@cleocode/core 2026.9.19 → 2026.9.21

package/dist/cloud/crypto.js

@@ -0,0 +1,223 @@
+import { argon2, createCipheriv, createDecipheriv, createHash, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, sign, timingSafeEqual, verify, } from 'node:crypto';
+import { KDF_LIMITS } from '@cleocode/contracts/cloud';
+/**
+ * Cleo Nexus E2E primitives. Spec: docs/security/e2e-keys.md. Uses Node 24 node:crypto only.
+ * Every AEAD message derives a fresh subkey from a random 32-byte salt, so ChaCha20-Poly1305's
+ * 96-bit nonce is never reused under one key.
+ */
+const AEAD_VERSION = 0x01;
+const SEAL_VERSION = 0x02;
+const SALT = 32;
+const NONCE = 12;
+const TAG = 16;
+export class DecryptError extends Error {
+    constructor(message = 'decryption failed: wrong key, wrong context, or tampered ciphertext') {
+        super(message);
+        this.name = 'DecryptError';
+    }
+}
+export const randomKey = () => randomBytes(32);
+function subkey(ikm, salt, purpose) {
+    return Buffer.from(hkdfSync('sha256', ikm, salt, `cleo-nexus/${purpose}/v1`, 32));
+}
+/** Derive a named key from a parent key (no salt). Examples: home-stream, verifier. */
+export function deriveKey(parent, purpose) {
+    return Buffer.from(hkdfSync('sha256', parent, Buffer.alloc(0), `cleo-nexus/${purpose}/v1`, 32));
+}
+/** AEAD-encrypt `plaintext` under `key`, bound to `context` (AAD) and `purpose` (HKDF info). */
+export function seal(key, plaintext, purpose, context) {
+    if (key.length !== 32)
+        throw new Error('key must be 32 bytes');
+    const salt = randomBytes(SALT);
+    const nonce = randomBytes(NONCE);
+    const cipher = createCipheriv('chacha20-poly1305', subkey(key, salt, purpose), nonce, {
+        authTagLength: TAG,
+    });
+    cipher.setAAD(Buffer.from(context, 'utf8'), { plaintextLength: plaintext.length });
+    const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return Buffer.concat([Buffer.of(AEAD_VERSION), salt, nonce, body, cipher.getAuthTag()]);
+}
+export function open(key, envelope, purpose, context) {
+    const e = Buffer.from(envelope);
+    if (e.length < 1 + SALT + NONCE + TAG || e[0] !== AEAD_VERSION)
+        throw new DecryptError('not an AEAD v1 envelope');
+    const salt = e.subarray(1, 1 + SALT);
+    const nonce = e.subarray(1 + SALT, 1 + SALT + NONCE);
+    const body = e.subarray(1 + SALT + NONCE, e.length - TAG);
+    const tag = e.subarray(e.length - TAG);
+    try {
+        const d = createDecipheriv('chacha20-poly1305', subkey(key, salt, purpose), nonce, {
+            authTagLength: TAG,
+        });
+        d.setAAD(Buffer.from(context, 'utf8'), { plaintextLength: body.length });
+        d.setAuthTag(tag);
+        return Buffer.concat([d.update(body), d.final()]);
+    }
+    catch {
+        throw new DecryptError();
+    }
+}
+// ---------- X25519 sealed box ----------
+const b64u = (b) => Buffer.from(b).toString('base64url');
+function x25519Public(raw) {
+    return createPublicKey({ key: { kty: 'OKP', crv: 'X25519', x: b64u(raw) }, format: 'jwk' });
+}
+export function generateX25519() {
+    const { publicKey, privateKey } = generateKeyPairSync('x25519');
+    const jwk = privateKey.export({ format: 'jwk' });
+    return {
+        publicKey: Buffer.from(publicKey.export({ format: 'jwk' }).x, 'base64url'),
+        privateKey: Buffer.from(jwk.d, 'base64url'),
+    };
+}
+function x25519Private(pub, priv) {
+    return createPrivateKey({
+        key: { kty: 'OKP', crv: 'X25519', x: b64u(pub), d: b64u(priv) },
+        format: 'jwk',
+    });
+}
+/** Encrypt to a recipient's X25519 public key. Only the holder of the private key can open it. */
+export function sealTo(recipientPublic, plaintext, context) {
+    const eph = generateKeyPairSync('x25519');
+    const ephPub = Buffer.from(eph.publicKey.export({ format: 'jwk' }).x, 'base64url');
+    const shared = diffieHellman({
+        privateKey: eph.privateKey,
+        publicKey: x25519Public(recipientPublic),
+    });
+    const k = Buffer.from(hkdfSync('sha256', shared, Buffer.concat([ephPub, recipientPublic]), 'cleo-nexus/seal/v1', 32));
+    return Buffer.concat([Buffer.of(SEAL_VERSION), ephPub, seal(k, plaintext, 'seal', context)]);
+}
+export function openSealed(recipient, sealed, context) {
+    const s = Buffer.from(sealed);
+    if (s.length < 33 || s[0] !== SEAL_VERSION)
+        throw new DecryptError('not a sealed-box v2 envelope');
+    const ephPub = s.subarray(1, 33);
+    try {
+        const shared = diffieHellman({
+            privateKey: x25519Private(recipient.publicKey, recipient.privateKey),
+            publicKey: x25519Public(ephPub),
+        });
+        const k = Buffer.from(hkdfSync('sha256', shared, Buffer.concat([ephPub, recipient.publicKey]), 'cleo-nexus/seal/v1', 32));
+        return open(k, s.subarray(33), 'seal', context);
+    }
+    catch (err) {
+        if (err instanceof DecryptError)
+            throw err;
+        throw new DecryptError();
+    }
+}
+// ---------- Ed25519 ----------
+export function generateEd25519() {
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+    return {
+        publicKey: Buffer.from(publicKey.export({ format: 'jwk' }).x, 'base64url'),
+        privateKey: Buffer.from(privateKey.export({ format: 'jwk' }).d, 'base64url'),
+    };
+}
+export function signEd25519(kp, message) {
+    const key = createPrivateKey({
+        key: { kty: 'OKP', crv: 'Ed25519', x: b64u(kp.publicKey), d: b64u(kp.privateKey) },
+        format: 'jwk',
+    });
+    return sign(null, message, key);
+}
+export function verifyEd25519(publicKey, message, signature) {
+    try {
+        const key = createPublicKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: b64u(publicKey) },
+            format: 'jwk',
+        });
+        return verify(null, message, key, signature);
+    }
+    catch {
+        return false;
+    }
+}
+export const DEFAULT_KDF = { memoryKiB: 65_536, iterations: 3, parallelism: 1 };
+export function newKdfParams() {
+    return { algorithm: 'argon2id', ...DEFAULT_KDF, salt: randomBytes(16).toString('base64') };
+}
+/**
+ * Refuse KDF parameters outside KDF_LIMITS. They come from the server, which must not be able to weaken
+ * the passphrase stretch or make the client allocate unbounded memory.
+ */
+export function checkKdfParams(p) {
+    const within = (v, b) => Number.isInteger(v) && v >= b.min && v <= b.max;
+    const salt = Buffer.from(p.salt, 'base64');
+    if (p.algorithm !== 'argon2id' ||
+        !within(p.memoryKiB, KDF_LIMITS.memoryKiB) ||
+        !within(p.iterations, KDF_LIMITS.iterations) ||
+        !within(p.parallelism, KDF_LIMITS.parallelism) ||
+        salt.length < 16 ||
+        salt.length > 64) {
+        throw new RangeError('KDF parameters are outside the accepted bounds');
+    }
+}
+export function passphraseKey(passphrase, p) {
+    checkKdfParams(p);
+    return new Promise((resolve, reject) => {
+        argon2('argon2id', {
+            message: Buffer.from(passphrase.normalize('NFKC'), 'utf8'),
+            nonce: Buffer.from(p.salt, 'base64'),
+            parallelism: p.parallelism,
+            tagLength: 32,
+            memory: p.memoryKiB,
+            passes: p.iterations,
+        }, (err, key) => (err ? reject(err) : resolve(Buffer.from(key))));
+    });
+}
+// ---------- recovery key (Crockford base32, 13×4 chars with a 4-bit checksum) ----------
+const CROCKFORD = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+export function encodeRecoveryKey(key) {
+    if (key.length !== 32)
+        throw new Error('recovery key must be 32 bytes');
+    const check = (createHash('sha256').update(key).digest()[0] ?? 0) >> 4;
+    let bits = 0n;
+    for (const b of key)
+        bits = (bits << 8n) | BigInt(b);
+    bits = (bits << 4n) | BigInt(check);
+    let out = '';
+    for (let i = 51; i >= 0; i--)
+        out += CROCKFORD[Number((bits >> BigInt(i * 5)) & 31n)];
+    return out.match(/.{4}/g)?.join('-') ?? out;
+}
+export function decodeRecoveryKey(text) {
+    const clean = text.toUpperCase().replace(/[-\s]/g, '').replace(/[IL]/g, '1').replace(/O/g, '0');
+    if (clean.length !== 52)
+        throw new Error('recovery key must be 52 characters');
+    let bits = 0n;
+    for (const ch of clean) {
+        const v = CROCKFORD.indexOf(ch);
+        if (v < 0)
+            throw new Error(`invalid recovery key character: ${ch}`);
+        bits = (bits << 5n) | BigInt(v);
+    }
+    const check = Number(bits & 15n);
+    bits >>= 4n;
+    const key = Buffer.alloc(32);
+    for (let i = 31; i >= 0; i--) {
+        key[i] = Number(bits & 255n);
+        bits >>= 8n;
+    }
+    if ((createHash('sha256').update(key).digest()[0] ?? 0) >> 4 !== check) {
+        throw new Error('recovery key checksum mismatch: check for a typo');
+    }
+    return key;
+}
+export function constantTimeEqual(a, b) {
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export const sha256Hex = (b) => createHash('sha256').update(b).digest('hex');
+export const hmacSha256 = (key, message) => createHmac('sha256', key).update(message).digest();
+/** A UUIDv7 (RFC 9562 §5.7): 48-bit Unix millis, then random bits. Used to mint checkpoint ids. */
+export function uuidv7(now = Date.now()) {
+    const b = randomBytes(16);
+    const ms = BigInt(Math.max(0, Math.floor(now)));
+    for (let i = 0; i < 6; i++)
+        b[i] = Number((ms >> BigInt(8 * (5 - i))) & 0xffn);
+    b[6] = ((b[6] ?? 0) & 0x0f) | 0x70;
+    b[8] = ((b[8] ?? 0) & 0x3f) | 0x80;
+    const h = b.toString('hex');
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20)}`;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/cloud/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/cloud/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,QAAQ,EAER,WAAW,EACX,IAAI,EACJ,eAAe,EACf,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD;;;;GAIG;AAEH,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,IAAI,GAAG,EAAE,CAAC;AAChB,MAAM,KAAK,GAAG,EAAE,CAAC;AACjB,MAAM,GAAG,GAAG,EAAE,CAAC;AAEf,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,GAAG,qEAAqE;QACzF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAEvD,SAAS,MAAM,CAAC,GAAe,EAAE,IAAgB,EAAE,OAAe;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,MAAkB,EAAE,OAAe;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,OAAO,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,IAAI,CAClB,GAAe,EACf,SAAqB,EACrB,OAAe,EACf,OAAe;IAEf,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE;QACpF,aAAa,EAAE,GAAG;KACnB,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,IAAI,CAClB,GAAe,EACf,QAAoB,EACpB,OAAe,EACf,OAAe;IAEf,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY;QAC5D,MAAM,IAAI,YAAY,CAAC,yBAAyB,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE;YACjF,aAAa,EAAE,GAAG;SACnB,CAAC,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,0CAA0C;AAE1C,MAAM,IAAI,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAErE,SAAS,YAAY,CAAC,GAAe;IACnC,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9F,CAAC;AAOD,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;QACpF,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAW,EAAE,WAAW,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAe,EAAE,IAAgB;IACtD,OAAO,gBAAgB,CAAC;QACtB,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QAC/D,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,MAAM,CACpB,eAA2B,EAC3B,SAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,YAAY,CAAC,eAAe,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAC/F,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAkB,EAAE,MAAkB,EAAE,OAAe;IAChF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY;QACxC,MAAM,IAAI,YAAY,CAAC,8BAA8B,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;YACpE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CACnB,QAAQ,CACN,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAC5C,oBAAoB,EACpB,EAAE,CACH,CACF,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,YAAY;YAAE,MAAM,GAAG,CAAC;QAC3C,MAAM,IAAI,YAAY,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,gCAAgC;AAEhC,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;QACpF,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAW,EAAE,WAAW,CAAC;KACvF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAW,EAAE,OAAmB;IAC1D,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE;QAClF,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,SAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;YACvD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAW,CAAC;AAEzF,MAAM,UAAU,YAAY;IAC1B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAY;IACzC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,CAA+B,EAAE,EAAE,CAC5D,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,IACE,CAAC,CAAC,SAAS,KAAK,UAAU;QAC1B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;QAC1C,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC;QAC5C,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,EAAE;QAChB,IAAI,CAAC,MAAM,GAAG,EAAE,EAChB,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,CAAY;IAC5D,cAAc,CAAC,CAAC,CAAC,CAAC;IAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CACJ,UAAU,EACV;YACE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAC1D,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,EAAE;YACb,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,MAAM,EAAE,CAAC,CAAC,UAAU;SACrB,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAE1F,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,EAAE,CAAC;IACZ,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAa,EAAE,CAAa;IAC5D,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAe,EAAE,OAAmB,EAAU,EAAE,CACzE,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;AAErD,mGAAmG;AACnG,MAAM,UAAU,MAAM,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IAC7C,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/dist/cloud/http.d.ts

@@ -0,0 +1,52 @@
+import type { ErrorCode } from '@cleocode/contracts/cloud';
+/**
+ * `E_NETWORK`: the request never got an answer. `E_PROTOCOL`: the server answered with something the
+ * contract or the E2E checks do not allow (a malformed body, replayed or reordered segments, a rolled-back
+ * checkpoint). Both are client-side codes; the server never sends them.
+ */
+export type ClientErrorCode = ErrorCode | 'E_NETWORK' | 'E_PROTOCOL';
+export declare class NexusError extends Error {
+    readonly code: ClientErrorCode;
+    readonly status: number;
+    readonly requestId: string | null;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: ClientErrorCode, message: string, status: number, requestId: string | null, details?: Record<string, unknown> | undefined);
+}
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/** Anything with zod's `safeParse`: every response body is parsed against its contract schema. */
+export interface ResponseSchema<T> {
+    safeParse(data: unknown): {
+        success: boolean;
+        data?: T;
+    };
+}
+export interface HttpOptions {
+    /** https, or http only for localhost (tests and local development). */
+    baseUrl: string;
+    token: string;
+    deviceId?: string;
+    fetch?: FetchLike;
+    /** Attempts for retryable failures: network, 5xx, 429. Default 4. */
+    maxAttempts?: number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/** The longest a server-sent Retry-After may make the client wait. Longer values are clamped. */
+export declare const MAX_RETRY_AFTER_MS = 30000;
+/** True for https URLs, and for http URLs on a loopback host. */
+export declare function isSecureUrl(url: string): boolean;
+/**
+ * Minimal envelope-aware HTTP client. It retries only failures that are safe to retry. Every API
+ * write is idempotent or lineage-checked, so a retried write either no-ops or is refused explicitly.
+ * It never follows redirects, so a bearer token is never replayed to another origin.
+ */
+export declare class Http {
+    private readonly o;
+    private readonly fetch;
+    private readonly sleep;
+    constructor(o: HttpOptions);
+    /** Send a request and parse the success payload against `schema`. A payload that does not parse is E_PROTOCOL. */
+    request<T>(method: string, path: string, schema: ResponseSchema<T>, body?: unknown): Promise<T>;
+}
+/** Honour a numeric Retry-After, clamped to MAX_RETRY_AFTER_MS; otherwise back off exponentially. */
+export declare function retryDelay(retryAfter: string | null, attempt: number): number;
+//# sourceMappingURL=http.d.ts.map

package/dist/cloud/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/cloud/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAErE,qBAAa,UAAW,SAAQ,KAAK;IAEjC,QAAQ,CAAC,IAAI,EAAE,eAAe;IAE9B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAJjC,IAAI,EAAE,eAAe,EAC9B,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAK7C;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,kGAAkG;AAClG,MAAM,WAAW,cAAc,CAAC,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAID,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAIzC,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOhD;AAED;;;;GAIG;AACH,qBAAa,IAAI;IAIH,OAAO,CAAC,QAAQ,CAAC,CAAC;IAH9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;gBAEzB,CAAC,EAAE,WAAW;IAa3C,kHAAkH;IAC5G,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EACzB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,CAAC,CAAC;CA0Dd;AAED,qGAAqG;AACrG,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAM7E"}

package/dist/cloud/http.js

@@ -0,0 +1,98 @@
+export class NexusError extends Error {
+    code;
+    status;
+    requestId;
+    details;
+    constructor(code, message, status, requestId, details) {
+        super(`${code}: ${message}${requestId ? ` (request ${requestId})` : ''}`);
+        this.code = code;
+        this.status = status;
+        this.requestId = requestId;
+        this.details = details;
+        this.name = 'NexusError';
+    }
+}
+const RETRYABLE = new Set([429, 500, 502, 503, 504]);
+/** The longest a server-sent Retry-After may make the client wait. Longer values are clamped. */
+export const MAX_RETRY_AFTER_MS = 30_000;
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** True for https URLs, and for http URLs on a loopback host. */
+export function isSecureUrl(url) {
+    try {
+        const u = new URL(url);
+        return u.protocol === 'https:' || (u.protocol === 'http:' && LOOPBACK.has(u.hostname));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Minimal envelope-aware HTTP client. It retries only failures that are safe to retry. Every API
+ * write is idempotent or lineage-checked, so a retried write either no-ops or is refused explicitly.
+ * It never follows redirects, so a bearer token is never replayed to another origin.
+ */
+export class Http {
+    o;
+    fetch;
+    sleep;
+    constructor(o) {
+        this.o = o;
+        if (!isSecureUrl(o.baseUrl)) {
+            throw new NexusError('E_VALIDATION', 'baseUrl must be https (http is allowed only for localhost)', 0, null);
+        }
+        this.fetch = o.fetch ?? ((i, init) => globalThis.fetch(i, init));
+        this.sleep = o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    }
+    /** Send a request and parse the success payload against `schema`. A payload that does not parse is E_PROTOCOL. */
+    async request(method, path, schema, body) {
+        const attempts = this.o.maxAttempts ?? 4;
+        let lastErr;
+        for (let attempt = 1; attempt <= attempts; attempt++) {
+            let res;
+            try {
+                const headers = { authorization: `Bearer ${this.o.token}` };
+                if (this.o.deviceId)
+                    headers['x-cleo-device-id'] = this.o.deviceId;
+                if (body !== undefined)
+                    headers['content-type'] = 'application/json';
+                res = await this.fetch(`${this.o.baseUrl}${path}`, {
+                    method,
+                    headers,
+                    redirect: 'error',
+                    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+                });
+            }
+            catch (err) {
+                lastErr = new NexusError('E_NETWORK', err.message, 0, null);
+                if (attempt < attempts)
+                    await this.sleep(backoff(attempt));
+                continue;
+            }
+            const json = (await res.json().catch(() => null));
+            const requestId = res.headers.get('x-request-id');
+            if (json?.success === true) {
+                const parsed = schema.safeParse(json.data);
+                if (!parsed.success) {
+                    throw new NexusError('E_PROTOCOL', `${method} ${path}: response does not match the contract`, res.status, requestId);
+                }
+                return parsed.data;
+            }
+            const e = json && json.success === false ? json.error : null;
+            lastErr = new NexusError(e?.code ?? 'E_INTERNAL', e?.message ?? `HTTP ${res.status}`, res.status, e?.requestId ?? requestId, e?.details);
+            if (!RETRYABLE.has(res.status) || attempt === attempts)
+                throw lastErr;
+            await this.sleep(retryDelay(res.headers.get('retry-after'), attempt));
+        }
+        throw lastErr ?? new NexusError('E_NETWORK', 'request failed', 0, null);
+    }
+}
+/** Honour a numeric Retry-After, clamped to MAX_RETRY_AFTER_MS; otherwise back off exponentially. */
+export function retryDelay(retryAfter, attempt) {
+    const seconds = Number(retryAfter);
+    if (retryAfter !== null && retryAfter.trim() !== '' && Number.isFinite(seconds) && seconds > 0) {
+        return Math.min(MAX_RETRY_AFTER_MS, seconds * 1000);
+    }
+    return backoff(attempt);
+}
+const backoff = (attempt) => Math.min(8_000, 250 * 2 ** (attempt - 1)) + Math.floor(Math.random() * 100);
+//# sourceMappingURL=http.js.map

package/dist/cloud/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/cloud/http.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAExB;IAEA;IACA;IACA;IALX,YACW,IAAqB,EAC9B,OAAe,EACN,MAAc,EACd,SAAwB,EACxB,OAAiC;QAE1C,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QANjE,SAAI,GAAJ,IAAI,CAAiB;QAErB,WAAM,GAAN,MAAM,CAAQ;QACd,cAAS,GAAT,SAAS,CAAe;QACxB,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAoBD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAErD,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9D,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,IAAI;IAIc;IAHZ,KAAK,CAAY;IACjB,KAAK,CAAgC;IAEtD,YAA6B,CAAc;QAAd,MAAC,GAAD,CAAC,CAAa;QACzC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,4DAA4D,EAC5D,CAAC,EACD,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,kHAAkH;IAClH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,MAAyB,EACzB,IAAc;QAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACzC,IAAI,OAA+B,CAAC;QACpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpF,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ;oBAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACnE,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;gBACrE,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;oBACjD,MAAM;oBACN,OAAO;oBACP,QAAQ,EAAE,OAAO;oBACjB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,UAAU,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACvE,IAAI,OAAO,GAAG,QAAQ;oBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAWxC,CAAC;YACT,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,IAAI,UAAU,CAClB,YAAY,EACZ,GAAG,MAAM,IAAI,IAAI,wCAAwC,EACzD,GAAG,CAAC,MAAM,EACV,SAAS,CACV,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC,IAAS,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,OAAO,GAAG,IAAI,UAAU,CACtB,CAAC,EAAE,IAAI,IAAI,YAAY,EACvB,CAAC,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAClC,GAAG,CAAC,MAAM,EACV,CAAC,EAAE,SAAS,IAAI,SAAS,EACzB,CAAC,EAAE,OAAO,CACX,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,QAAQ;gBAAE,MAAM,OAAO,CAAC;YACtE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,IAAI,IAAI,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,UAAyB,EAAE,OAAe;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAClC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC"}

package/dist/cloud/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Cleo Nexus cloud client runtime (T12534): E2E crypto, key hierarchy, the envelope HTTP client,
+ * journal push/pull with signature verification, the checkpoint manifest regression check, and the
+ * segment signing message. `node:crypto` only; no dependencies.
+ *
+ * Wire types: `@cleocode/contracts/cloud` (T12533). Spec: cleo-nexus `docs/security/e2e-keys.md`.
+ * Server: kryptobaseddev/cleo-nexus (ADR-095). `cleo cloud …` commands (T12337) build on this.
+ *
+ * @module cloud
+ */
+export * from './crypto.js';
+export * from './http.js';
+export * from './journal.js';
+export * from './keys.js';
+export * from './manifest-check.js';
+export * from './projects.js';
+export * from './signing.js';
+export * from './streams.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cloud/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloud/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/cloud/index.js

@@ -0,0 +1,19 @@
+/**
+ * Cleo Nexus cloud client runtime (T12534): E2E crypto, key hierarchy, the envelope HTTP client,
+ * journal push/pull with signature verification, the checkpoint manifest regression check, and the
+ * segment signing message. `node:crypto` only; no dependencies.
+ *
+ * Wire types: `@cleocode/contracts/cloud` (T12533). Spec: cleo-nexus `docs/security/e2e-keys.md`.
+ * Server: kryptobaseddev/cleo-nexus (ADR-095). `cleo cloud …` commands (T12337) build on this.
+ *
+ * @module cloud
+ */
+export * from './crypto.js';
+export * from './http.js';
+export * from './journal.js';
+export * from './keys.js';
+export * from './manifest-check.js';
+export * from './projects.js';
+export * from './signing.js';
+export * from './streams.js';
+//# sourceMappingURL=index.js.map

package/dist/cloud/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cloud/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/cloud/journal.d.ts

@@ -0,0 +1,169 @@
+import { AppendSegmentResult, type Checkpoint, type Manifest, type ReplicaHeads, type RevocationPins, type Segment } from '@cleocode/contracts/cloud';
+import { type KeyPair } from './crypto.js';
+import { type FetchLike, type Http } from './http.js';
+import { type TrustedSigners } from './keys.js';
+import { type SegmentMetaFields } from './signing.js';
+export type Uploader = (url: string, headers: Record<string, string>, bytes: Buffer) => Promise<void>;
+/** Download `url`, refusing (and no longer reading) once more than `maxBytes` arrive. */
+export type Downloader = (url: string, maxBytes: number) => Promise<Buffer>;
+/**
+ * Why the client refused what the server sent. Every refusal carries one in `details.reason`, so the
+ * caller (and the tests) can tell the checks apart. None of them is retryable as is.
+ */
+export type RefusalReason = 'unknown-signer' | 'bad-signature' | 'hash-mismatch' | 'blob-hash' | 'blob-size' | 'decrypt' | 'payload' | 'seq-order' | 'replica-device' | 'replica-replay' | 'replica-gap' | 'page' | 'checkpoint-stream' | 'checkpoint-rollback' | 'checkpoint-replicas' | 'revoked-signer' | 'too-large';
+/** The default downloader: https only, no redirects, and it stops reading past `maxBytes`. */
+export declare function cappedDownloader(fetchImpl: FetchLike): Downloader;
+export type SegmentMeta = SegmentMetaFields;
+export interface PulledSegment {
+    seq: number;
+    replicaId: string;
+    replicaSeq: number;
+    deviceId: string;
+    plaintext: Buffer;
+    meta: SegmentMeta;
+}
+/**
+ * Where a replica's pull stands. The caller persists it in the same local transaction that applies the
+ * pulled ops, and passes it back to the next pull. It is what lets the client refuse replayed,
+ * reordered, re-attributed and gapped segments across pages and restarts.
+ */
+export interface PullCursor {
+    /** The last stream seq applied. The next pull asks for segments strictly after it. */
+    after: number;
+    /**
+     * True when `replicas` lists every replica with a segment at or below `after`: the cursor started at
+     * genesis, or was seeded from a checkpoint's signed replica map (cursorFromCheckpoint). A replica first
+     * seen later must then start at replicaSeq 0. False only for a cursor built some other way.
+     */
+    knowsAllReplicas: boolean;
+    /** Per replica: the device that signs its segments (pinned at first sight) and the last replicaSeq applied. */
+    replicas: Record<string, {
+        deviceId: string;
+        replicaSeq: number;
+    }>;
+}
+export declare const initialPullCursor: () => PullCursor;
+/** A cursor that resumes right after a (verified) checkpoint, seeded from its signed replica map. */
+export declare function cursorFromCheckpoint(cp: Pick<Checkpoint, 'coversSeq' | 'replicas'>): PullCursor;
+/**
+ * The pins for revoking `deviceId`'s key: the last replicaSeq of each of its replicas in the given
+ * cursors, and the highest coversSeq of its checkpoints in the given (already verified) lists. Compute
+ * them from pulls this client verified itself, with the key trusted as pending (certifiedSigners with
+ * includePending), before signing the revocation.
+ */
+export declare function revocationPins(deviceId: string, streams: readonly {
+    streamId: string;
+    cursor: PullCursor;
+    checkpoints?: readonly Checkpoint[];
+}[]): RevocationPins;
+export interface JournalOptions {
+    http: Http;
+    streamId: string;
+    replicaId: string;
+    deviceId: string;
+    signing: KeyPair;
+    /** The stream data key: a project data key (PDK) or the home stream key (HSK). */
+    key: Buffer;
+    uploader?: Uploader;
+    downloader?: Downloader;
+    /** Used by the default uploader and downloader. Defaults to the global fetch. */
+    fetch?: FetchLike;
+    /** The largest segment blob a pull will download. Default 256 MiB. */
+    maxSegmentBlobBytes?: number;
+}
+/** sha256 of the canonical segment metadata. Covered by the segment signature and the ciphertext AAD. */
+export declare const segmentMetaHash: (m: SegmentMetaFields) => string;
+/** sha256 of the canonical manifest. Covered by the checkpoint signature. */
+export declare const manifestHash: (m: Manifest) => string;
+/** sha256 of the canonical replica map. Covered by the checkpoint signature. */
+export declare const replicasHash: (r: ReplicaHeads) => string;
+/**
+ * One replica's view of one journal stream. The caller owns durable state (`nextReplicaSeq`, the
+ * PullCursor and the highest checkpoint coversSeq seen) and must persist it in the same local
+ * transaction that records what was sent or applied.
+ */
+export declare class Journal {
+    private readonly o;
+    private readonly up;
+    private readonly down;
+    private readonly base;
+    private readonly maxSegmentBlobBytes;
+    constructor(o: JournalOptions);
+    /**
+     * Encrypt, sign and append one segment of ops. Safe to retry with the same replicaSeq, metadata and
+     * `sealed` bytes (from sealSegment): re-encrypting would change the hash and defeat idempotency.
+     */
+    push(replicaSeq: number, plaintext: Uint8Array, meta: SegmentMeta, sealed?: Buffer): Promise<AppendSegmentResult>;
+    /**
+     * Encrypt a segment without sending it, so the caller can persist the exact bytes before pushing.
+     * The AAD covers the metadata hash, so the same `meta` must be passed to push.
+     */
+    sealSegment(replicaSeq: number, plaintext: Uint8Array, meta: SegmentMeta): Buffer;
+    /**
+     * Pull, verify and decrypt the segments after `cursor.after`. Nothing unverified is ever returned for
+     * applying: the pull stops with a NexusError (see RefusalReason) when a segment
+     * - is not strictly after the previous one (replayed or reordered: `seq-order`);
+     * - is signed by a device outside `trustedSigners` (`unknown-signer`), or its signature fails over the
+     *   stream, replica, device, position, ciphertext hash and metadata hash (`bad-signature`);
+     * - belongs to a replica pinned to another device (`replica-device`), repeats a replicaSeq
+     *   (`replica-replay`) or skips one (`replica-gap`);
+     * - is signed by a revoked key past its revocation pin (`revoked-signer`);
+     * - has bytes that do not match its hash (`hash-mismatch`, `blob-hash`, `blob-size`) or fail to decrypt.
+     * Returns the next cursor; persist it with the applied ops, together with the TrustState returned by the
+     * certifiedSigners call that built `trustedSigners`, in the same local transaction. Nothing in core does
+     * this yet; the caller must.
+     */
+    pull(cursor: PullCursor, trustedSigners: TrustedSigners, limit?: number): Promise<{
+        segments: PulledSegment[];
+        head: number;
+        cursor: PullCursor;
+    }>;
+    private verifyAndOpen;
+    private decrypt;
+    /**
+     * Encrypt, upload and sign a checkpoint bundle, then register it. The client mints the checkpoint id,
+     * because the signature and the bundle's AAD both cover it. `cursor` is this replica's pull cursor at
+     * the point the bundle captures: it gives coversSeq and the signed replica map, so it must know every
+     * replica. The server verifies the signature and the replica map, and refuses lineage breaks and
+     * regressions. A retry of the same checkpoint returns it again.
+     */
+    pushCheckpoint(args: {
+        bundle: Uint8Array;
+        manifest: Manifest;
+        cursor: PullCursor;
+        parentCheckpointId: string | null;
+    }): Promise<Checkpoint>;
+    /**
+     * Check a checkpoint record: it belongs to this stream, and a trusted key signed every field that
+     * matters (ids, lineage, coversSeq, manifest, replica map, bundle hash and size). Accepted signers:
+     * - the author, with a live key, or with a revoked key whose pin for this stream covers coversSeq;
+     * - otherwise, any live device that endorsed (re-signed) it.
+     */
+    verifyCheckpoint(cp: Checkpoint, trustedSigners: TrustedSigners): void;
+    /**
+     * Re-sign (endorse) a checkpoint with this device's key, after checking it against `trustedSigners`,
+     * for example so that a checkpoint written by a device about to be revoked stays restorable without its pin.
+     */
+    endorseCheckpoint(cp: Checkpoint, trustedSigners: TrustedSigners): Promise<Checkpoint>;
+    /**
+     * Download, verify and decrypt a checkpoint bundle (point-in-time restore). `minCoversSeq` is the
+     * highest checkpoint coversSeq this replica has already seen (the caller persists it): an older
+     * checkpoint is refused, so the server cannot roll the replica back. The returned cursor resumes the
+     * pull after the checkpoint, seeded from its signed replica map.
+     */
+    restoreCheckpoint(checkpointId: string, trustedSigners: TrustedSigners, opts?: {
+        minCoversSeq?: number;
+    }): Promise<{
+        bundle: Buffer;
+        checkpoint: Checkpoint;
+        cursor: PullCursor;
+    }>;
+    private uploadBlob;
+    /**
+     * Download a segment stored as a blob. The blob may have been uploaded by another member, so it is
+     * fetched through the stream (`GET …/segments/:seq/blob`), not the caller's own blob scope. At most the
+     * announced size is read, and the bytes must match that size and the segment's sha256.
+     */
+    downloadSegmentBlob(s: Pick<Segment, 'seq' | 'blobSha256'>): Promise<Buffer>;
+}
+//# sourceMappingURL=journal.d.ts.map

package/dist/cloud/journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../src/cloud/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,EAEnB,KAAK,UAAU,EAOf,KAAK,QAAQ,EAGb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,OAAO,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,OAAO,EAOb,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,IAAI,EAGV,MAAM,WAAW,CAAC;AACnB,OAAO,EAAwC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAML,KAAK,iBAAiB,EAGvB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,QAAQ,GAAG,CACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,IAAI,CAAC,CAAC;AACnB,yFAAyF;AACzF,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE5E;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,WAAW,GACX,WAAW,GACX,SAAS,GACT,SAAS,GACT,WAAW,GACX,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,MAAM,GACN,mBAAmB,GACnB,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,WAAW,CAAC;AAmBhB,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAsCjE;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE5C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+GAA+G;IAC/G,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,iBAAiB,QAAO,UAInC,CAAC;AAEH,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,UAAU,CAAC,GAAG,UAAU,CAM/F;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,EAAE,GAChG,cAAc,CAchB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,IAAI,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iFAAiF;IACjF,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD,yGAAyG;AACzG,eAAO,MAAM,eAAe,GAAI,GAAG,iBAAiB,WAA6C,CAAC;AAClG,6EAA6E;AAC7E,eAAO,MAAM,YAAY,GAAI,GAAG,QAAQ,WAA0C,CAAC;AAEnF,gFAAgF;AAChF,eAAO,MAAM,YAAY,GAAI,GAAG,YAAY,WAA0C,CAAC;AAkCvF;;;;GAIG;AACH,qBAAa,OAAO;IAMN,OAAO,CAAC,QAAQ,CAAC,CAAC;IAL9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAEhB,CAAC,EAAE,cAAc;IAQ9C;;;OAGG;IACG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,UAAU,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC;IAuB/B;;;OAGG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM;IASjF;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,SAAM;;;;;YAwD5D,aAAa;IAiE3B,OAAO,CAAC,OAAO;IAUf;;;;;;OAMG;IACG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,QAAQ,EAAE,QAAQ,CAAC;QACnB,MAAM,EAAE,UAAU,CAAC;QACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,GAAG,OAAO,CAAC,UAAU,CAAC;IAqDvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,GAAG,IAAI;IA4CtE;;;OAGG;IACG,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC;IAe5F;;;;;OAKG;IACG,iBAAiB,CACrB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,cAAc,EAC9B,IAAI,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;YA0C5D,UAAU;IAyBxB;;;;OAIG;IACG,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAqCnF"}