@cleocode/cleo 2026.10.2 → 2026.10.4

package/dist/cli/cloud-PPQ4O5TX.js

@@ -0,0 +1,565 @@
+(() => {
+  const _installed = Symbol.for('cleocode.cli.sqliteWarningFilter');
+  if (globalThis[_installed]) return;
+  globalThis[_installed] = true;
+  const _origEmitWarning = process.emitWarning;
+  process.emitWarning = function(warning, type, code, ctor) {
+    if (typeof warning === 'object' && warning.name === 'ExperimentalWarning' && typeof warning.message === 'string' && /SQLite is an experimental feature/i.test(warning.message)) {
+      return;
+    }
+    if (typeof warning === 'string' && /SQLite is an experimental feature/i.test(warning)) {
+      return;
+    }
+    return _origEmitWarning.call(process, warning, type, code, ctor);
+  };
+})();
+import {
+  NEXUS_API_URL_ARG,
+  emitNexusResult,
+  failNexus,
+  nexusApiUrlArg
+} from "./chunk-ULN4OKQQ.js";
+import "./chunk-47JYZAMS.js";
+import "./chunk-C3B7C43W.js";
+import {
+  defineCommand
+} from "./chunk-PKKZPOOP.js";
+import "./chunk-3ZO3M37V.js";
+import "./chunk-6JSJNYH2.js";
+
+// packages/cleo/src/cli/commands/cloud.ts
+import { NEXUS_DEVICE_LIST_STATES as NEXUS_DEVICE_LIST_STATES2 } from "@cleocode/contracts";
+
+// packages/cleo/src/cli/lib/nexus-cloud-cli.ts
+import { NEXUS_DEVICE_LIST_STATES } from "@cleocode/contracts";
+function stringArg(args, name) {
+  const raw = args[name];
+  return typeof raw === "string" && raw !== "" ? raw : void 0;
+}
+function writeWarnings(warnings) {
+  for (const w of warnings) process.stderr.write(`warning: ${w.message} (${w.code})
+`);
+}
+function deviceStateArg(args) {
+  const raw = stringArg(args, "state");
+  if (raw === void 0) return void 0;
+  const known = NEXUS_DEVICE_LIST_STATES.find((s) => s === raw);
+  if (known !== void 0) return known;
+  throw Object.assign(new Error(`unknown --state '${raw}'`), {
+    code: "E_VALIDATION",
+    fix: `use one of: ${NEXUS_DEVICE_LIST_STATES.join(", ")}`
+  });
+}
+function cloudStatusSummary(r) {
+  if (r.verdict === "not-signed-in") {
+    return `Cloud status: not signed in to ${r.local.apiUrl}. Run \`cleo login nexus\`.`;
+  }
+  const s = r.summary;
+  const parts = [`device ${r.local.nexusDeviceId ?? "unknown"} (${s.profile ?? "no profile"})`];
+  if (r.local.projectId !== null) {
+    parts.push(`project ${r.local.projectId} ${s.linked ? "linked" : "NOT linked"}`);
+    parts.push(s.replicaAttached ? "replica attached" : "replica NOT attached");
+    parts.push(`${s.devices} device(s)`);
+    if (s.headSeq !== null) parts.push(`head ${s.headSeq}`);
+    if (s.openConflicts !== null) parts.push(`${s.openConflicts} open conflict(s)`);
+  }
+  return `Cloud status: ${r.verdict}. ${parts.join("; ")}.`;
+}
+async function runCloudRead(operation, call, summary) {
+  let result;
+  try {
+    result = await call();
+  } catch (err) {
+    const { NexusCloudOfflineError } = await import(
+      /* webpackIgnore: true */
+      "@cleocode/core/cloud/nexus-cloud-status.js"
+    );
+    if (err instanceof NexusCloudOfflineError) writeWarnings(err.publicDetails.warnings);
+    failNexus(err, operation);
+  }
+  writeWarnings(result.warnings);
+  emitNexusResult(result, summary(result), "cloud", operation);
+}
+async function runCloudStatus(args) {
+  await runCloudRead(
+    "cloud.status",
+    async () => {
+      const { getNexusCloudStatus } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud-status.js"
+      );
+      const projectId = stringArg(args, "project");
+      return getNexusCloudStatus({
+        apiUrl: nexusApiUrlArg(args),
+        ...projectId !== void 0 ? { projectId } : {}
+      });
+    },
+    cloudStatusSummary
+  );
+}
+async function runCloudWhoami(args) {
+  await runCloudRead(
+    "cloud.whoami",
+    async () => {
+      const { nexusCloudWhoami } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return nexusCloudWhoami({ apiUrl: nexusApiUrlArg(args) });
+    },
+    (r) => `Signed in to ${r.apiUrl} as ${r.user.email} with a ${r.credential.kind} credential${r.device ? ` (device ${r.device.deviceId}, profile ${r.credential.profile ?? "none"})` : ""}.`
+  );
+}
+async function runCloudDevices(args) {
+  await runCloudRead(
+    "cloud.devices.list",
+    async () => {
+      const state = deviceStateArg(args);
+      const { listNexusCloudDevices } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return listNexusCloudDevices({
+        apiUrl: nexusApiUrlArg(args),
+        ...state !== void 0 ? { state } : {}
+      });
+    },
+    (r) => `${r.count} device(s) on ${r.apiUrl}${r.state ? ` (state ${r.state})` : ""}: ${r.devices.map((d) => `${d.name} ${d.deviceId} ${d.state}${d.current ? " (this machine)" : ""}`).join("; ")}`
+  );
+}
+async function runCloudProjects(args) {
+  const action = stringArg(args, "action");
+  if (action === "show") {
+    await runCloudRead(
+      "cloud.projects.show",
+      async () => {
+        const projectId = stringArg(args, "id");
+        const { showNexusCloudProject } = await import(
+          /* webpackIgnore: true */
+          "@cleocode/core/cloud/nexus-cloud.js"
+        );
+        return showNexusCloudProject({
+          apiUrl: nexusApiUrlArg(args),
+          ...projectId !== void 0 ? { projectId } : {}
+        });
+      },
+      (r) => `Project ${r.projectId} "${r.project.label ?? ""}" (${r.role}): ${r.devices.active} active device(s), ${r.replicas.length} replica(s), head ${r.stream?.headSeq ?? "none"}, ${r.openConflicts} open conflict(s).`
+    );
+    return;
+  }
+  if (action !== void 0 && action !== "list") {
+    failNexus(
+      Object.assign(new Error(`unknown action '${action}'`), {
+        code: "E_VALIDATION",
+        fix: "use `cleo cloud projects` or `cleo cloud projects show [<id>]`"
+      }),
+      "cloud.projects.list"
+    );
+  }
+  await runCloudRead(
+    "cloud.projects.list",
+    async () => {
+      const organizationId = stringArg(args, "org");
+      const { listNexusCloudProjects } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud.js"
+      );
+      return listNexusCloudProjects({
+        apiUrl: nexusApiUrlArg(args),
+        ...organizationId !== void 0 ? { organizationId } : {}
+      });
+    },
+    (r) => `${r.count} project(s) on ${r.apiUrl}: ${r.projects.map((p) => `${p.label ?? p.projectId} (${p.role})`).join("; ")}`
+  );
+}
+
+// packages/cleo/src/cli/lib/nexus-vault-cli.ts
+function scopeArg(args, operation) {
+  const raw = stringArg(args, "scope") ?? "project";
+  if (raw === "project" || raw === "global") return raw;
+  failNexus(
+    Object.assign(new Error(`unknown scope '${raw}'`), {
+      code: "E_VALIDATION",
+      fix: "use --scope project (default) or --scope global"
+    }),
+    operation
+  );
+}
+var vaultModule = () => import(
+  /* webpackIgnore: true */
+  "@cleocode/core/cloud/nexus-vault.js"
+);
+function common(args, operation) {
+  return { apiUrl: nexusApiUrlArg(args), scope: scopeArg(args, operation) };
+}
+var who = (name, id) => name ?? id;
+function activityLimitArg(args) {
+  const raw = stringArg(args, "limit");
+  if (raw === void 0) return void 0;
+  const limit = Number(raw);
+  if (/^\d+$/.test(raw) && Number.isSafeInteger(limit) && limit >= 1 && limit <= 200) return limit;
+  throw Object.assign(new Error(`--limit must be a whole number from 1 to 200, got '${raw}'`), {
+    code: "E_VALIDATION",
+    fix: "pass --limit 1..200 (default 50)"
+  });
+}
+async function runCloudPush(args) {
+  await runCloudRead(
+    "cloud.push",
+    async () => (await vaultModule()).pushNexusVault({
+      ...common(args, "cloud.push"),
+      force: args["force"] === true,
+      hold: args["hold"] === true
+    }),
+    (r) => r.status === "up-to-date" ? `Up to date: ${r.streamId} already holds this ${r.scope} store (snapshot ${r.snapshot?.checkpointId ?? "none"}).` : `Pushed ${r.scope} snapshot ${r.snapshot?.checkpointId} to ${r.streamId} (${r.snapshot?.rows ?? 0} rows${r.parentCheckpointId ? `, parent ${r.parentCheckpointId}` : ", first snapshot"}${r.forked ? ", FORK: lease taken by force" : ""}).`
+  );
+}
+async function runCloudPull(args) {
+  await runCloudRestoreLike(args, "cloud.pull", "pull");
+}
+async function runCloudRestore(args) {
+  await runCloudRestoreLike(args, "cloud.restore", "restore");
+}
+async function restoreProjectId(args) {
+  const positional = stringArg(args, "name");
+  const flag = stringArg(args, "project");
+  if (positional !== void 0 && flag !== void 0 && positional !== flag) {
+    throw Object.assign(new Error("give the project once: as <name> or as --project"), {
+      code: "E_VALIDATION",
+      fix: "use `cleo cloud restore <name>` (or `--project <name>`), not both"
+    });
+  }
+  const ref = positional ?? flag;
+  if (ref === void 0) return void 0;
+  if (stringArg(args, "scope") === "global") {
+    throw Object.assign(new Error("a project name restores a project, not the global store"), {
+      code: "E_VALIDATION",
+      fix: "drop --scope global to restore the project, or drop the project to restore the global store"
+    });
+  }
+  const { assertNexusRestoreTarget, resolveNexusProjectRef } = await import(
+    /* webpackIgnore: true */
+    "@cleocode/core/cloud/nexus-project-names.js"
+  );
+  if (stringArg(args, "into") === void 0) assertNexusRestoreTarget();
+  const resolved = await resolveNexusProjectRef(ref, { apiUrl: nexusApiUrlArg(args) });
+  if (resolved.matchedBy === "name") {
+    process.stderr.write(`Restoring "${resolved.name}" (project ${resolved.projectId})...
+`);
+  }
+  return resolved.projectId;
+}
+async function runCloudRestoreLike(args, operation, mode) {
+  await runCloudRead(
+    operation,
+    async () => {
+      const checkpointId = stringArg(args, "checkpoint");
+      const projectId = mode === "restore" ? await restoreProjectId(args) : void 0;
+      const into = stringArg(args, "into");
+      return (await vaultModule()).restoreNexusVault({
+        ...common(args, operation),
+        mode,
+        force: args["force"] === true,
+        ...mode === "restore" && checkpointId !== void 0 ? { checkpointId } : {},
+        ...mode === "restore" && projectId !== void 0 ? { projectId } : {},
+        ...mode === "restore" && into !== void 0 ? { into } : {},
+        relink: async (projectRoot) => {
+          const { linkProjectToNexus } = await import(
+            /* webpackIgnore: true */
+            "@cleocode/core/cloud/nexus-link.js"
+          );
+          try {
+            const linked = await linkProjectToNexus({ apiUrl: nexusApiUrlArg(args), projectRoot });
+            return linked.warnings;
+          } catch (err) {
+            return [
+              `restored, but attaching this copy failed (${err instanceof Error ? err.message : String(err)}); run \`cleo project link\``
+            ];
+          }
+        }
+      });
+    },
+    (r) => r.status === "up-to-date" ? `Up to date: this ${r.scope} store already holds snapshot ${r.snapshot?.checkpointId ?? "none"}.` : `Restored ${r.scope} snapshot ${r.snapshot?.checkpointId} into ${r.target}: ${r.tables} table(s) verified by count and hash${r.safetyBackup ? `; previous state saved to ${r.safetyBackup}` : ""}.`
+  );
+}
+async function runCloudVerify(args) {
+  await runCloudRead(
+    "cloud.verify",
+    async () => (await vaultModule()).verifyNexusVault(common(args, "cloud.verify")),
+    (r) => {
+      const bad = r.tables.filter((t) => !t.match).map((t) => t.table);
+      const devices = r.devices.map(
+        (d) => `${who(d.deviceName, d.deviceId)} ${d.matchesHead ? "matches" : "differs from"} head`
+      ).join("; ");
+      return `Verify ${r.scope}: ${r.verdict}${bad.length ? ` (${bad.length} table(s) differ: ${bad.slice(0, 8).join(", ")}${bad.length > 8 ? ", \u2026" : ""})` : ""}; local integrity ${r.localIntegrity ? "ok" : "FAILED"}${devices ? `; ${devices}` : ""}.`;
+    }
+  );
+}
+async function runCloudVault(args) {
+  await runCloudRead(
+    "cloud.vault",
+    async () => (await vaultModule()).nexusVaultStatus(common(args, "cloud.vault")),
+    (r) => `Vault ${r.scope} ${r.streamId}: ${r.lineage.length} snapshot(s), head ${r.head?.checkpointId ?? "none"}${r.head ? ` by ${who(r.head.deviceName, r.head.deviceId)}` : ""}; this store last synced ${r.lastSynced ?? "never"}; ${r.pendingChanges.length} table(s) changed since; leases: ${r.leases.map((l) => `${l.role} ${who(l.deviceName, l.deviceId ?? l.replicaId)} until ${l.expiresAt}${l.mine ? " (this machine)" : ""}${l.forkedFromReplicaId ? " (forked)" : ""}`).join("; ") || "none"}.`
+  );
+}
+async function runCloudLease(args) {
+  const action = stringArg(args, "action") ?? "release";
+  if (action !== "release") {
+    failNexus(
+      Object.assign(new Error(`unknown action '${action}'`), {
+        code: "E_VALIDATION",
+        fix: "use `cleo cloud lease release` (see `cleo cloud vault` for holders)"
+      }),
+      "cloud.lease.release"
+    );
+  }
+  await runCloudRead(
+    "cloud.lease.release",
+    async () => (await vaultModule()).releaseNexusVaultLease(common(args, "cloud.lease.release")),
+    (r) => r.released ? `Released the write lease on ${r.streamId}: another device may push now.` : `This machine held no write lease on ${r.streamId}.`
+  );
+}
+async function runCloudActivity(args) {
+  await runCloudRead(
+    "cloud.activity",
+    async () => {
+      const { nexusCloudActivity } = await import(
+        /* webpackIgnore: true */
+        "@cleocode/core/cloud/nexus-cloud-activity.js"
+      );
+      const limit = activityLimitArg(args);
+      const before = stringArg(args, "before");
+      const projectId = stringArg(args, "project");
+      const deviceId = stringArg(args, "device");
+      return nexusCloudActivity({
+        ...deviceId !== void 0 ? { deviceId } : {},
+        apiUrl: nexusApiUrlArg(args),
+        ...limit !== void 0 ? { limit } : {},
+        ...before !== void 0 ? { before } : {},
+        ...projectId !== void 0 ? { projectId } : {}
+      });
+    },
+    (r) => `${r.items.length} event(s)${r.projectId ? ` for project ${r.projectId}` : ""}: ${r.items.slice(0, 10).map(
+      (i) => `${i.at} ${who(i.deviceName, i.deviceId ?? "account")}${i.thisDevice ? " (this machine)" : ""} ${i.action}${i.target ? ` ${i.target}` : ""}`
+    ).join("; ")}${r.items.length > 10 ? "; \u2026" : ""}`
+  );
+}
+
+// packages/cleo/src/cli/commands/cloud.ts
+var JSON_ARG = { type: "boolean", description: "Output as JSON envelope" };
+var SCOPE_ARG = {
+  type: "string",
+  description: "Which store: 'project' (the current project, default) or 'global' (this account's global store: the main brain)."
+};
+var statusSubCommand = defineCommand({
+  meta: {
+    name: "status",
+    description: "Verify this machine against Cleo Nexus in one call: device, credential, project link, replica and stream. Returns { verdict, summary, local, remote, warnings }; verdict is ok, attention, not-linked, not-registered or not-signed-in. Reads only (GET; never binds a replica), except that getting the credential may upgrade a 9.24 session (E1) and retry unsettled logouts (E9/E10)."
+  },
+  args: {
+    project: {
+      type: "string",
+      description: "Project id to check (default: the current project)."
+    },
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudStatus(args);
+  }
+});
+var whoamiSubCommand = defineCommand({
+  meta: {
+    name: "whoami",
+    description: "Show the Cleo Nexus user, organizations, credential and device for this machine."
+  },
+  args: { "api-url": NEXUS_API_URL_ARG, json: JSON_ARG },
+  async run({ args }) {
+    await runCloudWhoami(args);
+  }
+});
+var devicesSubCommand = defineCommand({
+  meta: {
+    name: "devices",
+    description: "List the account's devices (newest first), following every page; reports truncation."
+  },
+  args: {
+    state: {
+      type: "string",
+      description: `Filter: ${NEXUS_DEVICE_LIST_STATES2.join(", ")} (default: active).`
+    },
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudDevices(args);
+  }
+});
+var projectsSubCommand = defineCommand({
+  meta: {
+    name: "projects",
+    description: "List visible Cleo Nexus projects, following every page (cleo cloud projects [--org <id>]), or show one with its replicas and device counts (cleo cloud projects show [<id>], default: the current project)."
+  },
+  args: {
+    action: {
+      type: "positional",
+      description: "'list' (default) or 'show'.",
+      required: false
+    },
+    id: {
+      type: "positional",
+      description: "Project id for show (default: the current project).",
+      required: false
+    },
+    org: { type: "string", description: "Only this organization id (list)." },
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudProjects(args);
+  }
+});
+var pushSubCommand = defineCommand({
+  meta: {
+    name: "push",
+    description: "Back up this store to Cleo Nexus as an encrypted snapshot; the key is escrowed on Cleo Nexus (released only to your approved devices), so this is encrypted at rest, not zero-knowledge. The server also stores per-table row counts and keyed hashes in plaintext. Refused when another device holds the write lease or pushed since this machine last synced (pull first); --force takes the lease and pushes anyway as a labelled fork. The lease is released when the push ends unless --hold."
+  },
+  args: {
+    scope: SCOPE_ARG,
+    force: {
+      type: "boolean",
+      description: "Take the lease from another device / push over a newer snapshot (a labelled fork)."
+    },
+    hold: {
+      type: "boolean",
+      description: "Keep the write lease after the push (another device cannot push until it expires or `cleo cloud lease release`)."
+    },
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudPush(args);
+  }
+});
+var pullSubCommand = defineCommand({
+  meta: {
+    name: "pull",
+    description: "Bring this store to the cloud's newest snapshot, verified by per-table count and hash before anything is replaced; this machine's local-only state is kept. Refuses to overwrite local changes made since the last sync unless --force (a safety backup is taken first)."
+  },
+  args: {
+    scope: SCOPE_ARG,
+    force: { type: "boolean", description: "Overwrite local changes (after a safety backup)." },
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudPull(args);
+  }
+});
+var restoreSubCommand = defineCommand({
+  meta: {
+    name: "restore",
+    description: "Restore a snapshot: the newest, or --checkpoint <id> (point in time); or a project this machine does not have yet by name, label or id: cleo cloud restore <name> [--into <dir>] (then it is linked to this device). A name several projects share lists them. Verified by count and hash before activation; a safety backup of existing data is taken first."
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Project to restore onto this machine: its name, label or id (see `cleo cloud projects`; the same as --project).",
+      required: false
+    },
+    scope: SCOPE_ARG,
+    checkpoint: { type: "string", description: "Snapshot id to restore (see `cleo cloud vault`)." },
+    project: {
+      type: "string",
+      description: "Project to restore onto this machine: its name, label or server id (see `cleo cloud projects`)."
+    },
+    into: {
+      type: "string",
+      description: "Directory for --project (default: the current directory)."
+    },
+    force: { type: "boolean", description: "Overwrite local changes (after a safety backup)." },
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudRestore(args);
+  }
+});
+var verifyVaultSubCommand = defineCommand({
+  meta: {
+    name: "verify",
+    description: "Integrity check across machines: SQLite integrity of this store, its per-table counts and keyed hashes against the cloud's newest snapshot, and every device's newest snapshot against it. Verdict: match, ahead, behind, diverged, empty, or untrusted (the newest snapshot's signature does not verify)."
+  },
+  args: { scope: SCOPE_ARG, "api-url": NEXUS_API_URL_ARG, json: JSON_ARG },
+  async run({ args }) {
+    await runCloudVerify(args);
+  }
+});
+var vaultSubCommand = defineCommand({
+  meta: {
+    name: "vault",
+    description: "The store's cloud vault: snapshot lineage (newest first), the last push of each device, tables changed since this machine's last sync, and who holds the write lease until when."
+  },
+  args: { scope: SCOPE_ARG, "api-url": NEXUS_API_URL_ARG, json: JSON_ARG },
+  async run({ args }) {
+    await runCloudVault(args);
+  }
+});
+var leaseSubCommand = defineCommand({
+  meta: {
+    name: "lease",
+    description: "Hand the write lease back so another device can push: cleo cloud lease release."
+  },
+  args: {
+    action: { type: "positional", description: "'release'.", required: false },
+    scope: SCOPE_ARG,
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudLease(args);
+  }
+});
+var activitySubCommand = defineCommand({
+  meta: {
+    name: "activity",
+    description: "What this account's devices did on Cleo Nexus and when (snapshots pushed or refused, leases taken, forced or released, projects linked, devices enrolled), newest first."
+  },
+  args: {
+    limit: { type: "string", description: "Events to show (1-200, default 50)." },
+    before: { type: "string", description: "Older page: the nextBefore of a previous call." },
+    project: { type: "string", description: "Only events about this server project id." },
+    device: {
+      type: "string",
+      description: "Only events by this device id (see `cleo cloud devices`)."
+    },
+    "api-url": NEXUS_API_URL_ARG,
+    json: JSON_ARG
+  },
+  async run({ args }) {
+    await runCloudActivity(args);
+  }
+});
+var cloudCommand = defineCommand({
+  meta: {
+    name: "cloud",
+    description: "Cleo Nexus with the device credential: status (one-call verification), whoami, devices, projects [show], activity; the encrypted vault: push, pull, restore, verify, vault, lease release."
+  },
+  subCommands: {
+    status: statusSubCommand,
+    whoami: whoamiSubCommand,
+    devices: devicesSubCommand,
+    projects: projectsSubCommand,
+    activity: activitySubCommand,
+    push: pushSubCommand,
+    pull: pullSubCommand,
+    restore: restoreSubCommand,
+    verify: verifyVaultSubCommand,
+    vault: vaultSubCommand,
+    lease: leaseSubCommand
+  }
+});
+export {
+  cloudCommand
+};
+//# sourceMappingURL=cloud-PPQ4O5TX.js.map