@cleocode/core 2026.10.20 → 2026.10.21-rc.ci.692

package/dist/build-provenance.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "gitHead": "61df8623708aa137827194be3bfb5decfbf27913",
-  "builtAt": "2026-10-18T03:59:18.365Z",
+  "gitHead": "11de064096d9a7ef470818c8c9b7bcb83a29b343",
+  "builtAt": "2026-10-22T16:43:46.631Z",
   "linkedWorktree": null
 }

package/dist/cloud/http.d.ts

@@ -36,6 +36,16 @@ export interface HttpOptions {
 export declare const MAX_RETRY_AFTER_MS = 30000;
 /** True for https URLs, and for http URLs on a loopback host. */
 export declare function isSecureUrl(url: string): boolean;
+/**
+ * The header saying this client reads journal (checkpoint/v3) streams (T13867).
+ * Cleo Nexus refuses a v3 stream's checkpoint and head reads to a request
+ * without it (T13876): such a client reads only snapshots and would report a
+ * stale store as current. Released v2026.10.19 does not send it.
+ */
+export declare const NEXUS_STREAM_READER_HEADER: {
+    readonly name: "x-cleo-stream-reader";
+    readonly value: "3";
+};
 /**
  * Minimal envelope-aware HTTP client. It retries only failures that are safe to retry. Every API
  * write is idempotent or lineage-checked, so a retried write either no-ops or is refused explicitly.

package/dist/cloud/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/cloud/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAErE,qBAAa,UAAW,SAAQ,KAAK;IAKjC,QAAQ,CAAC,IAAI,EAAE,eAAe;IAE9B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAR5C,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAGpB,IAAI,EAAE,eAAe,EAC9B,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAM7C;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,kGAAkG;AAClG,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAID,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAIzC,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOhD;AAED;;;;GAIG;AACH,qBAAa,IAAI;IAYH,OAAO,CAAC,QAAQ,CAAC,CAAC;IAX9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAQ;gBAEZ,CAAC,EAAE,WAAW;IAa3C,kHAAkH;IAC5G,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,CAAC,CAAC;IAIb;;;OAGG;IACG,iBAAiB,CAAC,CAAC,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA4DxC;AAED,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAM7E"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/cloud/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAErE,qBAAa,UAAW,SAAQ,KAAK;IAKjC,QAAQ,CAAC,IAAI,EAAE,eAAe;IAE9B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAR5C,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAGpB,IAAI,EAAE,eAAe,EAC9B,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAM7C;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,kGAAkG;AAClG,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAID,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAIzC,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOhD;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B;;;CAAwD,CAAC;AAEhG;;;;GAIG;AACH,qBAAa,IAAI;IAYH,OAAO,CAAC,QAAQ,CAAC,CAAC;IAX9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAQ;gBAEZ,CAAC,EAAE,WAAW;IAa3C,kHAAkH;IAC5G,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,CAAC,CAAC;IAIb;;;OAGG;IACG,iBAAiB,CAAC,CAAC,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CA6DxC;AAED,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAM7E"}

package/dist/cloud/http.js

@@ -29,6 +29,13 @@ export function isSecureUrl(url) {
         return false;
     }
 }
+/**
+ * The header saying this client reads journal (checkpoint/v3) streams (T13867).
+ * Cleo Nexus refuses a v3 stream's checkpoint and head reads to a request
+ * without it (T13876): such a client reads only snapshots and would report a
+ * stale store as current. Released v2026.10.19 does not send it.
+ */
+export const NEXUS_STREAM_READER_HEADER = { name: 'x-cleo-stream-reader', value: '3' };
 /**
  * Minimal envelope-aware HTTP client. It retries only failures that are safe to retry. Every API
  * write is idempotent or lineage-checked, so a retried write either no-ops or is refused explicitly.
@@ -71,6 +78,7 @@ export class Http {
                 const headers = { authorization: `Bearer ${this.o.token}` };
                 if (this.o.deviceId)
                     headers['x-cleo-device-id'] = this.o.deviceId;
+                headers[NEXUS_STREAM_READER_HEADER.name] = NEXUS_STREAM_READER_HEADER.value;
                 if (body !== undefined)
                     headers['content-type'] = 'application/json';
                 res = await this.fetch(`${this.o.baseUrl}${path}`, {

package/dist/cloud/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/cloud/http.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAKxB;IAEA;IACA;IACA;IARX,0FAA0F;IACjF,aAAa,CAAS;IAE/B,YACW,IAAqB,EAC9B,OAAe,EACN,MAAc,EACd,SAAwB,EACxB,OAAiC;QAE1C,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QANjE,SAAI,GAAJ,IAAI,CAAiB;QAErB,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAe;QACxB,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;IAC/B,CAAC;CACF;AAoBD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAErD,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9D,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,IAAI;IAYc;IAXZ,KAAK,CAAY;IACjB,KAAK,CAAgC;IACtD;;;;;;OAMG;IACH,kBAAkB,GAAkB,IAAI,CAAC;IAEzC,YAA6B,CAAc;QAAd,MAAC,GAAD,CAAC,CAAa;QACzC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,4DAA4D,EAC5D,CAAC,EACD,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,kHAAkH;IAClH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,MAAyB,EACzB,IAAc;QAEd,OAAO,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,IAAY,EACZ,MAAyB,EACzB,IAAc;QAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACzC,IAAI,OAA+B,CAAC;QACpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpF,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ;oBAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACnE,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBACrE,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;oBACjD,MAAM;oBACN,OAAO;oBACP,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACvE,IAAI,OAAO,GAAG,QAAQ;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAWxC,CAAC;YACT,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3E,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,IAAI,UAAU,CAClB,YAAY,EACZ,GAAG,MAAM,IAAI,IAAI,wCAAwC,EACzD,GAAG,CAAC,MAAM,EACV,SAAS,CACV,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YACxD,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,OAAO,GAAG,IAAI,UAAU,CACtB,CAAC,EAAE,IAAI,IAAI,YAAY,EACvB,CAAC,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAClC,GAAG,CAAC,MAAM,EACV,CAAC,EAAE,SAAS,IAAI,SAAS,EACzB,CAAC,EAAE,OAAO,CACX,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YACtE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,IAAI,IAAI,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,UAAyB,EAAE,OAAe;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAClC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/cloud/http.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAKxB;IAEA;IACA;IACA;IARX,0FAA0F;IACjF,aAAa,CAAS;IAE/B,YACW,IAAqB,EAC9B,OAAe,EACN,MAAc,EACd,SAAwB,EACxB,OAAiC;QAE1C,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QANjE,SAAI,GAAJ,IAAI,CAAiB;QAErB,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAe;QACxB,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;IAC/B,CAAC;CACF;AAoBD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAErD,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9D,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAW,CAAC;AAEhG;;;;GAIG;AACH,MAAM,OAAO,IAAI;IAYc;IAXZ,KAAK,CAAY;IACjB,KAAK,CAAgC;IACtD;;;;;;OAMG;IACH,kBAAkB,GAAkB,IAAI,CAAC;IAEzC,YAA6B,CAAc;QAAd,MAAC,GAAD,CAAC,CAAa;QACzC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,4DAA4D,EAC5D,CAAC,EACD,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,kHAAkH;IAClH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,MAAyB,EACzB,IAAc;QAEd,OAAO,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,IAAY,EACZ,MAAyB,EACzB,IAAc;QAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACzC,IAAI,OAA+B,CAAC;QACpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpF,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ;oBAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACnE,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC;gBAC5E,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBACrE,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;oBACjD,MAAM;oBACN,OAAO;oBACP,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACvE,IAAI,OAAO,GAAG,QAAQ;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAWxC,CAAC;YACT,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3E,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,IAAI,UAAU,CAClB,YAAY,EACZ,GAAG,MAAM,IAAI,IAAI,wCAAwC,EACzD,GAAG,CAAC,MAAM,EACV,SAAS,CACV,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YACxD,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,OAAO,GAAG,IAAI,UAAU,CACtB,CAAC,EAAE,IAAI,IAAI,YAAY,EACvB,CAAC,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAClC,GAAG,CAAC,MAAM,EACV,CAAC,EAAE,SAAS,IAAI,SAAS,EACzB,CAAC,EAAE,OAAO,CACX,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YACtE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,IAAI,IAAI,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,UAAyB,EAAE,OAAe;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAClC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC"}

package/dist/cloud/nexus-vault.d.ts

@@ -100,6 +100,26 @@ export interface NexusVaultCommandOptions extends NexusVaultOptions {
     /** `project` (the current project, default) or `global` (this account's global store). */
     scope?: CloudVaultScope;
 }
+/**
+ * What works on a stream the change journal writes (its head snapshot is
+ * checkpoint/v3), for every message that would otherwise say "push" (T13034).
+ * A build where `sync.push` is unreleased cannot join the journal, since `cleo sync enable push`
+ * refuses there (T13851). While it is unreleased no released CLEO ships it either, so the remedy
+ * never sends the user to `cleo self-update`: a pre-release or allowUnreleased build started the
+ * journal, and pull, restore and verify keep working (T13856).
+ *
+ * @param pushReleased - Whether this build ships `sync.push`; defaults to the release state.
+ * @returns The remedy clause, naming only commands this build can run.
+ */
+export declare function journalStreamRemedy(pushReleased?: boolean): string;
+/**
+ * The fix for E_SYNC_DISABLED: turn the journal on where this build can, and otherwise say that no
+ * released CLEO can yet (T13856), never naming `cleo sync enable push` where it refuses.
+ *
+ * @param pushReleased - Whether this build ships `sync.push`; defaults to the release state.
+ * @returns The fix text.
+ */
+export declare function syncDisabledRemedy(pushReleased?: boolean): string;
 /**
  * The rows a parent hashed under an older vault format counted that this
  * format leaves out (T13808): rows local by row-identity spec. They never

package/dist/cloud/nexus-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAQH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EAGf,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAsD7B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAoB,KAAK,gBAAgB,EAAc,MAAM,uBAAuB,CAAC;AAgB5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAoChE,OAAO,EACL,KAAK,cAAc,EAKpB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAK/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAolCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAa7D;AAg/CD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,EACxC,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAmCzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,UAAU,CAAC,EACrD,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAUzC;AAkKD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,EACvD,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,GACtD,cAAc,CAkBhB;AAgID,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AA2lClD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+GAA+G;IAC/G,eAAe,CAAC,EAAE,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AA0CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}
+{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAQH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EAGf,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAsD7B,OAAO,EACL,KAAK,gBAAgB,EAMtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAoB,KAAK,gBAAgB,EAAc,MAAM,uBAAuB,CAAC;AAgB5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAoChE,OAAO,EACL,KAAK,cAAc,EAKpB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAK/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAkRD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,UAAqC,GAAG,MAAM,CAK7F;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,UAAqC,GAAG,MAAM,CAG5F;AA41BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACvC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC1C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAa7D;AAg/CD;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,EACxC,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAmCzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,UAAU,CAAC,EACrD,KAAK,EAAE,eAAe,EACtB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,OAAO,CAAC,gBAAgB,EAAE,GAAG,SAAS,CAAC,CAUzC;AAkKD,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,EACvD,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,aAAa,CAAC,GACtD,cAAc,CAkBhB;AAgID,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAuoClD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+GAA+G;IAC/G,eAAe,CAAC,EAAE,OAAO,CAAC;CACtB,GACL,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,IAAI,GAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAClE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,wBAAwB,GAAG;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7D,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;AA0CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}

package/dist/cloud/nexus-vault.js

@@ -371,8 +371,61 @@ async function replaySegments(journal, cursor, signers) {
 /**
  * What works on a stream the change journal writes (its head snapshot is
  * checkpoint/v3), for every message that would otherwise say "push" (T13034).
+ * A build where `sync.push` is unreleased cannot join the journal, since `cleo sync enable push`
+ * refuses there (T13851). While it is unreleased no released CLEO ships it either, so the remedy
+ * never sends the user to `cleo self-update`: a pre-release or allowUnreleased build started the
+ * journal, and pull, restore and verify keep working (T13856).
+ *
+ * @param pushReleased - Whether this build ships `sync.push`; defaults to the release state.
+ * @returns The remedy clause, naming only commands this build can run.
  */
-const JOURNAL_STREAM_REMEDY = 'on this stream local changes travel through the change journal (`sync.push`), and with it on a vault push checkpoints the journal (T12999); a store that has not joined it joins with `cleo sync enable push`, which keeps its own rows and merges them into the stream (T13466); `cleo cloud pull`, `cleo cloud restore` and `cleo cloud verify` still work';
+export function journalStreamRemedy(pushReleased = !UNRELEASED_FLAGS.has('sync.push')) {
+    if (pushReleased) {
+        return 'on this stream local changes travel through the change journal (`sync.push`), and with it on a vault push checkpoints the journal (T12999); a store that has not joined it joins with `cleo sync enable push`, which keeps its own rows and merges them into the stream (T13466); `cleo cloud pull`, `cleo cloud restore` and `cleo cloud verify` still work';
+    }
+    return `on this stream local changes travel through the change journal (\`sync.push\`), which checkpoints the stream (T12999) and which this CLEO cannot run: ${SYNC_PUSH_UNRELEASED_CLAUSE}; \`cleo cloud pull\`, \`cleo cloud restore\` and \`cleo cloud verify\` keep working`;
+}
+/** Why no CLEO can push while `sync.push` is unreleased (T13856): no release ships it yet. */
+const SYNC_PUSH_UNRELEASED_CLAUSE = '`sync.push` is not released yet, so a pre-release or allowUnreleased CLEO build started this journal and no released CLEO can push to it yet (T13856)';
+/**
+ * The fix for E_SYNC_DISABLED: turn the journal on where this build can, and otherwise say that no
+ * released CLEO can yet (T13856), never naming `cleo sync enable push` where it refuses.
+ *
+ * @param pushReleased - Whether this build ships `sync.push`; defaults to the release state.
+ * @returns The fix text.
+ */
+export function syncDisabledRemedy(pushReleased = !UNRELEASED_FLAGS.has('sync.push')) {
+    if (pushReleased)
+        return 'turn the change journal on first: `cleo sync enable push`';
+    return `the change journal is off here and this CLEO cannot turn it on: ${SYNC_PUSH_UNRELEASED_CLAUSE}; \`cleo cloud pull\`, \`cleo cloud restore\` and \`cleo cloud verify\` keep working`;
+}
+/** What a store that reads only snapshots does about journal changes past the head (T13867). */
+const JOURNAL_UNREAD_REMEDY = 'join the change journal with `cleo sync enable push` to receive them, or run `cleo cloud push` on a device that writes the journal (its push checkpoints the journal, T12999), then pull again';
+/**
+ * The change-journal segments past a checkpoint/v3 head that this store does
+ * not hold (T13867): it reads snapshots only, so the head is all it has, and
+ * every segment past the head's `coversSeq` is missing from it. A store is on
+ * the journal when it holds a genesis cut of the stream AND `sync.push` or
+ * `sync.pull` is on: a cut alone, as a restored bundle could carry, does not
+ * make it one. 0 for any other head, or a store on the journal.
+ */
+async function journalUnread(t, headSeq, headCp) {
+    if (!headCp || !isJournalSnapshot(headCp) || headSeq <= headCp.coversSeq)
+        return 0;
+    if (fs.existsSync(t.dbPath)) {
+        const { openNativeDatabase } = await import('../store/sqlite-native.js');
+        const db = openNativeDatabase(t.dbPath, { readonly: true, enableWal: false });
+        try {
+            const on = isSyncFlagOn(db, 'sync.push') || isSyncFlagOn(db, 'sync.pull');
+            if (on && genesisCutOf(db, t.streamId) !== undefined)
+                return 0;
+        }
+        finally {
+            db.close();
+        }
+    }
+    return headSeq - headCp.coversSeq;
+}
 /** Whether a snapshot is checkpoint/v3: the change journal writes its stream (T13034). */
 function isJournalSnapshot(cp) {
     return cp !== null && cp !== undefined && manifestVersion(cp.manifest) === 3;
@@ -409,7 +462,7 @@ function aheadOfThisCleo(t, schemaVersion, parent) {
  * orphan.
  */
 function journalStreamRefusal(t, parent) {
-    return streamUpgradedError(`${t.streamId} takes only checkpoint/v3 snapshots: its head snapshot ${parent.checkpointId} is one (the change journal writes this stream), and the server refuses the checkpoint/v2 snapshots this CLEO's vault writes after it`, `nothing was written; ${JOURNAL_STREAM_REMEDY}`);
+    return streamUpgradedError(`${t.streamId} takes only checkpoint/v3 snapshots: its head snapshot ${parent.checkpointId} is one (the change journal writes this stream), and the server refuses the checkpoint/v2 snapshots this CLEO's vault writes after it`, `nothing was written; ${journalStreamRemedy()}`);
 }
 function streamUpgradedError(message, fix) {
     return vaultError('E_NEXUS_VAULT_STREAM_UPGRADED', message, fix);
@@ -986,7 +1039,7 @@ async function appendCheckpoint(a) {
             // The server's v3 ratchet (reason `stream-v3`). The check above refuses a v3 head before
             // anything is written; this maps a server whose head this client did not see as v3.
             if (err instanceof NexusError && err.code === 'E_STREAM_VERSION') {
-                throw streamUpgradedError(`the server refused the snapshot: ${t.streamId} takes only checkpoint/v3 snapshots (${err.message})`, JOURNAL_STREAM_REMEDY);
+                throw streamUpgradedError(`the server refused the snapshot: ${t.streamId} takes only checkpoint/v3 snapshots (${err.message})`, journalStreamRemedy());
             }
             const countRefusal = err instanceof NexusError && (err.code === 'E_REGRESSION' || err.code === 'E_VALIDATION');
             if (countRefusal && attempt === 0)
@@ -1384,7 +1437,7 @@ async function pushNexusVaultImpl(opts = {}) {
         return pushJournalCheckpoint(conn, key, opts, scope, warnings);
     }
     if (cut !== undefined) {
-        throw streamUpgradedError(`this store started ${t.streamId}'s change journal (genesis cut at capture ${cut}); its changes are pushed as journal segments, not vault snapshots`, `nothing was written; ${JOURNAL_STREAM_REMEDY}`);
+        throw streamUpgradedError(`this store started ${t.streamId}'s change journal (genesis cut at capture ${cut}); its changes are pushed as journal segments, not vault snapshots`, `nothing was written; ${journalStreamRemedy()}`);
     }
     const force = opts.force === true;
     const journal = journalFor(conn, t);
@@ -1412,7 +1465,7 @@ async function pushNexusVaultImpl(opts = {}) {
     const overUnsynced = head.headCheckpointId !== null && head.headCheckpointId !== synced?.lastCheckpointId;
     if (overUnsynced && !force) {
         throw vaultError('E_NEXUS_VAULT_BEHIND', `another device pushed snapshot ${head.headCheckpointId} after this machine's last sync`, isJournalSnapshot(parent)
-            ? `run \`cleo cloud pull\` first (it refuses to overwrite local changes); ${JOURNAL_STREAM_REMEDY}`
+            ? `run \`cleo cloud pull\` first (it refuses to overwrite local changes); ${journalStreamRemedy()}`
             : 'run `cleo cloud pull` first (it refuses to overwrite local changes), or `--force` to push this store as a labelled fork');
     }
     const git = gitTracking(t);
@@ -2582,7 +2635,7 @@ async function cloudSyncImpl(opts = {}) {
         streams.push(await syncOneStream({ conn, key }, opts, scope));
     const worked = streams.filter((r) => r.status !== 'disabled' && r.status !== 'not-attached');
     if (worked.length === 0 && streams.some((r) => r.status === 'disabled')) {
-        throw vaultError('E_SYNC_DISABLED', 'no attached stream has sync.push or sync.pull on', 'turn the change journal on first: `cleo sync enable push`');
+        throw vaultError('E_SYNC_DISABLED', 'no attached stream has sync.push or sync.pull on', syncDisabledRemedy());
     }
     return { apiUrl: conn.apiUrl, streams, warnings: [...conn.warnings] };
 }
@@ -2957,6 +3010,13 @@ async function restoreNexusVaultImpl(opts) {
     const names = await deviceNames(conn);
     if (opts.mode === 'pull' && synced?.lastCheckpointId === target && opts.force !== true) {
         const cp = cps.find((c) => c.checkpointId === target) ?? null;
+        const unread = target === head.headCheckpointId
+            ? await journalUnread(t, head.headSeq, trusted.find((c) => c.checkpointId === target))
+            : 0;
+        if (unread > 0) {
+            // @sync-invariant none:local-only a read-only refusal: nothing is written
+            throw vaultError('E_NEXUS_VAULT_BEHIND', `${t.streamId}: the change journal holds ${unread} segment(s) past snapshot ${target}, and this store reads snapshots only, so it is not up to date`, JOURNAL_UNREAD_REMEDY);
+        }
         warnings.push(...conn.state.drainWarnings());
         return {
             apiUrl: conn.apiUrl,
@@ -3030,7 +3090,7 @@ async function restoreNexusVaultImpl(opts) {
             throw vaultError('E_NEXUS_VAULT_LOCAL_CHANGES', last
                 ? `this store changed since its last cloud sync (${changed.slice(0, 8).join(', ')}); restoring would overwrite those changes`
                 : 'this store holds data that was never synced with this cloud snapshot; restoring would replace it', isJournalSnapshot(targetCp)
-                ? `to keep them: ${JOURNAL_STREAM_REMEDY}; or pass --force to restore anyway (a safety backup is taken first)`
+                ? `to keep them: ${journalStreamRemedy()}; or pass --force to restore anyway (a safety backup is taken first)`
                 : 'run `cleo cloud push` to keep them (as a fork with --force if another device pushed since), or pass --force to restore anyway (a safety backup is taken first)');
         }
     }
@@ -3235,7 +3295,7 @@ async function restoreNexusVaultImpl(opts) {
         if (keptUnsynced.length > 0) {
             warnings.push({
                 code: 'W_NEXUS_VAULT_KEPT_LOCAL',
-                message: `kept ${keptUnsynced.length} local file(s) this store never synced with the cloud, in place of the snapshot's copies: ${keptUnsynced.slice(0, 8).join(', ')}${keptUnsynced.length > 8 ? ', …' : ''}; ${isJournalSnapshot(restored.checkpoint) ? `to keep them: ${JOURNAL_STREAM_REMEDY}; or` : 'push to keep them, or'} pull with --force to take the snapshot's`,
+                message: `kept ${keptUnsynced.length} local file(s) this store never synced with the cloud, in place of the snapshot's copies: ${keptUnsynced.slice(0, 8).join(', ')}${keptUnsynced.length > 8 ? ', …' : ''}; ${isJournalSnapshot(restored.checkpoint) ? `to keep them: ${journalStreamRemedy()}; or` : 'push to keep them, or'} pull with --force to take the snapshot's`,
             });
         }
         saveSynced(conn, t, restored.checkpoint, {
@@ -3256,6 +3316,15 @@ async function restoreNexusVaultImpl(opts) {
                 });
             }
         }
+        const unread = restored.checkpoint.checkpointId === head.headCheckpointId
+            ? await journalUnread(t, head.headSeq, restored.checkpoint)
+            : 0;
+        if (unread > 0) {
+            warnings.push({
+                code: 'W_NEXUS_VAULT_JOURNAL_UNREAD',
+                message: `the change journal holds ${unread} segment(s) past snapshot ${restored.checkpoint.checkpointId}, which this store does not have: ${JOURNAL_UNREAD_REMEDY}`,
+            });
+        }
         warnings.push(...conn.state.drainWarnings());
         return {
             apiUrl: conn.apiUrl,
@@ -3307,7 +3376,7 @@ async function nexusVaultStatusImpl(opts = {}) {
     if (headCp && isJournalSnapshot(headCp) && pendingChanges.length > 0) {
         warnings.push({
             code: 'W_NEXUS_VAULT_JOURNAL_STREAM',
-            message: `${pendingChanges.length} table(s) changed since the last sync, and the newest snapshot ${headCp.checkpointId} is checkpoint/v3 (the change journal writes this stream): ${JOURNAL_STREAM_REMEDY}`,
+            message: `${pendingChanges.length} table(s) changed since the last sync, and the newest snapshot ${headCp.checkpointId} is checkpoint/v3 (the change journal writes this stream): ${journalStreamRemedy()}`,
         });
     }
     return {
@@ -3488,12 +3557,27 @@ async function verifyNexusVaultImpl(opts = {}) {
             return { ...r, cloudRows, match: (r.localRows ?? 0) === cloudRows };
         });
     }
+    // On a journal head, tables only snapshots carry (files, other databases, the
+    // row-identity-exempt tables) hold machine-local state: listed, never the verdict (T13867).
+    const journalHead = isJournalSnapshot(headCp);
+    const snapshotOnly = new Set(Object.keys(ROW_IDENTITY_EXEMPT[tableScopeOf(t)]));
+    const decides = (r) => !journalHead || !(isSnapshotAuthoritativeKey(r.table) || snapshotOnly.has(r.table));
+    const asideDiffer = tables.filter((r) => !r.match && !decides(r)).map((r) => r.table);
+    if (asideDiffer.length > 0) {
+        warnings.push({
+            code: 'W_NEXUS_VAULT_SNAPSHOT_ONLY',
+            message: `${asideDiffer.length} table(s) only snapshots carry differ from the newest snapshot (machine-local, or not checkpointed yet), so they do not decide the verdict: ${asideDiffer.slice(0, 8).join(', ')}`,
+        });
+    }
+    const unread = await journalUnread(t, head.headSeq, headCp);
     let verdict;
     if (headUntrusted)
         verdict = 'untrusted';
     else if (!headCp)
         verdict = 'empty';
-    else if (tables.every((x) => x.match))
+    else if (unread > 0)
+        verdict = 'behind';
+    else if (tables.filter(decides).every((x) => x.match))
         verdict = 'match';
     else if (journalSide !== null) {
         const { localChanged, cloudAdvanced } = journalSide;
@@ -3501,7 +3585,7 @@ async function verifyNexusVaultImpl(opts = {}) {
     }
     else {
         const localChanged = last
-            ? compareWithSynced(local, last.manifest, git, fileChanges).some((d) => !d.match)
+            ? compareWithSynced(local, last.manifest, git, fileChanges).some((d) => !d.match && decides(d))
             : true;
         const cloudAdvanced = synced?.lastCheckpointId !== headCp.checkpointId;
         verdict = localChanged && cloudAdvanced ? 'diverged' : cloudAdvanced ? 'behind' : 'ahead';
@@ -3557,7 +3641,6 @@ async function verifyNexusVaultImpl(opts = {}) {
     const headFormat = formatWarning(t, headCp);
     if (headFormat)
         warnings.push(headFormat);
-    const journalHead = isJournalSnapshot(headCp);
     const remedy = deepFailure !== null
         ? `the cloud copy failed the deep check (${deepFailure}): do not pull it; see which device pushed the newest snapshot with \`cleo cloud vault\` and \`cleo cloud activity\`, then push a fresh snapshot from a machine whose store passes \`cleo cloud verify\``
         : verdict === 'untrusted'
@@ -3565,14 +3648,16 @@ async function verifyNexusVaultImpl(opts = {}) {
             : headCp && vaultManifestFormat(headCp.manifest, hashKeyOf(t.dataKey)) === 'unknown'
                 ? `the newest snapshot records a vault manifest format this CLEO does not recognise (this CLEO hashes format ${VAULT_MANIFEST_FORMAT_VERSION}): if a newer CLEO pushed it, upgrade CLEO on this machine, then verify again`
                 : verdict === 'behind'
-                    ? 'run `cleo cloud pull` to bring this machine to the newest snapshot'
+                    ? unread > 0
+                        ? `the change journal holds ${unread} segment(s) past the newest snapshot, which this store reads snapshots only and does not have: ${JOURNAL_UNREAD_REMEDY}`
+                        : 'run `cleo cloud pull` to bring this machine to the newest snapshot'
                     : verdict === 'ahead'
                         ? journalHead
-                            ? `this machine changed since the newest snapshot, which is checkpoint/v3 (the change journal writes this stream): ${JOURNAL_STREAM_REMEDY}`
+                            ? `this machine changed since the newest snapshot, which is checkpoint/v3 (the change journal writes this stream): ${journalStreamRemedy()}`
                             : 'run `cleo cloud push` to back up the local changes'
                         : verdict === 'diverged'
                             ? journalHead
-                                ? `both sides changed, and the newest snapshot is checkpoint/v3 (the change journal writes this stream): ${JOURNAL_STREAM_REMEDY}; or \`cleo cloud pull --force\` to take the cloud (a safety backup is taken first)`
+                                ? `both sides changed, and the newest snapshot is checkpoint/v3 (the change journal writes this stream): ${journalStreamRemedy()}; or \`cleo cloud pull --force\` to take the cloud (a safety backup is taken first)`
                                 : 'both sides changed: run `cleo cloud push --force` to keep this machine (a labelled fork), or `cleo cloud pull --force` to take the cloud (a safety backup is taken first)'
                             : verdict === 'empty'
                                 ? 'run `cleo cloud push` to make the first snapshot'