@cleocode/core 2026.9.23 → 2026.9.24

package/dist/cloud/nexus-credentials.js

@@ -0,0 +1,323 @@
+/**
+ * Cleo Nexus session-token store.
+ *
+ * Stored at `<cleoHome>/nexus-credentials.json` (resolved through
+ * `@cleocode/paths`, arch gate 2) with 0600 permissions, one session per API
+ * origin. Modelled on `../decide/credentials.ts`:
+ *
+ * - Writes go through `withLock` and `writeJsonFileAtomic({ mode: 0o600 })`,
+ *   so neither the live file, the temp file nor a rotated backup is ever
+ *   looser than owner-only. Deleting a session also purges the rotated
+ *   backups, which would otherwise keep a copy of the token.
+ * - Reads return a {@link SealedNexusSession}: the token sits in a private
+ *   field, so `JSON.stringify`, `util.inspect` and template strings of the
+ *   handle show a masked preview only. {@link SealedNexusSession.bearer} is the
+ *   one accessor, called where the HTTP request is built.
+ *
+ * Everything goes through the {@link NexusTokenStore} interface, so an OS
+ * keychain store can replace the file later without touching the callers.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { closeSync, constants as fsConstants, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, statSync, unlinkSync, writeSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { inspect } from 'node:util';
+import { nexusAccountOrganizationSchema, nexusAccountUserSchema, } from '@cleocode/contracts';
+import { getCleoHome } from '@cleocode/paths';
+import { z } from 'zod';
+import { withLock } from '../store/file-utils.js';
+/** File name of the store, directly under the CLEO home. */
+export const NEXUS_CREDENTIALS_FILE = 'nexus-credentials.json';
+const sessionSchema = z.object({
+    token: z.string().min(1),
+    tokenType: z.string(),
+    expiresAt: z.string().nullable(),
+    user: nexusAccountUserSchema.nullable(),
+    organization: nexusAccountOrganizationSchema.nullable(),
+    createdAt: z.string(),
+});
+const storeSchema = z.object({
+    version: z.literal(1),
+    sessions: z.record(z.string(), sessionSchema),
+});
+const EMPTY_STORE = { version: 1, sessions: {} };
+/** `O_NOFOLLOW` where the platform has it (not on Windows). */
+const NO_FOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+/**
+ * Mask a token down to a short, non-reversible preview.
+ *
+ * @param token - Plaintext token (read transiently, not retained).
+ * @returns `…` plus at most the last 4 characters.
+ */
+export function maskNexusToken(token) {
+    return token.length > 12 ? `…${token.slice(-4)}` : '…';
+}
+/**
+ * Opaque handle to a stored session. The token is held in a private field;
+ * serialising or inspecting the handle yields the masked preview only.
+ */
+export class SealedNexusSession {
+    /** API origin the session belongs to. */
+    apiUrl;
+    /** Token type (`Bearer`). */
+    tokenType;
+    /** ISO expiry, when known. */
+    expiresAt;
+    /** Signed-in user, when known. */
+    user;
+    /** Primary organization, when known. */
+    organization;
+    /** ISO time the session was stored. */
+    createdAt;
+    /** Masked token preview. */
+    tokenPreview;
+    #token;
+    /**
+     * @param apiUrl - API origin.
+     * @param record - Stored record; the token is captured privately.
+     */
+    constructor(apiUrl, record) {
+        this.apiUrl = apiUrl;
+        this.tokenType = record.tokenType;
+        this.expiresAt = record.expiresAt;
+        this.user = record.user;
+        this.organization = record.organization;
+        this.createdAt = record.createdAt;
+        this.#token = record.token;
+        this.tokenPreview = maskNexusToken(record.token);
+    }
+    /**
+     * The plaintext token. Call only where the `Authorization` header is built.
+     *
+     * @returns The bearer token.
+     */
+    bearer() {
+        return this.#token;
+    }
+    /** Secret-free JSON form. */
+    toJSON() {
+        return {
+            apiUrl: this.apiUrl,
+            tokenType: this.tokenType,
+            expiresAt: this.expiresAt,
+            user: this.user,
+            organization: this.organization,
+            createdAt: this.createdAt,
+            tokenPreview: this.tokenPreview,
+        };
+    }
+    /** Secret-free string form. */
+    toString() {
+        return `SealedNexusSession(${this.apiUrl}, token ${this.tokenPreview})`;
+    }
+    /** Secret-free `util.inspect` form. */
+    [inspect.custom]() {
+        return this.toString();
+    }
+}
+/** Thrown when the store cannot be written safely. */
+export class NexusCredentialsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NexusCredentialsError';
+    }
+}
+/**
+ * The storage key for an API URL: its origin (scheme, host and port).
+ *
+ * @param apiUrl - Any URL on the API host.
+ * @returns The origin, e.g. `https://api.cleocode.dev`.
+ */
+export function nexusOriginKey(apiUrl) {
+    return new URL(apiUrl).origin;
+}
+/**
+ * Absolute path of the default file store.
+ *
+ * @returns `<cleoHome>/nexus-credentials.json`.
+ */
+export function nexusCredentialsPath() {
+    return join(getCleoHome(), NEXUS_CREDENTIALS_FILE);
+}
+/**
+ * File-backed {@link NexusTokenStore}: `<cleoHome>/nexus-credentials.json`,
+ * mode 0600, one entry per API origin.
+ */
+export class FileNexusTokenStore {
+    /** Absolute path of the store file. */
+    location;
+    /** @param path - Store path; defaults to {@link nexusCredentialsPath}. */
+    constructor(path = nexusCredentialsPath()) {
+        this.location = path;
+    }
+    async get(apiUrl) {
+        const key = nexusOriginKey(apiUrl);
+        const record = this.read().sessions[key];
+        return record ? new SealedNexusSession(key, record) : null;
+    }
+    async put(apiUrl, session) {
+        const key = nexusOriginKey(apiUrl);
+        const record = sessionSchema.parse({
+            token: session.token,
+            tokenType: session.tokenType,
+            expiresAt: session.expiresAt,
+            user: session.user,
+            organization: session.organization,
+            createdAt: new Date().toISOString(),
+        });
+        await this.write((current) => ({
+            version: 1,
+            sessions: { ...current.sessions, [key]: record },
+        }));
+    }
+    async delete(apiUrl, expected) {
+        const key = nexusOriginKey(apiUrl);
+        let deleted = false;
+        if (key in this.read().sessions) {
+            await this.write((current) => {
+                const stored = current.sessions[key];
+                if (!stored || (expected !== undefined && stored.token !== expected.bearer())) {
+                    return current;
+                }
+                deleted = true;
+                const sessions = { ...current.sessions };
+                delete sessions[key];
+                return { version: 1, sessions };
+            });
+        }
+        // Rotated backups hold earlier copies of the file, and so of the token.
+        this.purgeBackups();
+        return deleted;
+    }
+    async list() {
+        return Object.entries(this.read().sessions)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, record]) => new SealedNexusSession(key, record));
+    }
+    /**
+     * Read and validate the file; a missing or malformed file reads as empty. A
+     * file readable or writable by group/others, or owned by another user, is
+     * refused: its token may already be exposed or planted.
+     */
+    read() {
+        this.assertPrivate();
+        let raw;
+        try {
+            raw = readFileSync(this.location, 'utf-8');
+        }
+        catch {
+            return EMPTY_STORE;
+        }
+        if (!raw.trim())
+            return EMPTY_STORE;
+        try {
+            const parsed = storeSchema.safeParse(JSON.parse(raw));
+            return parsed.success ? parsed.data : EMPTY_STORE;
+        }
+        catch {
+            return EMPTY_STORE;
+        }
+    }
+    /** Locked, atomic, owner-only read-modify-write. */
+    async write(transform) {
+        this.assertNoSymlinks();
+        this.seed();
+        await withLock(this.location, (current) => {
+            const parsed = storeSchema.safeParse(current);
+            return transform(parsed.success ? parsed.data : EMPTY_STORE);
+        }, { mode: 0o600 });
+    }
+    /**
+     * Create the store file owner-only if it does not exist. `O_EXCL` plus
+     * `O_NOFOLLOW` close the window between the symlink check and the create: a
+     * symlink planted meanwhile makes the open fail instead of being followed.
+     * On `EEXIST` the existing entry is re-opened with `O_NOFOLLOW`, which fails
+     * (`ELOOP`) on a symlink, so a planted link is refused before the locked
+     * write can touch it.
+     */
+    seed() {
+        mkdirSync(dirname(this.location), { recursive: true, mode: 0o700 });
+        let fd;
+        try {
+            fd = openSync(this.location, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY | NO_FOLLOW, 0o600);
+        }
+        catch (err) {
+            if (!(err instanceof Error && 'code' in err && err.code === 'EEXIST'))
+                throw err;
+            try {
+                closeSync(openSync(this.location, fsConstants.O_RDONLY | NO_FOLLOW));
+            }
+            catch {
+                throw new NexusCredentialsError(`refusing to write Nexus credentials through a symlink: ${this.location}`);
+            }
+            return;
+        }
+        try {
+            writeSync(fd, `${JSON.stringify(EMPTY_STORE)}\n`);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    /**
+     * Throw when the store exists with a mode wider than 0600 or another owner.
+     * Skipped on Windows, where Node reports every file as 0o666 and uids do not
+     * apply; the file lives in the user's profile, protected by its ACL.
+     */
+    assertPrivate() {
+        if (process.platform === 'win32')
+            return;
+        let st;
+        try {
+            st = statSync(this.location);
+        }
+        catch {
+            return; // absent: created 0600 on first write
+        }
+        const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+        if ((st.mode & 0o077) !== 0 || (uid !== null && st.uid !== uid)) {
+            throw new NexusCredentialsError(`refusing to read ${this.location}: it must be owned by you with mode 0600 (it is ${(st.mode & 0o777).toString(8)}). Run: chmod 600 ${this.location}`);
+        }
+    }
+    /** Refuse to write a token through a symlink (it could point anywhere). */
+    assertNoSymlinks() {
+        for (const candidate of [this.location, ...this.backupFiles()]) {
+            let isLink = false;
+            try {
+                isLink = lstatSync(candidate).isSymbolicLink();
+            }
+            catch {
+                continue;
+            }
+            if (isLink) {
+                throw new NexusCredentialsError(`refusing to write Nexus credentials through a symlink: ${candidate}`);
+            }
+        }
+    }
+    /** Rotated backups of the store file. */
+    backupFiles() {
+        const backupDir = join(dirname(this.location), '.backups');
+        const prefix = `${basename(this.location)}.`;
+        try {
+            return readdirSync(backupDir)
+                .filter((entry) => entry.startsWith(prefix))
+                .map((entry) => join(backupDir, entry));
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Delete every rotated backup (best effort). */
+    purgeBackups() {
+        for (const file of this.backupFiles()) {
+            try {
+                unlinkSync(file);
+            }
+            catch {
+                /* best effort */
+            }
+        }
+    }
+}
+//# sourceMappingURL=nexus-credentials.js.map

package/dist/cloud/nexus-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-credentials.js","sourceRoot":"","sources":["../../src/cloud/nexus-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAGL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,WAAW,GAAyB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAEvE,+DAA+D;AAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC;AAwC9C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAC7B,yCAAyC;IAChC,MAAM,CAAS;IACxB,6BAA6B;IACpB,SAAS,CAAS;IAC3B,8BAA8B;IACrB,SAAS,CAAgB;IAClC,kCAAkC;IACzB,IAAI,CAA0B;IACvC,wCAAwC;IAC/B,YAAY,CAAkC;IACvD,uCAAuC;IAC9B,SAAS,CAAS;IAC3B,4BAA4B;IACnB,YAAY,CAAS;IACrB,MAAM,CAAS;IAExB;;;OAGG;IACH,YAAY,MAAc,EAAE,MAAqC;QAC/D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,6BAA6B;IAC7B,MAAM;QACJ,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,QAAQ;QACN,OAAO,sBAAsB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,YAAY,GAAG,CAAC;IAC1E,CAAC;IAED,uCAAuC;IACvC,CAAC,OAAO,CAAC,MAAM,CAAC;QACd,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAC9B,uCAAuC;IAC9B,QAAQ,CAAS;IAE1B,0EAA0E;IAC1E,YAAY,OAAe,oBAAoB,EAAE;QAC/C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,OAA0B;QAClD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAA6B;QACxD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBAC9E,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACK,IAAI;QACV,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,WAAW,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,oDAAoD;IAC5C,KAAK,CAAC,KAAK,CACjB,SAAkE;QAElE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,CACZ,IAAI,CAAC,QAAQ,EACb,CAAC,OAAO,EAAE,EAAE;YACV,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC/D,CAAC,EACD,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,IAAI;QACV,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CACX,IAAI,CAAC,QAAQ,EACb,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,GAAG,SAAS,EAC3E,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,MAAM,GAAG,CAAC;YACjF,IAAI,CAAC;gBACH,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,IAAI,CAAC,QAAQ,EAAE,CAC1E,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,aAAa;QACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACzC,IAAI,EAA+B,CAAC;QACpC,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,sCAAsC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,qBAAqB,CAC7B,oBAAoB,IAAI,CAAC,QAAQ,mDAAmD,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CACtJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,gBAAgB;QACtB,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,SAAS,EAAE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,yCAAyC;IACjC,WAAW;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,SAAS,CAAC;iBAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,iDAAiD;IACzC,YAAY;QAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/cloud/nexus-link.d.ts

@@ -0,0 +1,85 @@
+/**
+ * `cleo project link`: register the current project with Cleo Nexus and bind
+ * the remote project to the local one.
+ *
+ * ## What is sent
+ *
+ * `POST /v1/projects` with `{ projectId, label }` only:
+ *
+ * - `projectId` is the tracked, immutable `.cleo/project-id`
+ *   (`readDeclaredProjectIdentity`), the key the server stores projects under,
+ *   so the remote id IS the local id.
+ * - `label` is the project's display name in plaintext
+ *   ({@link getProjectDisplayName}), or `--label`. It must not look like a path.
+ *
+ * No filesystem path, git remote or directory layout is ever sent.
+ *
+ * ## Idempotency
+ *
+ * Registering the same id again answers 200 (201 on first registration) and
+ * sets the server label to the one sent, so re-linking after a rename updates
+ * the label. Linking twice is safe.
+ *
+ * ## Where the binding lives
+ *
+ * `<project>/.cleo/nexus-link.json`, keyed by API origin. It is machine-local:
+ * `.cleo/.gitignore` denies everything not allow-listed, so the binding (which
+ * names an account's organization) is never committed. It is not
+ * `project-context.json`, which is tracked in git and regenerated by
+ * `cleo upgrade`, and not the project `cleo.db`, so linking never opens or
+ * migrates the task store. Each clone links itself, the same way each machine
+ * signs itself in.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import type { NexusProjectLink, NexusProjectLinkResult } from '@cleocode/contracts';
+import { type NexusFlowOptions } from './nexus-auth.js';
+/** File name of the binding, inside the project's `.cleo/` directory. */
+export declare const NEXUS_LINK_FILE = "nexus-link.json";
+/** Longest label the server accepts (`RegisterProjectRequest.label`). */
+export declare const NEXUS_LABEL_MAX = 120;
+/** Options for {@link linkProjectToNexus}. */
+export interface NexusLinkOptions extends NexusFlowOptions {
+    /** Project root; defaults to the resolved current project. */
+    projectRoot?: string;
+    /** Label to register (`--label`); defaults to {@link getProjectDisplayName}. */
+    label?: string;
+}
+/**
+ * Validate a project label: 1-120 characters; no path separator or look-alike
+ * slash, no drive letter (`C:`), no leading `~`, no control characters; and
+ * not the OS username, which would leak the account name. A label is a name,
+ * never a path.
+ *
+ * @param raw - Candidate label.
+ * @returns The trimmed label.
+ * @throws {NexusAccountError} `E_NEXUS_INVALID_LABEL`.
+ */
+export declare function validateNexusProjectLabel(raw: string): string;
+/**
+ * Path of the binding file for a project.
+ *
+ * @param projectRoot - Project root.
+ * @returns `<project>/.cleo/nexus-link.json`.
+ */
+export declare function nexusLinkPath(projectRoot: string): string;
+/**
+ * The stored binding for a project and origin, if any.
+ *
+ * @param projectRoot - Project root.
+ * @param apiUrl - API URL (any URL on the origin).
+ * @returns The binding, or `null`.
+ */
+export declare function readNexusProjectLink(projectRoot: string, apiUrl: string): NexusProjectLink | null;
+/**
+ * Register the project with Nexus (label only, never a path) and persist the
+ * binding in `.cleo/nexus-link.json`. Idempotent.
+ *
+ * @param opts - Project root, label, API URL, store and test overrides.
+ * @returns The binding and whether it already existed.
+ * @throws {NexusAccountError} Not signed in, expired session, invalid label,
+ *   not a CLEO project, or an API refusal (e.g. the id belongs to another account).
+ */
+export declare function linkProjectToNexus(opts?: NexusLinkOptions): Promise<NexusProjectLinkResult>;
+//# sourceMappingURL=nexus-link.d.ts.map

package/dist/cloud/nexus-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-link.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAOpF,OAAO,EAEL,KAAK,gBAAgB,EAGtB,MAAM,iBAAiB,CAAC;AAIzB,yEAAyE;AACzE,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD,yEAAyE;AACzE,eAAO,MAAM,eAAe,MAAM,CAAC;AAmBnC,8CAA8C;AAC9C,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmB7D;AAmBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAaD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAEjG;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,sBAAsB,CAAC,CAmEjC"}

package/dist/cloud/nexus-link.js

@@ -0,0 +1,226 @@
+/**
+ * `cleo project link`: register the current project with Cleo Nexus and bind
+ * the remote project to the local one.
+ *
+ * ## What is sent
+ *
+ * `POST /v1/projects` with `{ projectId, label }` only:
+ *
+ * - `projectId` is the tracked, immutable `.cleo/project-id`
+ *   (`readDeclaredProjectIdentity`), the key the server stores projects under,
+ *   so the remote id IS the local id.
+ * - `label` is the project's display name in plaintext
+ *   ({@link getProjectDisplayName}), or `--label`. It must not look like a path.
+ *
+ * No filesystem path, git remote or directory layout is ever sent.
+ *
+ * ## Idempotency
+ *
+ * Registering the same id again answers 200 (201 on first registration) and
+ * sets the server label to the one sent, so re-linking after a rename updates
+ * the label. Linking twice is safe.
+ *
+ * ## Where the binding lives
+ *
+ * `<project>/.cleo/nexus-link.json`, keyed by API origin. It is machine-local:
+ * `.cleo/.gitignore` denies everything not allow-listed, so the binding (which
+ * names an account's organization) is never committed. It is not
+ * `project-context.json`, which is tracked in git and regenerated by
+ * `cleo upgrade`, and not the project `cleo.db`, so linking never opens or
+ * migrates the task store. Each clone links itself, the same way each machine
+ * signs itself in.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { homedir, userInfo } from 'node:os';
+import { join, resolve } from 'node:path';
+import { readDeclaredProjectIdentity } from '@cleocode/paths';
+import { z } from 'zod';
+import { getCleoDirAbsolute, resolveOrCwd } from '../paths.js';
+import { getProjectDisplayName } from '../project-info.js';
+import { withLock } from '../store/file-utils.js';
+import { Http, NexusError } from './http.js';
+import { NexusAccountError, requireNexusSession, resolveNexusApiUrl, } from './nexus-auth.js';
+import { FileNexusTokenStore } from './nexus-credentials.js';
+import { registerProject } from './projects.js';
+/** File name of the binding, inside the project's `.cleo/` directory. */
+export const NEXUS_LINK_FILE = 'nexus-link.json';
+/** Longest label the server accepts (`RegisterProjectRequest.label`). */
+export const NEXUS_LABEL_MAX = 120;
+const linkSchema = z.object({
+    apiUrl: z.string(),
+    localProjectId: z.string(),
+    remoteProjectId: z.string(),
+    organizationId: z.string(),
+    label: z.string().nullable(),
+    streamId: z.string(),
+    linkedAt: z.string(),
+});
+const linkFileSchema = z.object({
+    version: z.literal(1),
+    links: z.record(z.string(), linkSchema),
+});
+/**
+ * Path separators and their look-alikes: `/`, `\`, fullwidth ／ ＼, division
+ * slash ∕, set minus ∖, fraction slash ⁄, big solidi ⧸ ⧹, small reverse
+ * solidus ﹨. Plus C0/C1 control characters.
+ */
+const LABEL_FORBIDDEN = /[/\\\uFF0F\uFF3C\u2215\u2216\u2044\u29F8\u29F9\uFE68\u0000-\u001f\u007f-\u009f]/;
+/** The OS account name, or `null` when the platform cannot say. */
+function osUsername() {
+    try {
+        return userInfo().username || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Validate a project label: 1-120 characters; no path separator or look-alike
+ * slash, no drive letter (`C:`), no leading `~`, no control characters; and
+ * not the OS username, which would leak the account name. A label is a name,
+ * never a path.
+ *
+ * @param raw - Candidate label.
+ * @returns The trimmed label.
+ * @throws {NexusAccountError} `E_NEXUS_INVALID_LABEL`.
+ */
+export function validateNexusProjectLabel(raw) {
+    const label = raw.trim();
+    const pathLike = LABEL_FORBIDDEN.test(label) || label.startsWith('~') || /^[A-Za-z]:/.test(label);
+    if (!label || label.length > NEXUS_LABEL_MAX || pathLike) {
+        throw new NexusAccountError('E_NEXUS_INVALID_LABEL', `invalid project label "${label}": use 1-${NEXUS_LABEL_MAX} characters with no slash or backslash (or look-alike), drive letter or leading "~" (a name, not a path)`, 'pass `--label <name>`');
+    }
+    const username = osUsername();
+    if (username !== null && label.toLowerCase() === username.toLowerCase()) {
+        throw new NexusAccountError('E_NEXUS_INVALID_LABEL', 'the project label equals your OS username, which would reveal it to the server', 'pass `--label <name>` with a different name');
+    }
+    return label;
+}
+/**
+ * The label to send: `--label`, else the project's display name. A project
+ * rooted at the home directory has no meaningful name (its basename is the
+ * account name), so it must be labelled explicitly.
+ */
+function resolveLinkLabel(projectRoot, explicit) {
+    if (explicit !== undefined)
+        return validateNexusProjectLabel(explicit);
+    if (resolve(projectRoot) === resolve(homedir())) {
+        throw new NexusAccountError('E_NEXUS_INVALID_LABEL', 'this project is your home directory; its name would reveal your account name', 'pass `--label <name>`');
+    }
+    return validateNexusProjectLabel(getProjectDisplayName(projectRoot));
+}
+/**
+ * Path of the binding file for a project.
+ *
+ * @param projectRoot - Project root.
+ * @returns `<project>/.cleo/nexus-link.json`.
+ */
+export function nexusLinkPath(projectRoot) {
+    return join(getCleoDirAbsolute(projectRoot), NEXUS_LINK_FILE);
+}
+/** Read the binding file; missing or malformed reads as empty. */
+function readLinkFile(path) {
+    try {
+        const parsed = linkFileSchema.safeParse(JSON.parse(readFileSync(path, 'utf-8')));
+        if (parsed.success)
+            return parsed.data;
+    }
+    catch {
+        /* missing or unreadable */
+    }
+    return { version: 1, links: {} };
+}
+/**
+ * The stored binding for a project and origin, if any.
+ *
+ * @param projectRoot - Project root.
+ * @param apiUrl - API URL (any URL on the origin).
+ * @returns The binding, or `null`.
+ */
+export function readNexusProjectLink(projectRoot, apiUrl) {
+    return readLinkFile(nexusLinkPath(projectRoot)).links[new URL(apiUrl).origin] ?? null;
+}
+/** Map an API failure to a Nexus error; a 401 means the session expired. */
+function toLinkError(err) {
+    if (err instanceof NexusError) {
+        if (err.status === 401) {
+            return new NexusAccountError('E_NEXUS_SESSION_EXPIRED', 'the Nexus session expired or was revoked', 'run `cleo login nexus` again');
+        }
+        const remedy = typeof err.details?.['remedy'] === 'string' ? err.details['remedy'] : undefined;
+        return new NexusAccountError('E_NEXUS_REQUEST_FAILED', err.message, remedy);
+    }
+    return err instanceof Error ? err : new Error(String(err));
+}
+/**
+ * Register the project with Nexus (label only, never a path) and persist the
+ * binding in `.cleo/nexus-link.json`. Idempotent.
+ *
+ * @param opts - Project root, label, API URL, store and test overrides.
+ * @returns The binding and whether it already existed.
+ * @throws {NexusAccountError} Not signed in, expired session, invalid label,
+ *   not a CLEO project, or an API refusal (e.g. the id belongs to another account).
+ */
+export async function linkProjectToNexus(opts = {}) {
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    const store = opts.store ?? new FileNexusTokenStore();
+    const session = await requireNexusSession(apiUrl, store);
+    let projectRoot;
+    try {
+        projectRoot = resolveOrCwd(opts.projectRoot);
+    }
+    catch {
+        throw new NexusAccountError('E_NEXUS_NOT_A_PROJECT', 'not inside a CLEO project', 'run `cleo init` first');
+    }
+    const identity = readDeclaredProjectIdentity(projectRoot);
+    if (!identity) {
+        throw new NexusAccountError('E_NEXUS_NOT_A_PROJECT', 'this project has no project id (.cleo/project-id)', 'run `cleo init` or `cleo upgrade` to assign one');
+    }
+    const projectId = identity.projectId;
+    const label = resolveLinkLabel(projectRoot, opts.label);
+    const http = new Http({
+        baseUrl: apiUrl,
+        token: session.bearer(),
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+    });
+    let registered;
+    try {
+        registered = await registerProject(http, { projectId, label });
+    }
+    catch (err) {
+        throw toLinkError(err);
+    }
+    const linkPath = nexusLinkPath(projectRoot);
+    const link = {
+        apiUrl,
+        localProjectId: projectId,
+        remoteProjectId: registered.project.projectId,
+        organizationId: registered.project.organizationId,
+        label: registered.project.label,
+        streamId: registered.streamId,
+        linkedAt: new Date().toISOString(),
+    };
+    // Locked read-modify-write: concurrent links (other origins, other shells)
+    // never drop each other's entries. withLock needs a parseable file to read,
+    // so seed an empty one exclusively ('wx') when there is none.
+    try {
+        writeFileSync(linkPath, `${JSON.stringify({ version: 1, links: {} })}\n`, { flag: 'wx' });
+    }
+    catch (err) {
+        if (!(err instanceof Error && 'code' in err && err.code === 'EEXIST'))
+            throw err;
+    }
+    await withLock(linkPath, (current) => {
+        const parsed = linkFileSchema.safeParse(current);
+        const links = parsed.success ? parsed.data.links : {};
+        return { version: 1, links: { ...links, [apiUrl]: link } };
+    });
+    return {
+        link,
+        alreadyLinked: !registered.created,
+        linkPath,
+    };
+}
+//# sourceMappingURL=nexus-link.js.map

package/dist/cloud/nexus-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-link.js","sourceRoot":"","sources":["../../src/cloud/nexus-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC;CACxC,CAAC,CAAC;AAYH;;;;GAIG;AACH,MAAM,eAAe,GACnB,iFAAiF,CAAC;AAEpF,mEAAmE;AACnE,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,IAAI,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,0BAA0B,KAAK,YAAY,eAAe,0GAA0G,EACpK,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,gFAAgF,EAChF,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,WAAmB,EAAE,QAA4B;IACzE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,8EAA8E,EAC9E,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,yBAAyB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,MAAc;IACtE,OAAO,YAAY,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;AACxF,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,iBAAiB,CAC1B,yBAAyB,EACzB,0CAA0C,EAC1C,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,OAAO,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAyB,EAAE;IAE3B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAEzD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,mDAAmD,EACnD,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAExD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,UAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAqB;QAC7B,MAAM;QACN,cAAc,EAAE,SAAS;QACzB,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS;QAC7C,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,cAAc;QACjD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK;QAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,GAAG,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,CAAgB,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,aAAa,EAAE,CAAC,UAAU,CAAC,OAAO;QAClC,QAAQ;KACT,CAAC;AACJ,CAAC"}