@zincapp/znvault-cli 4.22.1 → 4.23.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,iFAAiF;AACjF,qDAAqD;AACrD,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,4BAA4B,CAAC;IAC1C,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;KAClF,uBAAuB,EAAE;KACzB,OAAO,CAAC,UAAU,EAAE,CAAC;KACrB,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;KACzC,MAAM,CAAC,YAAY,EAAE,mCAAmC,CAAC;KACzD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;KAClE,MAAM,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC7D,MAAM,CAAC,aAAa,EAAE,kEAAkE,CAAC;KACzF,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE;IAChD,uBAAuB;IACvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAiB,CAAC;IAE/C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,yEAAyE;IACzE,iFAAiF;IACjF,qEAAqE;IACrE,IACE,0BAA0B,CAAC;QACzB,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE;QAC1B,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE;QACpC,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE;KAC3B,CAAC,EACF,CAAC;QACD,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,iDAAiD;AACjD,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,mEAAmE;AACnE,+CAA+C;AAC/C,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAEnC,6EAA6E;AAC7E,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAEpC,kFAAkF;AAClF,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6CAA6C;AAC7C,wBAAwB,EAAE,CAAC;AAE3B;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IAEzC,IAAI,UAAU,GAA8B,MAAM,CAAC;IACnD,IAAI,QAA4B,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IAErC,IAAI,SAAS,EAAE,EAAE,CAAC;QAChB,UAAU,GAAG,QAAQ,CAAC;QACtB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;QACpC,UAAU,GAAG,KAAK,CAAC;QACnB,2CAA2C;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAwC,CAAC;YAC7G,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU;QACV,QAAQ;QACR,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,KAAK,UAAU,IAAI;IACjB,mDAAmD;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBACtE,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,aAAa,EACb,MAAM,EACN,SAAS,EACT,oBAAoB,CACrB,CAAC;gBACF,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,WAAW;AACX,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,iFAAiF;AACjF,qDAAqD;AACrD,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAU5D;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,aAAsB;IACjD,IAAI,GAAG,GAAG,aAAa,CAAC;IACxB,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1B,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,4BAA4B,CAAC;IAC1C,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;KAClF,uBAAuB,EAAE;KACzB,OAAO,CAAC,UAAU,EAAE,CAAC;KACrB,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;KACzC,MAAM,CAAC,YAAY,EAAE,mCAAmC,CAAC;KACzD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;KAClE,MAAM,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC7D,MAAM,CAAC,aAAa,EAAE,kEAAkE,CAAC;KACzF,MAAM,CAAC,cAAc,EAAE,6DAA6D,CAAC;KACrF,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE;IAChD,uBAAuB;IACvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAiB,CAAC;IAE/C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,mDAAmD;IACnD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,+DAA+D;IAC/D,wEAAwE;IACxE,8CAA8C;IAC9C,0EAA0E;IAC1E,2EAA2E;IAC3E,mCAAmC;IACnC,EAAE;IACF,wEAAwE;IACxE,qCAAqC;IACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,OAAO,KAAK;gBACnC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBACf,CAAC,CAAC,wBAAwB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC7C,CAAC,CAAC,6BAA6B,CAAC;gBAClC,yHAAyH,CAC5H,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,yEAAyE;IACzE,iFAAiF;IACjF,qEAAqE;IACrE,IACE,0BAA0B,CAAC;QACzB,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE;QAC1B,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE;QACpC,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE;KAC3B,CAAC,EACF,CAAC;QACD,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,iDAAiD;AACjD,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,mEAAmE;AACnE,+CAA+C;AAC/C,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAEnC,6EAA6E;AAC7E,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAEpC,kFAAkF;AAClF,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6CAA6C;AAC7C,wBAAwB,EAAE,CAAC;AAE3B;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IAEzC,IAAI,UAAU,GAA8B,MAAM,CAAC;IACnD,IAAI,QAA4B,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IAErC,IAAI,SAAS,EAAE,EAAE,CAAC;QAChB,UAAU,GAAG,QAAQ,CAAC;QACtB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;QACpC,UAAU,GAAG,KAAK,CAAC;QACnB,2CAA2C;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAwC,CAAC;YAC7G,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU;QACV,QAAQ;QACR,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,KAAK,UAAU,IAAI;IACjB,mDAAmD;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBACtE,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,aAAa,EACb,MAAM,EACN,SAAS,EACT,oBAAoB,CACrB,CAAC;gBACF,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,WAAW;AACX,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/bsk-source.d.ts

@@ -0,0 +1,21 @@
+/** A row of `root_key_envelopes`. */
+export interface EnvelopeRow {
+    providerId: string;
+    providerType: string;
+    keyId: string | null;
+    ciphertext: Buffer;
+    /** Publishable KCV recorded at wrap time. The anchor for the check below. */
+    kcv: string;
+}
+/** Opens one envelope. The transport; anything that can answer. */
+export type UnwrapFn = (ciphertext: Buffer) => Promise<Buffer>;
+/**
+ * Ask a provider to open its envelope, and refuse anything that is not the key
+ * the envelope says it is.
+ *
+ * @returns a FRESH buffer the caller owns and must zeroize.
+ * @throws when the envelope row is malformed, the answer is the wrong length,
+ *   or the answer's KCV disagrees with the recorded one.
+ */
+export declare function resolveBskFromProvider(envelope: EnvelopeRow, unwrap: UnwrapFn): Promise<Buffer>;
+//# sourceMappingURL=bsk-source.d.ts.map

package/dist/lib/bsk-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bsk-source.d.ts","sourceRoot":"","sources":["../../src/lib/bsk-source.ts"],"names":[],"mappings":"AAqCA,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mEAAmE;AACnE,MAAM,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAI/D;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,QAAQ,GACf,OAAO,CAAC,MAAM,CAAC,CAqDjB"}

package/dist/lib/bsk-source.js

@@ -0,0 +1,89 @@
+// Path: src/lib/bsk-source.ts
+//
+// Obtain the bootstrap key for an escrow ceremony from a root-key provider
+// instead of from a cleartext file.
+//
+// WHY THIS EXISTS. `escrow snapshot` could only read `DATA_DIR/lmk.bin`, which
+// had two consequences neither of which is acceptable as an operational
+// control:
+//
+//   The ceremony had to run wherever the cleartext key already lives — in
+//   practice a production application node, with a USB device plugged into it.
+//   That is defensible only as "no NEW exposure"; it is not how a key ceremony
+//   is supposed to look, and it is not defensible to an auditor.
+//
+//   The escrow was a ONE-WAY DOOR. Retiring `lmk.bin` from the fleet — the
+//   declared goal of the whole programme — would permanently remove the ability
+//   to take another snapshot. A damaged datAshur, a lost one, a third copy for
+//   a new location: none of them possible, ever again.
+//
+// Sourcing from the Archon Sentinel over mTLS fixes both. The appliance is the
+// hardware root; a dedicated ceremony host asks it to open the envelope, writes
+// the bundle straight to the device, and stores nothing.
+//
+// THE GATE. A file is self-evidencing — the bytes are the key or they are not.
+// A network answer is not: something replied to an HTTPS request. If that reply
+// is wrong for ANY reason, the bundle is built around the wrong key and every
+// check inside it still passes, because a bundle is only ever checked against
+// itself. The escrow would verify perfectly and restore a key that opens
+// nothing.
+//
+// So the answer is checked against the KCV PostgreSQL recorded when the
+// envelope was wrapped — a value the appliance neither supplies nor can
+// influence at read time. This mirrors `sentinel-provider.ts` on the server,
+// which makes the identical check before serving a boot.
+import { computeBskKcv, isBskKcv } from './kcv.js';
+const BSK_LEN = 32;
+/**
+ * Ask a provider to open its envelope, and refuse anything that is not the key
+ * the envelope says it is.
+ *
+ * @returns a FRESH buffer the caller owns and must zeroize.
+ * @throws when the envelope row is malformed, the answer is the wrong length,
+ *   or the answer's KCV disagrees with the recorded one.
+ */
+export async function resolveBskFromProvider(envelope, unwrap) {
+    // Checked BEFORE the network call: a malformed recorded KCV can never equal a
+    // computed one, so leaving it would surface a corrupt row as a "the appliance
+    // returned the wrong key" mismatch — sending the ceremony after the wrong
+    // fault, with the device already unlocked and a witness in the room.
+    if (!isBskKcv(envelope.kcv)) {
+        throw new Error(`Envelope for provider '${envelope.providerId}' records a KCV that is not a ` +
+            `kcv1: fingerprint (${JSON.stringify(envelope.kcv)}). The row in ` +
+            'root_key_envelopes is malformed; this is a database problem, not an ' +
+            'appliance problem. Do not proceed with the ceremony.');
+    }
+    // A transport failure is an operational fact, not evidence about the key.
+    // It travels up unchanged.
+    const answered = await unwrap(envelope.ciphertext);
+    // Copy immediately, then wipe the transport's buffer. The caller must own
+    // exactly one buffer and be the only party responsible for wiping it;
+    // handing back the transport's own memory leaves the duty ambiguous.
+    const key = Buffer.from(answered);
+    answered.fill(0);
+    try {
+        if (key.length !== BSK_LEN) {
+            throw new Error(`Provider '${envelope.providerId}' opened its envelope to ` +
+                `${String(key.length)} bytes; a bootstrap key is exactly ` +
+                `${String(BSK_LEN)} bytes. The envelope is corrupt.`);
+        }
+        const actual = computeBskKcv(key);
+        if (actual !== envelope.kcv) {
+            throw new Error(`Provider '${envelope.providerId}' opened its envelope to a DIFFERENT key ` +
+                `than the one recorded when it was wrapped. Envelope records ` +
+                `${envelope.kcv}; the appliance returned ${actual}. Refusing to build an ` +
+                'escrow bundle around it: the bundle would verify against itself and ' +
+                "restore a key that opens nothing. Run 'znvault superadmin rootkey verify' " +
+                'and stop the ceremony.');
+        }
+    }
+    catch (error) {
+        // Rejected key material does not linger in the heap because a comparison
+        // failed. It is still a real key — from another deployment, or this one
+        // under a corrupt row.
+        key.fill(0);
+        throw error;
+    }
+    return key;
+}
+//# sourceMappingURL=bsk-source.js.map

package/dist/lib/bsk-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bsk-source.js","sourceRoot":"","sources":["../../src/lib/bsk-source.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,2EAA2E;AAC3E,oCAAoC;AACpC,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,WAAW;AACX,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,iEAAiE;AACjE,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,yDAAyD;AACzD,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,WAAW;AACX,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,6EAA6E;AAC7E,yDAAyD;AAEzD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAenD,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAqB,EACrB,MAAgB;IAEhB,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,CAAC,UAAU,gCAAgC;YAC7E,sBAAsB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB;YAClE,sEAAsE;YACtE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAEnD,0EAA0E;IAC1E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEjB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,UAAU,2BAA2B;gBAC3D,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,qCAAqC;gBAC1D,GAAG,MAAM,CAAC,OAAO,CAAC,kCAAkC,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,CAAC,UAAU,2CAA2C;gBAC3E,8DAA8D;gBAC9D,GAAG,QAAQ,CAAC,GAAG,4BAA4B,MAAM,yBAAyB;gBAC1E,sEAAsE;gBACtE,4EAA4E;gBAC5E,wBAAwB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,wEAAwE;QACxE,uBAAuB;QACvB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/config/index.d.ts

@@ -8,7 +8,7 @@ export { CONFIG_DEFAULTS, DEFAULT_PROFILE } from './types.js';
 export { store, setRuntimeProfile, resetConfig, getConfigPath, _resetStoreInstance } from './store.js';
 export { ensureMigrated, resetMigrationState } from './migration.js';
 export { invalidateProfileCache, invalidateAllProfileCaches, invalidateConfigCache, invalidateAllCaches, getCacheStats, } from './cache.js';
-export { getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, } from './profile.js';
+export { getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, listProfileNames, profileExists, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, } from './profile.js';
 export { storeCredentials, clearCredentials, getCredentials, isTokenExpired, hasEnvCredentials, getEnvCredentials, decodeRefreshJti, writePendingRefreshMarker, decidePendingRefresh, logPendingRefreshRecovery, type MarkerDecision, } from './credentials.js';
 export { hasApiKey, getApiKey, storeApiKey, getStoredApiKeyInfo, clearApiKey, getStoredApiKey, } from './apikey.js';
 export { getPlugins, addPlugin, removePlugin, setPluginEnabled, clearPlugins, } from './plugins.js';

package/dist/lib/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/config/index.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAGH,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGvG,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAEjB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/config/index.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAGH,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGvG,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa,GACd,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EAEjB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,EACf,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC"}

package/dist/lib/config/index.js

@@ -7,7 +7,7 @@ export { ensureMigrated, resetMigrationState } from './migration.js';
 // Cache
 export { invalidateProfileCache, invalidateAllProfileCaches, invalidateConfigCache, invalidateAllCaches, getCacheStats, } from './cache.js';
 // Profile management
-export { getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, } from './profile.js';
+export { getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, listProfileNames, profileExists, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, } from './profile.js';
 // Credentials
 export { storeCredentials, clearCredentials, getCredentials, isTokenExpired, hasEnvCredentials, getEnvCredentials, 
 // refresh-token-race-fix §A.1 additions:

package/dist/lib/config/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/config/index.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAUhC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9D,QAAQ;AACR,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEvG,YAAY;AACZ,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErE,QAAQ;AACR,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,qBAAqB;AACrB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,cAAc;AACd,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB;AACjB,yCAAyC;AACzC,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC;AAE1B,UAAU;AACV,OAAO,EACL,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,UAAU;AACV,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,yBAAyB;AACzB,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,aAAa;AACb,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,GAEhB,MAAM,iBAAiB,CAAC;AAEzB,cAAc;AACd,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,yCAAyC;AACzC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/config/index.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAUhC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9D,QAAQ;AACR,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEvG,YAAY;AACZ,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErE,QAAQ;AACR,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,qBAAqB;AACrB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,cAAc;AACd,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB;AACjB,yCAAyC;AACzC,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC;AAE1B,UAAU;AACV,OAAO,EACL,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,UAAU;AACV,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,yBAAyB;AACzB,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,aAAa;AACb,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,GAEhB,MAAM,iBAAiB,CAAC;AAEzB,cAAc;AACd,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAEzB,yCAAyC;AACzC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC"}

package/dist/lib/config/profile.d.ts

@@ -15,6 +15,20 @@ export declare function saveProfile(profileName: string, profile: Profile): void
  * List all profiles
  */
 export declare function listProfiles(): ProfileInfo[];
+/**
+ * Names of every configured profile, sorted.
+ */
+export declare function listProfileNames(): string[];
+/**
+ * Whether a profile with this exact name is configured.
+ *
+ * Used to fail closed on an explicitly requested profile that does not exist.
+ * `getCurrentProfile()` deliberately falls back to CONFIG_DEFAULTS for a
+ * missing profile so a fresh install still works; that fallback points at
+ * localhost, which is the right default and the wrong answer when an operator
+ * typed `--profile <name>` for a remote deployment.
+ */
+export declare function profileExists(name: string): boolean;
 /**
  * Create a new profile
  */

package/dist/lib/config/profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../src/lib/config/profile.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoC,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9F;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAqB3C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvE;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,WAAW,EAAE,CAW5C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiClH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAmBhD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQhD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAG5D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAwBpE"}
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../src/lib/config/profile.ts"],"names":[],"mappings":"AAQA,OAAO,EAAoC,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9F;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAG7C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAqB3C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvE;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,WAAW,EAAE,CAW5C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAI3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAInD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiClH;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAmBhD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQhD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAG5D;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAwBpE"}

package/dist/lib/config/profile.js

@@ -59,6 +59,28 @@ export function listProfiles() {
         hasApiKey: !!profile.apiKey,
     }));
 }
+/**
+ * Names of every configured profile, sorted.
+ */
+export function listProfileNames() {
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- needed for test mocks
+    const profiles = store.get('profiles') ?? {};
+    return Object.keys(profiles).sort();
+}
+/**
+ * Whether a profile with this exact name is configured.
+ *
+ * Used to fail closed on an explicitly requested profile that does not exist.
+ * `getCurrentProfile()` deliberately falls back to CONFIG_DEFAULTS for a
+ * missing profile so a fresh install still works; that fallback points at
+ * localhost, which is the right default and the wrong answer when an operator
+ * typed `--profile <name>` for a remote deployment.
+ */
+export function profileExists(name) {
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- needed for test mocks
+    const profiles = store.get('profiles') ?? {};
+    return Object.prototype.hasOwnProperty.call(profiles, name);
+}
 /**
  * Create a new profile
  */

package/dist/lib/config/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/lib/config/profile.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAElC;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAkC,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,cAAc,EAAE,CAAC;IACjB,OAAO,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC1F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,cAAc,EAAE,CAAC;IACjB,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;IAE3C,oBAAoB;IACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,kBAAkB;IAClB,gGAAgG;IAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI;QACvC,GAAG,EAAE,eAAe,CAAC,GAAG;QACxB,QAAQ,EAAE,eAAe,CAAC,QAAQ;QAClC,OAAO,EAAE,eAAe,CAAC,OAAO;KACjC,CAAC;IAEF,6BAA6B;IAC7B,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEnC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,OAAgB;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAChC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEhC,oCAAoC;IACpC,sBAAsB,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,KAAK,aAAa;QAC9B,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;KAC5B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAgE;IAC1G,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,UAAmB,CAAC;IAExB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,QAAQ,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,UAAU,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,yBAAyB;QACzB,UAAU,CAAC,WAAW,GAAG,SAAS,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,UAAU,GAAG;YACX,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG;YACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ;YACtD,OAAO,EAAE,eAAe,CAAC,OAAO;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAC5B,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,eAAe,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,gEAAgE;IAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEhC,sDAAsD;IACtD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAe;IAC5D,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,eAAe,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,aAAa,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,kBAAkB,CAAC,CAAC;IACzD,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,gEAAgE;IAChE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEhC,kCAAkC;IAClC,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/lib/config/profile.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAElC;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAkC,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpF;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,cAAc,EAAE,CAAC;IACjB,OAAO,iBAAiB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC1F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,cAAc,EAAE,CAAC;IACjB,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;IAE3C,oBAAoB;IACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,kBAAkB;IAClB,gGAAgG;IAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI;QACvC,GAAG,EAAE,eAAe,CAAC,GAAG;QACxB,QAAQ,EAAE,eAAe,CAAC,QAAQ;QAClC,OAAO,EAAE,eAAe,CAAC,OAAO;KACjC,CAAC;IAEF,6BAA6B;IAC7B,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEnC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,OAAgB;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAChC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEhC,oCAAoC;IACpC,sBAAsB,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,KAAK,aAAa;QAC9B,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;KAC5B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,gGAAgG;IAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,gGAAgG;IAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAgE;IAC1G,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,kBAAkB,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,UAAmB,CAAC;IAExB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,QAAQ,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,UAAU,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,yBAAyB;QACzB,UAAU,CAAC,WAAW,GAAG,SAAS,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,UAAU,GAAG;YACX,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG;YACvC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ;YACtD,OAAO,EAAE,eAAe,CAAC,OAAO;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAC5B,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,sBAAsB,eAAe,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,gEAAgE;IAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEhC,sDAAsD;IACtD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAe;IAC5D,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,eAAe,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAEvC,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,aAAa,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,YAAY,OAAO,kBAAkB,CAAC,CAAC;IACzD,CAAC;IAED,QAAQ,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,gEAAgE;IAChE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEhC,kCAAkC;IAClC,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/lib/config.d.ts

@@ -4,5 +4,5 @@
  * This file maintains backward compatibility by re-exporting from the
  * modularized config/ directory structure.
  */
-export { type Profile, type ConfigStore, type ProfileInfo, type ApiKeyInfo, CONFIG_DEFAULTS, DEFAULT_PROFILE, store, setRuntimeProfile, resetConfig, getConfigPath, ensureMigrated, resetMigrationState, invalidateProfileCache, invalidateAllProfileCaches, invalidateConfigCache, invalidateAllCaches, getCacheStats, getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, storeCredentials, clearCredentials, getCredentials, isTokenExpired, hasEnvCredentials, getEnvCredentials, decodeRefreshJti, writePendingRefreshMarker, decidePendingRefresh, logPendingRefreshRecovery, type MarkerDecision, hasApiKey, getApiKey, storeApiKey, getStoredApiKeyInfo, clearApiKey, getStoredApiKey, getPlugins, addPlugin, removePlugin, setPluginEnabled, clearPlugins, getConfig, getConfigValue, setConfigValue, getEffectiveUrl, getAllConfig, validateEnvironment, assertValidEnvironment, getValidatedEnvCredentials, getValidatedApiKey, getValidatedUrl, type ValidationResult, storeAutoUnsealSecret, getAutoUnsealSecret, hasAutoUnsealSecret, clearAutoUnsealSecret, generateTOTPCode, parseOTPAuthURI, } from './config/index.js';
+export { type Profile, type ConfigStore, type ProfileInfo, type ApiKeyInfo, CONFIG_DEFAULTS, DEFAULT_PROFILE, store, setRuntimeProfile, resetConfig, getConfigPath, ensureMigrated, resetMigrationState, invalidateProfileCache, invalidateAllProfileCaches, invalidateConfigCache, invalidateAllCaches, getCacheStats, getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, listProfileNames, profileExists, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, storeCredentials, clearCredentials, getCredentials, isTokenExpired, hasEnvCredentials, getEnvCredentials, decodeRefreshJti, writePendingRefreshMarker, decidePendingRefresh, logPendingRefreshRecovery, type MarkerDecision, hasApiKey, getApiKey, storeApiKey, getStoredApiKeyInfo, clearApiKey, getStoredApiKey, getPlugins, addPlugin, removePlugin, setPluginEnabled, clearPlugins, getConfig, getConfigValue, setConfigValue, getEffectiveUrl, getAllConfig, validateEnvironment, assertValidEnvironment, getValidatedEnvCredentials, getValidatedApiKey, getValidatedUrl, type ValidationResult, storeAutoUnsealSecret, getAutoUnsealSecret, hasAutoUnsealSecret, clearAutoUnsealSecret, generateTOTPCode, parseOTPAuthURI, } from './config/index.js';
 //# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,eAAe,EACf,eAAe,EAGf,KAAK,EACL,iBAAiB,EACjB,WAAW,EACX,aAAa,EAGb,cAAc,EACd,mBAAmB,EAGnB,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EAGb,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa,EAGb,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,cAAc,EAGnB,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe,EAGf,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,EAGZ,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,EAGZ,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,EACf,KAAK,gBAAgB,EAGrB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,eAAe,EACf,eAAe,EAGf,KAAK,EACL,iBAAiB,EACjB,WAAW,EACX,aAAa,EAGb,cAAc,EACd,mBAAmB,EAGnB,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EAGb,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa,EAGb,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,cAAc,EAGnB,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe,EAGf,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY,EAGZ,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY,EAGZ,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,EACf,KAAK,gBAAgB,EAGrB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/lib/config.js

@@ -13,7 +13,7 @@ ensureMigrated, resetMigrationState,
 // Cache
 invalidateProfileCache, invalidateAllProfileCaches, invalidateConfigCache, invalidateAllCaches, getCacheStats, 
 // Profile management
-getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, 
+getActiveProfileName, getCurrentProfile, saveProfile, listProfiles, listProfileNames, profileExists, createProfile, deleteProfile, switchProfile, getProfile, renameProfile, 
 // Credentials
 storeCredentials, clearCredentials, getCredentials, isTokenExpired, hasEnvCredentials, getEnvCredentials, decodeRefreshJti, writePendingRefreshMarker, decidePendingRefresh, logPendingRefreshRecovery, 
 // API key

package/dist/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B;;;;;GAKG;AAEH,OAAO,EAML,eAAe,EACf,eAAe;AAEf,QAAQ;AACR,KAAK,EACL,iBAAiB,EACjB,WAAW,EACX,aAAa;AAEb,YAAY;AACZ,cAAc,EACd,mBAAmB;AAEnB,QAAQ;AACR,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa;AAEb,qBAAqB;AACrB,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa;AAEb,cAAc;AACd,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB;AAGzB,UAAU;AACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe;AAEf,UAAU;AACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY;AAEZ,yBAAyB;AACzB,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY;AAEZ,aAAa;AACb,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe;AAGf,cAAc;AACd,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAE1B;;;;;GAKG;AAEH,OAAO,EAML,eAAe,EACf,eAAe;AAEf,QAAQ;AACR,KAAK,EACL,iBAAiB,EACjB,WAAW,EACX,aAAa;AAEb,YAAY;AACZ,cAAc,EACd,mBAAmB;AAEnB,QAAQ;AACR,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa;AAEb,qBAAqB;AACrB,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,UAAU,EACV,aAAa;AAEb,cAAc;AACd,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB;AAGzB,UAAU;AACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,eAAe;AAEf,UAAU;AACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,YAAY;AAEZ,yBAAyB;AACzB,SAAS,EACT,cAAc,EACd,cAAc,EACd,eAAe,EACf,YAAY;AAEZ,aAAa;AACb,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe;AAGf,cAAc;AACd,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/lib/db/index.d.ts

@@ -2,8 +2,12 @@ import { TenantOperations } from './tenants.js';
 import { UserOperations } from './users.js';
 import { LockdownOperations } from './lockdown.js';
 import { AuditOperations } from './audit.js';
-import type { LmkEscrowDatabaseSnapshot } from './lmk-escrow.js';
+import type { LmkEscrowDatabaseSnapshot, RootKeyEnvelopeRow } from './lmk-escrow.js';
+import type { PreflightDatabaseSnapshot } from './preflight.js';
 export * from './types.js';
+export type { RootKeyEnvelopeRow } from './lmk-escrow.js';
+export type { PreflightDatabaseSnapshot } from './preflight.js';
+export { PreflightOperations } from './preflight.js';
 export type { LmkEscrowActiveRotation, LmkEscrowAuditHead, LmkEscrowBackupBinding, LmkEscrowDatabaseSnapshot, LmkEscrowVersionRow, } from './lmk-escrow.js';
 /**
  * Composite database client that combines all operation modules.
@@ -17,6 +21,7 @@ export declare class LocalDBClient {
     private auditOps;
     private emergencyOps;
     private lmkEscrowOps;
+    private preflightOps;
     constructor();
     connect(): Promise<void>;
     close(): Promise<void>;
@@ -41,6 +46,9 @@ export declare class LocalDBClient {
     unlockUser: (username: string) => Promise<import("./emergency.js").OperationResult>;
     disableTotp: (username: string) => Promise<import("./emergency.js").OperationResult>;
     captureLmkEscrow: (backupId?: string) => Promise<LmkEscrowDatabaseSnapshot>;
+    getRootKeyEnvelope: (providerId: string) => Promise<RootKeyEnvelopeRow | null>;
+    listRootKeyEnvelopeProviders: () => Promise<string[]>;
+    capturePreflight: () => Promise<PreflightDatabaseSnapshot>;
 }
 /**
  * Legacy EmergencyDBClient class (alias for LocalDBClient)

package/dist/lib/db/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/db/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAGjE,cAAc,YAAY,CAAC;AAC3B,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,YAAY,CAAsB;;IAcpC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC,MAAM,+DAAiC;IACvC,aAAa,8DAAwC;IAGrD,WAAW,GAAI,UAAU,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,+DACjC;IACtC,SAAS,GAAI,IAAI,MAAM,EAAE,YAAY,OAAO,oEACF;IAC1C,cAAc,GAAI,IAAI,MAAM,yDACQ;IAGpC,SAAS,GAAI,UAAU,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,oDAC/B;IAClC,OAAO,GAAI,IAAI,MAAM,yDACM;IAC3B,iBAAiB,GAAI,UAAU,MAAM,yDACM;IAC3C,eAAe,6DACkB;IAGjC,iBAAiB,+DACsB;IACvC,kBAAkB,GAAI,QAAQ,MAAM,oEACS;IAC7C,UAAU,GAAI,UAAU,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,2DAChC;IAGvC,SAAS,GAAI,UAAU,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,0DAC/B;IACnC,gBAAgB,kEACmB;IAGnC,cAAc,+DACuB;IACrC,aAAa,GAAI,UAAU,MAAM,wDACW;IAC5C,aAAa,GAAI,UAAU,MAAM,EAAE,aAAa,MAAM,uDACG;IACzD,UAAU,GAAI,UAAU,MAAM,uDACW;IACzC,WAAW,GAAI,UAAU,MAAM,uDACW;IAG1C,gBAAgB,GAAI,WAAW,MAAM,KAAG,OAAO,CAAC,yBAAyB,CAAC,CACpC;CACvC;AAID;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,aAAa;;CAWnD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAG5C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/db/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,KAAK,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAGhE,cAAc,YAAY,CAAC;AAC3B,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,YAAY,EACV,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,YAAY,CAAsB;;IAepC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IActB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAKjC,MAAM,+DAAiC;IACvC,aAAa,8DAAwC;IAGrD,WAAW,GAAI,UAAU,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,+DACjC;IACtC,SAAS,GAAI,IAAI,MAAM,EAAE,YAAY,OAAO,oEACF;IAC1C,cAAc,GAAI,IAAI,MAAM,yDACQ;IAGpC,SAAS,GAAI,UAAU,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,oDAC/B;IAClC,OAAO,GAAI,IAAI,MAAM,yDACM;IAC3B,iBAAiB,GAAI,UAAU,MAAM,yDACM;IAC3C,eAAe,6DACkB;IAGjC,iBAAiB,+DACsB;IACvC,kBAAkB,GAAI,QAAQ,MAAM,oEACS;IAC7C,UAAU,GAAI,UAAU,UAAU,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,2DAChC;IAGvC,SAAS,GAAI,UAAU,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,0DAC/B;IACnC,gBAAgB,kEACmB;IAGnC,cAAc,+DACuB;IACrC,aAAa,GAAI,UAAU,MAAM,wDACW;IAC5C,aAAa,GAAI,UAAU,MAAM,EAAE,aAAa,MAAM,uDACG;IACzD,UAAU,GAAI,UAAU,MAAM,uDACW;IACzC,WAAW,GAAI,UAAU,MAAM,uDACW;IAG1C,gBAAgB,GAAI,WAAW,MAAM,KAAG,OAAO,CAAC,yBAAyB,CAAC,CACpC;IAEtC,kBAAkB,GAAI,YAAY,MAAM,KAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAC1B;IAEnD,4BAA4B,QAAO,OAAO,CAAC,MAAM,EAAE,CAAC,CACD;IAGnD,gBAAgB,QAAO,OAAO,CAAC,yBAAyB,CAAC,CAC3B;CAC/B;AAID;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,aAAa;;CAWnD;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAG5C"}

package/dist/lib/db/index.js

@@ -15,8 +15,10 @@ import { LockdownOperations } from './lockdown.js';
 import { AuditOperations } from './audit.js';
 import { EmergencyOperations } from './emergency.js';
 import { LmkEscrowOperations } from './lmk-escrow.js';
+import { PreflightOperations } from './preflight.js';
 // Re-export types
 export * from './types.js';
+export { PreflightOperations } from './preflight.js';
 /**
  * Composite database client that combines all operation modules.
  * Uses composition pattern to delegate to specialized operation classes.
@@ -29,6 +31,7 @@ export class LocalDBClient {
     auditOps;
     emergencyOps;
     lmkEscrowOps;
+    preflightOps;
     constructor() {
         // All operations share the same connection strategy via BaseDBClient
         this.healthOps = new HealthOperations();
@@ -38,6 +41,7 @@ export class LocalDBClient {
         this.auditOps = new AuditOperations();
         this.emergencyOps = new EmergencyOperations();
         this.lmkEscrowOps = new LmkEscrowOperations();
+        this.preflightOps = new PreflightOperations();
     }
     // Connection management - delegate to health ops (or any op, they all have the same base)
     async connect() {
@@ -53,6 +57,7 @@ export class LocalDBClient {
             this.auditOps.close(),
             this.emergencyOps.close(),
             this.lmkEscrowOps.close(),
+            this.preflightOps.close(),
         ]);
     }
     async disconnect() {
@@ -85,6 +90,10 @@ export class LocalDBClient {
     disableTotp = (username) => this.emergencyOps.disableTotp(username);
     // ============ Local LMK Escrow (read-only DB capture) ============
     captureLmkEscrow = (backupId) => this.lmkEscrowOps.capture(backupId);
+    getRootKeyEnvelope = (providerId) => this.lmkEscrowOps.getRootKeyEnvelope(providerId);
+    listRootKeyEnvelopeProviders = () => this.lmkEscrowOps.listRootKeyEnvelopeProviders();
+    // ============ BSK rotation preflight (read-only DB capture) ============
+    capturePreflight = () => this.preflightOps.capture();
 }
 // ============ Legacy exports for backward compatibility ============
 /**

package/dist/lib/db/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/db/index.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAE5B;;;mGAGmG;AAEnG;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,kBAAkB;AAClB,cAAc,YAAY,CAAC;AAS3B;;;GAGG;AACH,MAAM,OAAO,aAAa;IAChB,SAAS,CAAmB;IAC5B,SAAS,CAAmB;IAC5B,OAAO,CAAiB;IACxB,WAAW,CAAqB;IAChC,QAAQ,CAAkB;IAC1B,YAAY,CAAsB;IAClC,YAAY,CAAsB;IAE1C;QACE,qEAAqE;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,wBAAwB;QACxB,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;YACtB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;YACtB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YACpB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;YACrB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;YACzB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,mCAAmC;IACnC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IACvC,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;IAErD,oCAAoC;IACpC,WAAW,GAAG,CAAC,OAAwD,EAAE,EAAE,CACzE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,SAAS,GAAG,CAAC,EAAU,EAAE,SAAmB,EAAE,EAAE,CAC9C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC1C,cAAc,GAAG,CAAC,EAAU,EAAE,EAAE,CAC9B,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAEpC,kCAAkC;IAClC,SAAS,GAAG,CAAC,OAAoD,EAAE,EAAE,CACnE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CACvB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,iBAAiB,GAAG,CAAC,QAAgB,EAAE,EAAE,CACvC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,eAAe,GAAG,GAAG,EAAE,CACrB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;IAEjC,qCAAqC;IACrC,iBAAiB,GAAG,GAAG,EAAE,CACvB,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;IACvC,kBAAkB,GAAG,CAAC,KAAc,EAAE,EAAE,CACtC,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,UAAU,GAAG,CAAC,OAAyD,EAAE,EAAE,CACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAEvC,kCAAkC;IAClC,SAAS,GAAG,CAAC,OAAqD,EAAE,EAAE,CACpE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,gBAAgB,GAAG,GAAG,EAAE,CACtB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAEnC,iDAAiD;IACjD,cAAc,GAAG,GAAG,EAAE,CACpB,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;IACrC,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE,CACnC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC5C,aAAa,GAAG,CAAC,QAAgB,EAAE,WAAmB,EAAE,EAAE,CACxD,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzD,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAChC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,WAAW,GAAG,CAAC,QAAgB,EAAE,EAAE,CACjC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE1C,oEAAoE;IACpE,gBAAgB,GAAG,CAAC,QAAiB,EAAsC,EAAE,CAC3E,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;CACvC;AAED,sEAAsE;AAEtE;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD;QACE,qDAAqD;QACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,2EAA2E;gBAC3E,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,OAAO,MAAM,KAAK,IAAI,CAAC;AACzB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/db/index.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAE5B;;;mGAGmG;AAEnG;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAGrD,kBAAkB;AAClB,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AASrD;;;GAGG;AACH,MAAM,OAAO,aAAa;IAChB,SAAS,CAAmB;IAC5B,SAAS,CAAmB;IAC5B,OAAO,CAAiB;IACxB,WAAW,CAAqB;IAChC,QAAQ,CAAkB;IAC1B,YAAY,CAAsB;IAClC,YAAY,CAAsB;IAClC,YAAY,CAAsB;IAE1C;QACE,qEAAqE;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,kBAAkB,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,wBAAwB;QACxB,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;YACtB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;YACtB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YACpB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE;YACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE;YACrB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;YACzB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;YACzB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,mCAAmC;IACnC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;IACvC,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;IAErD,oCAAoC;IACpC,WAAW,GAAG,CAAC,OAAwD,EAAE,EAAE,CACzE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,SAAS,GAAG,CAAC,EAAU,EAAE,SAAmB,EAAE,EAAE,CAC9C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC1C,cAAc,GAAG,CAAC,EAAU,EAAE,EAAE,CAC9B,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAEpC,kCAAkC;IAClC,SAAS,GAAG,CAAC,OAAoD,EAAE,EAAE,CACnE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,EAAU,EAAE,EAAE,CACvB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,iBAAiB,GAAG,CAAC,QAAgB,EAAE,EAAE,CACvC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,eAAe,GAAG,GAAG,EAAE,CACrB,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;IAEjC,qCAAqC;IACrC,iBAAiB,GAAG,GAAG,EAAE,CACvB,IAAI,CAAC,WAAW,CAAC,iBAAiB,EAAE,CAAC;IACvC,kBAAkB,GAAG,CAAC,KAAc,EAAE,EAAE,CACtC,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC7C,UAAU,GAAG,CAAC,OAAyD,EAAE,EAAE,CACzE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAEvC,kCAAkC;IAClC,SAAS,GAAG,CAAC,OAAqD,EAAE,EAAE,CACpE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnC,gBAAgB,GAAG,GAAG,EAAE,CACtB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAEnC,iDAAiD;IACjD,cAAc,GAAG,GAAG,EAAE,CACpB,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;IACrC,aAAa,GAAG,CAAC,QAAgB,EAAE,EAAE,CACnC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC5C,aAAa,GAAG,CAAC,QAAgB,EAAE,WAAmB,EAAE,EAAE,CACxD,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACzD,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAChC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACzC,WAAW,GAAG,CAAC,QAAgB,EAAE,EAAE,CACjC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAE1C,oEAAoE;IACpE,gBAAgB,GAAG,CAAC,QAAiB,EAAsC,EAAE,CAC3E,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEtC,kBAAkB,GAAG,CAAC,UAAkB,EAAsC,EAAE,CAC9E,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAEnD,4BAA4B,GAAG,GAAsB,EAAE,CACrD,IAAI,CAAC,YAAY,CAAC,4BAA4B,EAAE,CAAC;IAEnD,0EAA0E;IAC1E,gBAAgB,GAAG,GAAuC,EAAE,CAC1D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;CAC/B;AAED,sEAAsE;AAEtE;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD;QACE,qDAAqD;QACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,2EAA2E;gBAC3E,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,OAAO,MAAM,KAAK,IAAI,CAAC;AACzB,CAAC"}

package/dist/lib/db/lmk-escrow.d.ts

@@ -37,6 +37,13 @@ export interface LmkEscrowActiveRotation {
     status: string;
     startedAt: Date | null;
 }
+export interface RootKeyEnvelopeRow {
+    providerId: string;
+    providerType: string;
+    keyId: string | null;
+    ciphertext: Buffer;
+    kcv: string;
+}
 export interface LmkEscrowDatabaseSnapshot {
     capturedAt: Date;
     databaseName: string;
@@ -54,6 +61,17 @@ export interface LmkEscrowDatabaseSnapshot {
  * This class never unwraps LMKs and never writes to PostgreSQL.
  */
 export declare class LmkEscrowOperations extends BaseDBClient {
+    /**
+     * Read one root-key envelope, for sourcing the BSK from the hardware root
+     * instead of a cleartext file.
+     *
+     * `kcv` is the load-bearing column: it is what the returned key is checked
+     * against, and the appliance neither supplies it nor can influence it at read
+     * time. See `resolveBskFromProvider`.
+     */
+    getRootKeyEnvelope(providerId: string): Promise<RootKeyEnvelopeRow | null>;
+    /** Provider ids that have an envelope, for a useful "did you mean" on error. */
+    listRootKeyEnvelopeProviders(): Promise<string[]>;
     capture(backupId?: string): Promise<LmkEscrowDatabaseSnapshot>;
 }
 //# sourceMappingURL=lmk-escrow.d.ts.map

package/dist/lib/db/lmk-escrow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lmk-escrow.d.ts","sourceRoot":"","sources":["../../../src/lib/db/lmk-escrow.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,IAAI,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,cAAc,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;CACvC;AAqBD;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAqHrE"}
+{"version":3,"file":"lmk-escrow.d.ts","sourceRoot":"","sources":["../../../src/lib/db/lmk-escrow.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,CAAC;IAClB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,IAAI,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,SAAS,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,cAAc,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAC/C,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;CACvC;AAqBD;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;IACnD;;;;;;;OAOG;IACG,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAehF,gFAAgF;IAC1E,4BAA4B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAQjD,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAqHrE"}

package/dist/lib/db/lmk-escrow.js

@@ -5,6 +5,31 @@ import { BaseDBClient } from './client.js';
  * This class never unwraps LMKs and never writes to PostgreSQL.
  */
 export class LmkEscrowOperations extends BaseDBClient {
+    /**
+     * Read one root-key envelope, for sourcing the BSK from the hardware root
+     * instead of a cleartext file.
+     *
+     * `kcv` is the load-bearing column: it is what the returned key is checked
+     * against, and the appliance neither supplies it nor can influence it at read
+     * time. See `resolveBskFromProvider`.
+     */
+    async getRootKeyEnvelope(providerId) {
+        await this.connect();
+        const result = await this.getRawClient().query(`SELECT provider_id AS "providerId",
+              provider_type AS "providerType",
+              key_id AS "keyId",
+              ciphertext,
+              kcv
+         FROM root_key_envelopes
+        WHERE provider_id = $1`, [providerId]);
+        return result.rows[0] ?? null;
+    }
+    /** Provider ids that have an envelope, for a useful "did you mean" on error. */
+    async listRootKeyEnvelopeProviders() {
+        await this.connect();
+        const result = await this.getRawClient().query(`SELECT provider_id AS "providerId" FROM root_key_envelopes ORDER BY provider_id`);
+        return result.rows.map((r) => r.providerId);
+    }
     async capture(backupId) {
         await this.connect();
         const client = this.getRawClient();

package/dist/lib/db/lmk-escrow.js.map

@@ -1 +1 @@
-{"version":3,"file":"lmk-escrow.js","sourceRoot":"","sources":["../../../src/lib/db/lmk-escrow.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA4E3C;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD,KAAK,CAAC,OAAO,CAAC,QAAiB;QAC7B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAElF,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB;;;;;;;;OAQ9D,CAAC,CAAC;YACH,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAExC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB;;;;;;;;;;;;;;;;;;OAkB9D,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAqB;;;;;;;;;;;OAW1D,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAA0B;;;;;;;;;;;OAWlE,CAAC,CAAC;YAEH,IAAI,MAAM,GAAkC,IAAI,CAAC;YACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,CAAqB;;;;;;;;;;;;SAY3D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACf,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,oCAAoC,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvC,IACE,SAAS,CAAC,MAAM,KAAK,UAAU;oBAC/B,CAAC,SAAS,CAAC,SAAS;oBACpB,SAAS,CAAC,QAAQ,KAAK,IAAI;oBAC3B,SAAS,CAAC,QAAQ,KAAK,EAAE;oBACzB,SAAS,CAAC,WAAW,KAAK,IAAI;oBAC9B,SAAS,CAAC,UAAU,KAAK,IAAI,EAC7B,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,kDAAkD,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM,GAAG;oBACP,GAAG,SAAS;oBACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,UAAU,EAAE,SAAS,CAAC,UAAU;iBACjC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO;gBACL,GAAG,QAAQ;gBACX,QAAQ,EAAE,cAAc,CAAC,IAAI;gBAC7B,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;gBACtC,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;gBAC9C,MAAM;aACP,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"lmk-escrow.js","sourceRoot":"","sources":["../../../src/lib/db/lmk-escrow.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoF3C;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACnD;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,UAAkB;QACzC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAC5C;;;;;;+BAMyB,EACzB,CAAC,UAAU,CAAC,CACb,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChC,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,4BAA4B;QAChC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAC5C,iFAAiF,CAClF,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAiB;QAC7B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAElF,IAAI,CAAC;YACH,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB;;;;;;;;OAQ9D,CAAC,CAAC;YACH,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAExC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAAsB;;;;;;;;;;;;;;;;;;OAkB9D,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAqB;;;;;;;;;;;OAW1D,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,KAAK,CAA0B;;;;;;;;;;;OAWlE,CAAC,CAAC;YAEH,IAAI,MAAM,GAAkC,IAAI,CAAC;YACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,CAAqB;;;;;;;;;;;;SAY3D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACf,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,oCAAoC,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvC,IACE,SAAS,CAAC,MAAM,KAAK,UAAU;oBAC/B,CAAC,SAAS,CAAC,SAAS;oBACpB,SAAS,CAAC,QAAQ,KAAK,IAAI;oBAC3B,SAAS,CAAC,QAAQ,KAAK,EAAE;oBACzB,SAAS,CAAC,WAAW,KAAK,IAAI;oBAC9B,SAAS,CAAC,UAAU,KAAK,IAAI,EAC7B,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,kDAAkD,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM,GAAG;oBACP,GAAG,SAAS;oBACZ,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,UAAU,EAAE,SAAS,CAAC,UAAU;iBACjC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO;gBACL,GAAG,QAAQ;gBACX,QAAQ,EAAE,cAAc,CAAC,IAAI;gBAC7B,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;gBACtC,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;gBAC9C,MAAM;aACP,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/lib/db/preflight.d.ts

@@ -0,0 +1,42 @@
+import { BaseDBClient } from './client.js';
+import type { PreflightAuditHead, PreflightBackup, PreflightEnvelope, PreflightLmkVersion, PreflightRotation } from '../preflight.js';
+export interface PreflightDatabaseSnapshot {
+    capturedAt: Date;
+    databaseName: string;
+    postgresVersion: string;
+    walLsn: string;
+    transactionSnapshot: string;
+    latestMigration: string | null;
+    lmkVersions: PreflightLmkVersion[];
+    rootKeyEnvelopes: PreflightEnvelope[];
+    rootKeyEnvelopesTablePresent: boolean;
+    activeRotations: PreflightRotation[];
+    auditHead: PreflightAuditHead | null;
+    latestVerifiedBackup: PreflightBackup | null;
+}
+/**
+ * Capture the key-hierarchy state a BSK rotation depends on.
+ *
+ * READ ONLY, AND SAID SO TO POSTGRESQL. The transaction is opened
+ * `REPEATABLE READ READ ONLY`, which makes any write on this connection fail
+ * with SQLSTATE 25006 rather than relying on nobody having added one. Test 1.1
+ * of the milestone is "preflight over production, and ZERO writes"; a promise
+ * kept only by inspection is not evidence.
+ *
+ * WHY NOT THE API. `/v1/superadmin/rootkey/status` and `.../verify` each WRITE
+ * AN AUDIT ROW. Reading the state through them would break the zero-writes
+ * property invisibly — the preflight would be the thing that falsified its own
+ * result. This reads PostgreSQL directly, exactly as the escrow snapshot does.
+ *
+ * REPEATABLE READ, not READ COMMITTED: every query below must see one instant.
+ * A version list read before a rotation commits and an envelope list read after
+ * would produce an inventory that never existed, and the gates would be
+ * evaluated over that.
+ *
+ * Nothing here selects key material. `wrapped_lmk` is read as `octet_length`
+ * only, `root_key_envelopes.ciphertext` is not read at all.
+ */
+export declare class PreflightOperations extends BaseDBClient {
+    capture(): Promise<PreflightDatabaseSnapshot>;
+}
+//# sourceMappingURL=preflight.d.ts.map

package/dist/lib/db/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../src/lib/db/preflight.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,IAAI,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,4BAA4B,EAAE,OAAO,CAAC;IACtC,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC,SAAS,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,oBAAoB,EAAE,eAAe,GAAG,IAAI,CAAC;CAC9C;AAgDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,mBAAoB,SAAQ,YAAY;IAC7C,OAAO,IAAI,OAAO,CAAC,yBAAyB,CAAC;CAkJpD"}