@cleocode/contracts 2026.9.26 → 2026.10.2

package/dist/nexus-vault.d.ts

@@ -0,0 +1,266 @@
+/**
+ * Cloud vault contracts: `cleo cloud push | pull | restore | verify | activity | lease`.
+ *
+ * The vault keeps encrypted snapshots of a project's (or this account's
+ * global) CLEO state on Cleo Nexus, as checkpoints on the project's journal
+ * stream (or the account's `home:` stream). The server stores ciphertext plus
+ * a plaintext manifest of per-table row counts and keyed hashes, and refuses a
+ * snapshot that does not descend from the stream head or whose counts do not
+ * reconcile with the journal.
+ *
+ * Keys (owner decision 2026-10-01): adding a device needs only `cleo login`
+ * and the one-time browser approval. The account master key is escrowed on
+ * the server (stored encrypted under a server-held key, cleo-nexus T082) and
+ * released only to an approved, active device, sealed to that device's X25519
+ * key (`GET /v1/account/keys/escrow`). Snapshots are encrypted, but with keys
+ * the server can recover: server-escrowed encryption, not zero-knowledge.
+ *
+ * The response schemas here parse what the API returns for the endpoints the
+ * wire contract (`./cloud/api.ts`, mirrored from cleo-nexus) does not yet
+ * carry; every object is loose so a newer server's extra fields survive.
+ *
+ * @task T12336
+ * @task T12337
+ * @task T12338
+ * @epic T12322
+ */
+import { z } from 'zod';
+import type { CloudWarning } from './nexus-cloud.js';
+/** `GET /v1/account/keys` (only the fields the vault reads). */
+export declare const nexusUserKeysSchema: z.ZodObject<{
+    keyVersion: z.ZodNumber;
+    masterKeyVerifier: z.ZodString;
+}, z.core.$loose>;
+/** `GET /v1/projects/:projectId/keys`: the caller's wrapped project keys, newest first. */
+export declare const nexusProjectKeysSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodObject<{
+        wrappedProjectKey: z.ZodString;
+        keyVersion: z.ZodNumber;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/** The lease role of the vault's single writer. */
+export declare const NEXUS_VAULT_LEASE_ROLE = "writer";
+/** A lease as `POST /v1/streams/:streamId/leases` answers it (parsed leniently). */
+export declare const nexusLeaseSchema: z.ZodObject<{
+    streamId: z.ZodString;
+    role: z.ZodString;
+    replicaId: z.ZodString;
+    expiresAt: z.ZodISODateTime;
+    forkedFromReplicaId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$loose>;
+/** `POST /v1/streams/:streamId/leases`. */
+export declare const nexusLeaseAcquireSchema: z.ZodObject<{
+    lease: z.ZodObject<{
+        streamId: z.ZodString;
+        role: z.ZodString;
+        replicaId: z.ZodString;
+        expiresAt: z.ZodISODateTime;
+        forkedFromReplicaId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>;
+}, z.core.$loose>;
+/** `GET /v1/streams/:streamId`. */
+export declare const nexusStreamHeadSchema: z.ZodObject<{
+    streamId: z.ZodString;
+    kind: z.ZodOptional<z.ZodString>;
+    headSeq: z.ZodNumber;
+    headCheckpointId: z.ZodNullable<z.ZodString>;
+    /**
+     * The highest segment `schemaVersion` the stream holds (the server raises it on every append).
+     * Absent from an older server.
+     */
+    maxSchemaVersion: z.ZodOptional<z.ZodNumber>;
+}, z.core.$loose>;
+/** One audit event of the caller's own activity. */
+export declare const nexusActivityEventSchema: z.ZodObject<{
+    id: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    at: z.ZodISODateTime;
+    actorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    actorDeviceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    requestId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    action: z.ZodString;
+    target: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    detail: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$loose>;
+/** `GET /v1/account/activity`, one page. */
+export declare const nexusActivityPageSchema: z.ZodObject<{
+    events: z.ZodArray<z.ZodObject<{
+        id: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+        at: z.ZodISODateTime;
+        actorUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        actorDeviceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        requestId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        action: z.ZodString;
+        target: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        detail: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$loose>>;
+    nextBefore: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+}, z.core.$loose>;
+/** Parsed activity event. */
+export type NexusActivityEvent = z.infer<typeof nexusActivityEventSchema>;
+/** Which store a vault command acts on: the current project, or this account's global store. */
+export type CloudVaultScope = 'project' | 'global';
+/** One table of a snapshot manifest. */
+export interface CloudVaultTable {
+    /** Manifest key (the table name). */
+    table: string;
+    /** Row count. */
+    rows: number;
+    /** Keyed hash of the rows (hex). */
+    hash: string;
+}
+/** A per-table comparison line. */
+export interface CloudVaultTableDiff {
+    table: string;
+    /** Rows on this machine, or `null` when the table is absent here. */
+    localRows: number | null;
+    /** Rows in the compared snapshot, or `null` when absent there. */
+    cloudRows: number | null;
+    /** Rows and hash both equal. */
+    match: boolean;
+}
+/** One snapshot (checkpoint) in a stream's lineage. */
+export interface CloudVaultSnapshot {
+    checkpointId: string;
+    parentCheckpointId: string | null;
+    deviceId: string;
+    /** The device's name, when the account's device list has it. */
+    deviceName: string | null;
+    replicaId: string;
+    coversSeq: number;
+    createdAt: string | null;
+    sizeBytes: number;
+    /** Total rows over the manifest. */
+    rows: number;
+    /** Devices that endorsed (co-signed) it. */
+    endorsedBy: string[];
+}
+/** A live lease on the stream. */
+export interface CloudVaultLease {
+    role: string;
+    replicaId: string;
+    deviceId: string | null;
+    deviceName: string | null;
+    expiresAt: string;
+    /** Set when the lease was taken by force: a labelled fork. */
+    forkedFromReplicaId: string | null;
+    /** When the current holder took it, when the server says. */
+    acquiredAt?: string | null;
+    /** This machine holds it. */
+    mine: boolean;
+}
+/** `cleo cloud push`. */
+export interface CloudPushResult {
+    apiUrl: string;
+    scope: CloudVaultScope;
+    streamId: string;
+    /** `pushed`: a new snapshot; `up-to-date`: nothing changed since the head snapshot. */
+    status: 'pushed' | 'up-to-date';
+    snapshot: CloudVaultSnapshot | null;
+    /** The snapshot this one descends from. */
+    parentCheckpointId: string | null;
+    /** The delta segment appended so the counts reconcile, if one was needed. */
+    deltaSegmentSeq: number | null;
+    /** The lease this push holds. */
+    lease: CloudVaultLease | null;
+    /**
+     * A labelled fork: pushed with `--force` over a head this store had not synced, or after
+     * taking another device's live lease. The label is on the snapshot itself (T13007).
+     */
+    forked: boolean;
+    warnings: CloudWarning[];
+}
+/** `cleo cloud pull` / `cleo cloud restore`. */
+export interface CloudRestoreResult {
+    apiUrl: string;
+    scope: CloudVaultScope;
+    streamId: string;
+    /** `restored`: the snapshot was activated; `up-to-date`: this machine already holds the head. */
+    status: 'restored' | 'up-to-date';
+    snapshot: CloudVaultSnapshot | null;
+    /** Where the store was placed (project root, or the CLEO home for global). */
+    target: string;
+    /** Every table's count and hash matched the manifest before activation. */
+    verified: boolean;
+    /** Tables checked. */
+    tables: number;
+    /** Local safety backup taken before activation, if any. */
+    safetyBackup: string | null;
+    warnings: CloudWarning[];
+}
+/** `cleo cloud verify`. */
+export interface CloudVerifyResult {
+    apiUrl: string;
+    scope: CloudVaultScope;
+    streamId: string;
+    /** `match`: local equals the head snapshot; `ahead`: local changed since this machine's last snapshot; `behind`: the cloud has a newer snapshot; `diverged`: both; `empty`: no snapshot yet; `untrusted`: the head snapshot's signature does not verify against a trusted device key (nothing is compared with it). */
+    verdict: 'match' | 'ahead' | 'behind' | 'diverged' | 'empty' | 'untrusted';
+    /** What to do about a verdict other than `match` (or a failed integrity check); `null` when nothing. */
+    remedy: string | null;
+    /** Local store passed SQLite integrity_check. */
+    localIntegrity: boolean;
+    head: CloudVaultSnapshot | null;
+    /** This machine's last pushed or restored snapshot. */
+    lastSynced: string | null;
+    /** Local vs head snapshot, per table. */
+    tables: CloudVaultTableDiff[];
+    /** The newest snapshot each device wrote, and whether its manifest equals the head's. */
+    devices: Array<{
+        deviceId: string;
+        deviceName: string | null;
+        checkpointId: string;
+        createdAt: string | null;
+        matchesHead: boolean;
+    }>;
+    warnings: CloudWarning[];
+}
+/** `cleo cloud vault` (status of the vault for the current store). */
+export interface CloudVaultStatusResult {
+    apiUrl: string;
+    scope: CloudVaultScope;
+    streamId: string;
+    headSeq: number;
+    head: CloudVaultSnapshot | null;
+    /** Newest first, at most 100 (the server's list ceiling). */
+    lineage: CloudVaultSnapshot[];
+    /** Newest snapshot per device. */
+    lastPushByDevice: Array<{
+        deviceId: string;
+        deviceName: string | null;
+        checkpointId: string;
+        createdAt: string | null;
+    }>;
+    /** Tables whose local rows or hash differ from this machine's last snapshot. */
+    pendingChanges: CloudVaultTableDiff[];
+    lastSynced: string | null;
+    leases: CloudVaultLease[];
+    warnings: CloudWarning[];
+}
+/** `cleo cloud lease release`. */
+export interface CloudLeaseReleaseResult {
+    apiUrl: string;
+    scope: CloudVaultScope;
+    streamId: string;
+    released: boolean;
+    warnings: CloudWarning[];
+}
+/** One line of `cleo cloud activity`. */
+export interface CloudActivityItem {
+    at: string;
+    action: string;
+    target: string | null;
+    deviceId: string | null;
+    deviceName: string | null;
+    /** This machine did it. */
+    thisDevice: boolean;
+}
+/** `cleo cloud activity`. */
+export interface CloudActivityResult {
+    apiUrl: string;
+    /** The project the list is filtered to, if any. */
+    projectId: string | null;
+    items: CloudActivityItem[];
+    /** The server has older events (`--before` this). */
+    nextBefore: string | null;
+    warnings: CloudWarning[];
+}
+//# sourceMappingURL=nexus-vault.d.ts.map

package/dist/nexus-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../src/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAOrD,gEAAgE;AAChE,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,sBAAsB;;;;;iBAIjC,CAAC;AAIH,mDAAmD;AACnD,eAAO,MAAM,sBAAsB,WAAW,CAAC;AAE/C,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;;;;iBAM3B,CAAC;AAEH,2CAA2C;AAC3C,eAAO,MAAM,uBAAuB;;;;;;;;iBAA6C,CAAC;AAElF,mCAAmC;AACnC,eAAO,MAAM,qBAAqB;;;;;IAKhC;;;OAGG;;iBAEH,CAAC;AAIH,oDAAoD;AACpD,eAAO,MAAM,wBAAwB;;;;;;;;;iBASnC,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAGlC,CAAC;AAEH,6BAA6B;AAC7B,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnD,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kEAAkE;IAClE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,4CAA4C;IAC5C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,6BAA6B;IAC7B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,yBAAyB;AACzB,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC;IAChC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,2CAA2C;IAC3C,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iCAAiC;IACjC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAClC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,CAAC;IAClB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,2BAA2B;AAC3B,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,uTAAuT;IACvT,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3E,wGAAwG;IACxG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iDAAiD;IACjD,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChC,uDAAuD;IACvD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yCAAyC;IACzC,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,yFAAyF;IACzF,OAAO,EAAE,KAAK,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC,CAAC;IACH,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChC,6DAA6D;IAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,kCAAkC;IAClC,gBAAgB,EAAE,KAAK,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,CAAC;IACH,gFAAgF;IAChF,cAAc,EAAE,mBAAmB,EAAE,CAAC;IACtC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,kCAAkC;AAClC,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2BAA2B;IAC3B,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,6BAA6B;AAC7B,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,qDAAqD;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B"}

package/dist/nexus-vault.js

@@ -0,0 +1,82 @@
+/**
+ * Cloud vault contracts: `cleo cloud push | pull | restore | verify | activity | lease`.
+ *
+ * The vault keeps encrypted snapshots of a project's (or this account's
+ * global) CLEO state on Cleo Nexus, as checkpoints on the project's journal
+ * stream (or the account's `home:` stream). The server stores ciphertext plus
+ * a plaintext manifest of per-table row counts and keyed hashes, and refuses a
+ * snapshot that does not descend from the stream head or whose counts do not
+ * reconcile with the journal.
+ *
+ * Keys (owner decision 2026-10-01): adding a device needs only `cleo login`
+ * and the one-time browser approval. The account master key is escrowed on
+ * the server (stored encrypted under a server-held key, cleo-nexus T082) and
+ * released only to an approved, active device, sealed to that device's X25519
+ * key (`GET /v1/account/keys/escrow`). Snapshots are encrypted, but with keys
+ * the server can recover: server-escrowed encryption, not zero-knowledge.
+ *
+ * The response schemas here parse what the API returns for the endpoints the
+ * wire contract (`./cloud/api.ts`, mirrored from cleo-nexus) does not yet
+ * carry; every object is loose so a newer server's extra fields survive.
+ *
+ * @task T12336
+ * @task T12337
+ * @task T12338
+ * @epic T12322
+ */
+import { z } from 'zod';
+const isoTime = z.iso.datetime({ offset: true });
+const uuid = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i);
+// ---------- wire: reads the vault parses leniently ----------
+/** `GET /v1/account/keys` (only the fields the vault reads). */
+export const nexusUserKeysSchema = z.looseObject({
+    keyVersion: z.number().int().positive(),
+    masterKeyVerifier: z.string(),
+});
+/** `GET /v1/projects/:projectId/keys`: the caller's wrapped project keys, newest first. */
+export const nexusProjectKeysSchema = z.looseObject({
+    keys: z.array(z.looseObject({ wrappedProjectKey: z.string(), keyVersion: z.number().int().positive() })),
+});
+// ---------- wire: leases (cleo-nexus T083) ----------
+/** The lease role of the vault's single writer. */
+export const NEXUS_VAULT_LEASE_ROLE = 'writer';
+/** A lease as `POST /v1/streams/:streamId/leases` answers it (parsed leniently). */
+export const nexusLeaseSchema = z.looseObject({
+    streamId: z.string(),
+    role: z.string(),
+    replicaId: uuid,
+    expiresAt: isoTime,
+    forkedFromReplicaId: uuid.nullable().optional(),
+});
+/** `POST /v1/streams/:streamId/leases`. */
+export const nexusLeaseAcquireSchema = z.looseObject({ lease: nexusLeaseSchema });
+/** `GET /v1/streams/:streamId`. */
+export const nexusStreamHeadSchema = z.looseObject({
+    streamId: z.string(),
+    kind: z.string().optional(),
+    headSeq: z.number().int().nonnegative(),
+    headCheckpointId: z.string().nullable(),
+    /**
+     * The highest segment `schemaVersion` the stream holds (the server raises it on every append).
+     * Absent from an older server.
+     */
+    maxSchemaVersion: z.number().int().nonnegative().optional(),
+});
+// ---------- wire: activity (E18 `GET /v1/account/activity`) ----------
+/** One audit event of the caller's own activity. */
+export const nexusActivityEventSchema = z.looseObject({
+    id: z.union([z.string(), z.number()]),
+    at: isoTime,
+    actorUserId: z.string().nullable().optional(),
+    actorDeviceId: z.string().nullable().optional(),
+    requestId: z.string().nullable().optional(),
+    action: z.string(),
+    target: z.string().nullable().optional(),
+    detail: z.unknown().optional(),
+});
+/** `GET /v1/account/activity`, one page. */
+export const nexusActivityPageSchema = z.looseObject({
+    events: z.array(nexusActivityEventSchema),
+    nextBefore: z.union([z.string(), z.number()]).nullable().optional(),
+});
+//# sourceMappingURL=nexus-vault.js.map

package/dist/nexus-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-vault.js","sourceRoot":"","sources":["../src/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACjD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;AAEjG,+DAA+D;AAE/D,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9B,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,KAAK,CACX,CAAC,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAC1F;CACF,CAAC,CAAC;AAEH,uDAAuD;AAEvD,mDAAmD;AACnD,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAE/C,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,OAAO;IAClB,mBAAmB,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAElF,mCAAmC;AACnC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,wEAAwE;AAExE,oDAAoD;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC"}

package/dist/portable-bundle.d.ts

@@ -66,6 +66,11 @@ export interface PortableFileEntry {
     sha256: string;
     /** True when the file was classified as a secret (only present in encrypted bundles). */
     secret: boolean;
+    /**
+     * True when the exporting checkout's git tracks this path (the cloud vault
+     * leaves tracked files to git, T13019). Absent otherwise.
+     */
+    gitTracked?: boolean;
 }
 /** A symbolic link inside the root whose target also stays inside the root. */
 export interface PortableSymlinkEntry {

package/dist/portable-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portable-bundle.d.ts","sourceRoot":"","sources":["../src/portable-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAMxF;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAM3E;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEtE,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,IAAI,EAAE,oBAAoB,CAAC;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,yFAAyF;IACzF,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAMD,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,2BAA2B;IAC3B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,kDAAkD;IAClD,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,8FAA8F;IAC9F,eAAe,EAAE,mBAAmB,EAAE,CAAC;IACvC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;CAC/C;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;IAClB,0BAA0B;IAC1B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,qFAAqF;AACrF,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEvD,wCAAwC;AACxC,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,yGAAyG;IACzG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,SAAS,EAAE,iBAAiB,CAAC;IAC7B,oDAAoD;IACpD,oBAAoB,EAAE,8BAA8B,CAAC;CACtD;AAED,iDAAiD;AACjD,MAAM,WAAW,qBAAqB;IACpC,4BAA4B;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,yEAAyE;IACzE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,4DAA4D;IAC5D,SAAS,EAAE,iBAAiB,CAAC;IAC7B,qEAAqE;IACrE,oBAAoB,EAAE,8BAA8B,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,eAAe,GACf,WAAW,GACX,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAMD,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,qBAAqB;IACrB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,kFAAkF;IAClF,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB;IAClB,MAAM,EAAE;QACN,8BAA8B;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,0CAA0C;QAC1C,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB;QACpB,KAAK,EAAE,mBAAmB,CAAC;QAC3B,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAC;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,SAAS,EAAE,OAAO,CAAC;QACnB,6EAA6E;QAC7E,eAAe,EAAE,OAAO,CAAC;QACzB,0FAA0F;QAC1F,gBAAgB,EAAE,IAAI,CAAC;KACxB,CAAC;IACF,gEAAgE;IAChE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACrC,wBAAwB;IACxB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,sDAAsD;IACtD,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1C,uBAAuB;IACvB,SAAS,EAAE;QACT,qBAAqB;QACrB,SAAS,EAAE,QAAQ,CAAC;QACpB,yEAAyE;QACzE,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,uCAAuC;IACvC,SAAS,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,MAAM,EAAE;QACN,mBAAmB;QACnB,QAAQ,EAAE,IAAI,CAAC;QACf,uDAAuD;QACvD,SAAS,EAAE,OAAO,CAAC;QACnB,0CAA0C;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,uEAAuE;QACvE,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,2BAA2B;IAC3B,QAAQ,EAAE,KAAK,CAAC;QACd,oDAAoD;QACpD,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAAC;QAClD,mBAAmB;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,oCAAoC;QACpC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oCAAoC;QACpC,SAAS,EAAE,MAAM,CAAC;QAClB,gCAAgC;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,wBAAwB;QACxB,SAAS,CAAC,EAAE,iBAAiB,CAAC;QAC9B,0DAA0D;QAC1D,oBAAoB,CAAC,EAAE,8BAA8B,CAAC;QACtD,oCAAoC;QACpC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QAC9B,kDAAkD;QAClD,eAAe,EAAE,mBAAmB,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,+CAA+C;IAC/C,OAAO,CAAC,EAAE;QACR,sCAAsC;QACtC,UAAU,EAAE,MAAM,CAAC;QACnB,yBAAyB;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,0CAA0C;QAC1C,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;KAC9D,CAAC;CACH;AAED,+DAA+D;AAC/D,MAAM,WAAW,uBAAuB;IACtC,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,+FAA+F;IAC/F,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;IACxC,2DAA2D;IAC3D,eAAe,EAAE,mBAAmB,EAAE,CAAC;IACvC;;;;OAIG;IACH,sBAAsB,EAAE,mBAAmB,EAAE,CAAC;CAC/C;AAED,uCAAuC;AACvC,MAAM,WAAW,2BAA2B;IAC1C,oBAAoB;IACpB,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAAC;IAClD,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gFAAgF;IAChF,UAAU,EAAE,KAAK,CAAC,uBAAuB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,sCAAsC;IACtC,SAAS,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1C,oEAAoE;IACpE,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,gEAAgE;IAChE,oBAAoB,CAAC,EAAE,8BAA8B,CAAC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,EAAE;QACT,eAAe;QACf,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;QAC1F,cAAc;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,4BAA4B;IAC5B,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACxC,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,eAAe,EAAE,OAAO,CAAC;IACzB,gEAAgE;IAChE,eAAe,EAAE,KAAK,CAAC,mBAAmB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,oBAAoB,GAAG;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,iBAAiB,GAAG;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACzD,CAAC;CACH"}
+{"version":3,"file":"portable-bundle.d.ts","sourceRoot":"","sources":["../src/portable-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAMxF;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAM3E;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEtE,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,IAAI,EAAE,oBAAoB,CAAC;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,+EAA+E;AAC/E,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,gGAAgG;IAChG,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC,yFAAyF;IACzF,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAMD,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,2BAA2B;IAC3B,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,kDAAkD;IAClD,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,8FAA8F;IAC9F,eAAe,EAAE,mBAAmB,EAAE,CAAC;IACvC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;CAC/C;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,oFAAoF;IACpF,QAAQ,EAAE,OAAO,CAAC;IAClB,0BAA0B;IAC1B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,qFAAqF;AACrF,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEvD,wCAAwC;AACxC,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,yGAAyG;IACzG,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,SAAS,EAAE,iBAAiB,CAAC;IAC7B,oDAAoD;IACpD,oBAAoB,EAAE,8BAA8B,CAAC;CACtD;AAED,iDAAiD;AACjD,MAAM,WAAW,qBAAqB;IACpC,4BAA4B;IAC5B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,yEAAyE;IACzE,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,4DAA4D;IAC5D,SAAS,EAAE,iBAAiB,CAAC;IAC7B,qEAAqE;IACrE,oBAAoB,EAAE,8BAA8B,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,eAAe,GACf,WAAW,GACX,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,yEAAyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAMD,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,qBAAqB;IACrB,MAAM,EAAE,sBAAsB,CAAC;IAC/B,kFAAkF;IAClF,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB;IAClB,MAAM,EAAE;QACN,8BAA8B;QAC9B,SAAS,EAAE,MAAM,CAAC;QAClB,0CAA0C;QAC1C,WAAW,EAAE,MAAM,CAAC;QACpB,oBAAoB;QACpB,KAAK,EAAE,mBAAmB,CAAC;QAC3B,wCAAwC;QACxC,KAAK,EAAE,MAAM,CAAC;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,SAAS,EAAE,OAAO,CAAC;QACnB,6EAA6E;QAC7E,eAAe,EAAE,OAAO,CAAC;QACzB,0FAA0F;QAC1F,gBAAgB,EAAE,IAAI,CAAC;KACxB,CAAC;IACF,gEAAgE;IAChE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACrC,wBAAwB;IACxB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,sDAAsD;IACtD,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1C,uBAAuB;IACvB,SAAS,EAAE;QACT,qBAAqB;QACrB,SAAS,EAAE,QAAQ,CAAC;QACpB,yEAAyE;QACzE,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,uCAAuC;IACvC,SAAS,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,eAAe,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,MAAM,EAAE;QACN,mBAAmB;QACnB,QAAQ,EAAE,IAAI,CAAC;QACf,uDAAuD;QACvD,SAAS,EAAE,OAAO,CAAC;QACnB,0CAA0C;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,uEAAuE;QACvE,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,2BAA2B;IAC3B,QAAQ,EAAE,KAAK,CAAC;QACd,oDAAoD;QACpD,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAAC;QAClD,mBAAmB;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,oCAAoC;QACpC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oCAAoC;QACpC,SAAS,EAAE,MAAM,CAAC;QAClB,gCAAgC;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,wBAAwB;QACxB,SAAS,CAAC,EAAE,iBAAiB,CAAC;QAC9B,0DAA0D;QAC1D,oBAAoB,CAAC,EAAE,8BAA8B,CAAC;QACtD,oCAAoC;QACpC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;QAC9B,kDAAkD;QAClD,eAAe,EAAE,mBAAmB,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,+CAA+C;IAC/C,OAAO,CAAC,EAAE;QACR,sCAAsC;QACtC,UAAU,EAAE,MAAM,CAAC;QACnB,yBAAyB;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,0CAA0C;QAC1C,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;KAC9D,CAAC;CACH;AAED,+DAA+D;AAC/D,MAAM,WAAW,uBAAuB;IACtC,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,+FAA+F;IAC/F,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;IACxC,2DAA2D;IAC3D,eAAe,EAAE,mBAAmB,EAAE,CAAC;IACvC;;;;OAIG;IACH,sBAAsB,EAAE,mBAAmB,EAAE,CAAC;CAC/C;AAED,uCAAuC;AACvC,MAAM,WAAW,2BAA2B;IAC1C,oBAAoB;IACpB,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAAC;IAClD,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qBAAqB;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,yBAAyB;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gFAAgF;IAChF,UAAU,EAAE,KAAK,CAAC,uBAAuB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE,sCAAsC;IACtC,SAAS,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1C,oEAAoE;IACpE,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,gEAAgE;IAChE,oBAAoB,CAAC,EAAE,8BAA8B,CAAC;IACtD,+DAA+D;IAC/D,QAAQ,CAAC,EAAE;QACT,eAAe;QACf,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,QAAQ,CAAC;QAC1F,cAAc;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,4BAA4B;IAC5B,QAAQ,EAAE,2BAA2B,EAAE,CAAC;IACxC,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,eAAe,EAAE,OAAO,CAAC;IACzB,gEAAgE;IAChE,eAAe,EAAE,KAAK,CAAC,mBAAmB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClE;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,oBAAoB,GAAG;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,iBAAiB,GAAG;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACzD,CAAC;CACH"}

package/dist/resource-governor.d.ts

@@ -44,6 +44,19 @@ export type ResourceClass = 'interactive-cli' | 'agent-session' | 'llm-call' | '
 export declare const RESOURCE_CLASSES: readonly ResourceClass[];
 /** Error code emitted when an acquire is denied because no slot is available. */
 export declare const RESOURCE_DEFERRED_CODE: "E_RESOURCE_DEFERRED";
+/**
+ * `cleo run`: the admitted command exited non-zero, was killed by a signal, or
+ * could not be started. The envelope's `details` carry the exit code/signal.
+ * @task T12979
+ */
+export declare const RUN_COMMAND_FAILED_CODE: "E_COMMAND_FAILED";
+/**
+ * `cleo run` exit code for "not admitted, nothing started"
+ * (sysexits EX_TEMPFAIL). Note a child may itself exit 75; the envelope's
+ * `error.code` tells the two apart.
+ * @task T12980
+ */
+export declare const RUN_DEFERRED_EXIT_CODE = 75;
 /**
  * Soft-signal code raised on the next admit when the host enters `backoff` —
  * asks granted work to checkpoint. Existing grants are NEVER revoked.

package/dist/resource-governor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-governor.d.ts","sourceRoot":"","sources":["../src/resource-governor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,eAAe,GACf,UAAU,GACV,UAAU,GACV,cAAc,GACd,YAAY,GACZ,UAAU,GACV,uBAAuB,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EASnD,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,EAAG,qBAA8B,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAG,yBAAkC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oCAAoC;IACpC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,IAAI,aAAa,CAEtE;AAED,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mGAAmG;AACnG,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,yBAAyB,EAAE,YAAY,CAAC,GAChF,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oHAAoH;IACpH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,WAAW,GACX,UAAU,GACV,cAAc,GACd,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB;;;;;;;;;GASG;AACH,MAAM,WAAW,iCAAiC;IAChD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iGAAiG;IACjG,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,iBAAiB,CAAC;IACxD,oFAAoF;IACpF,QAAQ,CAAC,cAAc,CAAC,EAAE,iCAAiC,CAAC;IAC5D,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAC;IACxD,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EACvB,gBAAgB,GAChB,sBAAsB,GACtB,yBAAyB,GACzB,YAAY,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C"}
+{"version":3,"file":"resource-governor.d.ts","sourceRoot":"","sources":["../src/resource-governor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,OAAO,GAAG,KAAK,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,eAAe,GACf,UAAU,GACV,UAAU,GACV,cAAc,GACd,YAAY,GACZ,UAAU,GACV,uBAAuB,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EASnD,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,EAAG,qBAA8B,CAAC;AAErE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAG,kBAA2B,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAG,yBAAkC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oCAAoC;IACpC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAErD,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,IAAI,aAAa,CAEtE;AAED,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACpC,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mGAAmG;AACnG,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,yBAAyB,EAAE,YAAY,CAAC,GAChF,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,oHAAoH;IACpH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACjD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,WAAW,GACX,UAAU,GACV,cAAc,GACd,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB;;;;;;;;;GASG;AACH,MAAM,WAAW,iCAAiC;IAChD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAC;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,iGAAiG;IACjG,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,iBAAiB,CAAC;IACxD,oFAAoF;IACpF,QAAQ,CAAC,cAAc,CAAC,EAAE,iCAAiC,CAAC;IAC5D,uFAAuF;IACvF,QAAQ,CAAC,YAAY,EAAE,eAAe,GAAG,cAAc,CAAC;IACxD,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EACvB,gBAAgB,GAChB,sBAAsB,GACtB,yBAAyB,GACzB,YAAY,CAAC;IACjB,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C"}

package/dist/resource-governor.js

@@ -31,6 +31,19 @@ export const RESOURCE_CLASSES = Object.freeze([
 ]);
 /** Error code emitted when an acquire is denied because no slot is available. */
 export const RESOURCE_DEFERRED_CODE = 'E_RESOURCE_DEFERRED';
+/**
+ * `cleo run`: the admitted command exited non-zero, was killed by a signal, or
+ * could not be started. The envelope's `details` carry the exit code/signal.
+ * @task T12979
+ */
+export const RUN_COMMAND_FAILED_CODE = 'E_COMMAND_FAILED';
+/**
+ * `cleo run` exit code for "not admitted, nothing started"
+ * (sysexits EX_TEMPFAIL). Note a child may itself exit 75; the envelope's
+ * `error.code` tells the two apart.
+ * @task T12980
+ */
+export const RUN_DEFERRED_EXIT_CODE = 75;
 /**
  * Soft-signal code raised on the next admit when the host enters `backoff` —
  * asks granted work to checkpoint. Existing grants are NEVER revoked.

package/dist/resource-governor.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-governor.js","sourceRoot":"","sources":["../src/resource-governor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmCH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA6B,MAAM,CAAC,MAAM,CAAC;IACtE,iBAAiB;IACjB,eAAe;IACf,UAAU;IACV,UAAU;IACV,cAAc;IACd,YAAY;IACZ,UAAU;IACV,uBAAuB;CACxB,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAA8B,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAkC,CAAC;AA0C7E;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,CAAkB;IAChD,OAAO,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"resource-governor.js","sourceRoot":"","sources":["../src/resource-governor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAmCH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA6B,MAAM,CAAC,MAAM,CAAC;IACtE,iBAAiB;IACjB,eAAe;IACf,UAAU;IACV,UAAU;IACV,cAAc;IACd,YAAY;IACZ,UAAU;IACV,uBAAuB;CACxB,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAA8B,CAAC;AAErE;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAA2B,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAkC,CAAC;AA0C7E;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAErD,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,CAAkB;IAChD,OAAO,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC9B,CAAC"}

package/dist/sync-schema.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The sync schema version: one numbering for the data on a Cleo Nexus journal
+ * stream (`project:<id>`, `home:<userId>`), shared by both of its writers
+ * (cleo-dev decision on T13034).
+ *
+ * - The change journal stamps it as each segment's `schemaVersion` (journal
+ *   spec §2.9: `schemaVersion = SYNC_SCHEMA_VERSION`), and a receiver refuses
+ *   a higher one (`E_SCHEMA_AHEAD`) until it upgrades.
+ * - The cloud vault stamps it on its `cleo-vault-delta/v1` segments and its
+ *   checkpoint manifests.
+ *
+ * Until the journal's sealer stamps segments, only the vault uses it. T13040
+ * (`SYNC_SET_VERSION`, which feeds the segment `schemaVersion`) must import
+ * this constant rather than define a second number, and test that a sealed
+ * segment's `schemaVersion` equals it.
+ *
+ * One number for both, so a vault segment inside a journal window is never a
+ * schema rise of its own: the server pins every rise in a checkpoint/v3
+ * manifest (`replayPin.transitions`) and holds a v3 manifest's `schemaVersion`
+ * at or above the parent's and the window's last rise. Bump it once, for both
+ * writers, when the synced data changes shape. It is not the vault's manifest
+ * computation format (`VAULT_MANIFEST_FORMAT_VERSION` in `@cleocode/core`),
+ * which never reaches the wire.
+ *
+ * This file is const data only (arch gate 10). Not part of `./cloud`: the
+ * server mirrors that directory and only bounds this number
+ * (`MAX_SCHEMA_VERSION`); the numbering is the client's.
+ *
+ * @task T13034
+ * @epic T12323
+ */
+/** The `schemaVersion` the change journal and the cloud vault stamp on what they write. */
+export declare const SYNC_SCHEMA_VERSION = 2;
+//# sourceMappingURL=sync-schema.d.ts.map

package/dist/sync-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-schema.d.ts","sourceRoot":"","sources":["../src/sync-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB,IAAI,CAAC"}

package/dist/sync-schema.js

@@ -0,0 +1,34 @@
+/**
+ * The sync schema version: one numbering for the data on a Cleo Nexus journal
+ * stream (`project:<id>`, `home:<userId>`), shared by both of its writers
+ * (cleo-dev decision on T13034).
+ *
+ * - The change journal stamps it as each segment's `schemaVersion` (journal
+ *   spec §2.9: `schemaVersion = SYNC_SCHEMA_VERSION`), and a receiver refuses
+ *   a higher one (`E_SCHEMA_AHEAD`) until it upgrades.
+ * - The cloud vault stamps it on its `cleo-vault-delta/v1` segments and its
+ *   checkpoint manifests.
+ *
+ * Until the journal's sealer stamps segments, only the vault uses it. T13040
+ * (`SYNC_SET_VERSION`, which feeds the segment `schemaVersion`) must import
+ * this constant rather than define a second number, and test that a sealed
+ * segment's `schemaVersion` equals it.
+ *
+ * One number for both, so a vault segment inside a journal window is never a
+ * schema rise of its own: the server pins every rise in a checkpoint/v3
+ * manifest (`replayPin.transitions`) and holds a v3 manifest's `schemaVersion`
+ * at or above the parent's and the window's last rise. Bump it once, for both
+ * writers, when the synced data changes shape. It is not the vault's manifest
+ * computation format (`VAULT_MANIFEST_FORMAT_VERSION` in `@cleocode/core`),
+ * which never reaches the wire.
+ *
+ * This file is const data only (arch gate 10). Not part of `./cloud`: the
+ * server mirrors that directory and only bounds this number
+ * (`MAX_SCHEMA_VERSION`); the numbering is the client's.
+ *
+ * @task T13034
+ * @epic T12323
+ */
+/** The `schemaVersion` the change journal and the cloud vault stamp on what they write. */
+export const SYNC_SCHEMA_VERSION = 2;
+//# sourceMappingURL=sync-schema.js.map

package/dist/sync-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-schema.js","sourceRoot":"","sources":["../src/sync-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC"}

package/dist/task.d.ts

@@ -238,6 +238,30 @@ export type EvidenceAtom = {
     passCount: number;
     failCount: number;
     skipCount: number;
+    /**
+     * HEAD of the checkout the report was bound to at verify time (T12965):
+     * the task's change-set root (its worktree when one is registered), the
+     * root `cleo done` and `cleo complete` recompute the tree in. Absent when
+     * that root is not a git checkout, and on atoms recorded before T12965.
+     */
+    headSha?: string;
+    /**
+     * Git tree of that checkout at verify time, as the tool cache computes
+     * it (T12958): HEAD's tree with every uncommitted, not-ignored change
+     * applied (T12965). `cleo complete` refuses the atom once the tree no
+     * longer matches, unless `ci:<pr>` or a full tool run carries the gate.
+     */
+    treeHash?: string;
+    /** Test files the report covered, relative to the bound checkout (capped, T12965). */
+    testFiles?: string[];
+    /** Total test files the report covered; exceeds `testFiles.length` when capped. */
+    testFileCount?: number;
+    /**
+     * Affected packages (changed, or depending on a changed one) with no
+     * test file, so no report could cover them — recorded like
+     * `tool:test-affected`'s `untestedPackages` (T12965 review).
+     */
+    untestedPackages?: string[];
 } | {
     kind: 'tool';
     tool: string;
@@ -258,14 +282,38 @@ export type EvidenceAtom = {
      * `affected`: the run covered only the packages the branch diff touches
      * plus their dependents (D11150, T12635). It satisfies testsPassed before
      * merge; merged CI (`ci:`) or a full `tool:test` supersedes it.
+     *
+     * `full`: a scope-aware `tool:test` ran the whole suite (T12959) —
+     * no affected template is declared, the project opted out
+     * (`testing.preferAffected: false`), the change has merged, or the
+     * affected planner refused; `scopeReason` says which when known.
+     */
+    scope?: 'affected' | 'full';
+    /**
+     * With `scope: 'full'`: why a scope-aware `tool:test` ran the full suite.
+     * With `scope: 'affected'`: what the scope rests on — dependents come
+     * only from declared workspace package dependencies (T12959).
      */
-    scope?: 'affected';
+    scopeReason?: string;
     /** The packages the affected run covered (with `scope: 'affected'`). */
     affectedPackages?: string[];
     /** The test projects the affected run actually selected (incl. non-package projects). */
     affectedProjects?: string[];
     /** Affected DEPENDENT packages with no test project (a changed one refuses the scope). */
     untestedPackages?: string[];
+    /**
+     * Test files that failed and then passed on their single retry
+     * (T12961). The run counts as a pass; this marks it as a FLAKY pass so
+     * it stays visible instead of reading as a clean one.
+     */
+    flaky?: string[];
+    /**
+     * Git tree of the source the run measured (T12958): HEAD's tree with
+     * every uncommitted, not-ignored change applied.
+     */
+    treeHash?: string;
+    /** `true` when the result was served from the tool cache (no spawn). */
+    cacheHit?: boolean;
 } | {
     kind: 'url';
     url: string;