@cleocode/contracts 2026.9.20 → 2026.9.22

package/dist/cloud/api.js

@@ -0,0 +1,417 @@
+import { z } from 'zod';
+import { Base64, DeviceId, Hlc, ProjectId, ReplicaId, Sha256Hex, StreamId } from './ids.js';
+/**
+ * Wire contract for the Cleo Nexus API (v1).
+ *
+ * Privacy rule: the server never receives plaintext content (ADR-093). Everything below is
+ * routing or integrity metadata. Content travels only as ciphertext (`Base64`) or as blobs
+ * addressed by the sha256 of their ciphertext.
+ */
+export const API_VERSION = 'v1';
+/**
+ * The highest key version any schema accepts. Key versions go up by one per rotation, so this is far above
+ * any real account, and it keeps an absurd value (2^53 - 1, say) out of client state.
+ */
+export const MAX_KEY_VERSION = 1_000_000;
+/** A master key or project key version: a positive integer, at most MAX_KEY_VERSION. */
+export const KeyVersion = z.number().int().positive().max(MAX_KEY_VERSION);
+/** Largest inline segment. Larger segments go to R2 as a blob and are referenced by sha256. */
+export const MAX_INLINE_SEGMENT_BYTES = 1_048_576;
+export const MAX_PULL_LIMIT = 500;
+// ---------- devices ----------
+export const Platform = z.enum(['darwin', 'linux', 'win32', 'other']);
+export const RegisterDeviceRequest = z.object({
+    deviceId: DeviceId,
+    name: z.string().min(1).max(120),
+    platform: Platform,
+    /** X25519 public key, base64 (32 bytes). Used to wrap the user master key for this device. */
+    encryptionPublicKey: Base64,
+    /** Ed25519 public key, base64 (32 bytes). Verifies segments this device's replicas sign. */
+    signingPublicKey: Base64,
+    cliVersion: z.string().max(40),
+});
+export const Device = z.object({
+    deviceId: DeviceId,
+    name: z.string(),
+    platform: Platform,
+    encryptionPublicKey: Base64,
+    signingPublicKey: Base64,
+    cliVersion: z.string(),
+    createdAt: z.iso.datetime(),
+    lastSeenAt: z.iso.datetime().nullable(),
+    revokedAt: z.iso.datetime().nullable(),
+    /**
+     * The device certificate from this device's current key grant: an HMAC under a key derived from the
+     * user master key over deviceCertificateMessage(...). Only a holder of the master key can make one,
+     * so a client that holds the master key can tell the user's real devices from rows the server
+     * invented (docs/security/e2e-keys.md, "Device trust"). Null until the device holds a grant.
+     */
+    certificate: Base64.nullable(),
+    /** The master key version the certificate was made under. */
+    certificateKeyVersion: KeyVersion.nullable(),
+});
+export const ListDevicesResult = z.object({ devices: z.array(Device) });
+// ---------- projects ----------
+export const RegisterProjectRequest = z.object({
+    projectId: ProjectId,
+    /**
+     * Optional plaintext label for the web view. The client decides whether to reveal a name;
+     * the default is the encrypted name only.
+     */
+    label: z.string().max(120).optional(),
+    /** The project name, encrypted with the project data key. */
+    encryptedName: Base64.optional(),
+    /** The git origin, only if the user opts in (it can reveal a private repo's name). */
+    remoteUrl: z.string().max(500).optional(),
+    /**
+     * The organization that will own the project. The caller must be a member of it. Defaults to the
+     * caller's personal organization, which every account has.
+     */
+    organizationId: z.string().uuid().optional(),
+});
+export const Project = z.object({
+    projectId: ProjectId,
+    label: z.string().nullable(),
+    encryptedName: Base64.nullable(),
+    remoteUrl: z.string().nullable(),
+    /** Projects are owned by an organization. Access derives from membership (ADR-095, ownership). */
+    organizationId: z.string().uuid(),
+    /** Who registered the project. Provenance only: it grants nothing. Null once that account is deleted. */
+    createdByUserId: z.string().uuid().nullable(),
+    createdAt: z.iso.datetime(),
+});
+export const RegisterProjectResult = z.object({ project: Project, streamId: StreamId });
+/**
+ * Which devices hold a project. The server stores NO filesystem path, not even as a hint.
+ * Paths are per-device local state (cleo-dev review, 2026-09-27).
+ */
+export const AttachProjectDeviceRequest = z.object({
+    deviceId: DeviceId,
+    replicaId: ReplicaId,
+});
+/**
+ * Path-free presence of one replica, for fleet status (cleo-dev SG-AGENTIC-CORE, T12479).
+ * The device keeps the full record, including paths. The cloud mirrors only this.
+ */
+export const ReplicaPresence = z.object({
+    git: z
+        .object({
+        /** Sent only when the user opts in: branch names can be sensitive. */
+        branch: z.string().max(200).optional(),
+        dirty: z.boolean(),
+        ahead: z.number().int().nonnegative(),
+        behind: z.number().int().nonnegative(),
+        /** The remote tracking state: in sync, diverged, no upstream, or unknown. */
+        remote: z.enum(['in-sync', 'ahead', 'behind', 'diverged', 'no-upstream', 'unknown']),
+        lastCommitAt: z.iso.datetime().optional(),
+    })
+        .optional(),
+    cliVersion: z.string().max(40),
+    schemaVersion: z.number().int().positive(),
+    /** When the device measured this. The server also records when it received it. */
+    observedAt: z.iso.datetime(),
+});
+// ---------- journal segments ----------
+/**
+ * Per-table row deltas in a segment: plaintext counts, no content. They let the server check a
+ * checkpoint manifest for regressions without reading any row (E_REGRESSION).
+ */
+export const TableDeltas = z.record(z.string().regex(/^[a-z][a-z0-9_]{0,62}$/), z.object({ created: z.number().int().nonnegative(), deleted: z.number().int().nonnegative() }));
+export const AppendSegmentRequest = z
+    .object({
+    replicaId: ReplicaId,
+    deviceId: DeviceId,
+    /** sha256 of the ciphertext bytes. With `replicaId`, it is the idempotency key. */
+    segmentHash: Sha256Hex,
+    /** The replica's own monotonically increasing segment counter, so gaps are detectable. */
+    replicaSeq: z.number().int().nonnegative(),
+    schemaVersion: z.number().int().positive(),
+    opCount: z.number().int().positive(),
+    hlcMin: Hlc,
+    hlcMax: Hlc,
+    deltas: TableDeltas,
+    /**
+     * Ed25519 signature by the device signing key over segmentSigningMessage (v2), which covers the
+     * stream, replica, device, replicaSeq, the ciphertext hash and the hash of every metadata field
+     * above (segmentMetaCanonical). The server verifies it on append; every client re-verifies it on pull.
+     */
+    signature: Base64,
+    ciphertext: Base64.optional(),
+    /** Set instead of `ciphertext` for segments over MAX_INLINE_SEGMENT_BYTES (uploaded first). */
+    blobSha256: Sha256Hex.optional(),
+})
+    .refine((r) => (r.ciphertext === undefined) !== (r.blobSha256 === undefined), {
+    message: 'exactly one of ciphertext or blobSha256 is required',
+})
+    .refine((r) => r.hlcMin <= r.hlcMax, { message: 'hlcMin must not exceed hlcMax' });
+export const AppendSegmentResult = z.object({
+    streamId: StreamId,
+    /** The server-assigned position in the stream. */
+    seq: z.number().int().positive(),
+    /** True when this exact segment was already stored. The retry was a no-op. */
+    duplicate: z.boolean(),
+});
+export const Segment = z.object({
+    seq: z.number().int().positive(),
+    replicaId: ReplicaId,
+    deviceId: DeviceId,
+    replicaSeq: z.number().int().nonnegative(),
+    segmentHash: Sha256Hex,
+    schemaVersion: z.number().int().positive(),
+    opCount: z.number().int().positive(),
+    hlcMin: Hlc,
+    hlcMax: Hlc,
+    deltas: TableDeltas,
+    signature: Base64,
+    ciphertext: Base64.nullable(),
+    blobSha256: Sha256Hex.nullable(),
+    receivedAt: z.iso.datetime(),
+});
+export const PullSegmentsQuery = z.object({
+    after: z.coerce.number().int().nonnegative().default(0),
+    limit: z.coerce.number().int().positive().max(MAX_PULL_LIMIT).default(100),
+});
+export const PullSegmentsResult = z.object({
+    streamId: StreamId,
+    segments: z.array(Segment),
+    /** The stream head at read time. When `nextAfter < head`, keep pulling. */
+    head: z.number().int().nonnegative(),
+    nextAfter: z.number().int().nonnegative(),
+});
+// ---------- checkpoints ----------
+/**
+ * A checkpoint id (UUIDv7). The authoring client mints it, because its signature and the bundle's AAD
+ * both cover it, so the id must exist before the bundle is encrypted.
+ */
+export const CheckpointId = z
+    .string()
+    .regex(/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/, 'expected a UUIDv7 checkpoint id');
+export const TableManifestEntry = z.object({
+    rows: z.number().int().nonnegative(),
+    /** Canonical content hash keyed by uid (Gate D). The same algorithm runs in core and on replay. */
+    hash: Sha256Hex,
+});
+/** Plaintext manifest: per-table counts and uid-keyed hashes. No content (ADR-093 §3). */
+export const Manifest = z.object({
+    schemaVersion: z.number().int().positive(),
+    tables: z.record(z.string().regex(/^[a-z][a-z0-9_]{0,62}$/), TableManifestEntry),
+});
+/**
+ * Where one replica stood at a checkpoint: the device that signs its segments and the last replicaSeq
+ * folded in. A checkpoint lists every replica with a segment at or below its coversSeq, so a client that
+ * restores it can check every later segment for gaps and re-attribution (PullCursor).
+ */
+export const ReplicaHead = z.object({
+    deviceId: DeviceId,
+    lastReplicaSeq: z.number().int().nonnegative(),
+});
+/** Per replica id, keys are replica ids. Covered by the checkpoint signature (replicasCanonical). */
+export const ReplicaHeads = z.record(ReplicaId, ReplicaHead);
+export const CreateCheckpointRequest = z.object({
+    /** Minted by the author: the signature and the bundle's AAD both cover it. */
+    checkpointId: CheckpointId,
+    replicaId: ReplicaId,
+    /** The authoring device. It must be the calling device. */
+    deviceId: DeviceId,
+    /** null only for a stream's genesis checkpoint. */
+    parentCheckpointId: z.string().uuid().nullable(),
+    /** The last stream seq whose ops are folded into this checkpoint. */
+    coversSeq: z.number().int().nonnegative(),
+    manifest: Manifest,
+    /** Every replica with a segment at or below coversSeq. The server checks it against the journal. */
+    replicas: ReplicaHeads,
+    /** The encrypted checkpoint bundle, uploaded to R2 first. */
+    blobSha256: Sha256Hex,
+    sizeBytes: z.number().int().positive(),
+    /**
+     * Ed25519 signature by the authoring device over checkpointSigningMessage(...): the stream, the
+     * checkpoint and parent ids, replica, device, coversSeq, the manifest hash (manifestCanonical), the
+     * replica map hash (replicasCanonical), the bundle sha256 and size. The server verifies it on create;
+     * a client verifies it before restoring. Creating the same checkpoint again is a no-op.
+     */
+    signature: Base64,
+});
+export const Checkpoint = z.object({
+    checkpointId: CheckpointId,
+    streamId: StreamId,
+    parentCheckpointId: CheckpointId.nullable(),
+    replicaId: ReplicaId,
+    deviceId: DeviceId,
+    coversSeq: z.number().int().nonnegative(),
+    manifest: Manifest,
+    replicas: ReplicaHeads,
+    blobSha256: Sha256Hex,
+    sizeBytes: z.number().int().positive(),
+    signature: Base64,
+    /**
+     * Re-signatures by other devices (checkpointEndorsementMessage). A client accepts a checkpoint whose
+     * author it no longer trusts without a pin (a revoked device) when a live device endorsed it.
+     */
+    endorsements: z.array(z.object({ deviceId: DeviceId, signature: Base64 })),
+    createdAt: z.iso.datetime(),
+});
+/** A live device re-signs a checkpoint. The device must be the calling device. */
+export const EndorseCheckpointRequest = z.object({ deviceId: DeviceId, signature: Base64 });
+export const CreateCheckpointResult = z.object({ checkpoint: Checkpoint });
+/** Newest first, at most 100. */
+export const ListCheckpointsResult = z.object({ checkpoints: z.array(Checkpoint) });
+// ---------- blobs ----------
+export const PresignUploadRequest = z.object({
+    sha256: Sha256Hex,
+    sizeBytes: z
+        .number()
+        .int()
+        .positive()
+        .max(5 * 1024 ** 3),
+    purpose: z.enum(['segment', 'checkpoint', 'attachment']),
+});
+export const PresignUploadResult = z.object({
+    /** True when the blob is already stored and verified. Skip the upload. */
+    alreadyPresent: z.boolean(),
+    uploadUrl: z.string().nullable(),
+    /** Headers the uploader must send exactly (signed). They include the sha256 checksum the store enforces. */
+    uploadHeaders: z.record(z.string(), z.string()).nullable(),
+    expiresAt: z.iso.datetime().nullable(),
+});
+export const CompleteUploadResult = z.object({ sha256: Sha256Hex, verified: z.literal(true) });
+/**
+ * A short-lived presigned download URL. The response of `GET /v1/streams/:streamId/segments/:seq/blob`
+ * and of `GET /v1/streams/:streamId/checkpoints/:checkpointId/download`. The client downloads at most
+ * `sizeBytes` and checks the bytes against the sha256 it already trusts, never against this one alone.
+ */
+export const BlobDownload = z.object({
+    url: z.string().min(1),
+    sha256: Sha256Hex,
+    sizeBytes: z.number().int().positive(),
+    expiresInSeconds: z.number().int().positive(),
+});
+// ---------- elected-writer leases (T12338) ----------
+/**
+ * Roles that must run on exactly one replica per stream (cleo-dev review R4). Consolidation
+ * writes (invalid_at, citation_count), sentient proposals and checkpoint authoring would otherwise
+ * produce op storms or duplicates. Ordinary journal appends are not leased, because merge handles concurrency.
+ */
+export const LeaseRole = z.enum(['consolidator', 'sentient', 'checkpointer']);
+export const AcquireLeaseRequest = z.object({
+    role: LeaseRole,
+    replicaId: ReplicaId,
+    ttlSeconds: z.number().int().min(15).max(3600).default(300),
+    /** Take the lease from a live holder. The server records a labelled fork event. */
+    force: z.boolean().default(false),
+    reason: z.string().max(300).optional(),
+});
+export const Lease = z.object({
+    streamId: StreamId,
+    role: LeaseRole,
+    leaseId: z.string().uuid(),
+    replicaId: ReplicaId,
+    expiresAt: z.iso.datetime(),
+    /** Set when this lease was taken by force from another replica. */
+    forkedFromReplicaId: ReplicaId.nullable(),
+});
+// ---------- keys (E2E; the server stores wrapped keys only) ----------
+/**
+ * Bounds on Argon2id parameters. The server stores the parameters, so a client must not trust them: too
+ * low weakens the passphrase, too high is a denial of service (a 64 GiB allocation). Both sides enforce these.
+ */
+export const KDF_LIMITS = {
+    memoryKiB: { min: 65_536, max: 1_048_576 },
+    iterations: { min: 2, max: 10 },
+    parallelism: { min: 1, max: 16 },
+};
+export const KdfParams = z.object({
+    algorithm: z.literal('argon2id'),
+    memoryKiB: z.number().int().min(KDF_LIMITS.memoryKiB.min).max(KDF_LIMITS.memoryKiB.max),
+    iterations: z.number().int().min(KDF_LIMITS.iterations.min).max(KDF_LIMITS.iterations.max),
+    parallelism: z.number().int().min(KDF_LIMITS.parallelism.min).max(KDF_LIMITS.parallelism.max),
+    salt: Base64,
+});
+export const PutUserKeysRequest = z.object({
+    /** The user master key wrapped by a passphrase-derived key (XChaCha20-Poly1305). */
+    passphraseWrappedMasterKey: Base64,
+    kdf: KdfParams,
+    /** The master key wrapped by the recovery key, which is shown to the user once. */
+    recoveryWrappedMasterKey: Base64,
+    /** sha256 of the master key's public verifier, so a wrong unwrap is detected client-side. */
+    masterKeyVerifier: Sha256Hex,
+    keyVersion: KeyVersion,
+});
+/** What the server returns for `GET /v1/account/keys`. */
+export const UserKeys = PutUserKeysRequest.extend({
+    /** The account the keys belong to. */
+    userId: z.string().uuid(),
+    updatedAt: z.iso.datetime(),
+});
+/**
+ * A device key grant: the master key sealed to the recipient device, signed by a device that holds the
+ * master key (docs/security/e2e-keys.md, "Device trust"). The sealed box alone is anonymous, so anyone,
+ * the server included, could seal a key of their choosing to a device. The signature is what the
+ * recipient checks, against a signer it already trusts, before it accepts the key.
+ */
+export const PutDeviceWrappedKeyRequest = z.object({
+    /** The master key sealed to the recipient device's X25519 key. */
+    sealedMasterKey: Base64,
+    keyVersion: KeyVersion,
+    /** The recipient's device certificate (see Device.certificate), made by the signer under the master key. */
+    certificate: Base64,
+    /** The device that made the grant. It must be the calling device: a self-grant names the recipient. */
+    signerDeviceId: DeviceId,
+    /** Ed25519 by the signer over deviceGrantMessage(...). */
+    grantSignature: Base64,
+});
+/** What the server returns for `GET /v1/devices/:deviceId/key`. */
+export const DeviceKeyGrant = PutDeviceWrappedKeyRequest.extend({ deviceId: DeviceId });
+/**
+ * Where a revoked signing key stops being trusted: per replica, the last replicaSeq it may have signed,
+ * and per stream, the highest coversSeq of a checkpoint it may have signed. Keys are replica ids and
+ * stream ids. Covered by the revocation signature (revocationPinsCanonical).
+ */
+export const RevocationPins = z.object({
+    replicas: z.record(ReplicaId, z.number().int().nonnegative()),
+    checkpoints: z.record(StreamId, z.number().int().nonnegative()),
+});
+/**
+ * A revocation record (docs/security/e2e-keys.md, "Revocation"): a certified device signs that one
+ * signing key of a device is revoked, and pins what it signed before. History up to the pins stays
+ * verifiable; anything past them is refused. The signer must be the calling device.
+ */
+export const CreateDeviceRevocationRequest = z.object({
+    /** The revoked key (base64 Ed25519 public key): the device's current key or an earlier one. */
+    signingPublicKey: Base64,
+    pins: RevocationPins,
+    signerDeviceId: DeviceId,
+    /** Ed25519 by the signer over deviceRevocationMessage(...). */
+    signature: Base64,
+});
+export const DeviceRevocation = CreateDeviceRevocationRequest.extend({ deviceId: DeviceId });
+/**
+ * One device certificate ever issued, kept for as long as the device's history exists. A revoke or a
+ * re-registration with new keys never deletes one. `live` is the server's claim that the key is the
+ * device's current key and the device is not revoked; clients trust it only in the safe direction.
+ */
+export const DeviceCertificateRecord = z.object({
+    deviceId: DeviceId,
+    encryptionPublicKey: Base64,
+    signingPublicKey: Base64,
+    keyVersion: KeyVersion,
+    certificate: Base64,
+    live: z.boolean(),
+});
+/** `GET /v1/devices/trust`: everything a client needs to build its trusted signer set (certifiedSigners). */
+export const DeviceTrust = z.object({
+    certificates: z.array(DeviceCertificateRecord),
+    revocations: z.array(DeviceRevocation),
+});
+export const PutProjectKeyRequest = z.object({
+    /** The project data key, wrapped by the member's master key. */
+    wrappedProjectKey: Base64,
+    keyVersion: KeyVersion,
+});
+// ---------- conflicts (metadata only; the content stays E2E) ----------
+export const ConflictSummary = z.object({
+    replicaId: ReplicaId,
+    open: z.number().int().nonnegative(),
+    byKind: z.record(z.string().max(60), z.number().int().nonnegative()),
+    reportedAt: z.iso.datetime(),
+});
+//# sourceMappingURL=api.js.map

package/dist/cloud/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/cloud/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE5F;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;AAEzC,wFAAwF;AACxF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAE3E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,gCAAgC;AAEhC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,QAAQ;IAClB,8FAA8F;IAC9F,mBAAmB,EAAE,MAAM;IAC3B,4FAA4F;IAC5F,gBAAgB,EAAE,MAAM;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;CAC/B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,QAAQ;IAClB,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,MAAM;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtC;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE;IAC9B,6DAA6D;IAC7D,qBAAqB,EAAE,UAAU,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAGxE,iCAAiC;AAEjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,SAAS;IACpB;;;OAGG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrC,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE;IAChC,sFAAsF;IACtF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzC;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,kGAAkG;IAClG,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACjC,yGAAyG;IACzG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAGxF;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,SAAS;CACrB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,sEAAsE;QACtE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACtC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACtC,6EAA6E;QAC7E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QACpF,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC1C,CAAC;SACD,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,kFAAkF;IAClF,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAGH,yCAAyC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CACjC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAC1C,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAC/F,CAAC;AAGF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,QAAQ;IAClB,mFAAmF;IACnF,WAAW,EAAE,SAAS;IACtB,0FAA0F;IAC1F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,WAAW;IACnB;;;;OAIG;IACH,SAAS,EAAE,MAAM;IACjB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;IAC7B,+FAA+F;IAC/F,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE;IAC5E,OAAO,EAAE,qDAAqD;CAC/D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;AAGrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,QAAQ;IAClB,kDAAkD;IAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,WAAW,EAAE,SAAS;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,WAAW;IACnB,SAAS,EAAE,MAAM;IACjB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAC3E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC1C,CAAC,CAAC;AAGH,oCAAoC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,KAAK,CACJ,uEAAuE,EACvE,iCAAiC,CAClC,CAAC;AAGJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,mGAAmG;IACnG,IAAI,EAAE,SAAS;CAChB,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,kBAAkB,CAAC;CACjF,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,QAAQ;IAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC/C,CAAC,CAAC;AAGH,qGAAqG;AACrG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAG7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,8EAA8E;IAC9E,YAAY,EAAE,YAAY;IAC1B,SAAS,EAAE,SAAS;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,QAAQ;IAClB,mDAAmD;IACnD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChD,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,QAAQ,EAAE,QAAQ;IAClB,oGAAoG;IACpG,QAAQ,EAAE,YAAY;IACtB,6DAA6D;IAC7D,UAAU,EAAE,SAAS;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC;;;;;OAKG;IACH,SAAS,EAAE,MAAM;CAClB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,YAAY,EAAE,YAAY;IAC1B,QAAQ,EAAE,QAAQ;IAClB,kBAAkB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,SAAS;IACpB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,YAAY;IACtB,UAAU,EAAE,SAAS;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,MAAM;IACjB;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAG5F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;AAG3E,iCAAiC;AACjC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AAGpF,8BAA8B;AAE9B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;CACzD,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,0EAA0E;IAC1E,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,4GAA4G;IAC5G,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAG/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAGH,uDAAuD;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAG9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,SAAS;IACf,SAAS,EAAE,SAAS;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3D,mFAAmF;IACnF,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC1B,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,mEAAmE;IACnE,mBAAmB,EAAE,SAAS,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;IAC1C,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IAC/B,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IACvF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC;IAC7F,IAAI,EAAE,MAAM;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oFAAoF;IACpF,0BAA0B,EAAE,MAAM;IAClC,GAAG,EAAE,SAAS;IACd,mFAAmF;IACnF,wBAAwB,EAAE,MAAM;IAChC,6FAA6F;IAC7F,iBAAiB,EAAE,SAAS;IAC5B,UAAU,EAAE,UAAU;CACvB,CAAC,CAAC;AAEH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC;IAChD,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kEAAkE;IAClE,eAAe,EAAE,MAAM;IACvB,UAAU,EAAE,UAAU;IACtB,4GAA4G;IAC5G,WAAW,EAAE,MAAM;IACnB,uGAAuG;IACvG,cAAc,EAAE,QAAQ;IACxB,0DAA0D;IAC1D,cAAc,EAAE,MAAM;CACvB,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAGxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;CAChE,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,+FAA+F;IAC/F,gBAAgB,EAAE,MAAM;IACxB,IAAI,EAAE,cAAc;IACpB,cAAc,EAAE,QAAQ;IACxB,+DAA+D;IAC/D,SAAS,EAAE,MAAM;CAClB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAG7F;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,QAAQ;IAClB,mBAAmB,EAAE,MAAM;IAC3B,gBAAgB,EAAE,MAAM;IACxB,UAAU,EAAE,UAAU;IACtB,WAAW,EAAE,MAAM;IACnB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CAClB,CAAC,CAAC;AAGH,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,gEAAgE;IAChE,iBAAiB,EAAE,MAAM;IACzB,UAAU,EAAE,UAAU;CACvB,CAAC,CAAC;AAEH,yEAAyE;AAEzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACpE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC"}

package/dist/cloud/envelope.d.ts

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+/**
+ * Stable error codes. Clients branch on `code`, never on `message`.
+ * Codes that describe a refused sync action are never retried blindly: the client must
+ * reassess (pull, then re-verify) first.
+ */
+export declare const ErrorCode: z.ZodEnum<{
+    E_NOT_FOUND: "E_NOT_FOUND";
+    E_VALIDATION: "E_VALIDATION";
+    E_UNAUTHENTICATED: "E_UNAUTHENTICATED";
+    E_FORBIDDEN: "E_FORBIDDEN";
+    E_CONFLICT: "E_CONFLICT";
+    E_RATE_LIMITED: "E_RATE_LIMITED";
+    E_PAYLOAD_TOO_LARGE: "E_PAYLOAD_TOO_LARGE";
+    E_LINEAGE: "E_LINEAGE";
+    E_REGRESSION: "E_REGRESSION";
+    E_SCHEMA_AHEAD: "E_SCHEMA_AHEAD";
+    E_LEASE_HELD: "E_LEASE_HELD";
+    E_BLOB_MISSING: "E_BLOB_MISSING";
+    E_BLOB_INTEGRITY: "E_BLOB_INTEGRITY";
+    E_UNAVAILABLE: "E_UNAVAILABLE";
+    E_INTERNAL: "E_INTERNAL";
+}>;
+export type ErrorCode = z.infer<typeof ErrorCode>;
+export declare const ErrorBody: z.ZodObject<{
+    code: z.ZodEnum<{
+        E_NOT_FOUND: "E_NOT_FOUND";
+        E_VALIDATION: "E_VALIDATION";
+        E_UNAUTHENTICATED: "E_UNAUTHENTICATED";
+        E_FORBIDDEN: "E_FORBIDDEN";
+        E_CONFLICT: "E_CONFLICT";
+        E_RATE_LIMITED: "E_RATE_LIMITED";
+        E_PAYLOAD_TOO_LARGE: "E_PAYLOAD_TOO_LARGE";
+        E_LINEAGE: "E_LINEAGE";
+        E_REGRESSION: "E_REGRESSION";
+        E_SCHEMA_AHEAD: "E_SCHEMA_AHEAD";
+        E_LEASE_HELD: "E_LEASE_HELD";
+        E_BLOB_MISSING: "E_BLOB_MISSING";
+        E_BLOB_INTEGRITY: "E_BLOB_INTEGRITY";
+        E_UNAVAILABLE: "E_UNAVAILABLE";
+        E_INTERNAL: "E_INTERNAL";
+    }>;
+    message: z.ZodString;
+    requestId: z.ZodString;
+    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type ErrorBody = z.infer<typeof ErrorBody>;
+export declare const ErrorEnvelope: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    error: z.ZodObject<{
+        code: z.ZodEnum<{
+            E_NOT_FOUND: "E_NOT_FOUND";
+            E_VALIDATION: "E_VALIDATION";
+            E_UNAUTHENTICATED: "E_UNAUTHENTICATED";
+            E_FORBIDDEN: "E_FORBIDDEN";
+            E_CONFLICT: "E_CONFLICT";
+            E_RATE_LIMITED: "E_RATE_LIMITED";
+            E_PAYLOAD_TOO_LARGE: "E_PAYLOAD_TOO_LARGE";
+            E_LINEAGE: "E_LINEAGE";
+            E_REGRESSION: "E_REGRESSION";
+            E_SCHEMA_AHEAD: "E_SCHEMA_AHEAD";
+            E_LEASE_HELD: "E_LEASE_HELD";
+            E_BLOB_MISSING: "E_BLOB_MISSING";
+            E_BLOB_INTEGRITY: "E_BLOB_INTEGRITY";
+            E_UNAVAILABLE: "E_UNAVAILABLE";
+            E_INTERNAL: "E_INTERNAL";
+        }>;
+        message: z.ZodString;
+        requestId: z.ZodString;
+        details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ErrorEnvelope = z.infer<typeof ErrorEnvelope>;
+export type OkEnvelope<T> = {
+    success: true;
+    data: T;
+    meta: {
+        requestId: string;
+    };
+};
+export type Envelope<T> = OkEnvelope<T> | ErrorEnvelope;
+/** HTTP status for each code, so server and client agree. */
+export declare const errorStatus: Record<ErrorCode, number>;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/cloud/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/cloud/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;EAqBpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;iBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;iBAA4D,CAAC;AACvF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AACpF,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;AAExD,6DAA6D;AAC7D,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAgBjD,CAAC"}

package/dist/cloud/envelope.js

@@ -0,0 +1,54 @@
+import { z } from 'zod';
+/**
+ * Stable error codes. Clients branch on `code`, never on `message`.
+ * Codes that describe a refused sync action are never retried blindly: the client must
+ * reassess (pull, then re-verify) first.
+ */
+export const ErrorCode = z.enum([
+    'E_VALIDATION',
+    'E_UNAUTHENTICATED',
+    'E_FORBIDDEN',
+    'E_NOT_FOUND',
+    'E_CONFLICT',
+    'E_RATE_LIMITED',
+    'E_PAYLOAD_TOO_LARGE',
+    /** The manifest does not descend from the stream's current head checkpoint. */
+    'E_LINEAGE',
+    /** The manifest loses rows that no tombstone in the covered segments accounts for. */
+    'E_REGRESSION',
+    /** A segment or manifest uses a schemaVersion newer than the stream accepts. It is quarantined, never dropped. */
+    'E_SCHEMA_AHEAD',
+    /** Another replica holds the exporter lease for this stream. */
+    'E_LEASE_HELD',
+    /** The referenced blob has not been uploaded and verified yet. */
+    'E_BLOB_MISSING',
+    'E_BLOB_INTEGRITY',
+    'E_UNAVAILABLE',
+    'E_INTERNAL',
+]);
+export const ErrorBody = z.object({
+    code: ErrorCode,
+    message: z.string(),
+    requestId: z.string(),
+    details: z.record(z.string(), z.unknown()).optional(),
+});
+export const ErrorEnvelope = z.object({ success: z.literal(false), error: ErrorBody });
+/** HTTP status for each code, so server and client agree. */
+export const errorStatus = {
+    E_VALIDATION: 400,
+    E_UNAUTHENTICATED: 401,
+    E_FORBIDDEN: 403,
+    E_NOT_FOUND: 404,
+    E_CONFLICT: 409,
+    E_LINEAGE: 409,
+    E_REGRESSION: 409,
+    E_LEASE_HELD: 409,
+    E_SCHEMA_AHEAD: 422,
+    E_BLOB_MISSING: 424,
+    E_BLOB_INTEGRITY: 422,
+    E_PAYLOAD_TOO_LARGE: 413,
+    E_RATE_LIMITED: 429,
+    E_UNAVAILABLE: 503,
+    E_INTERNAL: 500,
+};
+//# sourceMappingURL=envelope.js.map

package/dist/cloud/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/cloud/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9B,cAAc;IACd,mBAAmB;IACnB,aAAa;IACb,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,qBAAqB;IACrB,+EAA+E;IAC/E,WAAW;IACX,sFAAsF;IACtF,cAAc;IACd,kHAAkH;IAClH,gBAAgB;IAChB,gEAAgE;IAChE,cAAc;IACd,kEAAkE;IAClE,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;IACf,YAAY;CACb,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAMvF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,WAAW,GAA8B;IACpD,YAAY,EAAE,GAAG;IACjB,iBAAiB,EAAE,GAAG;IACtB,WAAW,EAAE,GAAG;IAChB,WAAW,EAAE,GAAG;IAChB,UAAU,EAAE,GAAG;IACf,SAAS,EAAE,GAAG;IACd,YAAY,EAAE,GAAG;IACjB,YAAY,EAAE,GAAG;IACjB,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,GAAG;IACnB,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,GAAG;IAClB,UAAU,EAAE,GAAG;CAChB,CAAC"}

package/dist/cloud/ids.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+/**
+ * A CLEO project id, read from `.cleo/project-id` (write-once, ADR-094 / T12325).
+ * New projects use a UUID. Older projects carry a 12-hex id. Paths are never identity.
+ */
+export declare const ProjectId: z.ZodString;
+export type ProjectId = z.infer<typeof ProjectId>;
+/** A replica is one `cleo.db` store (per store, not per machine; worktree copies are separate replicas). */
+export declare const ReplicaId: z.ZodString;
+export type ReplicaId = z.infer<typeof ReplicaId>;
+export declare const DeviceId: z.ZodString;
+export type DeviceId = z.infer<typeof DeviceId>;
+export declare const Sha256Hex: z.ZodString;
+export type Sha256Hex = z.infer<typeof Sha256Hex>;
+/**
+ * A journal stream. `project:<projectId>` carries portable·project ops. `home:<userId>` carries
+ * portable·personal ops for one account.
+ */
+export declare const StreamId: z.ZodString;
+export type StreamId = z.infer<typeof StreamId>;
+/**
+ * Hybrid logical clock, encoded so that lexical order is causal order:
+ * 13-digit zero-padded wall millis, 6-digit counter, and the replica id, joined by '-'. Example:
+ * 1790545492500-000003-0192f1c2-....
+ */
+export declare const Hlc: z.ZodString;
+export type Hlc = z.infer<typeof Hlc>;
+/** Base64 (standard alphabet, padded). Used for ciphertext and wrapped keys on the wire. */
+export declare const Base64: z.ZodString;
+//# sourceMappingURL=ids.d.ts.map

package/dist/cloud/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/cloud/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;GAGG;AACH,eAAO,MAAM,SAAS,aAKnB,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,4GAA4G;AAC5G,eAAO,MAAM,SAAS,aAA4D,CAAC;AACnF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,QAAQ,aAAsD,CAAC;AAC5E,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,eAAO,MAAM,SAAS,aAAgE,CAAC;AACvF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD;;;GAGG;AACH,eAAO,MAAM,QAAQ,aAKlB,CAAC;AACJ,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,GAAG,aAA8E,CAAC;AAC/F,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;AAEtC,4FAA4F;AAC5F,eAAO,MAAM,MAAM,aAAgE,CAAC"}

package/dist/cloud/ids.js

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID_V7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const LEGACY_PROJECT_ID = /^[0-9a-f]{12}$/;
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/**
+ * A CLEO project id, read from `.cleo/project-id` (write-once, ADR-094 / T12325).
+ * New projects use a UUID. Older projects carry a 12-hex id. Paths are never identity.
+ */
+export const ProjectId = z
+    .string()
+    .refine((s) => UUID.test(s) || LEGACY_PROJECT_ID.test(s), 'expected a UUID or legacy 12-hex project id');
+/** A replica is one `cleo.db` store (per store, not per machine; worktree copies are separate replicas). */
+export const ReplicaId = z.string().regex(UUID_V7, 'expected a UUIDv7 replica id');
+export const DeviceId = z.string().regex(UUID, 'expected a UUID device id');
+export const Sha256Hex = z.string().regex(SHA256_HEX, 'expected lowercase hex sha256');
+/**
+ * A journal stream. `project:<projectId>` carries portable·project ops. `home:<userId>` carries
+ * portable·personal ops for one account.
+ */
+export const StreamId = z
+    .string()
+    .regex(/^(project:[0-9a-f-]{12,36}|home:[A-Za-z0-9_-]{8,64})$/, 'expected project:<id> or home:<userId>');
+/**
+ * Hybrid logical clock, encoded so that lexical order is causal order:
+ * 13-digit zero-padded wall millis, 6-digit counter, and the replica id, joined by '-'. Example:
+ * 1790545492500-000003-0192f1c2-....
+ */
+export const Hlc = z.string().regex(/^\d{13}-\d{6}-[0-9a-f-]{36}$/, 'expected an encoded HLC');
+/** Base64 (standard alphabet, padded). Used for ciphertext and wrapped keys on the wire. */
+export const Base64 = z.string().regex(/^[A-Za-z0-9+/]*={0,2}$/, 'expected base64');
+//# sourceMappingURL=ids.js.map

package/dist/cloud/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/cloud/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,IAAI,GAAG,gEAAgE,CAAC;AAC9E,MAAM,OAAO,GAAG,uEAAuE,CAAC;AACxF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAChD,6CAA6C,CAC9C,CAAC;AAGJ,4GAA4G;AAC5G,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;AAG5E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;AAGvF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,KAAK,CACJ,uDAAuD,EACvD,wCAAwC,CACzC,CAAC;AAGJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,CAAC;AAG/F,4FAA4F;AAC5F,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC"}