@veilio-inc/cli 0.9.2 → 0.11.0

package/dist/git-index.js

@@ -0,0 +1,161 @@
+// What git tracks, read from the index file itself (spec 085 R1).
+//
+// The CLI and the MCP server spawn no process (offline.test.ts, MCP
+// purity.test.ts), and running git in a cloned repository would run that
+// repository's own config (core.fsmonitor and the like). So the store asks
+// the index directly. Anything this reader does not fully understand - no
+// .git, no index, an unknown version, a split index, a short or odd file - is
+// `null`: unknown, which the store treats as "not tracked", as it did before.
+import { closeSync, openSync, readFileSync, readSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve } from 'node:path';
+/** Each index file as last parsed, while its inode, mtime, ctime, size and
+ *  trailing checksum are unchanged: one parse per process, not per read. */
+const parsed = new Map();
+/** The git checkout holding `from`, and what its index lists; null when unknown. */
+export function trackedPaths(from) {
+    try {
+        const found = findGitDir(resolve(from));
+        if (!found)
+            return null;
+        const index = join(found.gitDir, 'index');
+        const st = statSync(index);
+        const stamp = `${st.ino}:${st.mtimeMs}:${st.ctimeMs}:${st.size}:${trailer(index, st.size)}`;
+        let hit = parsed.get(index);
+        if (hit?.stamp !== stamp) {
+            hit = { stamp, paths: readIndex(readFileSync(index), hashSize(found)) };
+            parsed.set(index, hit);
+        }
+        return hit.paths && { root: found.root, paths: hit.paths };
+    }
+    catch {
+        return null;
+    }
+}
+/** The index's last 32 bytes: its checksum (20 bytes for SHA-1, 32 for
+ *  SHA-256), which changes with any change to the content. */
+function trailer(path, size) {
+    const fd = openSync(path, 'r');
+    try {
+        const buf = Buffer.alloc(Math.min(32, size));
+        readSync(fd, buf, 0, buf.length, size - buf.length);
+        return buf.toString('hex');
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function findGitDir(start) {
+    for (let dir = start;; dir = dirname(dir)) {
+        const dotGit = join(dir, '.git');
+        const st = statOrNull(dotGit);
+        if (st?.isDirectory())
+            return { root: dir, gitDir: dotGit, commonDir: dotGit };
+        if (st?.isFile()) {
+            // A worktree or submodule: `gitdir: <path>`, and the shared config in its commondir.
+            const m = /^gitdir: *(.+?)\s*$/m.exec(readFileSync(dotGit, 'utf8'));
+            if (!m)
+                return null;
+            const gitDir = isAbsolute(m[1]) ? m[1] : resolve(dir, m[1]);
+            let commonDir = gitDir;
+            try {
+                const c = readFileSync(join(gitDir, 'commondir'), 'utf8').trim();
+                commonDir = isAbsolute(c) ? c : resolve(gitDir, c);
+            }
+            catch {
+                // no commondir: a submodule, whose config is its own
+            }
+            return { root: dir, gitDir, commonDir };
+        }
+        if (dirname(dir) === dir)
+            return null;
+    }
+}
+function statOrNull(path) {
+    try {
+        return statSync(path);
+    }
+    catch {
+        return null;
+    }
+}
+/** 20 for SHA-1, 32 for a repository made with `--object-format=sha256`. */
+function hashSize(found) {
+    try {
+        const config = readFileSync(join(found.commonDir, 'config'), 'utf8');
+        return /^\s*objectformat\s*=\s*sha256\s*$/im.test(config) ? 32 : 20;
+    }
+    catch {
+        return 20;
+    }
+}
+/** Index versions 2, 3 and 4 (git's index-format.txt). Null on anything else. */
+function readIndex(buf, hash) {
+    if (buf.length < 12 + hash || buf.toString('latin1', 0, 4) !== 'DIRC')
+        return null;
+    const version = buf.readUInt32BE(4);
+    if (version < 2 || version > 4)
+        return null;
+    const count = buf.readUInt32BE(8);
+    const end = buf.length - hash;
+    const paths = new Set();
+    let at = 12;
+    let previous = Buffer.alloc(0);
+    for (let i = 0; i < count; i++) {
+        // ctime, mtime, dev, ino, mode, uid, gid, size (40 bytes), the object id, flags.
+        const flagsAt = at + 40 + hash;
+        if (flagsAt + 2 > end)
+            return null;
+        const flags = buf.readUInt16BE(flagsAt);
+        let nameAt = flagsAt + 2;
+        if (flags & 0x4000) {
+            if (version < 3)
+                return null;
+            nameAt += 2;
+        }
+        let name;
+        if (version === 4) {
+            // A varint of bytes to drop from the previous path, then the rest, NUL-ended.
+            let drop = 0;
+            let byte;
+            let k = nameAt;
+            do {
+                if (k >= end)
+                    return null;
+                byte = buf[k++];
+                drop = (drop << 7) | (byte & 0x7f);
+                if (byte & 0x80)
+                    drop++;
+            } while (byte & 0x80);
+            if (drop > previous.length)
+                return null;
+            const nul = buf.indexOf(0, k);
+            if (nul === -1 || nul >= end)
+                return null;
+            name = Buffer.concat([previous.subarray(0, previous.length - drop), buf.subarray(k, nul)]);
+            at = nul + 1;
+        }
+        else {
+            const nul = buf.indexOf(0, nameAt);
+            if (nul === -1 || nul >= end)
+                return null;
+            name = buf.subarray(nameAt, nul);
+            // Each entry is padded with 1-8 NULs to a multiple of 8 bytes.
+            at = at + ((nameAt - at + name.length + 8) & ~7);
+        }
+        previous = name;
+        paths.add(name.toString('utf8').toLowerCase());
+    }
+    // Extensions: a split index ("link") keeps entries in another file, so this
+    // list would be partial. Anything malformed here is unknown too.
+    while (at < end) {
+        if (at + 8 > end)
+            return null;
+        const sig = buf.toString('latin1', at, at + 4);
+        const size = buf.readUInt32BE(at + 4);
+        if (sig === 'link' || sig === 'sdir')
+            return null;
+        at += 8 + size;
+    }
+    return at === end ? paths : null;
+}
+//# sourceMappingURL=git-index.js.map

package/dist/git-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-index.js","sourceRoot":"","sources":["../src/git-index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC/E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAQ9D;4EAC4E;AAC5E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwD,CAAA;AAE9E,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAA;QAC3F,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC3B,IAAI,GAAG,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;YACzB,GAAG,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;YACvE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;8DAC8D;AAC9D,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAA;QAC5C,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;QACnD,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,KAAK,IAAI,GAAG,GAAG,KAAK,GAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAChC,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;QAC7B,IAAI,EAAE,EAAE,WAAW,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAC9E,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;YACjB,qFAAqF;YACrF,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;YACnE,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;YAC9D,IAAI,SAAS,GAAG,MAAM,CAAA;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;gBAChE,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACpD,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzC,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;IACvC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,KAA4B;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QACpE,OAAO,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAClF,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,CAAA;IAC7B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,IAAI,EAAE,GAAG,EAAE,CAAA;IACX,IAAI,QAAQ,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,iFAAiF;QACjF,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAC9B,IAAI,OAAO,GAAG,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,MAAM,GAAG,OAAO,GAAG,CAAC,CAAA;QACxB,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC5B,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;QACD,IAAI,IAAY,CAAA;QAChB,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,8EAA8E;YAC9E,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,IAAI,IAAY,CAAA;YAChB,IAAI,CAAC,GAAG,MAAM,CAAA;YACd,GAAG,CAAC;gBACF,IAAI,CAAC,IAAI,GAAG;oBAAE,OAAO,IAAI,CAAA;gBACzB,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAE,CAAA;gBAChB,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;gBAClC,IAAI,IAAI,GAAG,IAAI;oBAAE,IAAI,EAAE,CAAA;YACzB,CAAC,QAAQ,IAAI,GAAG,IAAI,EAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YACvC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YAC7B,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAA;YACzC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC1F,EAAE,GAAG,GAAG,GAAG,CAAC,CAAA;QACd,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAClC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAA;YACzC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAChC,+DAA+D;YAC/D,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC;QACD,QAAQ,GAAG,IAAI,CAAA;QACf,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,4EAA4E;IAC5E,iEAAiE;IACjE,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;QAChB,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QACrC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QACjD,EAAE,IAAI,CAAC,GAAG,IAAI,CAAA;IAChB,CAAC;IACD,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAClC,CAAC"}

package/dist/hashed-bases.d.ts

@@ -1,10 +1,15 @@
 import type { Credential } from './credential.js';
 /** The base as the server sees it: `__H_<16 hex>__` for a rule's base. */
 export declare function wireBase(base: string, teamKey: Uint8Array): string;
-/** The raw team keys this machine holds for `teamId`, newest version first. */
+/** The raw team keys a rule's name may be hashed under, newest first: none
+ *  unless the newest is confirmed (`writeKeyOf`), and never one that is not
+ *  (spec 080 item 7a) - a hash under a key the server made tells it the name. */
 export declare function teamKeyBytes(credential: Pick<Credential, 'instance' | 'account'>, home: string | undefined, teamId: string): Uint8Array[];
 /** The newest team key version this machine holds for `teamId`. */
 export declare function teamKeyVersion(credential: Pick<Credential, 'instance' | 'account'>, home: string | undefined, teamId: string): number | undefined;
+/** The team to name when a rule's name may not be hashed because the newest
+ *  key is not confirmed; null when it may, or when nothing is unlocked. */
+export declare function teamKeyUnconfirmed(credential: Pick<Credential, 'instance' | 'account'>, home: string | undefined, teamId: string): string | null;
 /** Whether a base the server served (a reservation's) is `base`: as written,
  *  or its hash under any held key version - one reserved before a rotation
  *  carries the old key's hash. */

package/dist/hashed-bases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hashed-bases.d.ts","sourceRoot":"","sources":["../src/hashed-bases.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAGjD,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,CAIlE;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC,EACpD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,GACb,UAAU,EAAE,CAEd;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAC5B,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC,EACpD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAEpB;AAuBD;;kCAEkC;AAClC,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAE3F"}
+{"version":3,"file":"hashed-bases.d.ts","sourceRoot":"","sources":["../src/hashed-bases.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAIjD,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,CAIlE;AAED;;iFAEiF;AACjF,wBAAgB,YAAY,CAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC,EACpD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,GACb,UAAU,EAAE,CAEd;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAC5B,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC,EACpD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAEpB;AAwBD;2EAC2E;AAC3E,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC,EACpD,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAOf;AAED;;kCAEkC;AAClC,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAE3F"}

package/dist/hashed-bases.js

@@ -5,7 +5,8 @@
 // Everything on this machine - the map, reserved.json - keeps the real base.
 import { createHmac } from 'node:crypto';
 import { fromBase64, isEngineBase } from '@veilio-inc/engine';
-import { readTeamUnlock } from './team-unlock.js';
+import { readTeamUnlock, writeKeyOf } from './team-unlock.js';
+import { printable } from './reservations.js';
 /** The base as the server sees it: `__H_<16 hex>__` for a rule's base. */
 export function wireBase(base, teamKey) {
     if (isEngineBase(base))
@@ -13,7 +14,9 @@ export function wireBase(base, teamKey) {
     const mac = createHmac('sha256', teamKey).update(base, 'utf8').digest('hex');
     return `__H_${mac.slice(0, 16).toUpperCase()}__`;
 }
-/** The raw team keys this machine holds for `teamId`, newest version first. */
+/** The raw team keys a rule's name may be hashed under, newest first: none
+ *  unless the newest is confirmed (`writeKeyOf`), and never one that is not
+ *  (spec 080 item 7a) - a hash under a key the server made tells it the name. */
 export function teamKeyBytes(credential, home, teamId) {
     return heldKeys(credential, home, teamId).map((k) => k.raw);
 }
@@ -23,10 +26,12 @@ export function teamKeyVersion(credential, home, teamId) {
 }
 function heldKeys(credential, home, teamId) {
     const unlock = readTeamUnlock({ instance: credential.instance, account: credential.account }, home);
-    if (!unlock || unlock.teamId !== teamId)
+    if (!unlock || unlock.teamId !== teamId || !writeKeyOf(unlock))
         return [];
     const out = [];
     for (const k of unlock.keys) {
+        if (!k.writable)
+            continue;
         try {
             out.push({ version: k.version, raw: fromBase64(k.key) });
         }
@@ -36,6 +41,14 @@ function heldKeys(credential, home, teamId) {
     }
     return out.sort((a, b) => b.version - a.version);
 }
+/** The team to name when a rule's name may not be hashed because the newest
+ *  key is not confirmed; null when it may, or when nothing is unlocked. */
+export function teamKeyUnconfirmed(credential, home, teamId) {
+    const unlock = readTeamUnlock({ instance: credential.instance, account: credential.account }, home);
+    if (!unlock || unlock.teamId !== teamId || writeKeyOf(unlock))
+        return null;
+    return printable(unlock.teamName ?? unlock.teamId);
+}
 /** Whether a base the server served (a reservation's) is `base`: as written,
  *  or its hash under any held key version - one reserved before a rotation
  *  carries the old key's hash. */

package/dist/hashed-bases.js.map

@@ -1 +1 @@
-{"version":3,"file":"hashed-bases.js","sourceRoot":"","sources":["../src/hashed-bases.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAE7D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAmB;IACxD,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5E,OAAO,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAA;AAClD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAC1B,UAAoD,EACpD,IAAwB,EACxB,MAAc;IAEd,OAAO,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAC5B,UAAoD,EACpD,IAAwB,EACxB,MAAc;IAEd,OAAO,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAA;AACvD,CAAC;AAED,SAAS,QAAQ,CACf,UAAoD,EACpD,IAAwB,EACxB,MAAc;IAEd,MAAM,MAAM,GAAG,cAAc,CAC3B,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,EAC9D,IAAI,CACL,CAAA;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAA;IAClD,MAAM,GAAG,GAA2C,EAAE,CAAA;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ,CAAC,8CAA8C;QACzD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;AAClD,CAAC;AAED;;kCAEkC;AAClC,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,IAA2B;IAChF,OAAO,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;AAC1E,CAAC"}
+{"version":3,"file":"hashed-bases.js","sourceRoot":"","sources":["../src/hashed-bases.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,wEAAwE;AACxE,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAE7D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAmB;IACxD,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5E,OAAO,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAA;AAClD,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,YAAY,CAC1B,UAAoD,EACpD,IAAwB,EACxB,MAAc;IAEd,OAAO,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAC5B,UAAoD,EACpD,IAAwB,EACxB,MAAc;IAEd,OAAO,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAA;AACvD,CAAC;AAED,SAAS,QAAQ,CACf,UAAoD,EACpD,IAAwB,EACxB,MAAc;IAEd,MAAM,MAAM,GAAG,cAAc,CAC3B,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,EAC9D,IAAI,CACL,CAAA;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACzE,MAAM,GAAG,GAA2C,EAAE,CAAA;IACtD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,SAAQ;QACzB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ,CAAC,8CAA8C;QACzD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;AAClD,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,kBAAkB,CAChC,UAAoD,EACpD,IAAwB,EACxB,MAAc;IAEd,MAAM,MAAM,GAAG,cAAc,CAC3B,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,EAC9D,IAAI,CACL,CAAA;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;kCAEkC;AAClC,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,IAA2B;IAChF,OAAO,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;AAC1E,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AAE/E,OAAO,EAA2D,KAAK,EAAE,EAAE,MAAM,eAAe,CAAA;AA2BhG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,OAAO,EAAE,CAAA;AAElB,6EAA6E;AAC7E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB3E;AAED;;;GAGG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmFnE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AAE/E,OAAO,EAQL,KAAK,EAAE,EACR,MAAM,eAAe,CAAA;AA6BtB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,OAAO,EAAE,CAAA;AAElB,6EAA6E;AAC7E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB3E;AAED;;;GAGG;AACH,wBAAsB,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA2FnE"}

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { needsAction, parseArgs, UsageError } from './args.js';
 import { feedSecret } from './secret-input.js';
-import { EXIT_ERROR, HELP, runMap, runRestore, runScan, runScrub } from './commands.js';
+import { EXIT_ERROR, EXIT_FINDINGS, HELP, runMap, runRestore, runScan, runScrub, } from './commands.js';
 import { commandHelp } from './flags.js';
-import { runLogin, runLogout, runWhoami, runMapsList, runMapsPull, runMapsPush, runMapsRm, runMapsUpdate, runTeamUnlock, runTeamLock, runVaultUnlock, runVaultLock, runProjectsList, runProjectsUse, runRulesPull, teamLayerFor, teamNamespaceForScrub, } from './cloud-commands.js';
-import { resolveMapPath } from './store.js';
+import { runLogin, runLogout, runWhoami, runMapsList, runMapsPull, runMapsPush, runMapsRm, runMapsUpdate, runTeamUnlock, runTeamLock, runTeamTrust, runKeysFingerprint, runVaultUnlock, runVaultLock, runProjectsList, runProjectsUse, runRulesPull, teamLayerFor, teamNamespaceForScrub, } from './cloud-commands.js';
+import { resolveMapPath, StoreRefusal } from './store.js';
 import { guardHint } from './guard-hint.js';
 import { createInterface } from 'node:readline';
 import { realpathSync } from 'node:fs';
@@ -88,9 +88,11 @@ export async function run(args, io) {
             case 'team': {
                 switch (args.teamAction) {
                     case 'unlock':
-                        return await runTeamUnlock(io, args.days ?? undefined, resolveMapPath(args.mapPath, io.cwd));
+                        return await runTeamUnlock(io, args.days ?? undefined, resolveMapPath(args.mapPath, io.cwd), args.forgetRefused);
                     case 'lock':
                         return runTeamLock(io);
+                    case 'trust':
+                        return await runTeamTrust(args.files[0] ?? null, args.files[1] ?? null, io);
                     default:
                         io.stderr(`veilio: ${needsAction('team')}\n`);
                         return EXIT_ERROR;
@@ -107,6 +109,11 @@ export async function run(args, io) {
                         return EXIT_ERROR;
                 }
             }
+            case 'keys':
+                if (args.keysAction === 'fingerprint')
+                    return await runKeysFingerprint(io);
+                io.stderr(`veilio: ${needsAction('keys')}\n`);
+                return EXIT_ERROR;
             case 'projects':
                 if (args.projectsAction === 'use')
                     return await runProjectsUse(args.files[0] ?? null, io);
@@ -120,7 +127,8 @@ export async function run(args, io) {
     }
     catch (err) {
         io.stderr(`veilio: ${err instanceof Error ? err.message : String(err)}\n`);
-        return EXIT_ERROR;
+        // A store refused for what it is (tracked, a link) stops the pipeline like a finding.
+        return err instanceof StoreRefusal ? EXIT_FINDINGS : EXIT_ERROR;
     }
 }
 // A piped/scripted session (no TTY) commonly delivers every line in ONE data
@@ -231,20 +239,21 @@ function readSecret(label) {
         stdin.on('data', onData);
     });
 }
-function readStdin() {
-    return new Promise((resolvePromise, rejectPromise) => {
-        // A TTY with no piped input would hang forever waiting for EOF. Fail with
-        // usage guidance instead of appearing to freeze.
-        if (process.stdin.isTTY) {
-            rejectPromise(new Error('no input — pass a file or pipe to stdin'));
-            return;
-        }
-        let data = '';
-        process.stdin.setEncoding('utf8');
-        process.stdin.on('data', (chunk) => (data += chunk));
-        process.stdin.on('end', () => resolvePromise(data));
-        process.stdin.on('error', rejectPromise);
-    });
+/** Stdin as it arrives (`scan --blobs`: git's blob stream holds any byte). */
+async function* readStdinBytes() {
+    // A TTY with no piped input would hang forever waiting for EOF. Fail with
+    // usage guidance instead of appearing to freeze.
+    if (process.stdin.isTTY)
+        throw new Error('no input — pass a file or pipe to stdin');
+    for await (const chunk of process.stdin)
+        yield chunk;
+}
+/** Stdin as text: its bytes, decoded as UTF-8. */
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of readStdinBytes())
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
 }
 /**
  * Was this file run as a program, or imported?
@@ -279,6 +288,7 @@ if (invokedAsProgram()) {
     const io = {
         cwd: process.cwd(),
         stdin: readStdin,
+        stdinBytes: readStdinBytes,
         stdout: (text) => process.stdout.write(text),
         stderr: (text) => process.stderr.write(text),
         prompt: readLine,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAA;AAC/E,OAAO,EAAE,UAAU,EAAoB,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAW,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EACL,QAAQ,EACR,SAAS,EACT,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,EACb,WAAW,EACX,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,OAAO,EAAE,CAAA;AAElB,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB,EAAE,EAAM;IACxD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;YAC5D,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAA;YAC9E,EAAE,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;YAC5C,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,iGAAiG;IACjG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,IAAI;YAAE,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAgB,EAAE,EAAM;IAChD,IAAI,CAAC;QACH,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;gBAC9D,OAAO,CAAC,CAAA;YACV,KAAK,SAAS;gBACZ,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACV,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/E,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACxF,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAChC,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC/B,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACnE,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,EAAE,CAAC,CAAA;YAC5B,KAAK,QAAQ;gBACX,OAAO,SAAS,CAAC,EAAE,CAAC,CAAA;YACtB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,+DAA+D;gBAC/D,2DAA2D;gBAC3D,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;gBAClE,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxB,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,EAAE,CAAC,CAAA;oBAC9B,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;oBACvF,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC3E,KAAK,QAAQ;wBACX,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;4BAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;yBAC1B,CAAC,CAAA;oBACJ,KAAK,IAAI;wBACP,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;oBACnD;wBACE,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;wBAC7C,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxB,KAAK,QAAQ;wBACX,OAAO,MAAM,aAAa,CACxB,EAAE,EACF,IAAI,CAAC,IAAI,IAAI,SAAS,EACtB,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CACrC,CAAA;oBACH,KAAK,MAAM;wBACT,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;oBACxB;wBACE,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;wBAC7C,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;oBACzB,KAAK,QAAQ;wBACX,OAAO,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAA;oBACzD,KAAK,MAAM;wBACT,OAAO,YAAY,CAAC,EAAE,CAAC,CAAA;oBACzB;wBACE,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;wBAC9C,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,UAAU;gBACb,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK;oBAAE,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;gBACzF,OAAO,MAAM,eAAe,CAAC,EAAE,CAAC,CAAA;YAClC,KAAK,OAAO;gBACV,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM;oBAAE,OAAO,MAAM,YAAY,CAAC,EAAE,CAAC,CAAA;gBAC9D,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9C,OAAO,UAAU,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1E,OAAO,UAAU,CAAA;IACnB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,sEAAsE;AACtE,qEAAqE;AACrE,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,8DAA8D;AAC9D,uEAAuE;AACvE,sEAAsE;AACtE,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,sBAAsB;AACtB,IAAI,cAA8D,CAAA;AAClE,MAAM,gBAAgB,GAAa,EAAE,CAAA;AACrC,MAAM,YAAY,GAAkC,EAAE,CAAA;AAEtD,SAAS,oBAAoB;IAC3B,IAAI,cAAc;QAAE,OAAM;IAC1B,cAAc,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAA;QACnC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,CAAA;;YACnB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IACF,sEAAsE;IACtE,yEAAyE;IACzE,8DAA8D;IAC9D,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC9B,IAAI,MAA4C,CAAA;QAChD,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC;YAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3B,oBAAoB,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED,uCAAuC;AACvC,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IACrD,mEAAmE;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5B,EAAE,CAAC,KAAK,EAAE,CAAA;YACV,cAAc,CAAC,MAAM,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtB,KAAK,CAAC,MAAM,EAAE,CAAA;QACd,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACzB,IAAI,KAAK,GAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACrE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;YACjC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YACvB,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC1B,IAAI,GAAG;gBAAE,aAAa,CAAC,GAAG,CAAC,CAAA;;gBACtB,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAClC,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,gEAAgE;YAChE,2DAA2D;YAC3D,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAChC,2DAA2D;YAC3D,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;YACxD,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO,IAAI,EAAE,CAAA;QAC/B,CAAC,CAAA;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QACD,IAAI,IAAI,GAAG,EAAE,CAAA;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAA;QACpD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QACnD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,IAAI,gBAAgB,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,GAAO;QACb,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA;IACzB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrF,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAA;IAC/B,CAAC,CACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAA;AAC/E,OAAO,EAAE,UAAU,EAAoB,MAAM,mBAAmB,CAAA;AAChE,OAAO,EACL,UAAU,EACV,aAAa,EACb,IAAI,EACJ,MAAM,EACN,UAAU,EACV,OAAO,EACP,QAAQ,GAET,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EACL,QAAQ,EACR,SAAS,EACT,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,SAAS,EACT,aAAa,EACb,aAAa,EACb,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,qBAAqB,GACtB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,OAAO,EAAE,CAAA;AAElB,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB,EAAE,EAAM;IACxD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;YAC5D,wEAAwE;YACxE,yDAAyD;YACzD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,oCAAoC,CAAA;YAC9E,EAAE,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAA;YAC5C,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,iGAAiG;IACjG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,IAAI;YAAE,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAgB,EAAE,EAAM;IAChD,IAAI,CAAC;QACH,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;gBAC9D,OAAO,CAAC,CAAA;YACV,KAAK,SAAS;gBACZ,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;gBACzB,OAAO,CAAC,CAAA;YACV,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/E,KAAK,SAAS;gBACZ,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACxF,KAAK,MAAM;gBACT,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAChC,KAAK,KAAK;gBACR,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC/B,KAAK,OAAO;gBACV,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;YACnE,KAAK,QAAQ;gBACX,OAAO,MAAM,SAAS,CAAC,EAAE,CAAC,CAAA;YAC5B,KAAK,QAAQ;gBACX,OAAO,SAAS,CAAC,EAAE,CAAC,CAAA;YACtB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,+DAA+D;gBAC/D,2DAA2D;gBAC3D,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;gBAClE,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxB,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,EAAE,CAAC,CAAA;oBAC9B,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;oBACvF,KAAK,MAAM;wBACT,OAAO,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC3E,KAAK,QAAQ;wBACX,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;4BAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;yBAC1B,CAAC,CAAA;oBACJ,KAAK,IAAI;wBACP,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;oBACnD;wBACE,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;wBAC7C,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxB,KAAK,QAAQ;wBACX,OAAO,MAAM,aAAa,CACxB,EAAE,EACF,IAAI,CAAC,IAAI,IAAI,SAAS,EACtB,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EACpC,IAAI,CAAC,aAAa,CACnB,CAAA;oBACH,KAAK,MAAM;wBACT,OAAO,WAAW,CAAC,EAAE,CAAC,CAAA;oBACxB,KAAK,OAAO;wBACV,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;oBAC7E;wBACE,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;wBAC7C,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;oBACzB,KAAK,QAAQ;wBACX,OAAO,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAA;oBACzD,KAAK,MAAM;wBACT,OAAO,YAAY,CAAC,EAAE,CAAC,CAAA;oBACzB;wBACE,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;wBAC9C,OAAO,UAAU,CAAA;gBACrB,CAAC;YACH,CAAC;YACD,KAAK,MAAM;gBACT,IAAI,IAAI,CAAC,UAAU,KAAK,aAAa;oBAAE,OAAO,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAA;gBAC1E,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC7C,OAAO,UAAU,CAAA;YACnB,KAAK,UAAU;gBACb,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK;oBAAE,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;gBACzF,OAAO,MAAM,eAAe,CAAC,EAAE,CAAC,CAAA;YAClC,KAAK,OAAO;gBACV,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM;oBAAE,OAAO,MAAM,YAAY,CAAC,EAAE,CAAC,CAAA;gBAC9D,EAAE,CAAC,MAAM,CAAC,WAAW,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAC9C,OAAO,UAAU,CAAA;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1E,sFAAsF;QACtF,OAAO,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAA;IACjE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,sEAAsE;AACtE,qEAAqE;AACrE,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,8DAA8D;AAC9D,uEAAuE;AACvE,sEAAsE;AACtE,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,sBAAsB;AACtB,IAAI,cAA8D,CAAA;AAClE,MAAM,gBAAgB,GAAa,EAAE,CAAA;AACrC,MAAM,YAAY,GAAkC,EAAE,CAAA;AAEtD,SAAS,oBAAoB;IAC3B,IAAI,cAAc;QAAE,OAAM;IAC1B,cAAc,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAClF,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAA;QACnC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,CAAA;;YACnB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IACF,sEAAsE;IACtE,yEAAyE;IACzE,8DAA8D;IAC9D,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC9B,IAAI,MAA4C,CAAA;QAChD,OAAO,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC;YAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3B,oBAAoB,EAAE,CAAA;IACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED,uCAAuC;AACvC,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IACrD,mEAAmE;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5E,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5B,EAAE,CAAC,KAAK,EAAE,CAAA;YACV,cAAc,CAAC,MAAM,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC3B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtB,KAAK,CAAC,MAAM,EAAE,CAAA;QACd,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACzB,IAAI,KAAK,GAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;QACrE,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;YACjC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;YACvB,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC1B,IAAI,GAAG;gBAAE,aAAa,CAAC,GAAG,CAAC,CAAA;;gBACtB,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAClC,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,gEAAgE;YAChE,2DAA2D;YAC3D,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAChC,2DAA2D;YAC3D,IAAI,KAAK,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;YACxD,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO,IAAI,EAAE,CAAA;QAC/B,CAAC,CAAA;QACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,KAAK,SAAS,CAAC,CAAC,cAAc;IAC5B,0EAA0E;IAC1E,iDAAiD;IACjD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IACnF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;QAAE,MAAM,KAAe,CAAA;AAChE,CAAC;AAED,kDAAkD;AAClD,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,cAAc,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,IAAI,gBAAgB,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,GAAO;QACb,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,cAAc;QAC1B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,UAAU;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAA;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,EAAE;QACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAA;IACzB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrF,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAA;IAC/B,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/key-pins.d.ts

@@ -0,0 +1,46 @@
+export declare const KEY_PINS_FILE = "key-pins.json";
+export interface KeyPin {
+    /** The confirmed public key, base64. */
+    current: string;
+    /** Earlier confirmed keys of the same person, so what they granted with
+     *  those stays trusted after an honest key reset. */
+    history: string[];
+    /** ISO-8601. */
+    confirmedAt: string;
+}
+/** By granter user id, or `key:<publicKey>` for a granter with no account. */
+export type KeyPins = Record<string, KeyPin>;
+interface Binding {
+    instance: string;
+    account: string;
+}
+/** key-pins.json exists and is not one this CLI can read: never overwritten,
+ *  since confirmations a person made are in there. */
+export declare class KeyPinsDamaged extends Error {
+    readonly path: string;
+    constructor(path: string);
+}
+export declare function keyPinsPath(home?: string): string;
+/** This instance and account's pins. A damaged entry is left out. */
+export declare function readPins(binding: Binding, home?: string): KeyPins;
+/** The pin for `identity`, only if one was recorded under exactly that. */
+export declare function pinOf(pins: KeyPins, identity: string): KeyPin | undefined;
+/** The keys a pin accepts: the current one, then the earlier ones. */
+export declare function confirmedKeys(pin: KeyPin | undefined): string[];
+/** Record `publicKey` as confirmed for `identity`, keeping any earlier one. */
+export declare function confirmPin(binding: Binding, identity: string, publicKey: string, home?: string, now?: Date): void;
+/** This account's blocked version for `teamId`, or undefined. Throws
+ *  `KeyPinsDamaged` when it cannot be known: the caller then writes nothing. */
+export declare function blockedMark(binding: Binding, teamId: string, home?: string): number | undefined;
+/**
+ * Settle the blocked version for `teamId` against what is stored NOW, in one
+ * read-change-write: first `clearUpTo` drops the mark only if it is still at
+ * most that (the value this run read - a raise another unlock made since is
+ * kept), then `raise` keeps the higher of the two. The mark it leaves.
+ */
+export declare function settleBlockedMark(binding: Binding, teamId: string, change: {
+    clearUpTo?: number;
+    raise?: number;
+}, home?: string): number | undefined;
+export {};
+//# sourceMappingURL=key-pins.d.ts.map

package/dist/key-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-pins.d.ts","sourceRoot":"","sources":["../src/key-pins.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,MAAM,WAAW,MAAM;IACrB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAA;IACf;yDACqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,gBAAgB;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAE5C,UAAU,OAAO;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAkBD;sDACsD;AACtD,qBAAa,cAAe,SAAQ,KAAK;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAGlC;AAED,wBAAgB,WAAW,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE5D;AAsCD,qEAAqE;AACrE,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,MAAkB,GAAG,OAAO,CAQ5E;AAED,2EAA2E;AAC3E,wBAAgB,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEzE;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CACxB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,MAAkB,EACxB,GAAG,GAAE,IAAiB,GACrB,IAAI,CAON;AAED;gFACgF;AAChF,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,MAAkB,GACvB,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9C,IAAI,GAAE,MAAkB,GACvB,MAAM,GAAG,SAAS,CAapB"}

package/dist/key-pins.js

@@ -0,0 +1,165 @@
+// The teammate keys this member confirmed by fingerprint, on this device
+// (spec 080 item 7a; the web app's keyPinning.ts and its research R-011).
+//
+// A team key's wrap names the key it was made with, and decrypting it proves
+// only that whoever holds that key made it - so a server could make one with
+// its own key and label it as a teammate's. A pin is what a person checked
+// outside Veilio: `veilio team trust` writes one after the fingerprints were
+// compared. Nothing here is ever sent to the server, encrypted or not: a pin
+// the server could read or replace would protect against nothing.
+//
+// Unlike the web app's, every pin here is confirmed: the CLI never records a
+// first sighting, so there is no `auto` kind to tell apart.
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { STORE_DIR } from '@veilio-inc/engine';
+export const KEY_PINS_FILE = 'key-pins.json';
+/** key-pins.json exists and is not one this CLI can read: never overwritten,
+ *  since confirmations a person made are in there. */
+export class KeyPinsDamaged extends Error {
+    path;
+    constructor(path) {
+        super(`${path} is damaged`);
+        this.path = path;
+    }
+}
+export function keyPinsPath(home = homedir()) {
+    return join(home, STORE_DIR, KEY_PINS_FILE);
+}
+function isPin(p) {
+    if (typeof p !== 'object' || p === null)
+        return false;
+    const pin = p;
+    return (typeof pin.current === 'string' &&
+        pin.current !== '' &&
+        Array.isArray(pin.history) &&
+        pin.history.every((k) => typeof k === 'string') &&
+        typeof pin.confirmedAt === 'string');
+}
+/** The file, or null when it exists and is not one this CLI wrote. */
+function readFile(home) {
+    let text;
+    try {
+        text = readFileSync(keyPinsPath(home), 'utf8');
+    }
+    catch (err) {
+        // Only a file that is not there is "none yet". One that cannot be read
+        // (a directory, another owner, an I/O error) still holds what a person
+        // confirmed: damaged, so nothing replaces it.
+        if (err.code === 'ENOENT')
+            return { v: 1, scopes: [] };
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed?.v === 1 && Array.isArray(parsed.scopes))
+            return parsed;
+    }
+    catch {
+        // not JSON
+    }
+    return null;
+}
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+/** This instance and account's pins. A damaged entry is left out. */
+export function readPins(binding, home = homedir()) {
+    const file = readFile(home);
+    const scope = file ? findScope(file, binding) : undefined;
+    // No prototype: a granter id is the server's word, and `__proto__` or
+    // `constructor` must be a key like any other, never Object's own.
+    const pins = Object.create(null);
+    for (const [id, pin] of Object.entries(scope?.pins ?? {}))
+        if (isPin(pin))
+            pins[id] = pin;
+    return pins;
+}
+/** The pin for `identity`, only if one was recorded under exactly that. */
+export function pinOf(pins, identity) {
+    return Object.hasOwn(pins, identity) ? pins[identity] : undefined;
+}
+/** The keys a pin accepts: the current one, then the earlier ones. */
+export function confirmedKeys(pin) {
+    return pin ? [pin.current, ...pin.history] : [];
+}
+/** Record `publicKey` as confirmed for `identity`, keeping any earlier one. */
+export function confirmPin(binding, identity, publicKey, home = homedir(), now = new Date()) {
+    update(binding, home, (scope) => {
+        const held = pinOf(scope.pins, identity);
+        const before = isPin(held) ? held : undefined;
+        const history = confirmedKeys(before).filter((k) => k !== publicKey);
+        scope.pins[identity] = { current: publicKey, history, confirmedAt: now.toISOString() };
+    });
+}
+/** This account's blocked version for `teamId`, or undefined. Throws
+ *  `KeyPinsDamaged` when it cannot be known: the caller then writes nothing. */
+export function blockedMark(binding, teamId, home = homedir()) {
+    const file = readFile(home);
+    if (!file)
+        throw new KeyPinsDamaged(keyPinsPath(home));
+    const scope = findScope(file, binding);
+    if (!scope || scope.blocked === undefined)
+        return undefined;
+    if (!isRecord(scope.blocked))
+        throw new KeyPinsDamaged(keyPinsPath(home));
+    if (!Object.hasOwn(scope.blocked, teamId))
+        return undefined;
+    const mark = scope.blocked[teamId];
+    if (typeof mark !== 'number')
+        throw new KeyPinsDamaged(keyPinsPath(home));
+    return mark;
+}
+/**
+ * Settle the blocked version for `teamId` against what is stored NOW, in one
+ * read-change-write: first `clearUpTo` drops the mark only if it is still at
+ * most that (the value this run read - a raise another unlock made since is
+ * kept), then `raise` keeps the higher of the two. The mark it leaves.
+ */
+export function settleBlockedMark(binding, teamId, change, home = homedir()) {
+    let left;
+    update(binding, home, (scope) => {
+        const blocked = scope.blocked;
+        let mark = Object.hasOwn(blocked, teamId) ? blocked[teamId] : undefined;
+        if (change.clearUpTo !== undefined && mark !== undefined && mark <= change.clearUpTo)
+            mark = undefined;
+        if (change.raise !== undefined)
+            mark = Math.max(mark ?? change.raise, change.raise);
+        if (mark === undefined)
+            delete blocked[teamId];
+        else
+            blocked[teamId] = mark;
+        left = mark;
+    });
+    return left;
+}
+function findScope(file, binding) {
+    return file.scopes.find((s) => s?.instance === binding.instance && s?.account === binding.account);
+}
+/** Read, change this account's scope, write back atomically at 0600. A damaged
+ *  file, or a damaged scope of this account, is refused and left as it is. */
+function update(binding, home, change) {
+    const file = readFile(home);
+    let scope = file ? findScope(file, binding) : undefined;
+    if (!file ||
+        (scope && !isRecord(scope.pins)) ||
+        (scope?.blocked !== undefined &&
+            !(isRecord(scope.blocked) && Object.values(scope.blocked).every((m) => typeof m === 'number'))))
+        throw new KeyPinsDamaged(keyPinsPath(home));
+    if (!scope) {
+        scope = { instance: binding.instance, account: binding.account, pins: {} };
+        file.scopes.push(scope);
+    }
+    // No prototype: ids are the server's words (`__proto__` is a key here).
+    scope.pins = Object.assign(Object.create(null), scope.pins);
+    scope.blocked = Object.assign(Object.create(null), scope.blocked);
+    change(scope);
+    const path = keyPinsPath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    // Written beside, then renamed over: a crash mid-write must not leave a
+    // half file that reads as "no pins" and silently drops every confirmation.
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, path);
+}
+//# sourceMappingURL=key-pins.js.map

package/dist/key-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-pins.js","sourceRoot":"","sources":["../src/key-pins.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,4DAA4D;AAE5D,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAoC5C;sDACsD;AACtD,MAAM,OAAO,cAAe,SAAQ,KAAK;IAClB;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC,CAAA;QADR,SAAI,GAAJ,IAAI,CAAQ;IAEjC,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,OAAO,EAAE;IAClD,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,KAAK,CAAC,CAAU;IACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,GAAG,GAAG,CAA4B,CAAA;IACxC,OAAO,CACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,GAAG,CAAC,OAAO,KAAK,EAAE;QAClB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC/C,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CACpC,CAAA;AACH,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAA;QAC3C,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC5D,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAE1D,qEAAqE;AACrE,MAAM,UAAU,QAAQ,CAAC,OAAgB,EAAE,OAAe,OAAO,EAAE;IACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzD,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,IAAI,GAAY,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACzC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAAE,IAAI,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,CAAA;IACzF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,KAAK,CAAC,IAAa,EAAE,QAAgB;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACnE,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,GAAuB;IACnD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACjD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CACxB,OAAgB,EAChB,QAAgB,EAChB,SAAiB,EACjB,OAAe,OAAO,EAAE,EACxB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAA;IACxF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,WAAW,CACzB,OAAgB,EAChB,MAAc,EACd,OAAe,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;IACzE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,MAAc,EACd,MAA8C,EAC9C,OAAe,OAAO,EAAE;IAExB,IAAI,IAAwB,CAAA;IAC5B,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAQ,CAAA;QAC9B,IAAI,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvE,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS;YAClF,IAAI,GAAG,SAAS,CAAA;QAClB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QACnF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAA;;YACzC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QAC3B,IAAI,GAAG,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,OAAgB;IACjD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AACpG,CAAC;AAED;8EAC8E;AAC9E,SAAS,MAAM,CAAC,OAAgB,EAAE,IAAY,EAAE,MAA8B;IAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvD,IACE,CAAC,IAAI;QACL,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS;YAC3B,CAAC,CACC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAC5F,CAAC;QAEJ,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IACD,wEAAwE;IACxE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IACtE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAC3F,MAAM,CAAC,KAAK,CAAC,CAAA;IAEb,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;IAC9B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IACxC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACzE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC"}