@cleocode/core 2026.9.22 → 2026.9.24

package/dist/cloud/nexus-auth.js

@@ -0,0 +1,372 @@
+/**
+ * Cleo Nexus account engine: device-code login, logout and session status.
+ *
+ * The Nexus API is a better-auth app (cleo-nexus `apps/api/src/auth.ts`):
+ *
+ * - `POST /api/auth/device/code` and `POST /api/auth/device/token` run the
+ *   RFC 8628 grant for the single allowed client id `cleo-cli`, with RFC form
+ *   bodies (cleo-nexus #11). The access token it returns is a better-auth
+ *   session token.
+ * - The bearer plugin accepts that token as `Authorization: Bearer <token>` on
+ *   every `/v1` route and on `POST /api/auth/sign-out`, which deletes the
+ *   session server-side.
+ * - `GET /v1/account/me` names the user and their organizations; a dead
+ *   session answers 401 `E_UNAUTHENTICATED`.
+ *
+ * The device-code protocol itself is NOT implemented here: it is the shared
+ * runner in `../llm/oauth/device-code.ts` (also used by the kimi-code LLM
+ * login). This module adds the Nexus endpoints, token storage and account
+ * lookup. The CLI (`cleo login nexus`, `cleo logout`, `cleo status`) and the
+ * `nexus-account` setup section are thin callers.
+ *
+ * No function here logs, and no result carries the token.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { NEXUS_CLI_CLIENT_ID, NEXUS_DEFAULT_API_URL, nexusAccountMeSchema, } from '@cleocode/contracts';
+import { DeviceCodeAuthError, DeviceCodeTimeoutError, pollForToken, startDeviceCodeFlow, } from '../llm/oauth/device-code.js';
+import { Http, isSecureUrl, NexusError } from './http.js';
+import { FileNexusTokenStore, } from './nexus-credentials.js';
+/** Environment override for the default API origin (e.g. staging). */
+export const NEXUS_API_URL_ENV = 'CLEO_NEXUS_API_URL';
+/** Default time budget for the server-side revocation at logout. */
+export const NEXUS_REVOKE_TIMEOUT_MS = 5_000;
+/** Default time budget for a live status check. */
+export const NEXUS_STATUS_TIMEOUT_MS = 1_500;
+/** A Nexus account flow failure with a stable code. Never carries a token. */
+export class NexusAccountError extends Error {
+    code;
+    fix;
+    /**
+     * @param code - Stable error code.
+     * @param message - Human message.
+     * @param fix - Optional remedy for the user.
+     */
+    constructor(code, message, fix) {
+        super(message);
+        this.code = code;
+        this.fix = fix;
+        this.name = 'NexusAccountError';
+    }
+}
+/**
+ * Resolve and validate the API URL to its origin.
+ *
+ * @param raw - `--api-url`, or `undefined` for `$CLEO_NEXUS_API_URL` / the default.
+ * @returns The origin, e.g. `https://api.cleocode.dev`.
+ * @throws {NexusAccountError} `E_NEXUS_INVALID_API_URL` for anything but an
+ *   https URL (http only on loopback) without credentials in it.
+ */
+export function resolveNexusApiUrl(raw) {
+    const candidate = (raw ?? process.env[NEXUS_API_URL_ENV] ?? NEXUS_DEFAULT_API_URL).trim();
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        throw new NexusAccountError('E_NEXUS_INVALID_API_URL', `invalid Nexus API URL: ${candidate}`);
+    }
+    if (url.username || url.password || !isSecureUrl(url.origin)) {
+        throw new NexusAccountError('E_NEXUS_INVALID_API_URL', 'the Nexus API URL must be https:// (http:// only for localhost) with no user:password');
+    }
+    return url.origin;
+}
+/**
+ * The shared device-code runner's config for a Nexus origin.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param fetchImpl - Optional `fetch` override.
+ * @returns A {@link DeviceCodeConfig} for the better-auth device endpoints.
+ */
+export function nexusDeviceCodeConfig(apiUrl, fetchImpl) {
+    return {
+        provider: 'cleo-nexus',
+        deviceCodeUrl: `${apiUrl}/api/auth/device/code`,
+        tokenUrl: `${apiUrl}/api/auth/device/token`,
+        clientId: NEXUS_CLI_CLIENT_ID,
+        ...(fetchImpl ? { fetch: fetchImpl } : {}),
+    };
+}
+/**
+ * C0/C1 control characters (ESC, CR, LF, CSI, …), any whitespace, bidi
+ * embeddings/overrides/isolates (U+202A–202E, U+2066–2069), zero-width
+ * characters (U+200B–200D, U+FEFF) and `\` (which WHATWG URL parsing turns
+ * into `/`, so the host a user reads could differ from the one opened).
+ */
+const UNSAFE_URI_CHARS = /[\u0000-\u0020\u007f-\u009f\s\u202a-\u202e\u2066-\u2069\u200b-\u200d\ufeff\\]/;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/**
+ * Refuse a server-supplied verification URL unless it is safe to print and to
+ * hand to the OS browser opener:
+ *
+ * - no control characters or whitespace (terminal injection: ESC, CR, LF, CSI);
+ * - no leading `-` (option injection into `open` / `xdg-open`);
+ * - `https:` (plain `http:` only when the API itself is a loopback http origin);
+ * - no `user:pass@`;
+ * - the host is the API's web origin or a subdomain of it: the API host minus a
+ *   leading `api.` label (`api.cleocode.dev` → `cleocode.dev`,
+ *   `api.staging.cleocode.dev` → `staging.cleocode.dev`). A phishing host, a
+ *   `file:` URL or a custom scheme never reaches the screen or the opener.
+ *
+ * @param uri - `verification_uri` or `verification_uri_complete` as received.
+ * @param apiUrl - Resolved API origin.
+ * @returns The normalised URL (`new URL(uri).href`): the exact form that was
+ *   validated, and the only one to print or open.
+ * @throws {NexusAccountError} `E_NEXUS_UNTRUSTED_VERIFICATION_URI`.
+ */
+export function assertTrustedVerificationUri(uri, apiUrl) {
+    const refuse = (why) => {
+        throw new NexusAccountError('E_NEXUS_UNTRUSTED_VERIFICATION_URI', `the server sent an untrusted verification URL (${why}); the login was stopped`, 'check --api-url; only sign in through the Cleo Nexus web app');
+    };
+    if (UNSAFE_URI_CHARS.test(uri))
+        refuse('control characters or whitespace');
+    if (uri.startsWith('-'))
+        refuse('leading "-"');
+    const url = URL.canParse(uri) ? new URL(uri) : refuse('not a URL');
+    const api = new URL(apiUrl);
+    const loopbackHttp = url.protocol === 'http:' &&
+        api.protocol === 'http:' &&
+        LOOPBACK_HOSTS.has(url.hostname) &&
+        LOOPBACK_HOSTS.has(api.hostname);
+    if (url.protocol !== 'https:' && !loopbackHttp)
+        refuse(`scheme ${url.protocol}`);
+    if (url.username || url.password)
+        refuse('credentials in the URL');
+    const web = api.hostname.startsWith('api.') ? api.hostname.slice(4) : api.hostname;
+    if (url.hostname !== web && !url.hostname.endsWith(`.${web}`)) {
+        refuse(`host ${url.hostname} is not ${web}`);
+    }
+    return url.href;
+}
+/**
+ * The organization to show for an account: the personal one, else the first.
+ *
+ * @param me - Parsed `/v1/account/me`.
+ * @returns The primary organization, or `null`.
+ */
+export function primaryNexusOrganization(me) {
+    return me.organizations.find((o) => o.personal) ?? me.organizations[0] ?? null;
+}
+/** `GET /v1/account/me` with a bearer token. */
+async function fetchAccountMe(apiUrl, token, opts = {}) {
+    const http = new Http({
+        baseUrl: apiUrl,
+        token,
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+        maxAttempts: opts.maxAttempts ?? 2,
+    });
+    return http.request('GET', '/v1/account/me', nexusAccountMeSchema);
+}
+/** Map a device-code runner failure to a Nexus error. */
+function toLoginError(err) {
+    if (err instanceof DeviceCodeTimeoutError) {
+        return new NexusAccountError('E_NEXUS_DEVICE_CODE_EXPIRED', 'the device code expired before it was approved', 'run `cleo login nexus` again and approve the code sooner');
+    }
+    if (err instanceof DeviceCodeAuthError) {
+        if (err.errorCode === 'expired_token') {
+            return new NexusAccountError('E_NEXUS_DEVICE_CODE_EXPIRED', 'the device code expired before it was approved', 'run `cleo login nexus` again and approve the code sooner');
+        }
+        if (err.errorCode === 'access_denied') {
+            return new NexusAccountError('E_NEXUS_ACCESS_DENIED', 'the sign-in request was denied in the browser');
+        }
+        return new NexusAccountError('E_NEXUS_DEVICE_CODE_FAILED', err.message);
+    }
+    return new NexusAccountError('E_NEXUS_DEVICE_CODE_FAILED', `polling for the Nexus token failed: ${err instanceof Error ? err.message : String(err)}`);
+}
+/**
+ * Sign in to a Cleo Nexus account with the device-code grant and store the
+ * session token (0600, keyed by API origin).
+ *
+ * @param opts - API URL, store, UI hooks and test overrides.
+ * @returns The secret-free login result.
+ * @throws {NexusAccountError} On a start, poll, denial or expiry failure.
+ */
+export async function loginToNexus(opts = {}) {
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    const store = opts.store ?? new FileNexusTokenStore();
+    const cfg = nexusDeviceCodeConfig(apiUrl, opts.fetch);
+    let start;
+    try {
+        start = await startDeviceCodeFlow(cfg);
+    }
+    catch (err) {
+        throw new NexusAccountError('E_NEXUS_DEVICE_CODE_START_FAILED', `could not start the Nexus sign-in at ${apiUrl}: ${err instanceof Error ? err.message : String(err)}`, 'check the API URL and your network, then retry');
+    }
+    // Validate, then show and open only the normalised forms that were checked.
+    const shown = {
+        ...start,
+        verificationUri: assertTrustedVerificationUri(start.verificationUri, apiUrl),
+        ...(start.verificationUriComplete !== undefined
+            ? {
+                verificationUriComplete: assertTrustedVerificationUri(start.verificationUriComplete, apiUrl),
+            }
+            : {}),
+    };
+    opts.onCode?.(shown);
+    let token;
+    try {
+        token = await pollForToken(cfg, start, {
+            ...(opts.onPending ? { onPending: opts.onPending } : {}),
+            ...(opts.signal ? { signal: opts.signal } : {}),
+            ...(opts.sleep ? { sleep: opts.sleep } : {}),
+        });
+    }
+    catch (err) {
+        throw toLoginError(err);
+    }
+    const warnings = [];
+    let me = null;
+    try {
+        me = await fetchAccountMe(apiUrl, token.accessToken, opts.fetch ? { fetch: opts.fetch } : {});
+    }
+    catch (err) {
+        warnings.push(`signed in, but the account lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const organization = me ? primaryNexusOrganization(me) : null;
+    const expiresAt = typeof token.expiresIn === 'number'
+        ? new Date(Date.now() + token.expiresIn * 1000).toISOString()
+        : null;
+    await store.put(apiUrl, {
+        token: token.accessToken,
+        tokenType: token.tokenType,
+        expiresAt,
+        user: me?.user ?? null,
+        organization,
+    });
+    return {
+        apiUrl,
+        user: me?.user ?? null,
+        organization,
+        expiresAt,
+        credentialsPath: store.location,
+        warnings,
+    };
+}
+/**
+ * Sign out: delete the session locally FIRST, then revoke it server-side
+ * (`POST /api/auth/sign-out` with the bearer token) within
+ * {@link NEXUS_REVOKE_TIMEOUT_MS}. A slow or hung server can delay logout by
+ * at most that budget and can never keep the token on disk; a failed
+ * revocation is reported. The delete only removes the session that was read,
+ * so a login that finished concurrently for the same origin survives.
+ *
+ * @param opts - API URL, store, revoke budget and test overrides.
+ * @returns The logout result.
+ */
+export async function logoutFromNexus(opts = {}) {
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    const store = opts.store ?? new FileNexusTokenStore();
+    const session = await store.get(apiUrl);
+    if (!session) {
+        return { apiUrl, removedLocally: false, revocation: 'skipped', warnings: [] };
+    }
+    const removedLocally = await store.delete(apiUrl, session);
+    const warnings = [];
+    let revocation;
+    try {
+        revocation = await revokeSession(apiUrl, session, opts.revokeTimeoutMs ?? NEXUS_REVOKE_TIMEOUT_MS, opts.fetch);
+    }
+    catch (err) {
+        revocation = 'failed';
+        warnings.push(`server-side sign-out failed (${err instanceof Error ? err.message : String(err)}); the local token was deleted`);
+    }
+    return { apiUrl, removedLocally, revocation, warnings };
+}
+/** `POST /api/auth/sign-out` with the bearer token, within `timeoutMs`. Never follows redirects. */
+async function revokeSession(apiUrl, session, timeoutMs, fetchImpl) {
+    const doFetch = fetchImpl ?? ((input, init) => fetch(input, init));
+    const res = await doFetch(`${apiUrl}/api/auth/sign-out`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${session.bearer()}`,
+            'content-type': 'application/json',
+            accept: 'application/json',
+        },
+        body: '{}',
+        redirect: 'error',
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (res.status === 401)
+        return 'already-invalid';
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    return 'revoked';
+}
+/** Build one status row from a stored session and an optional live check. */
+function statusRow(apiUrl, state, session, me) {
+    const email = me?.user.email ?? session?.user?.email ?? null;
+    const org = (me ? primaryNexusOrganization(me) : session?.organization)?.name ?? null;
+    const who = `${email ?? 'unknown user'}${org ? ` (${org})` : ''}`;
+    const summary = state === 'signed-in'
+        ? `signed in as ${who}`
+        : state === 'unverified'
+            ? `signed in as ${who}; not verified (API unreachable)`
+            : state === 'expired'
+                ? 'session expired; run `cleo login nexus`'
+                : 'not signed in';
+    return {
+        apiUrl,
+        state,
+        email: state === 'not-signed-in' ? null : email,
+        organization: state === 'not-signed-in' ? null : org,
+        expiresAt: session?.expiresAt ?? null,
+        summary,
+    };
+}
+/** Check one stored session against the API. 401 means expired, never a crash. */
+async function checkSession(session, opts) {
+    if (opts.live === false)
+        return statusRow(session.apiUrl, 'unverified', session, null);
+    const timeoutMs = opts.timeoutMs ?? NEXUS_STATUS_TIMEOUT_MS;
+    const base = opts.fetch ?? ((input, init) => fetch(input, init));
+    const timed = (input, init) => base(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+    try {
+        const me = await fetchAccountMe(session.apiUrl, session.bearer(), {
+            fetch: timed,
+            maxAttempts: 1,
+        });
+        return statusRow(session.apiUrl, 'signed-in', session, me);
+    }
+    catch (err) {
+        if (err instanceof NexusError && err.status === 401) {
+            return statusRow(session.apiUrl, 'expired', session, null);
+        }
+        return statusRow(session.apiUrl, 'unverified', session, null);
+    }
+}
+/**
+ * Secret-free status rows for `cleo status` and `cleo auth list`: one per
+ * stored session, or one "not signed in" row for the default origin. Makes a
+ * network call only when a token is stored.
+ *
+ * @param opts - Origin filter, store, liveness and test overrides.
+ * @returns Status rows, sorted by origin.
+ */
+export async function getNexusAccountStatus(opts = {}) {
+    const store = opts.store ?? new FileNexusTokenStore();
+    const only = opts.apiUrl !== undefined ? resolveNexusApiUrl(opts.apiUrl) : null;
+    const sessions = (await store.list()).filter((s) => only === null || s.apiUrl === only);
+    if (sessions.length === 0) {
+        return [statusRow(only ?? resolveNexusApiUrl(), 'not-signed-in', null, null)];
+    }
+    return Promise.all(sessions.map((s) => checkSession(s, opts)));
+}
+/**
+ * The stored session for an origin, or a `E_NEXUS_NOT_SIGNED_IN` error.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param store - Token store.
+ * @returns The sealed session.
+ * @throws {NexusAccountError} When no session is stored.
+ */
+export async function requireNexusSession(apiUrl, store) {
+    const session = await store.get(apiUrl);
+    if (!session) {
+        throw new NexusAccountError('E_NEXUS_NOT_SIGNED_IN', `not signed in to Cleo Nexus at ${apiUrl}`, apiUrl === NEXUS_DEFAULT_API_URL
+            ? 'run `cleo login nexus`'
+            : `run \`cleo login nexus --api-url ${apiUrl}\``);
+    }
+    return session;
+}
+//# sourceMappingURL=nexus-auth.js.map

package/dist/cloud/nexus-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AA4CD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtD,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,OAAO,EACP,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,OAA2B,EAC3B,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,EAAE;YAC3C,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cloud/nexus-credentials.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Cleo Nexus session-token store.
+ *
+ * Stored at `<cleoHome>/nexus-credentials.json` (resolved through
+ * `@cleocode/paths`, arch gate 2) with 0600 permissions, one session per API
+ * origin. Modelled on `../decide/credentials.ts`:
+ *
+ * - Writes go through `withLock` and `writeJsonFileAtomic({ mode: 0o600 })`,
+ *   so neither the live file, the temp file nor a rotated backup is ever
+ *   looser than owner-only. Deleting a session also purges the rotated
+ *   backups, which would otherwise keep a copy of the token.
+ * - Reads return a {@link SealedNexusSession}: the token sits in a private
+ *   field, so `JSON.stringify`, `util.inspect` and template strings of the
+ *   handle show a masked preview only. {@link SealedNexusSession.bearer} is the
+ *   one accessor, called where the HTTP request is built.
+ *
+ * Everything goes through the {@link NexusTokenStore} interface, so an OS
+ * keychain store can replace the file later without touching the callers.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { inspect } from 'node:util';
+import { type NexusAccountOrganization, type NexusAccountUser } from '@cleocode/contracts';
+import { z } from 'zod';
+/** File name of the store, directly under the CLEO home. */
+export declare const NEXUS_CREDENTIALS_FILE = "nexus-credentials.json";
+declare const sessionSchema: z.ZodObject<{
+    token: z.ZodString;
+    tokenType: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    organization: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        role: z.ZodOptional<z.ZodString>;
+        personal: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+/** A session to store. The token is the only secret. */
+export interface NexusSessionInput {
+    /** Bearer session token issued by the device-code grant. */
+    readonly token: string;
+    /** Token type the server reported (`Bearer`). */
+    readonly tokenType: string;
+    /** ISO expiry, when the server reported one. */
+    readonly expiresAt: string | null;
+    /** The signed-in user, when known. */
+    readonly user: NexusAccountUser | null;
+    /** Primary organization, when known. */
+    readonly organization: NexusAccountOrganization | null;
+}
+/**
+ * Pluggable storage for Nexus session tokens, keyed by API origin.
+ *
+ * The file store below is the default. A keychain-backed store implements the
+ * same four methods.
+ */
+export interface NexusTokenStore {
+    /** Absolute location shown to the user (a path, or a keychain service name). */
+    readonly location: string;
+    /** The session for `apiUrl`'s origin, or `null`. */
+    get(apiUrl: string): Promise<SealedNexusSession | null>;
+    /** Store (replace) the session for `apiUrl`'s origin. */
+    put(apiUrl: string, session: NexusSessionInput): Promise<void>;
+    /**
+     * Delete the session for `apiUrl`'s origin. With `expected`, delete only if
+     * the stored token is still that session's token (checked under the store's
+     * lock), so a login that finished meanwhile is not wiped. Returns `true` when
+     * a session was deleted.
+     */
+    delete(apiUrl: string, expected?: SealedNexusSession): Promise<boolean>;
+    /** Every stored session. */
+    list(): Promise<SealedNexusSession[]>;
+}
+/**
+ * Mask a token down to a short, non-reversible preview.
+ *
+ * @param token - Plaintext token (read transiently, not retained).
+ * @returns `…` plus at most the last 4 characters.
+ */
+export declare function maskNexusToken(token: string): string;
+/**
+ * Opaque handle to a stored session. The token is held in a private field;
+ * serialising or inspecting the handle yields the masked preview only.
+ */
+export declare class SealedNexusSession {
+    #private;
+    /** API origin the session belongs to. */
+    readonly apiUrl: string;
+    /** Token type (`Bearer`). */
+    readonly tokenType: string;
+    /** ISO expiry, when known. */
+    readonly expiresAt: string | null;
+    /** Signed-in user, when known. */
+    readonly user: NexusAccountUser | null;
+    /** Primary organization, when known. */
+    readonly organization: NexusAccountOrganization | null;
+    /** ISO time the session was stored. */
+    readonly createdAt: string;
+    /** Masked token preview. */
+    readonly tokenPreview: string;
+    /**
+     * @param apiUrl - API origin.
+     * @param record - Stored record; the token is captured privately.
+     */
+    constructor(apiUrl: string, record: z.infer<typeof sessionSchema>);
+    /**
+     * The plaintext token. Call only where the `Authorization` header is built.
+     *
+     * @returns The bearer token.
+     */
+    bearer(): string;
+    /** Secret-free JSON form. */
+    toJSON(): Record<string, unknown>;
+    /** Secret-free string form. */
+    toString(): string;
+    /** Secret-free `util.inspect` form. */
+    [inspect.custom](): string;
+}
+/** Thrown when the store cannot be written safely. */
+export declare class NexusCredentialsError extends Error {
+    constructor(message: string);
+}
+/**
+ * The storage key for an API URL: its origin (scheme, host and port).
+ *
+ * @param apiUrl - Any URL on the API host.
+ * @returns The origin, e.g. `https://api.cleocode.dev`.
+ */
+export declare function nexusOriginKey(apiUrl: string): string;
+/**
+ * Absolute path of the default file store.
+ *
+ * @returns `<cleoHome>/nexus-credentials.json`.
+ */
+export declare function nexusCredentialsPath(): string;
+/**
+ * File-backed {@link NexusTokenStore}: `<cleoHome>/nexus-credentials.json`,
+ * mode 0600, one entry per API origin.
+ */
+export declare class FileNexusTokenStore implements NexusTokenStore {
+    /** Absolute path of the store file. */
+    readonly location: string;
+    /** @param path - Store path; defaults to {@link nexusCredentialsPath}. */
+    constructor(path?: string);
+    get(apiUrl: string): Promise<SealedNexusSession | null>;
+    put(apiUrl: string, session: NexusSessionInput): Promise<void>;
+    delete(apiUrl: string, expected?: SealedNexusSession): Promise<boolean>;
+    list(): Promise<SealedNexusSession[]>;
+    /**
+     * Read and validate the file; a missing or malformed file reads as empty. A
+     * file readable or writable by group/others, or owned by another user, is
+     * refused: its token may already be exposed or planted.
+     */
+    private read;
+    /** Locked, atomic, owner-only read-modify-write. */
+    private write;
+    /**
+     * Create the store file owner-only if it does not exist. `O_EXCL` plus
+     * `O_NOFOLLOW` close the window between the symlink check and the create: a
+     * symlink planted meanwhile makes the open fail instead of being followed.
+     * On `EEXIST` the existing entry is re-opened with `O_NOFOLLOW`, which fails
+     * (`ELOOP`) on a symlink, so a planted link is refused before the locked
+     * write can touch it.
+     */
+    private seed;
+    /**
+     * Throw when the store exists with a mode wider than 0600 or another owner.
+     * Skipped on Windows, where Node reports every file as 0o666 and uids do not
+     * apply; the file lives in the user's profile, protected by its ACL.
+     */
+    private assertPrivate;
+    /** Refuse to write a token through a symlink (it could point anywhere). */
+    private assertNoSymlinks;
+    /** Rotated backups of the store file. */
+    private backupFiles;
+    /** Delete every rotated backup (best effort). */
+    private purgeBackups;
+}
+export {};
+//# sourceMappingURL=nexus-credentials.d.ts.map

package/dist/cloud/nexus-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-credentials.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAeH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EAGtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;iBAOjB,CAAC;AAcH,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,wCAAwC;IACxC,QAAQ,CAAC,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACxD,yDAAyD;IACzD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;;OAKG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,4BAA4B;IAC5B,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,qBAAa,kBAAkB;;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,wCAAwC;IACxC,QAAQ,CAAC,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACvD,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4BAA4B;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAG9B;;;OAGG;gBACS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC;IAWjE;;;;OAIG;IACH,MAAM,IAAI,MAAM;IAIhB,6BAA6B;IAC7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAYjC,+BAA+B;IAC/B,QAAQ,IAAI,MAAM;IAIlB,uCAAuC;IACvC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM;CAG3B;AAED,sDAAsD;AACtD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,0EAA0E;gBAC9D,IAAI,GAAE,MAA+B;IAI3C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAMvD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBvE,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAM3C;;;;OAIG;IACH,OAAO,CAAC,IAAI;IAiBZ,oDAAoD;YACtC,KAAK;IAenB;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI;IA2BZ;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAgBrB,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IAgBxB,yCAAyC;IACzC,OAAO,CAAC,WAAW;IAYnB,iDAAiD;IACjD,OAAO,CAAC,YAAY;CASrB"}