@zincapp/znvault-cli 4.23.0 → 4.24.1

package/dist/lib/ceremony/system.js

@@ -0,0 +1,176 @@
+// Path: src/lib/ceremony/system.ts
+//
+// Facts about this machine, gathered for the ceremony's gates to judge.
+//
+// This module DECIDES NOTHING. It shells out to `hdiutil`, `mount`, `ioreg` and
+// `diskutil` and reports what they said; every refusal lives in `gates.ts` and
+// `workspace.ts`, which are pure and therefore testable. The split is
+// deliberate: this file cannot be unit-tested, so it must not be where the
+// thinking happens.
+//
+// macOS-only by construction. The ceremony runs on the operator's Mac (see
+// `docs/emergency-dr/PROTOCOLO-ceremonia-en-mac.md` for why that is the
+// decision and what it costs); a Linux ceremony host would need its own
+// implementation of exactly these five functions and nothing else.
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync } from 'node:fs';
+import { CEREMONY_MOUNT_POINT } from './workspace.js';
+/**
+ * Run a command and return stdout, or `null` if it could not run. Never throws.
+ *
+ * `null` AND NOT `''`. An audit found the earlier version collapsed the two:
+ * a `mount` that failed to execute returned the empty string, which reads as
+ * "nothing is mounted" — so teardown verification passed on zero evidence and a
+ * ceremony closed as COMPLETED over a live RAM disk. Callers now have to decide
+ * what silence means, and for teardown it means refuse.
+ */
+function run(cmd, args) {
+    try {
+        return execFileSync(cmd, args, { encoding: 'utf-8', maxBuffer: 8 * 1024 * 1024 });
+    }
+    catch {
+        return null;
+    }
+}
+/** `run`, for the callers where "could not run" and "said nothing" are the same. */
+function runOrEmpty(cmd, args) {
+    return run(cmd, args) ?? '';
+}
+/**
+ * Does this `hdiutil info` / `mount` line refer to exactly this device?
+ *
+ * NOT `startsWith`: `/dev/disk3` is a prefix of `/dev/disk32`, and a Mac with
+ * simulators attached routinely has a dozen images listed, so a straddling pair
+ * of unit numbers is ordinary rather than exotic. Prefix matching attributed one
+ * device's backing to another.
+ */
+function refersTo(line, device) {
+    const trimmed = line.trimStart();
+    if (!trimmed.startsWith(device))
+        return false;
+    const next = trimmed.charAt(device.length);
+    return next === '' || !/[0-9a-zA-Z]/.test(next);
+}
+/**
+ * Create a RAM-backed volume and report what the system says about it.
+ *
+ * Returns facts rather than throwing on failure: `assertRamBacked` is what
+ * refuses, and it must see the same facts an operator would — including the
+ * case where the mount silently did not happen, which is the whole reason the
+ * gate exists.
+ *
+ * `awk '{print $1}'` and NOT `tr -d ' '`: hdiutil pads the device path with
+ * TABS, and stripping only spaces yields a malformed path whose mount fails
+ * quietly while writes land on the SSD. That was a real hour of this build.
+ */
+export function createRamWorkspace(megabytes) {
+    const sectors = megabytes * 2048;
+    const attached = runOrEmpty('hdiutil', ['attach', '-nomount', `ram://${String(sectors)}`]);
+    const device = attached.trim().split(/\s+/)[0] ?? '';
+    if (device === '') {
+        return { device: '(hdiutil produced no device)', imagePath: null, mountPoint: null };
+    }
+    runOrEmpty('newfs_hfs', ['-v', 'CEREMONY', device]);
+    if (!existsSync(CEREMONY_MOUNT_POINT))
+        mkdirSync(CEREMONY_MOUNT_POINT, { recursive: true });
+    runOrEmpty('diskutil', ['mount', '-mountPoint', CEREMONY_MOUNT_POINT, device]);
+    return describeDevice(device);
+}
+/** What `hdiutil info` and `mount` currently say about a device. */
+export function describeDevice(device) {
+    let imagePath = null;
+    let current = null;
+    for (const line of runOrEmpty('hdiutil', ['info']).split('\n')) {
+        if (line.startsWith('image-path')) {
+            // `hdiutil info` prints `image-path : ram://131072`, colon and all. An
+            // earlier version kept the colon and the gate refused a perfectly good
+            // RAM volume — failing closed on a parsing bug, which is the right
+            // direction, but still a bug.
+            current = line.replace(/^image-path\s*:?\s*/, '').trim();
+        }
+        else if (refersTo(line, device)) {
+            imagePath = current;
+        }
+    }
+    const mountLine = runOrEmpty('mount', []).split('\n').find((l) => l.startsWith(`${device} on `));
+    const mountPoint = mountLine === undefined
+        ? null
+        : (/^\S+ on (.+?) \(/.exec(mountLine)?.[1] ?? null);
+    return { device, imagePath, mountPoint };
+}
+/**
+ * Unmount and detach, then report whether it worked.
+ *
+ * Reports rather than asserts, for the same reason as above: unmounting does
+ * not destroy a RAM device, and `assertTornDown` is what insists on both.
+ */
+export function destroyRamWorkspace(device) {
+    runOrEmpty('diskutil', ['unmount', CEREMONY_MOUNT_POINT]);
+    runOrEmpty('hdiutil', ['detach', device]);
+    // `null` where the command could not run at all: `assertTornDown` refuses
+    // rather than reading silence as proof the workspace is gone.
+    const mountOut = run('mount', []);
+    const infoOut = run('hdiutil', ['info']);
+    return {
+        device,
+        stillMounted: mountOut === null ? null : mountOut.includes(`${device} on `),
+        stillAttached: infoOut === null
+            ? null
+            : infoOut.split('\n').some((l) => refersTo(l, device)),
+    };
+}
+/**
+ * Every mounted datAshur, with the USB serial that actually identifies it.
+ *
+ * The mapping matters more than it looks: both devices shipped with the same
+ * volume label, so the mount path is not an identity. This walks the IO
+ * registry to pair each BSD disk with the serial of the USB device it hangs
+ * from — the same walk done by hand on 2026-08-25 to tell copy A from copy B.
+ */
+export function listEscrowDevices() {
+    const tree = runOrEmpty('ioreg', ['-p', 'IOService', '-n', 'datAshur PRO2', '-r', '-l', '-w', '0']);
+    // Serial appears above the BSD names of the disks beneath it.
+    const serialByDisk = new Map();
+    let serial = null;
+    for (const line of tree.split('\n')) {
+        const s = /"kUSBSerialNumberString"\s*=\s*"([^"]+)"/.exec(line);
+        if (s?.[1] !== undefined) {
+            serial = s[1];
+            continue;
+        }
+        const b = /"BSD Name"\s*=\s*"(disk\d+)"/.exec(line);
+        if (b?.[1] !== undefined && serial !== null)
+            serialByDisk.set(b[1], serial);
+    }
+    const devices = [];
+    for (const line of runOrEmpty('mount', []).split('\n')) {
+        const m = /^\/dev\/(disk\d+)s\d+ on (.+?) \(/.exec(line);
+        if (m === null)
+            continue;
+        // Neither group is optional, so a successful match guarantees both.
+        const [, whole, mountPoint] = m;
+        if (!mountPoint.startsWith('/Volumes/'))
+            continue;
+        const serialForDisk = serialByDisk.get(whole);
+        if (serialForDisk === undefined)
+            continue; // not a datAshur
+        devices.push({
+            mountPoint,
+            usbSerial: serialForDisk,
+            volumeLabel: mountPoint.slice('/Volumes/'.length),
+        });
+    }
+    return devices;
+}
+/** Is Spotlight indexing this path? Ceremony hygiene, reported not enforced. */
+export function indexingEnabled(path) {
+    const out = run('mdutil', ['-s', path]);
+    if (out === null || out === '')
+        return null;
+    if (/Indexing enabled/i.test(out))
+        return true;
+    if (/Indexing disabled|not (?:supported|eligible)/i.test(out))
+        return false;
+    return null;
+}
+//# sourceMappingURL=system.js.map

package/dist/lib/ceremony/system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.js","sourceRoot":"","sources":["../../../src/lib/ceremony/system.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,sEAAsE;AACtE,2EAA2E;AAC3E,oBAAoB;AACpB,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,wEAAwE;AACxE,mEAAmE;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEhD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGtD;;;;;;;;GAQG;AACH,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,GAAW,EAAE,IAAc;IAC7C,OAAO,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACvF,CAAC;IAED,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,SAAS,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,UAAU,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/E,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,8BAA8B;YAC9B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,SAAS,GAAG,OAAO,CAAC;QACtB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,SAAS,KAAK,SAAS;QACxC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEtD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,UAAU,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC1D,UAAU,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAE1C,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,OAAO;QACL,MAAM;QACN,YAAY,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,MAAM,MAAM,CAAC;QAC3E,aAAa,EAAE,OAAO,KAAK,IAAI;YAC7B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpG,8DAA8D;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACtD,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACzB,oEAAoE;QACpE,MAAM,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAwC,CAAC;QACvE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,SAAS;QAClD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,aAAa,KAAK,SAAS;YAAE,SAAS,CAAG,iBAAiB;QAC9D,OAAO,CAAC,IAAI,CAAC;YACX,UAAU;YACV,SAAS,EAAE,aAAa;YACxB,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/ceremony/workspace.d.ts

@@ -0,0 +1,54 @@
+/** Facts about the workspace device, as reported by the system. */
+export interface DeviceFacts {
+    /** e.g. `/dev/disk32` */
+    device: string;
+    /**
+     * `image-path` from `hdiutil info`. `ram://<sectors>` for a RAM device, a
+     * filesystem path for a disk image, `null` when hdiutil said nothing.
+     */
+    imagePath: string | null;
+    /** Where `mount` says it is, or `null` if it is not mounted. */
+    mountPoint: string | null;
+}
+export interface TeardownFacts {
+    device: string;
+    /**
+     * `null` when it could not be observed at all — `mount` or `hdiutil` failed
+     * rather than reported "no". The distinction is load-bearing: see
+     * `assertTornDown`.
+     */
+    stillMounted: boolean | null;
+    stillAttached: boolean | null;
+}
+/**
+ * Where a ceremony workspace is allowed to live.
+ *
+ * Pinned so teardown can find it and so a workspace cannot be created on top of
+ * an escrow device by a mistyped argument.
+ */
+export declare const CEREMONY_MOUNT_POINT = "/private/tmp/ceremony-ram";
+/**
+ * Refuse to proceed unless the workspace is demonstrably RAM-backed and mounted
+ * where it is supposed to be.
+ *
+ * @throws with the observed facts named, because this aborts a ceremony that
+ *   someone scheduled and possibly travelled for.
+ */
+export declare function assertRamBacked(facts: DeviceFacts): void;
+/**
+ * Refuse to close a ceremony while the workspace still exists.
+ *
+ * Unmounted is not destroyed: the RAM still holds the bytes and anyone can
+ * remount the device. Both facts have to be observed, and both have to be false.
+ *
+ * THE `null` CASE IS WHY THIS WAS REWRITTEN. The first version took plain
+ * booleans, and the fact-gatherer returned `false` both for "I looked and it is
+ * gone" and for "the command failed and I saw nothing". So a `mount` that could
+ * not run — ENOENT, a truncated buffer, a signal — read as proof of teardown,
+ * and the ceremony closed as COMPLETED over a live RAM disk still holding the
+ * bootstrap key. `assertRamBacked` had the opposite, correct policy three
+ * functions up ("absence of evidence is not evidence of RAM"); this one applied
+ * it backwards at the single moment that ends the ceremony.
+ */
+export declare function assertTornDown(facts: TeardownFacts): void;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/lib/ceremony/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../src/lib/ceremony/workspace.ts"],"names":[],"mappings":"AA4BA,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gEAAgE;IAChE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAkCxD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAsBzD"}

package/dist/lib/ceremony/workspace.js

@@ -0,0 +1,98 @@
+// Path: src/lib/ceremony/workspace.ts
+//
+// The scratch volume an escrow ceremony works in, and the proof that it is in
+// RAM rather than on the disk.
+//
+// WHY A GATE AND NOT A CHECK OF THE RETURN CODE. Observed while building this,
+// 2026-08-25:
+//
+//     $ diskutil mount ... /dev/disk34<TAB>       # malformed path
+//     Failed to find disk /dev/disk34
+//     $ head -c 32 /dev/urandom > /private/tmp/ceremony-ram/probe
+//       32 bytes written: OK                      # on the SSD
+//
+// The mount point existed as an ordinary directory, so the write succeeded and
+// nothing complained. Substitute the bootstrap key for random bytes and that is
+// the root of the entire key hierarchy sitting on a general-purpose disk while
+// the operator believes it is in volatile memory — undetectably, because
+// everything downstream keeps working.
+//
+// The proximate cause was mundane (`tr -d ' '` does not strip the TABS that
+// `hdiutil` emits). The lesson is not "use awk". It is that a workspace for key
+// material must PROVE where it lives, from facts the system reports, rather
+// than trust the exit status of the command that created it.
+//
+// HONEST LIMIT: macOS `ram://` is not Linux `tmpfs,noswap`. It is memory, but
+// the system may page it. With FileVault, anything paged is encrypted at rest.
+// This is stated in the ceremony protocol as a residual, not papered over.
+/**
+ * Where a ceremony workspace is allowed to live.
+ *
+ * Pinned so teardown can find it and so a workspace cannot be created on top of
+ * an escrow device by a mistyped argument.
+ */
+export const CEREMONY_MOUNT_POINT = '/private/tmp/ceremony-ram';
+/**
+ * Refuse to proceed unless the workspace is demonstrably RAM-backed and mounted
+ * where it is supposed to be.
+ *
+ * @throws with the observed facts named, because this aborts a ceremony that
+ *   someone scheduled and possibly travelled for.
+ */
+export function assertRamBacked(facts) {
+    if (facts.imagePath === null) {
+        throw new Error(`The backing of ${facts.device} could not be determined — 'hdiutil info' ` +
+            'reported nothing for it. Absence of evidence is not evidence of RAM. ' +
+            'Refusing to place key material here.');
+    }
+    if (!facts.imagePath.startsWith('ram://')) {
+        throw new Error(`${facts.device} is NOT backed by RAM: its image-path is ${facts.imagePath}, ` +
+            'expected something beginning with ram://. A disk image on the SSD mounts ' +
+            'and behaves identically, so image-path is the only thing that tells them ' +
+            'apart. Refusing to place key material here.');
+    }
+    if (facts.mountPoint === null) {
+        throw new Error(`${facts.device} is ram-backed but NOT mounted. This is the dangerous case: ` +
+            `if ${CEREMONY_MOUNT_POINT} exists as an ordinary directory, every write ` +
+            'below succeeds and lands on the SSD, with nothing to indicate it. ' +
+            'Refusing to proceed.');
+    }
+    if (facts.mountPoint !== CEREMONY_MOUNT_POINT) {
+        throw new Error(`Unexpected mount point: the workspace is at ${facts.mountPoint}, not ` +
+            `${CEREMONY_MOUNT_POINT}. The location is pinned so teardown can find it, ` +
+            'and so a mistyped argument cannot turn an escrow device into the workspace.');
+    }
+}
+/**
+ * Refuse to close a ceremony while the workspace still exists.
+ *
+ * Unmounted is not destroyed: the RAM still holds the bytes and anyone can
+ * remount the device. Both facts have to be observed, and both have to be false.
+ *
+ * THE `null` CASE IS WHY THIS WAS REWRITTEN. The first version took plain
+ * booleans, and the fact-gatherer returned `false` both for "I looked and it is
+ * gone" and for "the command failed and I saw nothing". So a `mount` that could
+ * not run — ENOENT, a truncated buffer, a signal — read as proof of teardown,
+ * and the ceremony closed as COMPLETED over a live RAM disk still holding the
+ * bootstrap key. `assertRamBacked` had the opposite, correct policy three
+ * functions up ("absence of evidence is not evidence of RAM"); this one applied
+ * it backwards at the single moment that ends the ceremony.
+ */
+export function assertTornDown(facts) {
+    if (facts.stillMounted === null || facts.stillAttached === null) {
+        throw new Error(`Could not determine whether ${facts.device} is really gone: the system ` +
+            'commands that would have said so did not run. Refusing to record a ' +
+            'teardown that has not been observed — check by hand with ' +
+            `'mount' and 'hdiutil info' before closing the ceremony.`);
+    }
+    if (facts.stillMounted) {
+        throw new Error(`${facts.device} is still mounted. The workspace held key material; the ` +
+            'ceremony is not closed until it is gone.');
+    }
+    if (facts.stillAttached) {
+        throw new Error(`${facts.device} is unmounted but still attached. Unmounting does not ` +
+            'destroy it — the RAM still holds the bytes and the device can be ' +
+            'remounted. Detach it before closing the ceremony.');
+    }
+}
+//# sourceMappingURL=workspace.js.map

package/dist/lib/ceremony/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../src/lib/ceremony/workspace.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,8EAA8E;AAC9E,+BAA+B;AAC/B,EAAE;AACF,+EAA+E;AAC/E,cAAc;AACd,EAAE;AACF,mEAAmE;AACnE,sCAAsC;AACtC,kEAAkE;AAClE,+DAA+D;AAC/D,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,yEAAyE;AACzE,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,4EAA4E;AAC5E,6DAA6D;AAC7D,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AA0B3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,CAAC,MAAM,4CAA4C;YAC1E,uEAAuE;YACvE,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,4CAA4C,KAAK,CAAC,SAAS,IAAI;YAC9E,2EAA2E;YAC3E,2EAA2E;YAC3E,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,8DAA8D;YAC7E,MAAM,oBAAoB,gDAAgD;YAC1E,oEAAoE;YACpE,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,+CAA+C,KAAK,CAAC,UAAU,QAAQ;YACvE,GAAG,oBAAoB,oDAAoD;YAC3E,6EAA6E,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,8BAA8B;YACzE,qEAAqE;YACrE,2DAA2D;YAC3D,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,0DAA0D;YACzE,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,wDAAwD;YACvE,mEAAmE;YACnE,mDAAmD,CACpD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/db/key-lifecycle.d.ts

@@ -0,0 +1,86 @@
+import { BaseDBClient } from './client.js';
+export type CeremonyPhase = 'preflight' | 'workspace' | 'material' | 'write-a' | 'write-b' | 'verify' | 'teardown';
+export interface PhaseEvent {
+    seq: number;
+    phase: string;
+    state: string;
+    at: string;
+    detail: Record<string, unknown> | null;
+}
+export interface LifecycleOperation {
+    operationId: string;
+    kind: string;
+    state: string;
+    phase: string;
+    epoch: number;
+    ownerNodeId: string;
+    ownerPrincipal: string;
+    minRelease: string;
+    startedAt: string;
+    finishedAt: string | null;
+    lastError: string | null;
+}
+export declare class KeyLifecycleOperations extends BaseDBClient {
+    /**
+     * Is the schema present?
+     *
+     * The CLI ships independently of the server, so it can meet a deployment that
+     * predates migration 093. Saying so plainly beats a `relation does not exist`
+     * in the middle of a ceremony.
+     */
+    schemaPresent(): Promise<boolean>;
+    /** The operation currently holding the exclusion slot, if any. */
+    active(): Promise<LifecycleOperation | null>;
+    /**
+     * Start a ceremony, or find out who already holds the slot.
+     *
+     * Does NOT look before it leaps: a "is anything running?" SELECT followed by
+     * an INSERT is exactly the race the index exists to close. The INSERT is the
+     * check, and 23505 is the answer.
+     */
+    claim(input: {
+        phase: CeremonyPhase;
+        ownerNodeId: string;
+        ownerPrincipal: string;
+        minRelease: string;
+        detail?: Record<string, unknown>;
+    }): Promise<{
+        ok: true;
+        operation: LifecycleOperation;
+    } | {
+        ok: false;
+        active: LifecycleOperation | null;
+    }>;
+    /**
+     * Move to the next phase, recording it in the same transaction.
+     *
+     * Compare-and-swap on `epoch`: a caller holding a stale read is refused
+     * rather than silently overwriting whoever moved first.
+     */
+    advance(input: {
+        operationId: string;
+        expectedEpoch: number;
+        phase: CeremonyPhase;
+        nodeId: string;
+        detail?: Record<string, unknown>;
+    }): Promise<LifecycleOperation>;
+    /**
+     * Close the operation, releasing the slot.
+     *
+     * `ABANDONED` is a real transition with a reason rather than a DELETE: why a
+     * ceremony was abandoned is exactly what the next person needs to read, and a
+     * global exclusion with no escape hatch is a deadlock waiting for its first
+     * interrupted ceremony.
+     */
+    finish(input: {
+        operationId: string;
+        expectedEpoch: number;
+        outcome: 'COMPLETED' | 'FAILED' | 'ABANDONED';
+        nodeId: string;
+        error?: string;
+        detail?: Record<string, unknown>;
+    }): Promise<LifecycleOperation>;
+    /** The full route travelled, oldest first. */
+    history(operationId: string): Promise<PhaseEvent[]>;
+}
+//# sourceMappingURL=key-lifecycle.d.ts.map

package/dist/lib/db/key-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/lib/db/key-lifecycle.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,WAAW,GACX,UAAU,GACV,SAAS,GACT,SAAS,GACT,QAAQ,GACR,UAAU,CAAC;AAEf,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAsCD,qBAAa,sBAAuB,SAAQ,YAAY;IACtD;;;;;;OAMG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IAQvC,kEAAkE;IAC5D,MAAM,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASlD;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE;QACjB,KAAK,EAAE,aAAa,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,kBAAkB,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAA;KAAE,CAAC;IAgC3G;;;;;OAKG;IACG,OAAO,CAAC,KAAK,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,aAAa,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAqC/B;;;;;;;OAOG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;QAC9C,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAqC/B,8CAA8C;IACxC,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAU1D"}

package/dist/lib/db/key-lifecycle.js

@@ -0,0 +1,182 @@
+// Path: src/lib/db/key-lifecycle.ts
+//
+// CLI-side access to the durable key-lifecycle state (zn-vault migration 093).
+//
+// WHY THE CEREMONY WRITES HERE AND NOT TO A LOG FILE. The owner's requirement
+// was that a ceremony leave a record of who ran it, when, and how far it got —
+// the thing a shell script cannot give you, because a script that dies leaves
+// nothing and a script that is edited leaves no trace of the edit.
+//
+// `key_lifecycle_operations` gives all three, and two more that matter:
+//
+//   EXCLUSION IS IN THE DATABASE. A partial unique index means a second
+//   ceremony — or a ceremony during an LMK rotation — is refused by PostgreSQL,
+//   not by an `if` that both processes evaluate to false at the same instant.
+//
+//   THE HISTORY CANNOT BE REWRITTEN. `key_lifecycle_phase_events` is
+//   append-only by trigger and is written in the SAME transaction as the state
+//   change, so a ceremony that dies at phase 5 still shows how it reached
+//   phase 5.
+//
+// PORT NOTICE. The server has a richer repository for these tables
+// (`zn-vault/src/db/repo.key-lifecycle.ts`) with compare-and-swap on `epoch`.
+// This package ships to npm on its own and cannot import it. The contract is
+// the SCHEMA, pinned by the migration — not this file and not that one. What is
+// duplicated here is deliberately the minimum: claim, advance, finish, read.
+import { BaseDBClient } from './client.js';
+const COLUMNS = `operation_id, kind, state, phase, epoch, owner_node_id,
+  owner_principal, min_release, started_at, finished_at, last_error`;
+const PG_UNIQUE_VIOLATION = '23505';
+function toOperation(r) {
+    return {
+        operationId: r.operation_id,
+        kind: r.kind,
+        state: r.state,
+        phase: r.phase,
+        // BIGINT arrives as a string from some drivers, a number from others.
+        epoch: Number(r.epoch),
+        ownerNodeId: r.owner_node_id,
+        ownerPrincipal: r.owner_principal,
+        minRelease: r.min_release,
+        startedAt: r.started_at,
+        finishedAt: r.finished_at,
+        lastError: r.last_error,
+    };
+}
+export class KeyLifecycleOperations extends BaseDBClient {
+    /**
+     * Is the schema present?
+     *
+     * The CLI ships independently of the server, so it can meet a deployment that
+     * predates migration 093. Saying so plainly beats a `relation does not exist`
+     * in the middle of a ceremony.
+     */
+    async schemaPresent() {
+        await this.connect();
+        const r = await this.getRawClient().query(`SELECT to_regclass('public.key_lifecycle_operations')::text AS present`);
+        return (r.rows[0]?.present ?? null) !== null;
+    }
+    /** The operation currently holding the exclusion slot, if any. */
+    async active() {
+        await this.connect();
+        const r = await this.getRawClient().query(`SELECT ${COLUMNS} FROM key_lifecycle_operations WHERE state = 'IN_PROGRESS' LIMIT 1`);
+        const row = r.rows.at(0);
+        return row === undefined ? null : toOperation(row);
+    }
+    /**
+     * Start a ceremony, or find out who already holds the slot.
+     *
+     * Does NOT look before it leaps: a "is anything running?" SELECT followed by
+     * an INSERT is exactly the race the index exists to close. The INSERT is the
+     * check, and 23505 is the answer.
+     */
+    async claim(input) {
+        await this.connect();
+        const c = this.getRawClient();
+        try {
+            await c.query('BEGIN');
+            const r = await c.query(`INSERT INTO key_lifecycle_operations
+           (kind, state, phase, epoch, owner_node_id, owner_principal, min_release)
+         VALUES ('ESCROW_SNAPSHOT', 'IN_PROGRESS', $1, 0, $2, $3, $4)
+         RETURNING ${COLUMNS}`, [input.phase, input.ownerNodeId, input.ownerPrincipal, input.minRelease]);
+            const row = r.rows.at(0);
+            if (row === undefined)
+                throw new Error('claim: INSERT ... RETURNING produced no row');
+            // Same transaction: an operation whose history starts one commit late is
+            // an operation whose first phase can vanish.
+            await c.query(`INSERT INTO key_lifecycle_phase_events
+           (operation_id, seq, phase, state, node_id, detail)
+         VALUES ($1, 0, $2, 'IN_PROGRESS', $3, $4)`, [row.operation_id, input.phase, input.ownerNodeId,
+                input.detail ? JSON.stringify(input.detail) : null]);
+            await c.query('COMMIT');
+            return { ok: true, operation: toOperation(row) };
+        }
+        catch (error) {
+            await c.query('ROLLBACK').catch(() => undefined);
+            if (error.code !== PG_UNIQUE_VIOLATION)
+                throw error;
+            return { ok: false, active: await this.active() };
+        }
+    }
+    /**
+     * Move to the next phase, recording it in the same transaction.
+     *
+     * Compare-and-swap on `epoch`: a caller holding a stale read is refused
+     * rather than silently overwriting whoever moved first.
+     */
+    async advance(input) {
+        await this.connect();
+        const c = this.getRawClient();
+        const next = input.expectedEpoch + 1;
+        try {
+            await c.query('BEGIN');
+            const r = await c.query(`UPDATE key_lifecycle_operations
+            SET phase = $1, epoch = $2, updated_at = now()
+          WHERE operation_id = $3 AND epoch = $4 AND state = 'IN_PROGRESS'
+        RETURNING ${COLUMNS}`, [input.phase, next, input.operationId, input.expectedEpoch]);
+            const row = r.rows.at(0);
+            if (row === undefined) {
+                await c.query('ROLLBACK');
+                throw new Error(`Could not advance operation ${input.operationId} to '${input.phase}': it is ` +
+                    'no longer IN_PROGRESS at the expected epoch. Someone or something else ' +
+                    "moved it. Run 'ceremony status' before deciding what to do.");
+            }
+            await c.query(`INSERT INTO key_lifecycle_phase_events
+           (operation_id, seq, phase, state, node_id, detail)
+         VALUES ($1, $2, $3, 'IN_PROGRESS', $4, $5)`, [input.operationId, next, input.phase, input.nodeId,
+                input.detail ? JSON.stringify(input.detail) : null]);
+            await c.query('COMMIT');
+            return toOperation(row);
+        }
+        catch (error) {
+            await c.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+    }
+    /**
+     * Close the operation, releasing the slot.
+     *
+     * `ABANDONED` is a real transition with a reason rather than a DELETE: why a
+     * ceremony was abandoned is exactly what the next person needs to read, and a
+     * global exclusion with no escape hatch is a deadlock waiting for its first
+     * interrupted ceremony.
+     */
+    async finish(input) {
+        await this.connect();
+        const c = this.getRawClient();
+        const next = input.expectedEpoch + 1;
+        try {
+            await c.query('BEGIN');
+            const r = await c.query(`UPDATE key_lifecycle_operations
+            SET state = $1, epoch = $2, last_error = COALESCE($3, last_error),
+                updated_at = now(), finished_at = now()
+          WHERE operation_id = $4 AND epoch = $5 AND state = 'IN_PROGRESS'
+        RETURNING ${COLUMNS}`, [input.outcome, next, input.error ?? null, input.operationId, input.expectedEpoch]);
+            const row = r.rows.at(0);
+            if (row === undefined) {
+                await c.query('ROLLBACK');
+                throw new Error(`Could not close operation ${input.operationId}: it is no longer IN_PROGRESS ` +
+                    'at the expected epoch.');
+            }
+            await c.query(`INSERT INTO key_lifecycle_phase_events
+           (operation_id, seq, phase, state, node_id, detail)
+         VALUES ($1, $2, $3, $4, $5, $6)`, [input.operationId, next, row.phase, input.outcome, input.nodeId,
+                input.detail ? JSON.stringify(input.detail) : null]);
+            await c.query('COMMIT');
+            return toOperation(row);
+        }
+        catch (error) {
+            await c.query('ROLLBACK').catch(() => undefined);
+            throw error;
+        }
+    }
+    /** The full route travelled, oldest first. */
+    async history(operationId) {
+        await this.connect();
+        const r = await this.getRawClient().query(`SELECT seq, phase, state, at::text AS at, detail
+         FROM key_lifecycle_phase_events
+        WHERE operation_id = $1 ORDER BY seq ASC`, [operationId]);
+        return r.rows;
+    }
+}
+//# sourceMappingURL=key-lifecycle.js.map

package/dist/lib/db/key-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-lifecycle.js","sourceRoot":"","sources":["../../../src/lib/db/key-lifecycle.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,mEAAmE;AACnE,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,gFAAgF;AAChF,8EAA8E;AAC9E,EAAE;AACF,qEAAqE;AACrE,+EAA+E;AAC/E,0EAA0E;AAC1E,aAAa;AACb,EAAE;AACF,mEAAmE;AACnE,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA+C3C,MAAM,OAAO,GAAG;oEACoD,CAAC;AAErE,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,SAAS,WAAW,CAAC,CAAe;IAClC,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,sEAAsE;QACtE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACtB,WAAW,EAAE,CAAC,CAAC,aAAa;QAC5B,cAAc,EAAE,CAAC,CAAC,eAAe;QACjC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACtD;;;;;;OAMG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CACvC,wEAAwE,CACzE,CAAC;QACF,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;IAC/C,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CACvC,UAAU,OAAO,oEAAoE,CACtF,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,KAMX;QACC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CACrB;;;qBAGa,OAAO,EAAE,EACtB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,CACzE,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACtF,yEAAyE;YACzE,6CAA6C;YAC7C,MAAM,CAAC,CAAC,KAAK,CACX;;mDAE2C,EAC3C,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW;gBAChD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACrD,CAAC;YACF,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjD,IAAK,KAA2B,CAAC,IAAI,KAAK,mBAAmB;gBAAE,MAAM,KAAK,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,KAMb;QACC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CACrB;;;oBAGY,OAAO,EAAE,EACrB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CAC5D,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,WAAW,QAAQ,KAAK,CAAC,KAAK,WAAW;oBAC9E,yEAAyE;oBACzE,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,CACX;;oDAE4C,EAC5C,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM;gBAClD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACrD,CAAC;YACF,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,KAOZ;QACC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CACrB;;;;oBAIY,OAAO,EAAE,EACrB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,aAAa,CAAC,CACnF,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,CAAC,WAAW,gCAAgC;oBAC9E,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,CACX;;yCAEiC,EACjC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM;gBAC/D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACrD,CAAC;YACF,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,OAAO,CAAC,WAAmB;QAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CACvC;;iDAE2C,EAC3C,CAAC,WAAW,CAAC,CACd,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC;IAChB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zincapp/znvault-cli",
-  "version": "4.23.0",
+  "version": "4.24.1",
   "description": "Official CLI for ZnVault administration",
   "type": "module",
   "main": "dist/index.js",