
-  so on stderr, with the reason, even under `--quiet`: those placeholders may
-  clash with the team's.
+  so on stderr, with the reason, even under `--quiet`. It is still a team, so
+  new names go into the local family (`__LOCAL_<TAG>_…`), never above the
+  map. The team comes from the team unlock, else from `~/.veilio/team.json`
+  (the team this account was last seen in, written by any command that lists
+  it and removed by `veilio logout`); with no `reserved.json` yet, scrub writes
+  one holding a fresh tag. With no team ever seen, new names still go into a
+  local family, under a tag for that run only.
 - **Signed out, it makes no request**, exactly as before. Signed in, it waits at
   most **5 seconds** for Cloud.
 
+### Team numbers for the guard
+
+The Claude Code guard makes no request, so it cannot ask the team for a number
+each time it masks a new name. Instead, `veilio maps pull` of a team map (and
+`veilio team unlock` in a project that already has a map) reserves a **block**
+of the team's numbers for you - 500 per kind - and keeps it in
+`.veilio/reserved.json`. The guard numbers new names inside it, so two members
+working at the same time never give one placeholder two meanings. A pull takes
+a new block whenever a teammate's newer numbers sit above yours.
+
+A reservation sends Cloud a kind, a count and a floor - never a name. The
+engine's own kinds (`__VAR__`, `__FN__`, `__CLS__`, ...) go as they are; a
+custom replace rule's placeholder (`__ACME_ACQUISITION_TARGET__`) names what
+the team considers sensitive, so it is sent as `__H_<16 hex>__`, an HMAC of it
+under the newest team key, and read back locally. Teammates holding the same
+key send the same hash. Cloud counts each hash on its own, so a rule's kind is
+floored above the team's reservations of it under its hash with every team key
+version this machine holds (read from the team's reservations, which are only
+ever asked for by hash): after a key rotation new numbers stay above the old
+hash's while the old key is still held; without it, the floor is the map's.
+Without the team key unlocked, or without that listing (an older instance),
+numbers for a rule's kind are not reserved at all.
+
+Only numbers Cloud issued count toward a floor. A number in a map that no run
+of the team's reservations holds - one numbered on this machine, or planted -
+is checked against the team's listing of its kind (`?bases=`, with each kind's
+highest number) and floors nothing; for a kind never reserved yet, a map's
+numbers floor its first run up to 10000. A pull says how many such numbers the
+map held, and restore leaves one above the highest number Cloud has issued for
+its kind. (A map from before team numbering with numbers above 10000, in a kind
+never reserved, therefore floors nothing; such teams existed only on staging.)
+Every reservation asks for an answer per kind: a kind Cloud refuses is numbered
+on this machine (`__LOCAL_…`), with the refusal shown, and the others are
+reserved. An older Cloud that refuses the whole call names the kinds it
+refuses, and is asked again without them.
+
+If no block can be reserved - the day's limit, offline, the plan, a server
+error - the pull (or the unlock) still succeeds, exits 0, and says so on its
+normal output, with the reason and, for the day's limit, when the next block is
+possible:
+
+```
+veilio: could not reserve team numbers: this account's daily limit for this team is reached; the next block is possible at 09:14 (local time). New names are numbered on this machine as __LOCAL_K7Q2XA_… until a block is held; your next publish gives them team numbers.
+```
+
+`reserved.json` is still written, with the reason, and a signed-in
+`veilio scrub` repeats the sentence on stderr - even under `--quiet` - for as
+long as it holds. Until a block is held, the guard, a signed-in
+`veilio scrub` and the MCP server number new names in this checkout's **local
+family**, `__LOCAL_<TAG>_<KIND>__n` (`__LOCAL_K7Q2XA_VAR__3`). The tag is six
+characters drawn for this checkout, so two checkouts never mint the same
+string:
+
+- **This machine restores them**, from its map.
+- **A teammate's restore leaves them as written** and names them: only the
+  checkout that numbered one knows what it means.
+- **The next team publish renumbers them** into reserved team numbers, keeps
+  the old placeholders in `.veilio/aliases.json` (they still restore here),
+  and draws a new tag.
+- **No team map ever holds one.** A team map is sealed on your machine, so the
+  check is here too: a publish that would still seal one is refused, naming
+  them, and a reader drops one it finds - `maps pull` of a team map leaves
+  them out of `map.json` and says how many.
+
 ### Restoring a teammate's placeholders
 
 `veilio restore` resolves a placeholder this project's map cannot explain
@@ -151,6 +272,11 @@ with the real names:
   wins and the placeholder stays in the output with a line naming it. Same for
   one this project numbered on its own while the team was out of reach — a
   wrong name restored silently is worse than a placeholder left visibly.
+- **Another checkout's local placeholder is left.** `__LOCAL_<TAG>_…` was
+  numbered on a checkout that held no team numbers; only that checkout restores
+  it, so it stays in the output, is named, and counts as left for `--strict`.
+  Your own restore still reads it, through `.veilio/aliases.json` once a publish
+  renumbered it.
 - **Locked, and it says so.** With no team key on this machine it tells you to
   run `veilio team unlock` rather than restoring half the text.
 - **Signed out, it makes no request at all** — that restore is as offline as it
@@ -176,11 +302,12 @@ a plan feature the web app couldn't.
                         For: scrub
 -m, --map <path>        Use a specific map file
                         For: scrub, restore, map, maps pull, maps push, maps
-                        update
+                        update, team unlock
     --json              Machine-readable output
                         For: scan, map
     --strict            scan: also fail on advisory findings. restore: write
-                        nothing and exit 1 if a placeholder would be left
+                        nothing and exit 1 if a placeholder or a redaction
+                        would be left
                         For: scan, restore
     --keep-docs         Keep JSDoc blocks the model wrote
                         For: restore
@@ -222,8 +349,9 @@ command.
 placeholder would be left in it — one the AI invented, one whose shape it changed
 (`__fn__1`), one the team's maps disagree on, or one the team's maps could not be
 read for — nothing goes to stdout and it exits 1. Without it, restore writes the
-text, placeholders and all, names each one on stderr and exits 0. A credential
-redacted on purpose is not a placeholder and never fails it.
+text, placeholders and all, names each one on stderr and exits 0. A value
+redacted one-way (`__REDACTED_CREDENTIAL_1__`) cannot be restored, so the text is
+not the original file: restore names it every time, and `--strict` refuses it.
 
 `--keep-docs` is worth knowing about: the default strip removes JSDoc along with
 the narration and TODOs, which is wrong when the model was _asked_ to document
@@ -259,7 +387,7 @@ so write files from PowerShell 7 (`pwsh`).
 | Code | Meaning                                                                                                            |
 | ---- | ------------------------------------------------------------------------------------------------------------------ |
 | 0    | Clean                                                                                                              |
-| 1    | Findings that should stop the pipeline: a credential (`scan`), or a placeholder `restore --strict` would have left |
+| 1    | Findings that should stop the pipeline: a credential (`scan`), or a placeholder or redaction `restore --strict` would have left |
 | 2    | Usage or IO error                                                                                                  |
 
 As a pre-commit hook:
@@ -272,6 +400,21 @@ git diff --cached | veilio scan || {
 }
 ```
 
+## What is masked
+
+Distinctive names - `quaywardThrottle`, `SkerryTariff`, `berth_quorum`, an invented
+`tarnwick` - become placeholders. A name that is a single common English word
+(`total`, `ledger`, `invoice`), shared vocabulary every codebase has (`src`,
+`util`, `com`, `java`) or a toolchain's name (`vitest`, `junit`, `mvn`) is left as
+written as a name or a path segment: it is nobody's secret, and masking it made
+paths and test output unreadable. A codename that is an ordinary word (`phoenix`)
+is therefore readable as a name; a custom replace rule (`veilio rules pull`) keeps
+it masked. In a value - a string literal, a config value, XML text - every word is
+masked. A value whose key contains a credential word (`password: sunshine`,
+`DB_PASSWORD_PROD="sunshine"`, `const DB_PASS = "Summer2024!"`) is redacted one-way,
+whole, under the default `--secrets redact`, so the map never holds it. Credentials
+are redacted whatever they are called.
+
 ## The symbol map
 
 `scrub` writes `.veilio/map.json` at the project root and `restore` reads it, so placeholders stay stable across runs and across a whole session. The store is created `0600` with its own `.gitignore` — it holds the real identifier names, so committing it would undo the anonymization for anyone reading the repo.

package/dist/client/blocks.d.ts

@@ -0,0 +1,30 @@
+import { type PlaceholderReservation } from '../cloud.js';
+import type { Credential } from '../credential.js';
+import { type Block, type RefusalReason } from '../reservations.js';
+export type BlocksOutcome = {
+    status: 'kept';
+} | {
+    status: 'reserved';
+    blocks: Record<string, Block>;
+}
+/** The pull still succeeded; new names are numbered in the local family
+ *  until a block is held (spec 066). */
+ | {
+    status: 'failed';
+    reason: RefusalReason;
+    detail: string;
+    nextAt?: string;
+    tag: string;
+};
+/**
+ * Written on every outcome (spec 066 R4): without the file a refused member's
+ * guard cannot tell "team, no block" from "no team", and numbers into the next
+ * teammate's block. The checkout's tag is drawn once and kept across pulls.
+ */
+export declare function ensureBlocks(credential: Credential, teamId: string, mapPath: string, 
+/** Where the team keys are: a rule's base is reserved under its hash. */
+home?: string, 
+/** The team's reservations of the map's bases, when the caller listed
+ *  them; null when the instance keeps no record. */
+reservations?: PlaceholderReservation[] | null): Promise<BlocksOutcome>;
+//# sourceMappingURL=blocks.d.ts.map

package/dist/client/blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocks.d.ts","sourceRoot":"","sources":["../../src/client/blocks.ts"],"names":[],"mappings":"AASA,OAAO,EAAmC,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAE1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAElD,OAAO,EAML,KAAK,KAAK,EACV,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAA;AAE3B,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAAE;AACvD;wCACwC;GACtC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAA;AAW7F;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM;AACf,yEAAyE;AACzE,IAAI,CAAC,EAAE,MAAM;AACb;oDACoD;AACpD,YAAY,CAAC,EAAE,sBAAsB,EAAE,GAAG,IAAI,GAC7C,OAAO,CAAC,aAAa,CAAC,CAmGxB"}

package/dist/client/blocks.js

@@ -0,0 +1,125 @@
+// Spec 063 US1: make sure this member holds a block of the team's numbers for
+// every kind the guard will mint, above everything the project's map holds.
+//
+// The guard makes no request (spec 017's rule, kept): it numbers inside the
+// block offline. Whoever writes the map from Cloud - a pull, an unlock - is
+// what keeps the block usable, because the engine numbers above the map's
+// highest number of a kind and never into a gap below it.
+import { highestPerKind, isSaneBlock } from '@veilio-inc/engine';
+import { reservePlaceholders, CloudError } from '../cloud.js';
+import { teamKeyBytes, teamKeyVersion } from '../hashed-bases.js';
+import { loadMap } from '../store.js';
+import { CORE_BASES, basesNeedingBlocks, drawTag, loadReserved, saveReserved, } from '../reservations.js';
+/** Why a reservation failed, in the four kinds a member can act on (spec 066 R4). */
+function reasonOf(err) {
+    if (!(err instanceof CloudError))
+        return 'server';
+    if (err.kind === 'unentitled')
+        return 'payment';
+    if (err.kind === 'unreachable')
+        return 'offline';
+    if (err.status === 429 && err.body?.reason === 'cap')
+        return 'cap';
+    return 'server';
+}
+/**
+ * Written on every outcome (spec 066 R4): without the file a refused member's
+ * guard cannot tell "team, no block" from "no team", and numbers into the next
+ * teammate's block. The checkout's tag is drawn once and kept across pulls.
+ */
+export async function ensureBlocks(credential, teamId, mapPath, 
+/** Where the team keys are: a rule's base is reserved under its hash. */
+home, 
+/** The team's reservations of the map's bases, when the caller listed
+ *  them; null when the instance keeps no record. */
+reservations) {
+    let held;
+    try {
+        held = loadReserved(mapPath);
+    }
+    catch {
+        held = null; // malformed: replaced, never numbered from
+    }
+    // Blocks taken by another account, team or instance are not this member's,
+    // and neither is the tag: two checkouts must never share one.
+    const same = held !== null &&
+        held.instance === credential.instance &&
+        held.account === credential.account &&
+        held.teamId === teamId;
+    let mine = same ? held.blocks : {};
+    const tag = (same && held.local?.tag) || drawTag();
+    const save = (blocks, refused) => saveReserved(mapPath, {
+        version: 1,
+        instance: credential.instance,
+        account: credential.account,
+        teamId,
+        blocks,
+        local: { tag },
+        ...(refused ? { refused } : {}),
+    });
+    const fail = (reason, detail, nextAt) => {
+        const short = detail.slice(0, 200);
+        save(mine, {
+            reason,
+            at: new Date().toISOString(),
+            ...(nextAt ? { nextAt } : {}),
+            detail: short,
+        });
+        return { status: 'failed', reason, detail: short, ...(nextAt ? { nextAt } : {}), tag };
+    };
+    const map = loadMap(mapPath);
+    const need = basesNeedingBlocks(map, mine, CORE_BASES);
+    if (need.length === 0 && same) {
+        save(mine); // adds a tag to an older file, and clears a refusal nothing needs now
+        return { status: 'kept' };
+    }
+    // Keyed by base: a local kind's numbers are another family and floor nothing.
+    const floors = highestPerKind(map);
+    let ranges = [];
+    // A rule base the server's key version refuses (Cloud 809444d0): no block
+    // for it, the engine bases' blocks kept, and the refusal on the band.
+    let refused;
+    if (need.length) {
+        try {
+            let sent;
+            ({
+                ranges,
+                refused,
+                floors: sent,
+            } = await reservePlaceholders(credential, teamId, need.map((base) => ({ base, count: 1, floor: floors[base] ?? 0 })), undefined, {
+                block: true,
+                keys: teamKeyBytes(credential, home, teamId),
+                keyVersion: teamKeyVersion(credential, home, teamId),
+                ...(reservations !== undefined ? { reservations } : {}),
+            }));
+            // Round 4 (D): the floor the server was sent, once vouched.
+            Object.assign(floors, sent ?? {});
+        }
+        catch (err) {
+            const retry = err instanceof CloudError ? err.body?.retry_at : undefined;
+            const nextAt = typeof retry === 'string' && !Number.isNaN(Date.parse(retry)) ? retry : undefined;
+            return fail(reasonOf(err), err instanceof CloudError ? err.message : String(err), nextAt);
+        }
+    }
+    // A reply that is not one sane run per kind asked for is no block: the
+    // guard would otherwise number from whatever it said.
+    const asked = need.filter((base) => !refused?.bases.includes(base));
+    const sane = Array.isArray(ranges) &&
+        ranges.length === asked.length &&
+        ranges.every((r) => asked.includes(r?.base) && isSaneBlock(r) && r.start > (floors[r.base] ?? 0));
+    if (!sane)
+        return fail('server', 'the server answered without a usable block');
+    const blocks = { ...mine };
+    for (const r of ranges)
+        blocks[r.base] = { start: r.start, end: r.end };
+    if (refused) {
+        mine = blocks;
+        return fail('server', refused.detail);
+    }
+    save(blocks);
+    return {
+        status: 'reserved',
+        blocks: Object.fromEntries(ranges.map((r) => [r.base, { start: r.start, end: r.end }])),
+    };
+}
+//# sourceMappingURL=blocks.js.map

package/dist/client/blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocks.js","sourceRoot":"","sources":["../../src/client/blocks.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,0EAA0E;AAC1E,0DAA0D;AAE1D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAA+B,MAAM,aAAa,CAAA;AAC1F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAEjE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,YAAY,EACZ,YAAY,GAKb,MAAM,oBAAoB,CAAA;AAS3B,qFAAqF;AACrF,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;QAAE,OAAO,QAAQ,CAAA;IACjD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAA;IAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,SAAS,CAAA;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAClE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAsB,EACtB,MAAc,EACd,OAAe;AACf,yEAAyE;AACzE,IAAa;AACb;oDACoD;AACpD,YAA8C;IAE9C,IAAI,IAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAA,CAAC,2CAA2C;IACzD,CAAC;IACD,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,IAAI,GACR,IAAI,KAAK,IAAI;QACb,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;QACrC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO;QACnC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAA;IACxB,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IACnC,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,IAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAA;IACnD,MAAM,IAAI,GAAG,CAAC,MAA6B,EAAE,OAAiB,EAAE,EAAE,CAChE,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM;QACN,MAAM;QACN,KAAK,EAAE,EAAE,GAAG,EAAE;QACd,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC,CAAA;IACJ,MAAM,IAAI,GAAG,CAAC,MAAqB,EAAE,MAAc,EAAE,MAAe,EAAiB,EAAE;QACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,IAAI,EAAE;YACT,MAAM;YACN,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAA;IACxF,CAAC,CAAA;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,sEAAsE;QACjF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,MAAM,GAAmD,EAAE,CAAA;IAC/D,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,OAAwD,CAAA;IAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,IAAI,IAAwC,CAC3C;YAAA,CAAC;gBACA,MAAM;gBACN,OAAO;gBACP,MAAM,EAAE,IAAI;aACb,GAAG,MAAM,mBAAmB,CAC3B,UAAU,EACV,MAAM,EACN,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAClE,SAAS,EACT;gBACE,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC;gBAC5C,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC;gBACpD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxD,CACF,CAAC,CAAA;YACF,4DAA4D;YAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;YACxE,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;YACnF,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACnE,MAAM,IAAI,GACR,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CACV,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACpF,CAAA;IACH,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,4CAA4C,CAAC,CAAA;IAC9E,MAAM,MAAM,GAA0B,EAAE,GAAG,IAAI,EAAE,CAAA;IACjD,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IACvE,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,GAAG,MAAM,CAAA;QACb,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,CAAA;IACZ,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;KACxF,CAAA;AACH,CAAC"}

package/dist/client/maps.d.ts

@@ -1,3 +1,4 @@
+import { type BlocksOutcome } from './blocks.js';
 import { type Env } from './project-scope.js';
 import { type Outcome } from './wording.js';
 export interface ClientContext {
@@ -40,6 +41,13 @@ export declare function pullCloudMap(ctx: ClientContext, id: string | null, opts
     name: string;
     count: number;
     path: string;
+    blocks?: BlocksOutcome;
+    /** Local-family keys the team map held and the pull left out (spec 066). */
+    localDropped?: number;
+    /** Keys numbered above 1e8: kept, never numbered after (security audit). */
+    outOfRange?: number;
+    /** Round 4 (D): keys outside every run the server issued: no floor. */
+    unvouched?: number;
 }>>;
 /**
  * Placeholders the local map and the team's namespace use for DIFFERENT names.

package/dist/client/maps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"maps.d.ts","sourceRoot":"","sources":["../../src/client/maps.ts"],"names":[],"mappings":"AAwDA,OAAO,EAKL,KAAK,GAAG,EAET,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAiC,KAAK,OAAO,EAAgB,MAAM,cAAc,CAAA;AAExF,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAA;CACV;AAuBD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,GAAG,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;8DAC0D;IAC1D,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAC9D,OAAO,CAAC;IACN,IAAI,EAAE,SAAS,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,8EAA8E;IAC9E,cAAc,EAAE,OAAO,CAAA;CACxB,CAAC,CACH,CA0BA;AA8KD,wBAAsB,YAAY,CAChC,GAAG,EAAE,aAAa,EAClB,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA0F7E;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAOzD;AA0GD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,GAAG,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAsF3B;AA0BD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,GAAG,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAmJ3B;AAwCD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAyCvD"}
+{"version":3,"file":"maps.d.ts","sourceRoot":"","sources":["../../src/client/maps.ts"],"names":[],"mappings":"AAmEA,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAA;AAU9D,OAAO,EAKL,KAAK,GAAG,EAET,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAiC,KAAK,OAAO,EAAgB,MAAM,cAAc,CAAA;AAExF,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAA;CACV;AAuBD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,GAAG,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;8DAC0D;IAC1D,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAC9D,OAAO,CAAC;IACN,IAAI,EAAE,SAAS,EAAE,CAAA;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,8EAA8E;IAC9E,cAAc,EAAE,OAAO,CAAA;CACxB,CAAC,CACH,CA0BA;AA8KD,wBAAsB,YAAY,CAChC,GAAG,EAAE,aAAa,EAClB,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CACR,OAAO,CAAC;IACN,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAC,CACH,CAqIA;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,CAOzD;AAkSD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,GAAG,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAsG3B;AA0BD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,UAAU,GAAG,MAAM,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CA2K3B;AAwCD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,EAAE,EAAE,MAAM,GAAG,IAAI,EACjB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAyCvD"}