@cleocode/core 2026.10.4 → 2026.10.5-rc.ci.672

package/dist/cloud/nexus-project-history.js

@@ -0,0 +1,108 @@
+/**
+ * Ask Cleo Nexus, read-only, whether it holds ANY history of a project: a
+ * checkpoint or a journal segment from any device (T13231). `cleo doctor
+ * row-identity --refill` needs this answer before re-deriving the row identity
+ * of a Nexus-linked store: a uid in the cloud must never be rewritten locally.
+ *
+ * Every linked origin is asked with this machine's device credential. Nothing
+ * is written, locally or remotely: no lease, no key minting, no replica bind.
+ *
+ * @task T13231
+ * @module cloud/nexus-project-history
+ */
+import { ListCheckpointsResult } from '@cleocode/contracts/cloud';
+import { nexusStreamHeadSchema } from '@cleocode/contracts/nexus-vault.js';
+import { NexusError } from './http.js';
+import { readNexusProjectLinks } from './nexus-link.js';
+import { connectNexusVault } from './nexus-vault-keys.js';
+import { projectStream } from './streams.js';
+/**
+ * The cleo-nexus answer for a project the caller can see whose stream was
+ * never created (`requireStreamAccess`: `notFound('stream')`, after project
+ * access passed). A non-member gets `project not found`, and an unknown route
+ * a bare 404; neither proves the cloud holds nothing.
+ */
+const STREAM_NEVER_CREATED = 'stream not found';
+/** Whether a failure is exactly the server's "this project's stream does not exist". */
+function streamNeverCreated(err) {
+    return (err instanceof NexusError &&
+        err.status === 404 &&
+        err.code === 'E_NOT_FOUND' &&
+        err.serverMessage === STREAM_NEVER_CREATED);
+}
+/**
+ * What one stream holds: its head and its checkpoint count. Only two answers
+ * count as "nothing": a stream that exists with no checkpoint and head 0, and
+ * the server's explicit "stream not found" for a project the caller can see.
+ * Every other failure, including any other 404, is thrown (the caller treats
+ * it as unknown).
+ *
+ * @param reader - An authenticated reader.
+ * @param streamId - The project's stream.
+ * @returns Checkpoint count and head sequence.
+ * @task T13231
+ */
+export async function nexusStreamHistory(reader, streamId) {
+    const base = `/v1/streams/${encodeURIComponent(streamId)}`;
+    let head;
+    try {
+        head = await reader.raw('GET', base, nexusStreamHeadSchema);
+    }
+    catch (err) {
+        if (streamNeverCreated(err))
+            return { checkpoints: 0, headSeq: 0 };
+        throw err;
+    }
+    const list = await reader.raw('GET', `${base}/checkpoints`, ListCheckpointsResult);
+    const checkpoints = Math.max(list.checkpoints.length, head.headCheckpointId ? 1 : 0);
+    return { checkpoints, headSeq: head.headSeq };
+}
+/** Ask one origin; any failure is an `error` answer, never "none". */
+async function askOrigin(link, open) {
+    const streamId = link.streamId || projectStream(link.remoteProjectId);
+    const base = { apiUrl: link.apiUrl, remoteProjectId: link.remoteProjectId, streamId };
+    try {
+        const history = await nexusStreamHistory(await open(link.apiUrl), streamId);
+        const present = history.checkpoints > 0 || history.headSeq > 0;
+        return { ...base, answer: present ? 'present' : 'none', ...history };
+    }
+    catch (err) {
+        return {
+            ...base,
+            answer: 'error',
+            checkpoints: 0,
+            headSeq: 0,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+/**
+ * Ask every origin the project is linked to whether it holds a checkpoint or
+ * a journal segment of the project, from any device.
+ *
+ * @param projectRoot - Project root (its `nexus-link.json` names the origins).
+ * @param options - Connection options, or a reader factory (tests).
+ * @returns One answer per linked origin; an unreadable link entry is an `error` answer.
+ * @task T13231
+ */
+export async function askNexusProjectHistory(projectRoot, options = {}) {
+    const { readerFor, ...connectOptions } = options;
+    const open = readerFor ?? ((apiUrl) => connectNexusVault({ ...connectOptions, apiUrl }));
+    const { links, unreadable } = readNexusProjectLinks(projectRoot);
+    const answers = [];
+    for (const link of links)
+        answers.push(await askOrigin(link, open));
+    for (const origin of unreadable) {
+        answers.push({
+            apiUrl: origin,
+            remoteProjectId: '',
+            streamId: '',
+            answer: 'error',
+            checkpoints: 0,
+            headSeq: 0,
+            error: 'this version cannot read the link entry',
+        });
+    }
+    return answers;
+}
+//# sourceMappingURL=nexus-project-history.js.map

package/dist/cloud/nexus-project-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-project-history.js","sourceRoot":"","sources":["../../src/cloud/nexus-project-history.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAA0B,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAW7C;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEhD,wFAAwF;AACxF,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,IAAI,KAAK,aAAa;QAC1B,GAAG,CAAC,aAAa,KAAK,oBAAoB,CAC3C,CAAC;AACJ,CAAC;AAKD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAyB,EACzB,QAAgB;IAEhB,MAAM,IAAI,GAAG,eAAe,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3D,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,kBAAkB,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,cAAc,EAAE,qBAAqB,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,SAAS,CACtB,IAAsB,EACtB,IAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAmB,EACnB,UAAwE,EAAE;IAE1E,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC;IACjD,MAAM,IAAI,GACR,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,MAAM;YACd,eAAe,EAAE,EAAE;YACnB,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,yCAAyC;SACjD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cloud/nexus-vault-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault-keys.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AASlG,OAAO,EAAE,KAAK,OAAO,EAAyB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,IAAI,EAAc,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAML,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAqB,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,eAAO,MAAM,2BAA2B,QAAc,CAAC;AAEvD,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,WAChB,CAAC;AAE/C,sCAAsC;AACtC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,iCAAiC;IACjC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClC,4FAA4F;IAC5F,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,2CAA2C;IAC3C,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACrE;AAQD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAoED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAwID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC,CAE1B;AAgFD,gDAAgD;AAChD,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,iBAAiB,CAAC,CAiD5B;AAkCD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiDxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"nexus-vault-keys.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AASlG,OAAO,EAAE,KAAK,OAAO,EAAyB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,IAAI,EAAc,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAOL,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAGL,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAErF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,eAAO,MAAM,2BAA2B,QAAc,CAAC;AAEvD,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,WAChB,CAAC;AAE/C,sCAAsC;AACtC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,iCAAiC;IACjC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClC,4FAA4F;IAC5F,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,2CAA2C;IAC3C,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACrE;AAQD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAoED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AAwID;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC,CAE1B;AAgFD,gDAAgD;AAChD,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAeD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,iBAAiB,CAAC,CAiD5B;AAmCD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwDxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/cloud/nexus-vault-keys.js

@@ -39,13 +39,13 @@
  * @task T13100
  * @epic T12322
  */
-import { nexusProjectKeysSchema, nexusUserKeysSchema } from '@cleocode/contracts';
 import { DeviceTrust as DeviceTrustSchema, KeyEscrowGrant, PutKeyEscrowResult, } from '@cleocode/contracts/cloud';
+import { nexusProjectKeysSchema, nexusUserKeysSchema } from '@cleocode/contracts/nexus-vault.js';
 import { z } from 'zod';
 import { openSealed, randomKey } from './crypto.js';
 import { Http, NexusError } from './http.js';
-import { certifiedSigners, createDeviceGrant, homeStreamKey, masterKeyVerifier, newProjectKey, unwrapProjectKey, wrapProjectKey, } from './keys.js';
-import { NexusAccountError, resolveNexusApiUrl } from './nexus-auth.js';
+import { certifiedSigners, createDeviceGrant, homeStreamKey, isSendableWrap, masterKeyVerifier, newProjectKey, unwrapProjectKey, wrapProjectKey, } from './keys.js';
+import { NEXUS_PROJECT_KEY_OWNER_REMEDY, NexusAccountError, resolveNexusApiUrl, } from './nexus-auth.js';
 import { assertNexusCloudDeviceMode, NEXUS_CLOUD_TIMEOUT_MS, nexusCredentialWarnings, } from './nexus-cloud.js';
 import { redactNexusDeviceSecrets } from './nexus-device.js';
 import { ensureNexusDeviceCredential, nexusApiErrorToAccountError } from './nexus-enrol.js';
@@ -387,8 +387,9 @@ function refusedFirstKey(err, projectId) {
             return keyUnavailable(`project ${projectId} already has a key, but it has not been shared with this account`, 'ask the project owner to share the project key with this account');
         case 'project-role':
             // Checked before the server knows whether the project has a key, so an owner may already
-            // have created one and not shared it with this account.
-            return keyUnavailable(`this account holds no key for project ${projectId}, and only a project owner can create one`, 'ask a project owner to share the project key with this account, or, if the project has no key yet, to run the first `cleo cloud push`');
+            // have created one and not shared it with this account. A device cannot create it for a
+            // project its account does not own (cleo-nexus #35), so the remedy names a session (T13101).
+            return keyUnavailable(`this account holds no key for project ${projectId}, and only a project owner can create one`, `${NEXUS_PROJECT_KEY_OWNER_REMEDY}, or, if the project already has a key, share it with this account`);
         default:
             return null;
     }
@@ -421,9 +422,14 @@ export async function nexusProjectDataKey(conn, mk, projectId, mint) {
     if (have !== null || !mint)
         return have;
     const pdk = newProjectKey();
+    const wrappedProjectKey = wrapProjectKey(mk, pdk, projectId, 1);
+    // Never send an empty or padding-only wrap: cleo-nexus #35 refuses it with 400 (T13101).
+    if (!isSendableWrap(wrappedProjectKey)) {
+        throw keyUnavailable(`the new key of project ${projectId} wrapped to nothing; nothing was sent`);
+    }
     try {
         await conn.raw('PUT', `${path}/${encodeURIComponent(conn.userId)}`, z.looseObject({}), {
-            wrappedProjectKey: wrapProjectKey(mk, pdk, projectId, 1),
+            wrappedProjectKey,
             keyVersion: 1,
             // Cleo Nexus accepts a new key version, the first one included, only as a rotation naming
             // the current highest version (cleo-nexus T12856). The two fields stay out of the shared

package/dist/cloud/nexus-vault-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault-keys.js","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAEL,WAAW,IAAI,iBAAiB,EAChC,cAAc,EACd,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,aAAa,EAEb,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAA0B,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAChE,wBAAwB,MAAM,IAAI,QAAQ,EAAE,CAAC;AAgC/C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAEpD,SAAS,SAAS,CAAC,EAA6C;IAC9D,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAAE;IAE5B,0BAA0B,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CACxB,MAAyB,EACzB,MAAc,EACd,IAAuB,EACvB,kBAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,EAC/B,0EAA0E,EAC1E,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,2BAA2B,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc,EAAE,EAAE,CACzF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QAC5F,IAAI;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACzB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACtE,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,eAAe,EAAE;QAC/C,QAAQ,EAAE,uBAAuB,CAAC,kBAAkB,CAAC;QACrD,GAAG;QACH,KAAK,CAAC,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc;YACnF,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAyB;YACnD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACjE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe,EAAE,EAAE,CACnD,GAAG,YAAY,UAAU;IACzB,GAAG,CAAC,MAAM,KAAK,GAAG;IAClB,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,OAAe,EAAE,GAAY;IACnD,OAAO,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,IAAI,KAAK,aAAa;QAC1B,GAAG,CAAC,aAAa,KAAK,iBAAiB,CACxC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,gBAAgB;IACvB,OAAO,IAAI,iBAAiB,CAC1B,2BAA2B,EAC3B,2FAA2F,EAC3F,4HAA4H,CAC7H,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAA0B;IAClD,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,wFAAwF;QACxF,oFAAoF;QACpF,wDAAwD;QACxD,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/F,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,cAAc,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,UAAU,CACb,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAC1B,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,cAAc,CAClB,6DAA6D,EAC7D,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,iBAAiB,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1E,MAAM,cAAc,CAAC,sDAAsD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,IAA0B;IAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAC1E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,cAAc,CAClB,gGAAgG,EAChG,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,kBAAkB,EAAE;YACnE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnC,UAAU,EAAE,CAAC;YACb,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,oFAAoF;QACpF,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC7D,8CAA8C;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI;YACd,MAAM,cAAc,CAAC,+DAA+D,CAAC,CAAC;QACxF,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,eAAe,CAC5B,IAA0B,EAC1B,EAAU,EACV,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAC/F,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS;YACnD,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;SAC9C;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,IAAI,CACb,KAAK,EACL,eAAe,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EACtD,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EACjB,KAAK,CACN,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B,EAC1B,OAA+B,EAAE;IAEjC,OAAO,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1F,CAAC;AAUD;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA0B,EAC1B,QAAiB,EACjB,QAAyC;IAEzC,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;QAClC,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,+EAA+E,EAC/E,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,QAAoC,CAAC;IACzC,IAAI,MAAiC,CAAC;IACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,GAAG,QAAQ,CAAC;QACpB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,oFAAoF;QACpF,6EAA6E;QAC7E,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,GAAG,MAAM,CAAC;QAClB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjD,CAAC;IACD,QAAQ,CAAC,IAAI,GAAG,SAAS,CAAC;IAC1B,IAAI,KAAkB,CAAC;IACvB,IAAI,WAAW,GAAmC,IAAI,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QACxB,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACrD,CAAC;IACD,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC;IACxB,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;QAC9E,MAAM,CAAC,GAAG,gBAAgB,CACxB,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EACrC,IAAI,CAAC,MAAM,EACX,KAAK,EACL,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,cAAc,CAClB,UAAU,CAAC,UAAU;YACnB,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,iEAAiE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;QACrF,MAAM;QACN,WAAW;KACZ,CAAC;AACJ,CAAC;AAaD,wDAAwD;AACxD,MAAM,iBAAiB,GAAoD;IACzE,OAAO,EAAE,yDAAyD;IAClE,aAAa,EAAE,kCAAkC;IACjD,aAAa,EAAE,wCAAwC;IACvD,OAAO,EAAE,8CAA8C;IACvD,KAAK,EAAE,kCAAkC;CAC1C,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GACnB,wFAAwF,CAAC;AAE3F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAqC,EAAE;IAEvC,MAAM,QAAQ,GAAoC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtE,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3E,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,GAAG,GACP,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAC1B,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,6DAA6D,CAAC;QACpE,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,UAAU;YAC/C,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU;YACnC,OAAO,EAAE,gDAAgD,GAAG,2CAA2C;SACxG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACjF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,+BAA+B,CAAC;YACvD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG;gBACH,OAAO,EAAE,uDAAuD,GAAG,CAAC,OAAO,UAAU,GAAG,EAAE;aAC3F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACpF,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,wBAAwB,CACtC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAC9E,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC;QACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,GAAG;YACH,OAAO,EAAE,yDAAyD,IAAI,KAAK,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,IAAI,KAAK,OAAO,UAAU,GAAG,EAAE;SACnJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAY,EAAE,SAAiB;IACtD,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,KAAK,gBAAgB;YACnB,OAAO,cAAc,CACnB,WAAW,SAAS,+FAA+F,EACnH,kHAAkH,CACnH,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO,cAAc,CACnB,WAAW,SAAS,kEAAkE,EACtF,kEAAkE,CACnE,CAAC;QACJ,KAAK,cAAc;YACjB,yFAAyF;YACzF,wDAAwD;YACxD,OAAO,cAAc,CACnB,yCAAyC,SAAS,2CAA2C,EAC7F,uIAAuI,CACxI,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,EAAU,EACV,SAAiB,EACjB,IAAa;IAEb,MAAM,IAAI,GAAG,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,cAAc,CAAC,sBAAsB,SAAS,wCAAwC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;YACrF,iBAAiB,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,UAAU,EAAE,CAAC;YACb,0FAA0F;YAC1F,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,cAAc,CAClB,sBAAsB,SAAS,uEAAuE,EACtG,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,GAAiB,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,cAAc,CAClB,kDAAkD,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,aAAa,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"nexus-vault-keys.js","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAEL,WAAW,IAAI,iBAAiB,EAChC,cAAc,EACd,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAuB,MAAM,WAAW,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,aAAa,EAEb,gBAAgB,EAChB,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EAEtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAA0B,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,MAAM,CAAC;AAEvD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CAChE,wBAAwB,MAAM,IAAI,QAAQ,EAAE,CAAC;AAgC/C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAEpD,SAAS,SAAS,CAAC,EAA6C;IAC9D,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA0B,EAAE;IAE5B,0BAA0B,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CACxB,MAAyB,EACzB,MAAc,EACd,IAAuB,EACvB,kBAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,+BAA+B,EAC/B,0EAA0E,EAC1E,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,2BAA2B,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc,EAAE,EAAE,CACzF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QAC5F,IAAI;QACJ,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACzB,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACtE,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,eAAe,EAAE;QAC/C,QAAQ,EAAE,uBAAuB,CAAC,kBAAkB,CAAC;QACrD,GAAG;QACH,KAAK,CAAC,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,MAAyB,EAAE,IAAc;YACnF,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAyB;YACnD,IAAI,CAAC;gBACH,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACjE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,GAAG,CAAC,GAAY,EAAE,MAAe,EAAE,EAAE,CACnD,GAAG,YAAY,UAAU;IACzB,GAAG,CAAC,MAAM,KAAK,GAAG;IAClB,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC;AAE/D,SAAS,cAAc,CAAC,OAAe,EAAE,GAAY;IACnD,OAAO,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,IAAI,KAAK,aAAa;QAC1B,GAAG,CAAC,aAAa,KAAK,iBAAiB,CACxC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,gBAAgB;IACvB,OAAO,IAAI,iBAAiB,CAC1B,2BAA2B,EAC3B,2FAA2F,EAC3F,4HAA4H,CAC7H,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAA0B;IAClD,IAAI,KAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,cAAc,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,wFAAwF;QACxF,oFAAoF;QACpF,wDAAwD;QACxD,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/F,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,cAAc,CAAC,0DAA0D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,UAAU,CACb,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAC1B,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,cAAc,CAClB,6DAA6D,EAC7D,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,iBAAiB,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1E,MAAM,cAAc,CAAC,sDAAsD,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,IAA0B;IAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAC1E,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,cAAc,CAClB,gGAAgG,EAChG,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,kBAAkB,EAAE;YACnE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACnC,UAAU,EAAE,CAAC;YACb,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uFAAuF;QACvF,oFAAoF;QACpF,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC7D,8CAA8C;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,IAAI;YACd,MAAM,cAAc,CAAC,+DAA+D,CAAC,CAAC;QACxF,OAAO,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,eAAe,CAC5B,IAA0B,EAC1B,EAAU,EACV,EAAU;IAEV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAC/F,CAAC;IACF,IAAI,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS;YACnD,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;SAC9C;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;KAChE,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,IAAI,CACb,KAAK,EACL,eAAe,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EACtD,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EACjB,KAAK,CACN,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA0B,EAC1B,OAA+B,EAAE;IAEjC,OAAO,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1F,CAAC;AAUD;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,IAA0B,EAC1B,QAAiB,EACjB,QAAyC;IAEzC,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;QAClC,2EAA2E;QAC3E,kDAAkD;QAClD,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,EACrB,+EAA+E,EAC/E,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,QAAoC,CAAC;IACzC,IAAI,MAAiC,CAAC;IACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,GAAG,QAAQ,CAAC;QACpB,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,oFAAoF;QACpF,6EAA6E;QAC7E,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,QAAQ,GAAG,MAAM,CAAC;QAClB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjD,CAAC;IACD,QAAQ,CAAC,IAAI,GAAG,SAAS,CAAC;IAC1B,IAAI,KAAkB,CAAC;IACvB,IAAI,WAAW,GAAmC,IAAI,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QACxB,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACrD,CAAC;IACD,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC;IACxB,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;QAC9E,MAAM,CAAC,GAAG,gBAAgB,CACxB,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EACrC,IAAI,CAAC,MAAM,EACX,KAAK,EACL,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,cAAc,CAClB,UAAU,CAAC,UAAU;YACnB,CAAC,CAAC,uEAAuE;YACzE,CAAC,CAAC,iEAAiE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE;QACrF,MAAM;QACN,WAAW;KACZ,CAAC;AACJ,CAAC;AAaD,wDAAwD;AACxD,MAAM,iBAAiB,GAAoD;IACzE,OAAO,EAAE,yDAAyD;IAClE,aAAa,EAAE,kCAAkC;IACjD,aAAa,EAAE,wCAAwC;IACvD,OAAO,EAAE,8CAA8C;IACvD,KAAK,EAAE,kCAAkC;CAC1C,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GACnB,wFAAwF,CAAC;AAE3F;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAqC,EAAE;IAEvC,MAAM,QAAQ,GAAoC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtE,0FAA0F;IAC1F,wEAAwE;IACxE,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3E,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,GAAG,GACP,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAC1B,CAAC,CAAC,wDAAwD;YAC1D,CAAC,CAAC,6DAA6D,CAAC;QACpE,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,UAAU;YAC/C,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU;YACnC,OAAO,EAAE,gDAAgD,GAAG,2CAA2C;SACxG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACjF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,+BAA+B,CAAC;YACvD,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG;gBACH,OAAO,EAAE,uDAAuD,GAAG,CAAC,OAAO,UAAU,GAAG,EAAE;aAC3F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC;QACpF,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,wBAAwB,CACtC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAC9E,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC;QACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,GAAG;YACH,OAAO,EAAE,yDAAyD,IAAI,KAAK,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,IAAI,KAAK,OAAO,UAAU,GAAG,EAAE;SACnJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAY,EAAE,SAAiB;IACtD,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,KAAK,gBAAgB;YACnB,OAAO,cAAc,CACnB,WAAW,SAAS,+FAA+F,EACnH,kHAAkH,CACnH,CAAC;QACJ,KAAK,kBAAkB;YACrB,OAAO,cAAc,CACnB,WAAW,SAAS,kEAAkE,EACtF,kEAAkE,CACnE,CAAC;QACJ,KAAK,cAAc;YACjB,yFAAyF;YACzF,wFAAwF;YACxF,6FAA6F;YAC7F,OAAO,cAAc,CACnB,yCAAyC,SAAS,2CAA2C,EAC7F,GAAG,8BAA8B,oEAAoE,CACtG,CAAC;QACJ;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,EAAU,EACV,SAAiB,EACjB,IAAa;IAEb,MAAM,IAAI,GAAG,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,cAAc,CAAC,sBAAsB,SAAS,wCAAwC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,iBAAiB,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAChE,yFAAyF;IACzF,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvC,MAAM,cAAc,CAClB,0BAA0B,SAAS,uCAAuC,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;YACrF,iBAAiB;YACjB,UAAU,EAAE,CAAC;YACb,0FAA0F;YAC1F,yFAAyF;YACzF,4EAA4E;YAC5E,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;YACvE,gEAAgE;YAChE,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;YACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,cAAc,CAClB,sBAAsB,SAAS,uEAAuE,EACtG,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,GAAiB,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,MAAM,cAAc,CAClB,kDAAkD,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC,aAAa,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,MAAM,2BAA2B,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/cloud/nexus-vault.d.ts

@@ -145,11 +145,15 @@ export declare function restoreNexusVault(opts: NexusVaultRestoreOptions): Promi
 export declare function nexusVaultStatus(opts?: NexusVaultCommandOptions): Promise<CloudVaultStatusResult>;
 /**
  * `cleo cloud verify`: compare this store with the cloud and every device's newest snapshot.
+ * Local backups are checked by `cleo backup verify`.
  *
- * @param opts - Scope and overrides.
- * @returns The verdict and per-table comparison.
+ * @param opts - Scope and overrides; `deep` downloads the snapshots again and
+ *   re-checks their bytes and the journal segments after the head (T13291).
+ * @returns The verdict and per-table comparison, with the deep check when asked.
  */
-export declare function verifyNexusVault(opts?: NexusVaultCommandOptions): Promise<CloudVerifyResult>;
+export declare function verifyNexusVault(opts?: NexusVaultCommandOptions & {
+    deep?: boolean;
+}): Promise<CloudVerifyResult>;
 /**
  * `cleo cloud lease release`: hand the write lease back.
  *

package/dist/cloud/nexus-vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAMH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAElB,eAAe,EAEf,sBAAsB,EAEtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AA+D7B,OAAO,EAGL,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAI/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AA6kCD,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAitBlD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,wBAA6B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAEhG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}
+{"version":3,"file":"nexus-vault.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAMH,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAElB,eAAe,EAEf,sBAAsB,EAGtB,iBAAiB,EAGlB,MAAM,qBAAqB,CAAC;AAoE7B,OAAO,EAGL,KAAK,iBAAiB,EAIvB,MAAM,uBAAuB,CAAC;AAI/B,gGAAgG;AAChG,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAMjD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B1B,CAAC;AAkCX,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,0FAA0F;IAC1F,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AA+kCD,4CAA4C;AAC5C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,uHAAuH;IACvH,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACrD;AAyDD,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAw1BlD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,wBAAwB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,wBAAwB,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAElC"}

package/dist/cloud/nexus-vault.js

@@ -55,8 +55,10 @@ import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { NEXUS_VAULT_LEASE_ROLE, nexusCloudDevicePageSchema, nexusLeaseAcquireSchema, nexusStreamHeadSchema, SYNC_SCHEMA_VERSION, } from '@cleocode/contracts';
 import { ListCheckpointsResult, ListLeasesResult, } from '@cleocode/contracts/cloud';
+import { nexusCloudDevicePageSchema } from '@cleocode/contracts/nexus-cloud.js';
+import { NEXUS_VAULT_LEASE_ROLE, nexusLeaseAcquireSchema, nexusStreamHeadSchema, } from '@cleocode/contracts/nexus-vault.js';
+import { SYNC_SCHEMA_VERSION } from '@cleocode/contracts/sync-schema.js';
 import { readDeclaredProjectIdentity } from '@cleocode/paths';
 import { extract as tarExtract } from 'tar';
 import { z } from 'zod';
@@ -65,8 +67,9 @@ import { withLock } from '../store/lock.js';
 import { exportPortableBundle, globalHomeRules } from '../store/portable-bundle.js';
 import { importPortableBundle } from '../store/portable-bundle-import.js';
 import { integrityCheck, PROJECT_SECTION_RULES, scanSection, sha256File, } from '../store/portable-bundle-scan.js';
+import { writeRestoreMarker } from '../store/restore-marker.js';
 import { FIRST_OPEN_LOCK_SUFFIX } from '../store/sqlite.js';
-import { readActiveReplicaId } from '../store/sync/replica.js';
+import { fileIdentity, readActiveReplicaId, rebindAfterVaultRestore, } from '../store/sync/replica.js';
 import { buildVaultManifest, carryMachineState, compareVaultManifests, emptyVaultTableHash, isVaultAnnotationKey, isVaultForkManifest, sameVaultManifest, VAULT_FILES_KEY, VAULT_FORK_KEY, VAULT_FORMAT_KEY, VAULT_GLOBAL_CONFIG_LOCAL_KEYS, VAULT_MANIFEST_FORMAT_VERSION, vaultDatabaseEntry, vaultDatabaseKey, vaultFileDigest, vaultFilesEntry, vaultForkEntry, vaultFormatEntry, vaultManifestFormat, vaultStripColumns, } from '../store/vault-manifest.js';
 import { foreignWriterLeases, storeOpenElsewhere } from '../store/writer-lease.js';
 import { deriveKey } from './crypto.js';
@@ -546,14 +549,16 @@ function compareWithSynced(local, snapshot, git, changes) {
 }
 /**
  * This device's local-only change journal, emptied in every vault snapshot
- * (T13042): capture, undo and quarantined images hold values the snapshot
- * strips, and a restore takes these tables from the live store anyway.
+ * (T13042): capture, undo and quarantined images, and apply intents (T12757),
+ * hold values the snapshot strips, and a restore takes these tables from the
+ * live store anyway.
  */
 const VAULT_CLEARED_JOURNAL_TABLES = [
     '_sync_capture',
     '_sync_undo',
     '_sync_frame',
     '_sync_quarantine',
+    '_sync_apply_intent',
 ];
 /**
  * Export the store the way the vault snapshots it: no secrets, no `strip`
@@ -1237,6 +1242,7 @@ async function restoreNexusVaultImpl(opts) {
             verified: false,
             tables: 0,
             safetyBackup: null,
+            replica: null,
             warnings,
         };
     }
@@ -1302,6 +1308,8 @@ async function restoreNexusVaultImpl(opts) {
                 ...(t.scope === 'project' ? { projectRoot: t.storeRoot } : {}),
                 outputPath: safetyBackup,
                 label: 'cloud-vault-pre-restore',
+                // A local safety copy: it shares nothing (T13250).
+                sharesIdentity: false,
             });
             safety = await safetyInventory(safetyBackup, t);
             rotateSafetyBundles(dir);
@@ -1329,6 +1337,9 @@ async function restoreNexusVaultImpl(opts) {
             : new Map();
         if (t.scope === 'project')
             fs.mkdirSync(t.storeRoot, { recursive: true });
+        // T13258: the restore-in-progress marker, held from the final liveness
+        // check until the placement is done; every store open refuses meanwhile.
+        let releaseMarker = null;
         const place = () => importPortableBundle({
             bundlePath,
             ...(t.scope === 'project' ? { target: t.storeRoot } : {}),
@@ -1389,7 +1400,9 @@ async function restoreNexusVaultImpl(opts) {
                             keptUnsynced.push(f.relPath);
                     }
                 }
-                // Checked again under the lock.
+                // Checked again under the lock, with the marker held.
+                fs.mkdirSync(path.dirname(t.dbPath), { recursive: true });
+                releaseMarker = writeRestoreMarker(t.dbPath, 'vault');
                 if (hasLocal)
                     await assertStoreQuiescent(t);
                 // Keep this machine's own state: local-only tables and columns,
@@ -1401,11 +1414,54 @@ async function restoreNexusVaultImpl(opts) {
                 })));
             },
         });
+        let replica = null;
         const placeAndPrune = async () => {
-            await place();
-            // The snapshot's install id never becomes this machine's (T13022).
-            if (globalConfig !== null && fs.existsSync(globalConfig)) {
-                keepGlobalConfigLocalKeys(globalConfig, ownConfigKeys);
+            // Which file the snapshot replaces: its replica is retired as a vault
+            // restore only if it was bound to that file (T13109 review MED-1).
+            const before = fs.existsSync(t.dbPath) ? fileIdentity(t.dbPath) : null;
+            // T13258: the marker (written in onStaged) is held through the rebind,
+            // so no open can bind the placed file first (T13262).
+            try {
+                await place();
+                // The snapshot's install id never becomes this machine's (T13022).
+                if (globalConfig !== null && fs.existsSync(globalConfig)) {
+                    keepGlobalConfigLocalKeys(globalConfig, ownConfigKeys);
+                }
+                // The placed file is a new store instance: its replica is retired and a
+                // new one bound (§1.5; T13109).
+                const placedReplica = await readActiveReplicaId(t.dbPath, t.scope).catch(() => null);
+                try {
+                    const rebound = await rebindAfterVaultRestore(t.dbPath, t.scope, before);
+                    if (rebound) {
+                        replica = {
+                            retired: rebound.previousReplicaId,
+                            current: rebound.replicaId,
+                            reason: rebound.reason,
+                        };
+                    }
+                }
+                catch (err) {
+                    const why = err instanceof Error ? err.message : String(err);
+                    // The store's transaction may have committed before the registry write failed.
+                    const now = await readActiveReplicaId(t.dbPath, t.scope).catch(() => null);
+                    if (placedReplica !== null && now !== null && now !== placedReplica) {
+                        replica = { retired: placedReplica, current: now, reason: null };
+                        warnings.push({
+                            code: 'W_NEXUS_VAULT_REBIND',
+                            message: `this store's replica ${placedReplica} was retired and ${now} bound, but recording it in this device's replica registry failed (${why}), so it may not be a retire candidate`,
+                        });
+                    }
+                    else {
+                        warnings.push({
+                            code: 'W_NEXUS_VAULT_REBIND',
+                            message: `restored, but this store's replica was not rebound (${why}); ${t.scope === 'global' ? 'the next global push' : 'the next `cleo project link`'} rebinds it as a copied file`,
+                        });
+                    }
+                }
+            }
+            finally {
+                releaseMarker?.();
+                releaseMarker = null;
             }
             // Deletions propagate: what the snapshot no longer lists goes (T13004);
             // without a synced snapshot, only --force removes anything (T13020).
@@ -1461,6 +1517,7 @@ async function restoreNexusVaultImpl(opts) {
             verified: true,
             tables,
             safetyBackup,
+            replica,
             warnings,
         };
     }
@@ -1544,6 +1601,72 @@ function unsyncedForks(trusted, headCheckpointId, syncedCheckpointId, deviceId)
     }
     return out;
 }
+/**
+ * What the client refused in bytes the server sent (T13291): every client-side
+ * refusal carries `details.reason`. A network or HTTP failure is no finding
+ * about the cloud copy, so it returns `null` and the caller rethrows it.
+ */
+function refusalOf(err) {
+    return err instanceof NexusError && typeof err.details?.['reason'] === 'string'
+        ? err.serverMessage
+        : null;
+}
+/**
+ * `cleo cloud verify --deep` (T13291): download the head snapshot and each
+ * device's newest snapshot again, checking size, sha256 and decryption, then
+ * re-hash, signature-check and decrypt every journal segment after the head.
+ * The segments a snapshot covers are what its bundle captured, so the tail
+ * after the head is what a pull would still replay.
+ */
+async function deepVerify(journal, signers, headCp, snapshots) {
+    const picked = new Map();
+    if (headCp)
+        picked.set(headCp.checkpointId, headCp);
+    for (const cp of snapshots)
+        if (!picked.has(cp.checkpointId))
+            picked.set(cp.checkpointId, cp);
+    const checked = [];
+    for (const cp of picked.values()) {
+        let problem = null;
+        try {
+            await journal.restoreCheckpoint(cp.checkpointId, signers);
+        }
+        catch (err) {
+            problem = refusalOf(err);
+            if (problem === null)
+                throw err;
+        }
+        checked.push({
+            checkpointId: cp.checkpointId,
+            deviceId: cp.deviceId,
+            sizeBytes: cp.sizeBytes,
+            ok: problem === null,
+            problem,
+        });
+    }
+    let cursor = headCp ? cursorFromCheckpoint(headCp) : initialPullCursor();
+    const from = cursor.after;
+    let count = 0;
+    let problem = null;
+    try {
+        for (;;) {
+            const page = await journal.pull(cursor, signers);
+            count += page.segments.length;
+            cursor = page.cursor;
+            if (page.segments.length === 0 || cursor.after >= page.head)
+                break;
+        }
+    }
+    catch (err) {
+        problem = refusalOf(err);
+        if (problem === null)
+            throw err;
+    }
+    return {
+        snapshots: checked,
+        segments: { from, checked: count, ok: problem === null, problem },
+    };
+}
 /** `cleo cloud verify`: local integrity, local vs head per table, and every device's newest snapshot vs the head. */
 async function verifyNexusVaultImpl(opts = {}) {
     const conn = await connectNexusVault(opts);
@@ -1589,6 +1712,25 @@ async function verifyNexusVaultImpl(opts = {}) {
     for (const cp of trusted)
         if (!newest.has(cp.deviceId))
             newest.set(cp.deviceId, cp);
+    const deep = opts.deep
+        ? await deepVerify(journal, key.signers, headCp, [...newest.values()])
+        : undefined;
+    // The head's bundle or the tail after it failing the byte check decides the
+    // verdict; another device's older snapshot failing it is reported (T13291).
+    const deepFailure = deep
+        ? (deep.snapshots.find((x) => x.checkpointId === headCp?.checkpointId && !x.ok)?.problem ??
+            deep.segments.problem)
+        : null;
+    if (deepFailure !== null)
+        verdict = 'untrusted';
+    for (const x of deep?.snapshots ?? []) {
+        if (!x.ok && x.checkpointId !== headCp?.checkpointId) {
+            warnings.push({
+                code: 'W_NEXUS_VAULT_BLOB_INTEGRITY',
+                message: `snapshot ${x.checkpointId} by ${names.get(x.deviceId) ?? x.deviceId} failed the deep check: ${x.problem}`,
+            });
+        }
+    }
     // Only a fork this machine has not synced past is news to it (T12976). The
     // label is on the checkpoint, so it outlives the lease (T13007); a forced
     // lease whose push has not landed yet is reported from the lease.
@@ -1618,25 +1760,27 @@ async function verifyNexusVaultImpl(opts = {}) {
     if (headFormat)
         warnings.push(headFormat);
     const journalHead = isJournalSnapshot(headCp);
-    const remedy = verdict === 'untrusted'
-        ? `the newest snapshot ${head.headCheckpointId} is not signed by a device this account trusts: do not pull it; see which device pushed it with \`cleo cloud vault\` and \`cleo cloud activity\`, and revoke that device if you do not recognise it`
-        : headCp && vaultManifestFormat(headCp.manifest, hashKeyOf(t.dataKey)) === 'unknown'
-            ? `the newest snapshot records a vault manifest format this CLEO does not recognise (this CLEO hashes format ${VAULT_MANIFEST_FORMAT_VERSION}): if a newer CLEO pushed it, upgrade CLEO on this machine, then verify again`
-            : verdict === 'behind'
-                ? 'run `cleo cloud pull` to bring this machine to the newest snapshot'
-                : verdict === 'ahead'
-                    ? journalHead
-                        ? `this machine changed since the newest snapshot, which is checkpoint/v3 (the change journal writes this stream): ${JOURNAL_STREAM_REMEDY}`
-                        : 'run `cleo cloud push` to back up the local changes'
-                    : verdict === 'diverged'
+    const remedy = deepFailure !== null
+        ? `the cloud copy failed the deep check (${deepFailure}): do not pull it; see which device pushed the newest snapshot with \`cleo cloud vault\` and \`cleo cloud activity\`, then push a fresh snapshot from a machine whose store passes \`cleo cloud verify\``
+        : verdict === 'untrusted'
+            ? `the newest snapshot ${head.headCheckpointId} is not signed by a device this account trusts: do not pull it; see which device pushed it with \`cleo cloud vault\` and \`cleo cloud activity\`, and revoke that device if you do not recognise it`
+            : headCp && vaultManifestFormat(headCp.manifest, hashKeyOf(t.dataKey)) === 'unknown'
+                ? `the newest snapshot records a vault manifest format this CLEO does not recognise (this CLEO hashes format ${VAULT_MANIFEST_FORMAT_VERSION}): if a newer CLEO pushed it, upgrade CLEO on this machine, then verify again`
+                : verdict === 'behind'
+                    ? 'run `cleo cloud pull` to bring this machine to the newest snapshot'
+                    : verdict === 'ahead'
                         ? journalHead
-                            ? `both sides changed, and the newest snapshot is checkpoint/v3 (the change journal writes this stream): ${JOURNAL_STREAM_REMEDY}; or \`cleo cloud pull --force\` to take the cloud (a safety backup is taken first)`
-                            : 'both sides changed: run `cleo cloud push --force` to keep this machine (a labelled fork), or `cleo cloud pull --force` to take the cloud (a safety backup is taken first)'
-                        : verdict === 'empty'
-                            ? 'run `cleo cloud push` to make the first snapshot'
-                            : !localIntegrity
-                                ? 'the local store failed its integrity check: run `cleo doctor` and `cleo cloud restore`'
-                                : null;
+                            ? `this machine changed since the newest snapshot, which is checkpoint/v3 (the change journal writes this stream): ${JOURNAL_STREAM_REMEDY}`
+                            : 'run `cleo cloud push` to back up the local changes'
+                        : verdict === 'diverged'
+                            ? journalHead
+                                ? `both sides changed, and the newest snapshot is checkpoint/v3 (the change journal writes this stream): ${JOURNAL_STREAM_REMEDY}; or \`cleo cloud pull --force\` to take the cloud (a safety backup is taken first)`
+                                : 'both sides changed: run `cleo cloud push --force` to keep this machine (a labelled fork), or `cleo cloud pull --force` to take the cloud (a safety backup is taken first)'
+                            : verdict === 'empty'
+                                ? 'run `cleo cloud push` to make the first snapshot'
+                                : !localIntegrity
+                                    ? 'the local store failed its integrity check: run `cleo doctor` and `cleo cloud restore`'
+                                    : null;
     return {
         apiUrl: conn.apiUrl,
         scope: t.scope,
@@ -1654,6 +1798,7 @@ async function verifyNexusVaultImpl(opts = {}) {
             createdAt: cp.createdAt ?? null,
             matchesHead: headCp ? sameVaultManifest(cp.manifest, headCp.manifest) : false,
         })),
+        ...(deep ? { deep } : {}),
         warnings: [...warnings, ...conn.state.drainWarnings()],
     };
 }
@@ -1726,9 +1871,11 @@ export function nexusVaultStatus(opts = {}) {
 }
 /**
  * `cleo cloud verify`: compare this store with the cloud and every device's newest snapshot.
+ * Local backups are checked by `cleo backup verify`.
  *
- * @param opts - Scope and overrides.
- * @returns The verdict and per-table comparison.
+ * @param opts - Scope and overrides; `deep` downloads the snapshots again and
+ *   re-checks their bytes and the journal segments after the head (T13291).
+ * @returns The verdict and per-table comparison, with the deep check when asked.
  */
 export function verifyNexusVault(opts = {}) {
     return mapped(() => verifyNexusVaultImpl(opts));