@cleocode/core 2026.10.3 → 2026.10.5-rc.ci.672

package/dist/cloud/nexus-vault-keys.d.ts

@@ -13,6 +13,9 @@
  * 2. No escrow and no account keys: this is the account's first vault use.
  *    The client mints MK and escrows it (`PUT`, insert-only). A concurrent
  *    first device loses the insert with 409 and reads the winner's key.
+ *    Since T13100 `cleo login nexus` runs steps 1 to 4 right after enrolment
+ *    ({@link provisionNexusAccount}); `cleo cloud push` still does them for a
+ *    device that logged in before that.
  * 3. The device certifies itself under MK (a self-grant, `PUT
  *    /v1/devices/:id/key`), so other devices can verify its snapshots.
  * 4. Signer trust comes from `certifiedSigners` over `GET /v1/devices/trust`,
@@ -33,15 +36,16 @@
  * No function here logs a key, and no error carries one.
  *
  * @task T12336
+ * @task T13100
  * @epic T12322
  */
-import type { CloudWarning } from '@cleocode/contracts';
+import type { CloudWarning, NexusAccountSetup } from '@cleocode/contracts';
 import { type KeyPair } from './crypto.js';
 import { type FetchLike, Http, type ResponseSchema } from './http.js';
 import { type TrustedSigners } from './keys.js';
 import { resolveNexusApiUrl } from './nexus-auth.js';
 import { type NexusCloudOptions } from './nexus-cloud.js';
-import type { SealedNexusDevice } from './nexus-device.js';
+import { type SealedNexusDevice } from './nexus-device.js';
 import { NexusVaultState } from './nexus-vault-state.js';
 /** Timeout of a snapshot blob upload or download. */
 export declare const NEXUS_VAULT_BLOB_TIMEOUT_MS: number;
@@ -107,6 +111,33 @@ export interface NexusAccountKey {
 export declare function unlockNexusAccountKey(conn: NexusVaultConnection, opts?: {
     readOnly?: boolean;
 }): Promise<NexusAccountKey>;
+/** Options of {@link provisionNexusAccount}. */
+export interface ProvisionNexusAccountOptions extends NexusVaultOptions {
+    /**
+     * The device entry to act as. `cleo login nexus` passes the entry it just
+     * stored, so the setup runs on that new device credential (the escrow routes
+     * accept only device credentials). Default: the stored credential, as
+     * {@link connectNexusVault} finds it.
+     */
+    device?: SealedNexusDevice;
+}
+/**
+ * Make the account ready for encrypted backups on this device (onboarding A,
+ * T13100): read the escrowed account master key, or mint and escrow it when
+ * the account has none (a 409 means another device won: its key is read,
+ * never re-minted), then certify this device under it and record the signer
+ * trust state in {@link NexusVaultState}. It is {@link unlockNexusAccountKey}
+ * with a report, so a later `cleo cloud push` finds everything in place and
+ * mints nothing; it is idempotent.
+ *
+ * It never throws: a server without key escrow answers `unsupported`, any
+ * other failure answers `failed` with the step and the remedy. No key is in
+ * the result, and a failure message is redacted of the device credential.
+ *
+ * @param opts - API URL, stores, the device to act as, and test overrides.
+ * @returns What the setup did.
+ */
+export declare function provisionNexusAccount(opts?: ProvisionNexusAccountOptions): Promise<NexusAccountSetup>;
 /**
  * The data key of a project stream: unwrap the newest wrapped key, or mint
  * and store one when the project has none yet (its first push).

package/dist/cloud/nexus-vault-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault-keys.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AASxD,OAAO,EAAE,KAAK,OAAO,EAAyB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,IAAI,EAAc,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAML,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAqB,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,eAAO,MAAM,2BAA2B,QAAc,CAAC;AAEvD,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,WAChB,CAAC;AAE/C,sCAAsC;AACtC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,iCAAiC;IACjC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClC,4FAA4F;IAC5F,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,2CAA2C;IAC3C,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACrE;AAQD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA8D/B;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAiID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC,CAoC1B;AAkCD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiDxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"nexus-vault-keys.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AASlG,OAAO,EAAE,KAAK,OAAO,EAAyB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,IAAI,EAAc,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAOL,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAGL,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,eAAO,MAAM,2BAA2B,QAAc,CAAC;AAEvD,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,WAChB,CAAC;AAE/C,sCAAsC;AACtC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,iCAAiC;IACjC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClC,4FAA4F;IAC5F,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,2CAA2C;IAC3C,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACrE;AAQD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAoED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAwID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC,CAE1B;AAgFD,gDAAgD;AAChD,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,iBAAiB,CAAC,CAiD5B;AAmCD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwDxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/cloud/nexus-vault-keys.js

@@ -13,6 +13,9 @@
  * 2. No escrow and no account keys: this is the account's first vault use.
  *    The client mints MK and escrows it (`PUT`, insert-only). A concurrent
  *    first device loses the insert with 409 and reads the winner's key.
+ *    Since T13100 `cleo login nexus` runs steps 1 to 4 right after enrolment
+ *    ({@link provisionNexusAccount}); `cleo cloud push` still does them for a
+ *    device that logged in before that.
  * 3. The device certifies itself under MK (a self-grant, `PUT
  *    /v1/devices/:id/key`), so other devices can verify its snapshots.
  * 4. Signer trust comes from `certifiedSigners` over `GET /v1/devices/trust`,
@@ -33,16 +36,18 @@
  * No function here logs a key, and no error carries one.
  *
  * @task T12336
+ * @task T13100
  * @epic T12322
  */
-import { nexusProjectKeysSchema, nexusUserKeysSchema } from '@cleocode/contracts';
 import { DeviceTrust as DeviceTrustSchema, KeyEscrowGrant, PutKeyEscrowResult, } from '@cleocode/contracts/cloud';
+import { nexusProjectKeysSchema, nexusUserKeysSchema } from '@cleocode/contracts/nexus-vault.js';
 import { z } from 'zod';
 import { openSealed, randomKey } from './crypto.js';
 import { Http, NexusError } from './http.js';
-import { certifiedSigners, createDeviceGrant, homeStreamKey, masterKeyVerifier, newProjectKey, unwrapProjectKey, wrapProjectKey, } from './keys.js';
-import { NexusAccountError, resolveNexusApiUrl } from './nexus-auth.js';
+import { certifiedSigners, createDeviceGrant, homeStreamKey, isSendableWrap, masterKeyVerifier, newProjectKey, unwrapProjectKey, wrapProjectKey, } from './keys.js';
+import { NEXUS_PROJECT_KEY_OWNER_REMEDY, NexusAccountError, resolveNexusApiUrl, } from './nexus-auth.js';
 import { assertNexusCloudDeviceMode, NEXUS_CLOUD_TIMEOUT_MS, nexusCredentialWarnings, } from './nexus-cloud.js';
+import { redactNexusDeviceSecrets } from './nexus-device.js';
 import { ensureNexusDeviceCredential, nexusApiErrorToAccountError } from './nexus-enrol.js';
 import { NexusVaultState } from './nexus-vault-state.js';
 /** Timeout of a snapshot blob upload or download. */
@@ -64,7 +69,10 @@ export async function connectNexusVault(opts = {}) {
     assertNexusCloudDeviceMode();
     const apiUrl = resolveNexusApiUrl(opts.apiUrl);
     const handle = await ensureNexusDeviceCredential({ ...opts, apiUrl });
-    const device = handle.device;
+    return vaultConnectionOf(handle.device, apiUrl, opts, handle.warnings);
+}
+/** A vault connection acting as `device` (its current credential and keys). */
+function vaultConnectionOf(device, apiUrl, opts, credentialWarnings) {
     const bearer = device.currentBearer();
     if (bearer === null) {
         throw new NexusAccountError('E_NEXUS_NOT_SIGNED_IN', `not signed in to Cleo Nexus at ${apiUrl}`, 'run `cleo login nexus`');
@@ -93,7 +101,7 @@ export async function connectNexusVault(opts = {}) {
         http,
         blobFetch: (input, init) => base(input, { ...init, signal: AbortSignal.timeout(blobTimeoutMs) }),
         state: opts.vaultState ?? new NexusVaultState(),
-        warnings: nexusCredentialWarnings(handle.warnings),
+        warnings: nexusCredentialWarnings(credentialWarnings),
         raw,
         async call(method, path, schema, body) {
             try {
@@ -166,6 +174,10 @@ async function openEscrow(conn) {
     }
     return { mk, kv: grant.keyVersion };
 }
+/**
+ * Mint the account master key and escrow it (insert-only). `adopted` is `true` when another
+ * device escrowed first (409): its key is read and used, and this device never mints again.
+ */
 async function mintEscrow(conn) {
     const existing = await conn.find('/v1/account/keys', nexusUserKeysSchema);
     if (existing !== null) {
@@ -178,7 +190,7 @@ async function mintEscrow(conn) {
             keyVersion: 1,
             masterKeyVerifier: masterKeyVerifier(mk),
         });
-        return { mk, kv: 1 };
+        return { mk, kv: 1, adopted: false };
     }
     catch (err) {
         // Backstop: unreachable while GET and PUT escrow ship together (cleo-nexus #24), since
@@ -191,15 +203,16 @@ async function mintEscrow(conn) {
         const won = await openEscrow(conn);
         if (won === null)
             throw keyUnavailable('the account key was escrowed concurrently but is not readable');
-        return won;
+        return { ...won, adopted: true };
     }
 }
+/** Certify this device under MK unless it already is; `wrote` says whether this call did. */
 async function ensureCertified(conn, mk, kv) {
     const trust = await conn.call('GET', '/v1/devices/trust', DeviceTrustSchema);
     const mine = conn.keys.signing.publicKey.toString('base64');
     const certified = trust.certificates.some((c) => c.deviceId === conn.deviceId && c.keyVersion === kv && c.signingPublicKey === mine && c.live);
     if (certified)
-        return trust;
+        return { trust, wrote: false };
     const grant = createDeviceGrant({
         masterKey: mk,
         userId: conn.userId,
@@ -212,7 +225,7 @@ async function ensureCertified(conn, mk, kv) {
         signer: { deviceId: conn.deviceId, signing: conn.keys.signing },
     });
     await conn.call('PUT', `/v1/devices/${encodeURIComponent(conn.deviceId)}/key`, z.looseObject({}), grant);
-    return conn.call('GET', '/v1/devices/trust', DeviceTrustSchema);
+    return { trust: await conn.call('GET', '/v1/devices/trust', DeviceTrustSchema), wrote: true };
 }
 /**
  * Get the account master key for this device, minting and escrowing it on
@@ -227,16 +240,46 @@ async function ensureCertified(conn, mk, kv) {
  *   has no key escrow route; a mapped API error otherwise.
  */
 export async function unlockNexusAccountKey(conn, opts = {}) {
+    return (await unlockAccount(conn, opts.readOnly === true, { step: 'escrow-read' })).key;
+}
+/**
+ * {@link unlockNexusAccountKey}, reporting how the key was obtained. `progress.step` names the
+ * step running, so a caller that catches a failure can say where it happened.
+ */
+async function unlockAccount(conn, readOnly, progress) {
+    progress.step = 'escrow-read';
     const escrowed = await openEscrow(conn);
-    if (escrowed === null && opts.readOnly === true) {
+    if (escrowed === null && readOnly) {
         // Nothing was ever pushed from any device: a read has nothing to read, and
         // must not mint the account key as a side effect.
         throw new NexusAccountError('E_NEXUS_VAULT_EMPTY', 'the cloud vault is empty: no device has pushed a snapshot to this account yet', 'run `cleo cloud push` on a device that has the data');
     }
-    const unlocked = escrowed ?? (await mintEscrow(conn));
-    const trust = opts.readOnly === true
-        ? await conn.call('GET', '/v1/devices/trust', DeviceTrustSchema)
-        : await ensureCertified(conn, unlocked.mk, unlocked.kv);
+    let unlocked;
+    let escrow;
+    if (escrowed !== null) {
+        unlocked = escrowed;
+        escrow = 'fetched';
+    }
+    else {
+        // The account's first device. Since T13100 `cleo login nexus` does this right after
+        // enrolment; a push still gets here for a device that logged in before that.
+        progress.step = 'escrow-mint';
+        const minted = await mintEscrow(conn);
+        unlocked = minted;
+        escrow = minted.adopted ? 'adopted' : 'minted';
+    }
+    progress.step = 'certify';
+    let trust;
+    let certificate = null;
+    if (readOnly) {
+        trust = await conn.call('GET', '/v1/devices/trust', DeviceTrustSchema);
+    }
+    else {
+        const certified = await ensureCertified(conn, unlocked.mk, unlocked.kv);
+        trust = certified.trust;
+        certificate = certified.wrote ? 'new' : 'existing';
+    }
+    progress.step = 'trust';
     // Read, evaluate and persist the trust state under one lock, so two
     // concurrent commands cannot interleave and lose a narrowed pin.
     const evaluation = conn.state.updateTrust(conn.apiUrl, conn.userId, (current) => {
@@ -248,7 +291,84 @@ export async function unlockNexusAccountKey(conn, opts = {}) {
             ? 'the account key was rotated and this device does not hold the new one'
             : 'the server declared an account key version no rotation explains');
     }
-    return { masterKey: unlocked.mk, keyVersion: unlocked.kv, signers: evaluation.signers };
+    return {
+        key: { masterKey: unlocked.mk, keyVersion: unlocked.kv, signers: evaluation.signers },
+        escrow,
+        certificate,
+    };
+}
+/** What each setup step does, for a failure message. */
+const SETUP_STEP_LABELS = {
+    connect: 'opening the vault connection with the device credential',
+    'escrow-read': 'reading the escrowed account key',
+    'escrow-mint': 'creating and escrowing the account key',
+    certify: 'certifying this device under the account key',
+    trust: 'recording the device trust state',
+};
+/** The remedy of a failed setup step whose error carried none. */
+const SETUP_RETRY_FIX = 'run `cleo login nexus` again; `cleo cloud push` also finishes the setup on this device';
+/**
+ * Make the account ready for encrypted backups on this device (onboarding A,
+ * T13100): read the escrowed account master key, or mint and escrow it when
+ * the account has none (a 409 means another device won: its key is read,
+ * never re-minted), then certify this device under it and record the signer
+ * trust state in {@link NexusVaultState}. It is {@link unlockNexusAccountKey}
+ * with a report, so a later `cleo cloud push` finds everything in place and
+ * mints nothing; it is idempotent.
+ *
+ * It never throws: a server without key escrow answers `unsupported`, any
+ * other failure answers `failed` with the step and the remedy. No key is in
+ * the result, and a failure message is redacted of the device credential.
+ *
+ * @param opts - API URL, stores, the device to act as, and test overrides.
+ * @returns What the setup did.
+ */
+export async function provisionNexusAccount(opts = {}) {
+    const progress = { step: 'connect' };
+    // The bearer in use, so a failure message that quotes it (fetch quotes a malformed header
+    // value) is redacted even when it does not have the credential's shape.
+    let bearer = opts.device?.currentBearer() ?? null;
+    try {
+        const conn = opts.device !== undefined
+            ? vaultConnectionOf(opts.device, resolveNexusApiUrl(opts.apiUrl), opts, [])
+            : await connectNexusVault(opts);
+        bearer = conn.device.currentBearer();
+        const unlocked = await unlockAccount(conn, false, progress);
+        const how = unlocked.escrow === 'minted'
+            ? 'the account key was created and escrowed on Cleo Nexus'
+            : 'this device received the account key from Cleo Nexus escrow';
+        return {
+            status: 'ready',
+            escrow: unlocked.escrow,
+            certificate: unlocked.certificate ?? 'existing',
+            keyVersion: unlocked.key.keyVersion,
+            summary: `Your account is ready for encrypted backups: ${how}, and this device is certified to use it.`,
+        };
+    }
+    catch (err) {
+        if (err instanceof NexusAccountError && err.code === 'E_NEXUS_VAULT_UNSUPPORTED') {
+            const fix = err.fix ?? 'upgrade the Cleo Nexus server';
+            return {
+                status: 'unsupported',
+                code: err.code,
+                fix,
+                summary: `signed in, but encrypted backups are not available: ${err.message}. Fix: ${fix}`,
+            };
+        }
+        const code = err instanceof NexusAccountError ? err.code : 'E_NEXUS_REQUEST_FAILED';
+        const raw = err instanceof Error ? err.message : String(err);
+        const message = redactNexusDeviceSecrets(bearer !== null && bearer !== '' ? raw.split(bearer).join('[redacted]') : raw);
+        const fix = (err instanceof NexusAccountError ? err.fix : undefined) ?? SETUP_RETRY_FIX;
+        const step = progress.step;
+        return {
+            status: 'failed',
+            step,
+            code,
+            message,
+            fix,
+            summary: `signed in, but encrypted backups are not set up: step ${step} (${SETUP_STEP_LABELS[step]}) failed with ${code}: ${message}. Fix: ${fix}`,
+        };
+    }
 }
 /**
  * Why Cleo Nexus refused this device's first key for a project (403), as an
@@ -267,8 +387,9 @@ function refusedFirstKey(err, projectId) {
             return keyUnavailable(`project ${projectId} already has a key, but it has not been shared with this account`, 'ask the project owner to share the project key with this account');
         case 'project-role':
             // Checked before the server knows whether the project has a key, so an owner may already
-            // have created one and not shared it with this account.
-            return keyUnavailable(`this account holds no key for project ${projectId}, and only a project owner can create one`, 'ask a project owner to share the project key with this account, or, if the project has no key yet, to run the first `cleo cloud push`');
+            // have created one and not shared it with this account. A device cannot create it for a
+            // project its account does not own (cleo-nexus #35), so the remedy names a session (T13101).
+            return keyUnavailable(`this account holds no key for project ${projectId}, and only a project owner can create one`, `${NEXUS_PROJECT_KEY_OWNER_REMEDY}, or, if the project already has a key, share it with this account`);
         default:
             return null;
     }
@@ -301,9 +422,14 @@ export async function nexusProjectDataKey(conn, mk, projectId, mint) {
     if (have !== null || !mint)
         return have;
     const pdk = newProjectKey();
+    const wrappedProjectKey = wrapProjectKey(mk, pdk, projectId, 1);
+    // Never send an empty or padding-only wrap: cleo-nexus #35 refuses it with 400 (T13101).
+    if (!isSendableWrap(wrappedProjectKey)) {
+        throw keyUnavailable(`the new key of project ${projectId} wrapped to nothing; nothing was sent`);
+    }
     try {
         await conn.raw('PUT', `${path}/${encodeURIComponent(conn.userId)}`, z.looseObject({}), {
-            wrappedProjectKey: wrapProjectKey(mk, pdk, projectId, 1),
+            wrappedProjectKey,
             keyVersion: 1,
             // Cleo Nexus accepts a new key version, the first one included, only as a rotation naming
             // the current highest version (cleo-nexus T12856). The two fields stay out of the shared

package/dist/cloud/nexus-vault-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault-keys.js","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAEL,WAAW,IAAI,iBAAiB,EAChC,cAAc,EACd,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,aAAa,EAEb,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAChE,wBAAwB,MAAM,IAAI,QAAQ,EAAE,CAAC;AAgC/C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAEpD,SAAS,SAAS,CAAC,EAA6C;IAC9D,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAAE;IAE5B,0BAA0B,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,EAC/B,0EAA0E,EAC1E,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,2BAA2B,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc,EAAE,EAAE,CACzF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QAC5F,IAAI;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACzB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACtE,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,eAAe,EAAE;QAC/C,QAAQ,EAAE,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClD,GAAG;QACH,KAAK,CAAC,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc;YACnF,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAyB;YACnD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACjE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe,EAAE,EAAE,CACnD,GAAG,YAAY,UAAU;IACzB,GAAG,CAAC,MAAM,KAAK,GAAG;IAClB,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,OAAe,EAAE,GAAY;IACnD,OAAO,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,IAAI,KAAK,aAAa;QAC1B,GAAG,CAAC,aAAa,KAAK,iBAAiB,CACxC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,gBAAgB;IACvB,OAAO,IAAI,iBAAiB,CAC1B,2BAA2B,EAC3B,2FAA2F,EAC3F,4HAA4H,CAC7H,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAA0B;IAClD,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,wFAAwF;QACxF,oFAAoF;QACpF,wDAAwD;QACxD,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/F,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,cAAc,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,UAAU,CACb,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAC1B,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,cAAc,CAClB,6DAA6D,EAC7D,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,iBAAiB,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1E,MAAM,cAAc,CAAC,sDAAsD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAA0B;IAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAC1E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,cAAc,CAClB,gGAAgG,EAChG,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,kBAAkB,EAAE;YACnE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnC,UAAU,EAAE,CAAC;YACb,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,oFAAoF;QACpF,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC7D,8CAA8C;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI;YACd,MAAM,cAAc,CAAC,+DAA+D,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAA0B,EAC1B,EAAU,EACV,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAC/F,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS;YACnD,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;SAC9C;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,IAAI,CACb,KAAK,EACL,eAAe,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EACtD,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EACjB,KAAK,CACN,CAAC;IACF,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B,EAC1B,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,+EAA+E,EAC/E,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,KAAK,GACT,IAAI,CAAC,QAAQ,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;QAChE,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5D,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;QAC9E,MAAM,CAAC,GAAG,gBAAgB,CACxB,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EACrC,IAAI,CAAC,MAAM,EACX,KAAK,EACL,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,cAAc,CAClB,UAAU,CAAC,UAAU;YACnB,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,iEAAiE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAY,EAAE,SAAiB;IACtD,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,KAAK,gBAAgB;YACnB,OAAO,cAAc,CACnB,WAAW,SAAS,+FAA+F,EACnH,kHAAkH,CACnH,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO,cAAc,CACnB,WAAW,SAAS,kEAAkE,EACtF,kEAAkE,CACnE,CAAC;QACJ,KAAK,cAAc;YACjB,yFAAyF;YACzF,wDAAwD;YACxD,OAAO,cAAc,CACnB,yCAAyC,SAAS,2CAA2C,EAC7F,uIAAuI,CACxI,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,EAAU,EACV,SAAiB,EACjB,IAAa;IAEb,MAAM,IAAI,GAAG,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,cAAc,CAAC,sBAAsB,SAAS,wCAAwC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;YACrF,iBAAiB,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,CAAC;YACb,0FAA0F;YAC1F,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,cAAc,CAClB,sBAAsB,SAAS,uEAAuE,EACtG,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,GAAiB,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,cAAc,CAClB,kDAAkD,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,aAAa,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"nexus-vault-keys.js","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAEL,WAAW,IAAI,iBAAiB,EAChC,cAAc,EACd,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,aAAa,EAEb,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAA0B,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAChE,wBAAwB,MAAM,IAAI,QAAQ,EAAE,CAAC;AAgC/C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAEpD,SAAS,SAAS,CAAC,EAA6C;IAC9D,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAAE;IAE5B,0BAA0B,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CACxB,MAAyB,EACzB,MAAc,EACd,IAAuB,EACvB,kBAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,EAC/B,0EAA0E,EAC1E,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,2BAA2B,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc,EAAE,EAAE,CACzF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QAC5F,IAAI;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACzB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACtE,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,eAAe,EAAE;QAC/C,QAAQ,EAAE,uBAAuB,CAAC,kBAAkB,CAAC;QACrD,GAAG;QACH,KAAK,CAAC,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc;YACnF,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAyB;YACnD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACjE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe,EAAE,EAAE,CACnD,GAAG,YAAY,UAAU;IACzB,GAAG,CAAC,MAAM,KAAK,GAAG;IAClB,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,OAAe,EAAE,GAAY;IACnD,OAAO,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,IAAI,KAAK,aAAa;QAC1B,GAAG,CAAC,aAAa,KAAK,iBAAiB,CACxC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,gBAAgB;IACvB,OAAO,IAAI,iBAAiB,CAC1B,2BAA2B,EAC3B,2FAA2F,EAC3F,4HAA4H,CAC7H,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAA0B;IAClD,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,wFAAwF;QACxF,oFAAoF;QACpF,wDAAwD;QACxD,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/F,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,cAAc,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,UAAU,CACb,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAC1B,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,cAAc,CAClB,6DAA6D,EAC7D,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,iBAAiB,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1E,MAAM,cAAc,CAAC,sDAAsD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,IAA0B;IAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAC1E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,cAAc,CAClB,gGAAgG,EAChG,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,kBAAkB,EAAE;YACnE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnC,UAAU,EAAE,CAAC;YACb,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,oFAAoF;QACpF,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC7D,8CAA8C;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI;YACd,MAAM,cAAc,CAAC,+DAA+D,CAAC,CAAC;QACxF,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,eAAe,CAC5B,IAA0B,EAC1B,EAAU,EACV,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAC/F,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS;YACnD,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;SAC9C;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,IAAI,CACb,KAAK,EACL,eAAe,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EACtD,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EACjB,KAAK,CACN,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B,EAC1B,OAA+B,EAAE;IAEjC,OAAO,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1F,CAAC;AAUD;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA0B,EAC1B,QAAiB,EACjB,QAAyC;IAEzC,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;QAClC,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,+EAA+E,EAC/E,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,QAAoC,CAAC;IACzC,IAAI,MAAiC,CAAC;IACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,GAAG,QAAQ,CAAC;QACpB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,oFAAoF;QACpF,6EAA6E;QAC7E,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,GAAG,MAAM,CAAC;QAClB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjD,CAAC;IACD,QAAQ,CAAC,IAAI,GAAG,SAAS,CAAC;IAC1B,IAAI,KAAkB,CAAC;IACvB,IAAI,WAAW,GAAmC,IAAI,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QACxB,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACrD,CAAC;IACD,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC;IACxB,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;QAC9E,MAAM,CAAC,GAAG,gBAAgB,CACxB,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EACrC,IAAI,CAAC,MAAM,EACX,KAAK,EACL,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,cAAc,CAClB,UAAU,CAAC,UAAU;YACnB,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,iEAAiE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;QACrF,MAAM;QACN,WAAW;KACZ,CAAC;AACJ,CAAC;AAaD,wDAAwD;AACxD,MAAM,iBAAiB,GAAoD;IACzE,OAAO,EAAE,yDAAyD;IAClE,aAAa,EAAE,kCAAkC;IACjD,aAAa,EAAE,wCAAwC;IACvD,OAAO,EAAE,8CAA8C;IACvD,KAAK,EAAE,kCAAkC;CAC1C,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GACnB,wFAAwF,CAAC;AAE3F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAqC,EAAE;IAEvC,MAAM,QAAQ,GAAoC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtE,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3E,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,GAAG,GACP,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAC1B,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,6DAA6D,CAAC;QACpE,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,UAAU;YAC/C,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU;YACnC,OAAO,EAAE,gDAAgD,GAAG,2CAA2C;SACxG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACjF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,+BAA+B,CAAC;YACvD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG;gBACH,OAAO,EAAE,uDAAuD,GAAG,CAAC,OAAO,UAAU,GAAG,EAAE;aAC3F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACpF,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,wBAAwB,CACtC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAC9E,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC;QACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,GAAG;YACH,OAAO,EAAE,yDAAyD,IAAI,KAAK,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,IAAI,KAAK,OAAO,UAAU,GAAG,EAAE;SACnJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAY,EAAE,SAAiB;IACtD,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,KAAK,gBAAgB;YACnB,OAAO,cAAc,CACnB,WAAW,SAAS,+FAA+F,EACnH,kHAAkH,CACnH,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO,cAAc,CACnB,WAAW,SAAS,kEAAkE,EACtF,kEAAkE,CACnE,CAAC;QACJ,KAAK,cAAc;YACjB,yFAAyF;YACzF,wFAAwF;YACxF,6FAA6F;YAC7F,OAAO,cAAc,CACnB,yCAAyC,SAAS,2CAA2C,EAC7F,GAAG,8BAA8B,oEAAoE,CACtG,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,EAAU,EACV,SAAiB,EACjB,IAAa;IAEb,MAAM,IAAI,GAAG,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,cAAc,CAAC,sBAAsB,SAAS,wCAAwC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,iBAAiB,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAChE,yFAAyF;IACzF,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvC,MAAM,cAAc,CAClB,0BAA0B,SAAS,uCAAuC,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;YACrF,iBAAiB;YACjB,UAAU,EAAE,CAAC;YACb,0FAA0F;YAC1F,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,cAAc,CAClB,sBAAsB,SAAS,uEAAuE,EACtG,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,GAAiB,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,cAAc,CAClB,kDAAkD,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,aAAa,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/cloud/nexus-vault.d.ts

@@ -145,11 +145,15 @@ export declare function restoreNexusVault(opts: NexusVaultRestoreOptions): Promi
 export declare function nexusVaultStatus(opts?: NexusVaultCommandOptions): Promise<CloudVaultStatusResult>;
 /**
  * `cleo cloud verify`: compare this store with the cloud and every device's newest snapshot.
+ * Local backups are checked by `cleo backup verify`.
  *
- * @param opts - Scope and overrides.
- * @returns The verdict and per-table comparison.
+ * @param opts - Scope and overrides; `deep` downloads the snapshots again and
+ *   re-checks their bytes and the journal segments after the head (T13291).
+ * @returns The verdict and per-table comparison, with the deep check when asked.
  */
-export declare function verifyNexusVault(opts?: NexusVaultCommandOptions): Promise<CloudVerifyResult>;
+export declare function verifyNexusVault(opts?: NexusVaultCommandOptions & {
+    deep?: boolean;
+}): Promise<CloudVerifyResult>;
 /**
  * `cleo cloud lease release`: hand the write lease back.
  *

package/dist/cloud/nexus-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAMH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAElB,eAAe,EAEf,sBAAsB,EAEtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AA+D7B,OAAO,EAGL,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAI/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AA6kCD,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAitBlD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAEhG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}
+{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAMH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAElB,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAoE7B,OAAO,EAGL,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAI/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AA+kCD,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAw1BlD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}