pinecall 0.4.0 → 0.5.0

package/dist/cli/config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,uGAAuG;AAEvG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAY,UAAU,EAAyD,MAAM,eAAe,CAAC;AAO5G,eAAO,MAAM,KAAK,EAAE,KAwBnB,CAAC;AAEF,8FAA8F;AAC9F,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,mFAAmF;AACnF,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,OAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ5E;AAED,6EAA6E;AAC7E,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,OAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAO5E;AAsFD,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/cli/config.js

@@ -1,125 +0,0 @@
-/** `pinecall config` and `pinecall use`: the gateways this machine knows, and which one is in hand. */
-import { activate, activeName, forget, inWorld, readConfig } from "./profiles.js";
-const USAGE = `usage: pinecall config              the gateways this machine knows
-       pinecall config rm <name>    forget one
-       pinecall use <org>           the org the next verb goes to
-       pinecall use <org> <world>   and the world: sandbox, or production`;
-export const group = {
-    purpose: "the gateways this machine knows, and which one the next verb goes to",
-    usage: `${USAGE}
-
-  One file — ~/.pinecall/config.json — holds them, and \`pinecall login\` writes one per ORG you
-  belong to, named after the org, with your key in both of its worlds (\`--as <name>\` and a
-  machine's key keep ONE profile, holding the key in hand). Nothing is exported, and there is no
-  order of precedence to remember: the profile with the ▸ is the one every verb uses until
-  \`pinecall use\` moves it, and \`--profile <name>\` on any one verb sends that command elsewhere.
-
-  It prints no key. What a listing may say about one is that it is there, and its fingerprint is
-  the Keys screen's business — not a prefix, not a hint. The org and the world beside each name
-  are what the login wrote down from \`whoami\`, kept as a label so this list reads without a
-  network; "sandbox (and production)" is a profile holding both worlds' keys.
-
-  \`use <org> <world>\` is a line in this file and never a trip to the gateway; a profile with no
-  key for that world is refused, and \`pinecall login\` again keeps both.
-
-  \`config rm\` takes a row out — a gateway that has moved, a key that was revoked — and the ▸ with
-  it when it was the active one. It keeps the gateway this machine is pointed at (\`pinecall
-  gateway\`), and forgets nothing else: the key itself is stopped from the Keys screen, and a row
-  left behind is a key somebody will trust tomorrow and a refusal they will read as the gateway's
-  fault.`,
-    run,
-};
-/** `config` with nothing after it prints them all; `use <name>` moves the mark. */
-export async function run(argv, how = {}) {
-    const out = how.out ?? process.stdout;
-    const err = how.err ?? process.stderr;
-    const [named, ...rest] = argv;
-    if (named === undefined)
-        return listed(out, how.home);
-    if (named === "rm")
-        return dropped(rest[0], out, err, how.home);
-    if (rest[0] !== undefined)
-        return moved(named, rest[0], out, err, how.home);
-    return chosen(named, out, err, how.home);
-}
-/** The same verb under the name a person reaches for: `pinecall use box`. */
-export async function use(argv, how = {}) {
-    const [named] = argv;
-    if (named === undefined) {
-        (how.err ?? process.stderr).write(`${USAGE}\n`);
-        return 2;
-    }
-    return await run(argv, how);
-}
-function listed(out, home) {
-    const config = readConfig(home);
-    const names = Object.keys(config.profiles).sort();
-    if (names.length === 0) {
-        out.write("no gateway yet: `pinecall login`\n");
-        return 0;
-    }
-    const rows = names.map((name) => [
-        name === config.active ? `▸ ${name}` : `  ${name}`,
-        config.profiles[name].url,
-        said(config.profiles[name]),
-    ]);
-    for (const line of asColumns(rows))
-        out.write(`${line}\n`);
-    return 0;
-}
-function dropped(name, out, err, home) {
-    if (name === undefined) {
-        err.write(`${USAGE}\n`);
-        return 2;
-    }
-    if (forget(name, home)) {
-        out.write(`forgot ${name}\n`);
-        return 0;
-    }
-    return noSuchProfile(name, err, home);
-}
-function chosen(name, out, err, home) {
-    if (activate(name, home)) {
-        out.write(`▸ ${name}\n`);
-        return 0;
-    }
-    return noSuchProfile(name, err, home);
-}
-// One login keeps both worlds' keys, so this is a line in a file and never a trip to the gateway.
-function moved(name, world, out, err, home) {
-    if (world !== "sandbox" && world !== "production") {
-        err.write(`a world is sandbox or production, not ${world}\n`);
-        return 2;
-    }
-    const answer = inWorld(name, world, home);
-    if (answer === "unknown")
-        return noSuchProfile(name, err, home);
-    if (answer === "nokey") {
-        err.write(`${name} holds no ${world} key: \`pinecall login\` again keeps both worlds\n`);
-        return 2;
-    }
-    out.write(`▸ ${name} · ${world}\n`);
-    if (world === "production")
-        out.write("  you look at production from here; what answers its numbers is the box's own key\n");
-    return 0;
-}
-/** The one refusal both `use` and `rm` give, naming what this machine does know. */
-function noSuchProfile(name, err, home) {
-    const known = Object.keys(readConfig(home).profiles).sort();
-    const has = known.length === 0 ? "none yet: `pinecall login`" : known.join(" · ");
-    err.write(`no profile called ${name}: ${has}\n`);
-    return 2;
-}
-/** Whose org and which world, as the gateway last said them. A label, never a check. */
-function said(profile) {
-    const other = profile.env === "production" ? "sandbox" : "production";
-    const world = profile.env !== undefined && profile.keys?.[other] !== undefined ? `${profile.env} (and ${other})` : profile.env;
-    return [profile.org, world].filter((word) => word !== undefined).join(" · ");
-}
-/** Every column as wide as its widest value: nothing is cut to make a table line up. */
-function asColumns(rows) {
-    const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length)));
-    return rows.map((row) => row.map((value, column) => (value ?? "").padEnd(widths[column])).join("  ").trimEnd());
-}
-export { activeName };
-//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,uGAAuG;AAGvG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAA4B,MAAM,eAAe,CAAC;AAE5G,MAAM,KAAK,GAAG;;;0EAG4D,CAAC;AAE3E,MAAM,CAAC,MAAM,KAAK,GAAU;IAC1B,OAAO,EAAE,sEAAsE;IAC/E,KAAK,EAAE,GAAG,KAAK;;;;;;;;;;;;;;;;;;;;SAoBR;IACP,GAAG;CACJ,CAAC;AASF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAG,GAAY,EAAE;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAG,GAAY,EAAE;IACzD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,MAAM,CAAC,GAA0B,EAAE,IAAwB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/B,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE;QAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC,GAAG;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC;KAC7B,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CACd,IAAwB,EACxB,GAA0B,EAC1B,GAA0B,EAC1B,IAAwB;IAExB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CACb,IAAY,EACZ,GAA0B,EAC1B,GAA0B,EAC1B,IAAwB;IAExB,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,kGAAkG;AAClG,SAAS,KAAK,CAAC,IAAY,EAAE,KAAa,EAAE,GAA0B,EAAE,GAA0B,EAAE,IAAwB;IAC1H,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAClD,GAAG,CAAC,KAAK,CAAC,yCAAyC,KAAK,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,KAAc,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,aAAa,KAAK,oDAAoD,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,YAAY;QAAE,GAAG,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC7H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,IAAY,EAAE,GAA0B,EAAE,IAAwB;IACvF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClF,GAAG,CAAC,KAAK,CAAC,qBAAqB,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wFAAwF;AACxF,SAAS,IAAI,CAAC,OAAgB;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC/H,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,IAAgB;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/cli/credentials.d.ts

@@ -1,41 +0,0 @@
-/** ~/.pinecall: the keys this machine keeps — the gateways it logged in to, and the local one. */
-/** The directory both files live in: ~/.pinecall, or the one PINECALL_HOME names instead. */
-export declare function pinecallHome(env?: NodeJS.ProcessEnv): string;
-/** One gateway this machine has logged in to: the key, the org it opened, and when it was kept. */
-export interface GatewayEntry {
-    api_key: string;
-    org: string;
-    logged_in_at: string;
-    /** The phone this person calls FROM, so a ring in the sandbox reaches their own agent rather
-     * than whoever holds the line. Said once with `pinecall line from`, and re-sent by every
-     * `pinecall run` — the gateway keeps it beside its live table, not in a row. */
-    calling?: string;
-}
-/**
- * The credentials file as it is on disk.
- *
- * `api_key` is v1's own field — one key, no URL — and it is still read by the v1 CLI on this same
- * machine. Nothing here writes over it: a login adds a row under `gateways` and leaves the rest of
- * the file exactly as it found it.
- */
-export interface Credentials {
-    api_key?: string;
-    gateways: Record<string, GatewayEntry>;
-}
-/** The whole file. A missing one, an unreadable one and a broken one are all an empty table. */
-export declare function readCredentials(home?: string): Credentials;
-/** One gateway's row, by the URL as `normalised` writes it. Nothing logged in is nothing here. */
-export declare function gatewayFor(url: string, home?: string): GatewayEntry | undefined;
-/** Keep one gateway's key, the rest of the file untouched, and the file readable by nobody else. */
-export declare function writeGateway(url: string, entry: Omit<GatewayEntry, "logged_in_at">, home?: string): void;
-/**
- * Remember which phone this person calls from, on the row for this gateway.
- *
- * A row only, never a login: `line from` is said by somebody already logged in, and rewriting the
- * key here would be a second place that decides what the key is. Nothing happens for a gateway
- * with no row — you cannot say which phone is yours at a gateway you have not signed in to.
- */
-export declare function writeCalling(url: string, calling: string | undefined, home?: string): boolean;
-/** The URL as a key in the table: lowercase scheme and host, and no trailing slash. */
-export declare function normalised(url: string): string;
-//# sourceMappingURL=credentials.d.ts.map

package/dist/cli/credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAgBlG,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAED,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB;;oFAEgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACxC;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAuB,GAAG,WAAW,CAO1E;AAED,kGAAkG;AAClG,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,MAAuB,GAAG,YAAY,GAAG,SAAS,CAE/F;AAED,oGAAoG;AACpG,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EACzC,IAAI,GAAE,MAAuB,GAC5B,IAAI,CASN;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,GAAE,MAAuB,GAAG,OAAO,CAW7G;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO9C"}

package/dist/cli/credentials.js

@@ -1,98 +0,0 @@
-/** ~/.pinecall: the keys this machine keeps — the gateways it logged in to, and the local one. */
-import { chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { homedir, userInfo } from "node:os";
-import { join } from "node:path";
-// The directory is a person's, not a machine's: 0700 so another account on the same box cannot
-// list it, and 0600 on every file so it cannot read one whose name it guessed.
-const DIRECTORY_MODE = 0o700;
-const FILE_MODE = 0o600;
-// Every bit outside the owner's. A file that has one of them is readable by somebody else, and a
-// key somebody else can read is not a key we are willing to send anywhere.
-const OTHERS = 0o077;
-const CREDENTIALS = "credentials";
-/** The directory both files live in: ~/.pinecall, or the one PINECALL_HOME names instead. */
-export function pinecallHome(env = process.env) {
-    return env["PINECALL_HOME"] ?? join(homedir(), ".pinecall");
-}
-/** The whole file. A missing one, an unreadable one and a broken one are all an empty table. */
-export function readCredentials(home = pinecallHome()) {
-    const read = parsed(join(home, CREDENTIALS));
-    if (read === undefined)
-        return { gateways: {} };
-    const gateways = read["gateways"];
-    const kept = { gateways: isTable(gateways) ? gateways : {} };
-    if (typeof read["api_key"] === "string")
-        kept.api_key = read["api_key"];
-    return kept;
-}
-/** One gateway's row, by the URL as `normalised` writes it. Nothing logged in is nothing here. */
-export function gatewayFor(url, home = pinecallHome()) {
-    return readCredentials(home).gateways[normalised(url)];
-}
-/** Keep one gateway's key, the rest of the file untouched, and the file readable by nobody else. */
-export function writeGateway(url, entry, home = pinecallHome()) {
-    const kept = readCredentials(home);
-    kept.gateways[normalised(url)] = { ...entry, logged_in_at: new Date().toISOString() };
-    mkdirSync(home, { recursive: true, mode: DIRECTORY_MODE });
-    const path = join(home, CREDENTIALS);
-    writeFileSync(path, `${JSON.stringify(kept, null, 2)}\n`, { mode: FILE_MODE });
-    // writeFileSync's mode applies only when it creates the file, so a file that was already there
-    // keeps whatever mode it had — including one an editor widened.
-    chmodSync(path, FILE_MODE);
-}
-/**
- * Remember which phone this person calls from, on the row for this gateway.
- *
- * A row only, never a login: `line from` is said by somebody already logged in, and rewriting the
- * key here would be a second place that decides what the key is. Nothing happens for a gateway
- * with no row — you cannot say which phone is yours at a gateway you have not signed in to.
- */
-export function writeCalling(url, calling, home = pinecallHome()) {
-    const kept = readCredentials(home);
-    const row = kept.gateways[normalised(url)];
-    if (row === undefined)
-        return false;
-    kept.gateways[normalised(url)] = { ...row, ...(calling === undefined ? {} : { calling }) };
-    if (calling === undefined)
-        delete kept.gateways[normalised(url)]?.calling;
-    mkdirSync(home, { recursive: true, mode: DIRECTORY_MODE });
-    const path = join(home, CREDENTIALS);
-    writeFileSync(path, `${JSON.stringify(kept, null, 2)}\n`, { mode: FILE_MODE });
-    chmodSync(path, FILE_MODE);
-    return true;
-}
-/** The URL as a key in the table: lowercase scheme and host, and no trailing slash. */
-export function normalised(url) {
-    try {
-        const parsedUrl = new URL(url);
-        return `${parsedUrl.origin}${parsedUrl.pathname}`.replace(/\/+$/, "");
-    }
-    catch {
-        return url.replace(/\/+$/, "");
-    }
-}
-// One JSON object off disk, or nothing: a file that is not there, cannot be read or does not parse
-// are the same answer to every caller here, and none of them is worth an exception.
-function parsed(path) {
-    try {
-        const read = JSON.parse(readFileSync(path, "utf8"));
-        return isTable(read) ? read : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-// Owned by this account and readable by nobody else.
-function ours(path) {
-    try {
-        const about = statSync(path);
-        return about.uid === userInfo().uid && (about.mode & OTHERS) === 0;
-    }
-    catch {
-        return false;
-    }
-}
-function isTable(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-//# sourceMappingURL=credentials.js.map

package/dist/cli/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/cli/credentials.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,+FAA+F;AAC/F,+EAA+E;AAC/E,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,iGAAiG;AACjG,2EAA2E;AAC3E,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/D,OAAO,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAyBD,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,IAAI,GAAW,YAAY,EAAE;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,IAAI,GAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAyC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5G,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAI,GAAW,YAAY,EAAE;IACnE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,KAAyC,EACzC,IAAI,GAAW,YAAY,EAAE;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACtF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,+FAA+F;IAC/F,gEAAgE;IAChE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAA2B,EAAE,IAAI,GAAW,YAAY,EAAE;IAClG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC3F,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;IAC1E,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,oFAAoF;AACpF,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,IAAI,CAAC,IAAY;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli/gateway.d.ts

@@ -1,12 +0,0 @@
-/** `pinecall gateway [url]`: which gateway this machine talks to, and pointing it at another one. */
-import type { Group } from "./groups.js";
-export declare const group: Group;
-/** What the verb can be told besides the argv. Tests only: where to print, and which home. */
-export interface Pointing {
-    out?: NodeJS.WritableStream;
-    err?: NodeJS.WritableStream;
-    home?: string;
-}
-/** With nothing after it, where this machine is pointed; with a URL, point it there. */
-export declare function run(argv: string[], how?: Pointing): number;
-//# sourceMappingURL=gateway.d.ts.map

package/dist/cli/gateway.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/cli/gateway.ts"],"names":[],"mappings":"AAAA,qGAAqG;AAGrG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAMzC,eAAO,MAAM,KAAK,EAAE,KAkBnB,CAAC;AAEF,8FAA8F;AAC9F,MAAM,WAAW,QAAQ;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,QAAa,GAAG,MAAM,CAmB9D"}

package/dist/cli/gateway.js

@@ -1,67 +0,0 @@
-/** `pinecall gateway [url]`: which gateway this machine talks to, and pointing it at another one. */
-import { CLOUD_URL } from "./env.js";
-import { chooseGateway, chosenGateway, nameFor, readConfig } from "./profiles.js";
-const USAGE = `usage: pinecall gateway              where this machine is pointed
-       pinecall gateway <url>        point it at your own box, then \`pinecall login\``;
-export const group = {
-    purpose: "which gateway this machine talks to, and pointing it at another",
-    usage: `${USAGE}
-
-  Every verb goes to ${CLOUD_URL} until this says otherwise, so a person who is on the cloud
-  types \`pinecall login\` and nothing else — no URL to remember, no URL to mistype.
-
-  Somebody running their own box says so ONCE, here, and every verb that runs before this machine
-  holds a key goes there: the login and the refusal a verb prints when it has no key.
-  It is remembered as \`gateway\` in ~/.pinecall/config.json, beside the profiles; \`pinecall gateway\`
-  with nothing after it prints which, and \`pinecall config rm\` leaves it alone. An address with
-  no scheme is read as https, and only the origin is kept. A URL typed on \`pinecall login <url>\`
-  still wins, for that one command.
-
-  Once a login has kept a profile, every verb goes where the ACTIVE profile points — an org you
-  are signed in to is a profile, \`pinecall use <org>\` moves between them, and this verb is not
-  what you want. This one is for the gateway you have not signed in to yet.`,
-    run,
-};
-/** With nothing after it, where this machine is pointed; with a URL, point it there. */
-export function run(argv, how = {}) {
-    const out = how.out ?? process.stdout;
-    const err = how.err ?? process.stderr;
-    const [named, ...rest] = argv;
-    if (rest.length > 0) {
-        err.write(`${USAGE}\n`);
-        return 2;
-    }
-    if (named === undefined)
-        return said(out, how.home);
-    const url = asAUrl(named);
-    if (url === null) {
-        err.write(`not a gateway URL: ${named} — it is the address of a box, like https://voz.clinica.com\n`);
-        return 2;
-    }
-    chooseGateway(url, how.home);
-    const known = readConfig(how.home).profiles[nameFor(url, readConfig(how.home))] !== undefined;
-    out.write(`▸ ${url}\n`);
-    out.write(known ? "  signed in already: `pinecall use <org>` moves between them\n" : "  `pinecall login` signs this machine in there\n");
-    return 0;
-}
-// Where the next verb goes, and where that answer came from: a person debugging a refusal reads
-// this line first, and a "default" that looks chosen is how an hour goes missing.
-function said(out, home) {
-    const chosen = chosenGateway(home);
-    out.write(chosen === undefined ? `▸ ${CLOUD_URL}   (the default)\n` : `▸ ${chosen}   (this machine's own)\n`);
-    return 0;
-}
-/** A URL a gateway could live at, or null. An address with no scheme is read as https. */
-function asAUrl(said) {
-    const text = /^[a-z][a-z0-9+.-]*:\/\//i.test(said) ? said : `https://${said}`;
-    try {
-        const url = new URL(text);
-        if (url.protocol !== "http:" && url.protocol !== "https:")
-            return null;
-        return url.origin;
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=gateway.js.map

package/dist/cli/gateway.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/cli/gateway.ts"],"names":[],"mappings":"AAAA,qGAAqG;AAErG,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAElF,MAAM,KAAK,GAAG;uFACyE,CAAC;AAExF,MAAM,CAAC,MAAM,KAAK,GAAU;IAC1B,OAAO,EAAE,iEAAiE;IAC1E,KAAK,EAAE,GAAG,KAAK;;uBAEM,SAAS;;;;;;;;;;;;4EAY4C;IAC1E,GAAG;CACJ,CAAC;AASF,wFAAwF;AACxF,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,GAAG,GAAa,EAAE;IACpD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,sBAAsB,KAAK,+DAA+D,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;IAC9F,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC;IACzI,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gGAAgG;AAChG,kFAAkF;AAClF,SAAS,IAAI,CAAC,GAA0B,EAAE,IAAwB;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,oBAAoB,CAAC,CAAC,CAAC,KAAK,MAAM,2BAA2B,CAAC,CAAC;IAC9G,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0FAA0F;AAC1F,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cli/keys.d.ts

@@ -1,28 +0,0 @@
-/** `pinecall keys issue | list | revoke`: the API keys this org's machines run on, shown once. */
-import type { Group } from "./groups.js";
-export declare const group: Group;
-/** What the verb can be told besides the argv: where to print, and which environment. */
-export interface Issuing {
-    out?: NodeJS.WritableStream;
-    err?: NodeJS.WritableStream;
-    env?: NodeJS.ProcessEnv;
-}
-/** One row of the listing, as the gateway answers it: the fingerprint, and never the key. */
-interface Listed {
-    fingerprint: string;
-    label: string | null;
-    env: string;
-    scopes: string[];
-    subject: string | null;
-    name: string | null;
-    created_at: string;
-    revoked_at: string | null;
-}
-/** Read the sub-verb and do it: one key minted, the org's keys listed, or one stopped. */
-export declare function run(argv: string[], how?: Issuing): Promise<number>;
-/** The fingerprint as the listing prints it: enough to tell two keys apart, short enough to read. */
-export declare function shortened(fingerprint: string): string;
-/** One row as a terminal reads it: what it is, where it opens, whose it is, and its standing. */
-export declare function aLine(row: Listed): string;
-export {};
-//# sourceMappingURL=keys.d.ts.map

package/dist/cli/keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/cli/keys.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAKlG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAsBzC,eAAO,MAAM,KAAK,EAAE,KAkBnB,CAAC;AAEF,yFAAyF;AACzF,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,6FAA6F;AAC7F,UAAU,MAAM;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAWD,0FAA0F;AAC1F,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,OAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB5E;AA8ED,qGAAqG;AACrG,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAErD;AAID,iGAAiG;AACjG,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIzC"}

package/dist/cli/keys.js

@@ -1,137 +0,0 @@
-/** `pinecall keys issue | list | revoke`: the API keys this org's machines run on, shown once. */
-import { parseArgs } from "node:util";
-import { theDoor } from "./env.js";
-import { asked } from "./testing/gateway.js";
-import { refusal } from "./whoami.js";
-const USAGE = `usage: pinecall keys issue --label "<what it is for>" [--env production|sandbox] [--scope <scope>]…
-       pinecall keys list
-       pinecall keys revoke <fingerprint>`;
-// The doors, on this terminal's own key. An org issues its own: the operator's /v1/ops/orgs door
-// is the box's way in and a tenant never holds its key. runtime docs/protocol/gateway-api.md §7.
-const KEYS = "/v1/keys";
-// The one sentence that matters here. It is printed under every key issued, because the table
-// keeps the sha256 and no door, here or anywhere, reads one back.
-const PRINTED_ONCE = "copy it now: the gateway keeps the fingerprint, and the key is never shown again";
-// What a key with no label is in the listing. The column is still a column.
-const NO_LABEL = "—";
-const REVOKED = "revoked";
-const LIVE = "live";
-export const group = {
-    purpose: "issue | list | revoke the API keys this org's machines run on",
-    usage: `${USAGE}
-
-  A key issued here is a MACHINE's: a server, a CI job, a box. It names nobody — people get
-  keys by logging in — and it holds \`app\` in production unless --scope says otherwise, which
-  is the shape a deployment has. Your own key does not hold \`app\` in production: a deployed
-  agent is held by the process somebody put on a box, not by whoever is logged in.
-
-  So this is the last step before a deploy: issue one, put it in the box's environment as
-  \`pinecall login --key-stdin\`, and that \`pinecall run\` is the one that answers your numbers.
-
-  issue prints the key once and never again. list prints fingerprints, labels, worlds, whose
-  each is and whether it is revoked — never a key. revoke takes a fingerprint as list prints it:
-  the first twelve characters, or more of them when two keys share those. The row and its history
-  stay, so the calls it wrote stay readable. A key may not issue a scope
-  it does not itself open.`,
-    run,
-};
-/** Read the sub-verb and do it: one key minted, the org's keys listed, or one stopped. */
-export async function run(argv, how = {}) {
-    const out = how.out ?? process.stdout;
-    const err = how.err ?? process.stderr;
-    const verb = argv[0];
-    const door = theDoor(how.env ?? process.env, err);
-    if (door === undefined)
-        return 1;
-    try {
-        if (verb === "issue")
-            return await issue(argv.slice(1), door, out, err);
-        if (verb === "list")
-            return await list(door, out);
-        if (verb === "revoke")
-            return await revoke(argv[1], door, out, err);
-    }
-    catch (refused) {
-        err.write(`${refusal(refused)}\n`);
-        return 1;
-    }
-    err.write(`${USAGE}\n`);
-    return 2;
-}
-/** Mint one, print it once, and say what it opens — so the next paste is into the right box. */
-async function issue(argv, door, out, err) {
-    const { values } = parseArgs({
-        args: argv,
-        options: {
-            label: { type: "string" },
-            env: { type: "string" },
-            scope: { type: "string", multiple: true },
-        },
-    });
-    if (values.label === undefined) {
-        err.write(`${USAGE}\n`);
-        err.write("missing: --label, because a key you can tell apart is a key you will revoke\n");
-        return 2;
-    }
-    const body = { label: values.label };
-    if (values.env !== undefined)
-        body["env"] = values.env;
-    if (values.scope !== undefined)
-        body["scopes"] = values.scope;
-    const made = await asked(door, KEYS, { method: "POST", body });
-    out.write(`${made.key}\n`);
-    out.write(`  ${made.env} · ${made.label ?? NO_LABEL} · ${made.scopes.join(" · ")}\n`);
-    out.write(`  ${PRINTED_ONCE}\n`);
-    return 0;
-}
-/** Every key of the org, oldest first, as fingerprints — the word `revoke` takes. */
-async function list(door, out) {
-    const rows = await asked(door, KEYS);
-    if (rows.length === 0) {
-        out.write("no key of this org: `pinecall keys issue --label \"…\"` mints the first\n");
-        return 0;
-    }
-    for (const row of rows)
-        out.write(`${aLine(row)}\n`);
-    return 0;
-}
-// The listing prints the first twelve characters, because a full sha256 is unreadable in a
-// column — so the word a person copies off the screen is NOT the word the door takes, and
-// `pinecall keys revoke <what list printed>` answered 404 for every key there was. The door stays
-// strict, and this resolves what was typed against the org's own rows before it knocks.
-const NO_SUCH_FINGERPRINT = "no key of this org begins with {said}: `pinecall keys list` prints them";
-const TWO_KEYS = "{said} names more than one key: {which}";
-/** Stop one key. A fingerprint that is not this org's is the 404 a stranger's is. */
-async function revoke(said, door, out, err) {
-    if (said === undefined) {
-        err.write(`${USAGE}\n`);
-        return 2;
-    }
-    const rows = await asked(door, KEYS);
-    const found = rows.filter((row) => row.fingerprint.startsWith(said));
-    if (found.length === 0) {
-        err.write(`${NO_SUCH_FINGERPRINT.replace("{said}", said)}\n`);
-        return 1;
-    }
-    if (found.length > 1) {
-        const which = found.map((row) => shortened(row.fingerprint)).join(" · ");
-        err.write(`${TWO_KEYS.replace("{said}", said).replace("{which}", which)}\n`);
-        return 1;
-    }
-    const whole = found[0].fingerprint;
-    await asked(door, `${KEYS}/${encodeURIComponent(whole)}/revoke`, { method: "POST" });
-    out.write(`revoked ${shortened(whole)}\n`);
-    return 0;
-}
-/** The fingerprint as the listing prints it: enough to tell two keys apart, short enough to read. */
-export function shortened(fingerprint) {
-    return fingerprint.slice(0, FINGERPRINT_CHARS);
-}
-const FINGERPRINT_CHARS = 12;
-/** One row as a terminal reads it: what it is, where it opens, whose it is, and its standing. */
-export function aLine(row) {
-    const whose = row.name ?? (row.subject === null ? "a machine" : row.subject);
-    const standing = row.revoked_at === null ? LIVE : REVOKED;
-    return `${shortened(row.fingerprint)}  ${row.env.padEnd(11)} ${(row.label ?? NO_LABEL).padEnd(20)} ${whose.padEnd(14)} ${standing}`;
-}
-//# sourceMappingURL=keys.js.map

package/dist/cli/keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/cli/keys.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAElG,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,OAAO,EAAE,KAAK,EAAa,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,KAAK,GAAG;;0CAE4B,CAAC;AAE3C,iGAAiG;AACjG,iGAAiG;AACjG,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,8FAA8F;AAC9F,kEAAkE;AAClE,MAAM,YAAY,GAAG,kFAAkF,CAAC;AAExG,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,IAAI,GAAG,MAAM,CAAC;AAEpB,MAAM,CAAC,MAAM,KAAK,GAAU;IAC1B,OAAO,EAAE,+DAA+D;IACxE,KAAK,EAAE,GAAG,KAAK;;;;;;;;;;;;;;2BAcU;IACzB,GAAG;CACJ,CAAC;AA8BF,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAG,GAAY,EAAE;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACxE,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,KAAK,CAClB,IAAc,EACd,IAAU,EACV,GAA0B,EAC1B,GAA0B;IAE1B,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI;QACV,OAAO,EAAE;YACP,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC1C;KACF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACxB,GAAG,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAC3F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAS,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3B,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,IAAI,QAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtF,GAAG,CAAC,KAAK,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,IAAI,CAAC,IAAU,EAAE,GAA0B;IACxD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAW,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2FAA2F;AAC3F,0FAA0F;AAC1F,kGAAkG;AAClG,wFAAwF;AACxF,MAAM,mBAAmB,GAAG,yEAAyE,CAAC;AACtG,MAAM,QAAQ,GAAG,yCAAyC,CAAC;AAE3D,qFAAqF;AACrF,KAAK,UAAU,MAAM,CACnB,IAAwB,EACxB,IAAU,EACV,GAA0B,EAC1B,GAA0B;IAE1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAW,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC;IACpC,MAAM,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,GAAG,CAAC,KAAK,CAAC,WAAW,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,SAAS,CAAC,WAAmB;IAC3C,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,iGAAiG;AACjG,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;AACtI,CAAC"}