@cleocode/core 2026.9.23 → 2026.9.25

package/dist/cloud/nexus-auth.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Cleo Nexus account engine: device-code login, logout and session status.
+ *
+ * The Nexus API is a better-auth app (cleo-nexus `apps/api/src/auth.ts`):
+ *
+ * - `POST /api/auth/device/code` and `POST /api/auth/device/token` run the
+ *   RFC 8628 grant for the single allowed client id `cleo-cli`, with RFC form
+ *   bodies (cleo-nexus #11). The access token it returns is a better-auth
+ *   session token.
+ * - The bearer plugin accepts that token as `Authorization: Bearer <token>` on
+ *   every `/v1` route and on `POST /api/auth/sign-out`, which deletes the
+ *   session server-side.
+ * - `GET /v1/account/me` names the user and their organizations; a dead
+ *   session answers 401 `E_UNAUTHENTICATED`.
+ *
+ * The device-code protocol itself is NOT implemented here: it is the shared
+ * runner in `../llm/oauth/device-code.ts` (also used by the kimi-code LLM
+ * login). This module adds the Nexus endpoints, token storage and account
+ * lookup. The CLI (`cleo login nexus`, `cleo logout`, `cleo status`) and the
+ * `nexus-account` setup section are thin callers.
+ *
+ * No function here logs, and no result carries the token.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { type NexusAccountErrorCode, type NexusAccountMe, type NexusAccountOrganization, type NexusAccountStatus, type NexusLoginResult, type NexusLogoutResult } from '@cleocode/contracts';
+import { type DeviceCodeConfig, type DeviceCodeStartResponse } from '../llm/oauth/device-code.js';
+import { type FetchLike } from './http.js';
+import { type NexusTokenStore, type SealedNexusSession } from './nexus-credentials.js';
+/** Environment override for the default API origin (e.g. staging). */
+export declare const NEXUS_API_URL_ENV = "CLEO_NEXUS_API_URL";
+/** Default time budget for the server-side revocation at logout. */
+export declare const NEXUS_REVOKE_TIMEOUT_MS = 5000;
+/** Default time budget for a live status check. */
+export declare const NEXUS_STATUS_TIMEOUT_MS = 1500;
+/** A Nexus account flow failure with a stable code. Never carries a token. */
+export declare class NexusAccountError extends Error {
+    readonly code: NexusAccountErrorCode;
+    readonly fix?: string | undefined;
+    /**
+     * @param code - Stable error code.
+     * @param message - Human message.
+     * @param fix - Optional remedy for the user.
+     */
+    constructor(code: NexusAccountErrorCode, message: string, fix?: string | undefined);
+}
+/** Dependencies shared by every flow; all optional (tests inject them). */
+export interface NexusFlowOptions {
+    /** API URL; defaults to `$CLEO_NEXUS_API_URL`, then {@link NEXUS_DEFAULT_API_URL}. */
+    apiUrl?: string;
+    /** Token store; defaults to the 0600 file store. */
+    store?: NexusTokenStore;
+    /** `fetch` override. */
+    fetch?: FetchLike;
+}
+/** Options for {@link logoutFromNexus}. */
+export interface NexusLogoutOptions extends NexusFlowOptions {
+    /** Budget for the revocation call; default {@link NEXUS_REVOKE_TIMEOUT_MS}. */
+    revokeTimeoutMs?: number;
+}
+/** Options for {@link loginToNexus}. */
+export interface NexusLoginOptions extends NexusFlowOptions {
+    /** Called once with the user code and verification URL to show the user. */
+    onCode?: (code: DeviceCodeStartResponse) => void;
+    /** Called on every pending poll with elapsed and total seconds. */
+    onPending?: (elapsed: number, expiresIn: number) => void;
+    /** Cancels polling. */
+    signal?: AbortSignal;
+    /** Wait override for polling (tests). */
+    sleep?: (ms: number) => Promise<void>;
+}
+/** Options for {@link getNexusAccountStatus}. */
+export interface NexusStatusOptions {
+    /** Report only this origin. Default: every stored origin, else the default origin. */
+    apiUrl?: string;
+    /** Token store. */
+    store?: NexusTokenStore;
+    /** `fetch` override. */
+    fetch?: FetchLike;
+    /** Check each session against the API (default `true`). */
+    live?: boolean;
+    /** Time budget per live check. */
+    timeoutMs?: number;
+}
+/**
+ * Resolve and validate the API URL to its origin.
+ *
+ * @param raw - `--api-url`, or `undefined` for `$CLEO_NEXUS_API_URL` / the default.
+ * @returns The origin, e.g. `https://api.cleocode.dev`.
+ * @throws {NexusAccountError} `E_NEXUS_INVALID_API_URL` for anything but an
+ *   https URL (http only on loopback) without credentials in it.
+ */
+export declare function resolveNexusApiUrl(raw?: string): string;
+/**
+ * The shared device-code runner's config for a Nexus origin.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param fetchImpl - Optional `fetch` override.
+ * @returns A {@link DeviceCodeConfig} for the better-auth device endpoints.
+ */
+export declare function nexusDeviceCodeConfig(apiUrl: string, fetchImpl?: FetchLike): DeviceCodeConfig;
+/**
+ * Refuse a server-supplied verification URL unless it is safe to print and to
+ * hand to the OS browser opener:
+ *
+ * - no control characters or whitespace (terminal injection: ESC, CR, LF, CSI);
+ * - no leading `-` (option injection into `open` / `xdg-open`);
+ * - `https:` (plain `http:` only when the API itself is a loopback http origin);
+ * - no `user:pass@`;
+ * - the host is the API's web origin or a subdomain of it: the API host minus a
+ *   leading `api.` label (`api.cleocode.dev` → `cleocode.dev`,
+ *   `api.staging.cleocode.dev` → `staging.cleocode.dev`). A phishing host, a
+ *   `file:` URL or a custom scheme never reaches the screen or the opener.
+ *
+ * @param uri - `verification_uri` or `verification_uri_complete` as received.
+ * @param apiUrl - Resolved API origin.
+ * @returns The normalised URL (`new URL(uri).href`): the exact form that was
+ *   validated, and the only one to print or open.
+ * @throws {NexusAccountError} `E_NEXUS_UNTRUSTED_VERIFICATION_URI`.
+ */
+export declare function assertTrustedVerificationUri(uri: string, apiUrl: string): string;
+/**
+ * The organization to show for an account: the personal one, else the first.
+ *
+ * @param me - Parsed `/v1/account/me`.
+ * @returns The primary organization, or `null`.
+ */
+export declare function primaryNexusOrganization(me: NexusAccountMe): NexusAccountOrganization | null;
+/**
+ * Sign in to a Cleo Nexus account with the device-code grant and store the
+ * session token (0600, keyed by API origin).
+ *
+ * @param opts - API URL, store, UI hooks and test overrides.
+ * @returns The secret-free login result.
+ * @throws {NexusAccountError} On a start, poll, denial or expiry failure.
+ */
+export declare function loginToNexus(opts?: NexusLoginOptions): Promise<NexusLoginResult>;
+/**
+ * Sign out: delete the session locally FIRST, then revoke it server-side
+ * (`POST /api/auth/sign-out` with the bearer token) within
+ * {@link NEXUS_REVOKE_TIMEOUT_MS}. A slow or hung server can delay logout by
+ * at most that budget and can never keep the token on disk; a failed
+ * revocation is reported. The delete only removes the session that was read,
+ * so a login that finished concurrently for the same origin survives.
+ *
+ * @param opts - API URL, store, revoke budget and test overrides.
+ * @returns The logout result.
+ */
+export declare function logoutFromNexus(opts?: NexusLogoutOptions): Promise<NexusLogoutResult>;
+/**
+ * Secret-free status rows for `cleo status` and `cleo auth list`: one per
+ * stored session, or one "not signed in" row for the default origin. Makes a
+ * network call only when a token is stored.
+ *
+ * @param opts - Origin filter, store, liveness and test overrides.
+ * @returns Status rows, sorted by origin.
+ */
+export declare function getNexusAccountStatus(opts?: NexusStatusOptions): Promise<NexusAccountStatus[]>;
+/**
+ * The stored session for an origin, or a `E_NEXUS_NOT_SIGNED_IN` error.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param store - Token store.
+ * @returns The sealed session.
+ * @throws {NexusAccountError} When no session is stored.
+ */
+export declare function requireNexusSession(apiUrl: string, store: NexusTokenStore): Promise<SealedNexusSession>;
+//# sourceMappingURL=nexus-auth.d.ts.map

package/dist/cloud/nexus-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-auth.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAI7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,SAAS,EAAiC,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,KAAK;IAOxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB;IAEpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IARvB;;;;OAIG;gBAEQ,IAAI,EAAE,qBAAqB,EACpC,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA;CAKxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACjD,mEAAmE;IACnE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,uBAAuB;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yCAAyC;IACzC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAevD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAQ7F;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAwBhF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,cAAc,GAAG,wBAAwB,GAAG,IAAI,CAE5F;AAgDD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwE1F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyB/F;AA8ED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}

package/dist/cloud/nexus-auth.js

@@ -0,0 +1,372 @@
+/**
+ * Cleo Nexus account engine: device-code login, logout and session status.
+ *
+ * The Nexus API is a better-auth app (cleo-nexus `apps/api/src/auth.ts`):
+ *
+ * - `POST /api/auth/device/code` and `POST /api/auth/device/token` run the
+ *   RFC 8628 grant for the single allowed client id `cleo-cli`, with RFC form
+ *   bodies (cleo-nexus #11). The access token it returns is a better-auth
+ *   session token.
+ * - The bearer plugin accepts that token as `Authorization: Bearer <token>` on
+ *   every `/v1` route and on `POST /api/auth/sign-out`, which deletes the
+ *   session server-side.
+ * - `GET /v1/account/me` names the user and their organizations; a dead
+ *   session answers 401 `E_UNAUTHENTICATED`.
+ *
+ * The device-code protocol itself is NOT implemented here: it is the shared
+ * runner in `../llm/oauth/device-code.ts` (also used by the kimi-code LLM
+ * login). This module adds the Nexus endpoints, token storage and account
+ * lookup. The CLI (`cleo login nexus`, `cleo logout`, `cleo status`) and the
+ * `nexus-account` setup section are thin callers.
+ *
+ * No function here logs, and no result carries the token.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { NEXUS_CLI_CLIENT_ID, NEXUS_DEFAULT_API_URL, nexusAccountMeSchema, } from '@cleocode/contracts';
+import { DeviceCodeAuthError, DeviceCodeTimeoutError, pollForToken, startDeviceCodeFlow, } from '../llm/oauth/device-code.js';
+import { Http, isSecureUrl, NexusError } from './http.js';
+import { FileNexusTokenStore, } from './nexus-credentials.js';
+/** Environment override for the default API origin (e.g. staging). */
+export const NEXUS_API_URL_ENV = 'CLEO_NEXUS_API_URL';
+/** Default time budget for the server-side revocation at logout. */
+export const NEXUS_REVOKE_TIMEOUT_MS = 5_000;
+/** Default time budget for a live status check. */
+export const NEXUS_STATUS_TIMEOUT_MS = 1_500;
+/** A Nexus account flow failure with a stable code. Never carries a token. */
+export class NexusAccountError extends Error {
+    code;
+    fix;
+    /**
+     * @param code - Stable error code.
+     * @param message - Human message.
+     * @param fix - Optional remedy for the user.
+     */
+    constructor(code, message, fix) {
+        super(message);
+        this.code = code;
+        this.fix = fix;
+        this.name = 'NexusAccountError';
+    }
+}
+/**
+ * Resolve and validate the API URL to its origin.
+ *
+ * @param raw - `--api-url`, or `undefined` for `$CLEO_NEXUS_API_URL` / the default.
+ * @returns The origin, e.g. `https://api.cleocode.dev`.
+ * @throws {NexusAccountError} `E_NEXUS_INVALID_API_URL` for anything but an
+ *   https URL (http only on loopback) without credentials in it.
+ */
+export function resolveNexusApiUrl(raw) {
+    const candidate = (raw ?? process.env[NEXUS_API_URL_ENV] ?? NEXUS_DEFAULT_API_URL).trim();
+    let url;
+    try {
+        url = new URL(candidate);
+    }
+    catch {
+        throw new NexusAccountError('E_NEXUS_INVALID_API_URL', `invalid Nexus API URL: ${candidate}`);
+    }
+    if (url.username || url.password || !isSecureUrl(url.origin)) {
+        throw new NexusAccountError('E_NEXUS_INVALID_API_URL', 'the Nexus API URL must be https:// (http:// only for localhost) with no user:password');
+    }
+    return url.origin;
+}
+/**
+ * The shared device-code runner's config for a Nexus origin.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param fetchImpl - Optional `fetch` override.
+ * @returns A {@link DeviceCodeConfig} for the better-auth device endpoints.
+ */
+export function nexusDeviceCodeConfig(apiUrl, fetchImpl) {
+    return {
+        provider: 'cleo-nexus',
+        deviceCodeUrl: `${apiUrl}/api/auth/device/code`,
+        tokenUrl: `${apiUrl}/api/auth/device/token`,
+        clientId: NEXUS_CLI_CLIENT_ID,
+        ...(fetchImpl ? { fetch: fetchImpl } : {}),
+    };
+}
+/**
+ * C0/C1 control characters (ESC, CR, LF, CSI, …), any whitespace, bidi
+ * embeddings/overrides/isolates (U+202A–202E, U+2066–2069), zero-width
+ * characters (U+200B–200D, U+FEFF) and `\` (which WHATWG URL parsing turns
+ * into `/`, so the host a user reads could differ from the one opened).
+ */
+const UNSAFE_URI_CHARS = /[\u0000-\u0020\u007f-\u009f\s\u202a-\u202e\u2066-\u2069\u200b-\u200d\ufeff\\]/;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/**
+ * Refuse a server-supplied verification URL unless it is safe to print and to
+ * hand to the OS browser opener:
+ *
+ * - no control characters or whitespace (terminal injection: ESC, CR, LF, CSI);
+ * - no leading `-` (option injection into `open` / `xdg-open`);
+ * - `https:` (plain `http:` only when the API itself is a loopback http origin);
+ * - no `user:pass@`;
+ * - the host is the API's web origin or a subdomain of it: the API host minus a
+ *   leading `api.` label (`api.cleocode.dev` → `cleocode.dev`,
+ *   `api.staging.cleocode.dev` → `staging.cleocode.dev`). A phishing host, a
+ *   `file:` URL or a custom scheme never reaches the screen or the opener.
+ *
+ * @param uri - `verification_uri` or `verification_uri_complete` as received.
+ * @param apiUrl - Resolved API origin.
+ * @returns The normalised URL (`new URL(uri).href`): the exact form that was
+ *   validated, and the only one to print or open.
+ * @throws {NexusAccountError} `E_NEXUS_UNTRUSTED_VERIFICATION_URI`.
+ */
+export function assertTrustedVerificationUri(uri, apiUrl) {
+    const refuse = (why) => {
+        throw new NexusAccountError('E_NEXUS_UNTRUSTED_VERIFICATION_URI', `the server sent an untrusted verification URL (${why}); the login was stopped`, 'check --api-url; only sign in through the Cleo Nexus web app');
+    };
+    if (UNSAFE_URI_CHARS.test(uri))
+        refuse('control characters or whitespace');
+    if (uri.startsWith('-'))
+        refuse('leading "-"');
+    const url = URL.canParse(uri) ? new URL(uri) : refuse('not a URL');
+    const api = new URL(apiUrl);
+    const loopbackHttp = url.protocol === 'http:' &&
+        api.protocol === 'http:' &&
+        LOOPBACK_HOSTS.has(url.hostname) &&
+        LOOPBACK_HOSTS.has(api.hostname);
+    if (url.protocol !== 'https:' && !loopbackHttp)
+        refuse(`scheme ${url.protocol}`);
+    if (url.username || url.password)
+        refuse('credentials in the URL');
+    const web = api.hostname.startsWith('api.') ? api.hostname.slice(4) : api.hostname;
+    if (url.hostname !== web && !url.hostname.endsWith(`.${web}`)) {
+        refuse(`host ${url.hostname} is not ${web}`);
+    }
+    return url.href;
+}
+/**
+ * The organization to show for an account: the personal one, else the first.
+ *
+ * @param me - Parsed `/v1/account/me`.
+ * @returns The primary organization, or `null`.
+ */
+export function primaryNexusOrganization(me) {
+    return me.organizations.find((o) => o.personal) ?? me.organizations[0] ?? null;
+}
+/** `GET /v1/account/me` with a bearer token. */
+async function fetchAccountMe(apiUrl, token, opts = {}) {
+    const http = new Http({
+        baseUrl: apiUrl,
+        token,
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+        maxAttempts: opts.maxAttempts ?? 2,
+    });
+    return http.request('GET', '/v1/account/me', nexusAccountMeSchema);
+}
+/** Map a device-code runner failure to a Nexus error. */
+function toLoginError(err) {
+    if (err instanceof DeviceCodeTimeoutError) {
+        return new NexusAccountError('E_NEXUS_DEVICE_CODE_EXPIRED', 'the device code expired before it was approved', 'run `cleo login nexus` again and approve the code sooner');
+    }
+    if (err instanceof DeviceCodeAuthError) {
+        if (err.errorCode === 'expired_token') {
+            return new NexusAccountError('E_NEXUS_DEVICE_CODE_EXPIRED', 'the device code expired before it was approved', 'run `cleo login nexus` again and approve the code sooner');
+        }
+        if (err.errorCode === 'access_denied') {
+            return new NexusAccountError('E_NEXUS_ACCESS_DENIED', 'the sign-in request was denied in the browser');
+        }
+        return new NexusAccountError('E_NEXUS_DEVICE_CODE_FAILED', err.message);
+    }
+    return new NexusAccountError('E_NEXUS_DEVICE_CODE_FAILED', `polling for the Nexus token failed: ${err instanceof Error ? err.message : String(err)}`);
+}
+/**
+ * Sign in to a Cleo Nexus account with the device-code grant and store the
+ * session token (0600, keyed by API origin).
+ *
+ * @param opts - API URL, store, UI hooks and test overrides.
+ * @returns The secret-free login result.
+ * @throws {NexusAccountError} On a start, poll, denial or expiry failure.
+ */
+export async function loginToNexus(opts = {}) {
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    const store = opts.store ?? new FileNexusTokenStore();
+    const cfg = nexusDeviceCodeConfig(apiUrl, opts.fetch);
+    let start;
+    try {
+        start = await startDeviceCodeFlow(cfg);
+    }
+    catch (err) {
+        throw new NexusAccountError('E_NEXUS_DEVICE_CODE_START_FAILED', `could not start the Nexus sign-in at ${apiUrl}: ${err instanceof Error ? err.message : String(err)}`, 'check the API URL and your network, then retry');
+    }
+    // Validate, then show and open only the normalised forms that were checked.
+    const shown = {
+        ...start,
+        verificationUri: assertTrustedVerificationUri(start.verificationUri, apiUrl),
+        ...(start.verificationUriComplete !== undefined
+            ? {
+                verificationUriComplete: assertTrustedVerificationUri(start.verificationUriComplete, apiUrl),
+            }
+            : {}),
+    };
+    opts.onCode?.(shown);
+    let token;
+    try {
+        token = await pollForToken(cfg, start, {
+            ...(opts.onPending ? { onPending: opts.onPending } : {}),
+            ...(opts.signal ? { signal: opts.signal } : {}),
+            ...(opts.sleep ? { sleep: opts.sleep } : {}),
+        });
+    }
+    catch (err) {
+        throw toLoginError(err);
+    }
+    const warnings = [];
+    let me = null;
+    try {
+        me = await fetchAccountMe(apiUrl, token.accessToken, opts.fetch ? { fetch: opts.fetch } : {});
+    }
+    catch (err) {
+        warnings.push(`signed in, but the account lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const organization = me ? primaryNexusOrganization(me) : null;
+    const expiresAt = typeof token.expiresIn === 'number'
+        ? new Date(Date.now() + token.expiresIn * 1000).toISOString()
+        : null;
+    await store.put(apiUrl, {
+        token: token.accessToken,
+        tokenType: token.tokenType,
+        expiresAt,
+        user: me?.user ?? null,
+        organization,
+    });
+    return {
+        apiUrl,
+        user: me?.user ?? null,
+        organization,
+        expiresAt,
+        credentialsPath: store.location,
+        warnings,
+    };
+}
+/**
+ * Sign out: delete the session locally FIRST, then revoke it server-side
+ * (`POST /api/auth/sign-out` with the bearer token) within
+ * {@link NEXUS_REVOKE_TIMEOUT_MS}. A slow or hung server can delay logout by
+ * at most that budget and can never keep the token on disk; a failed
+ * revocation is reported. The delete only removes the session that was read,
+ * so a login that finished concurrently for the same origin survives.
+ *
+ * @param opts - API URL, store, revoke budget and test overrides.
+ * @returns The logout result.
+ */
+export async function logoutFromNexus(opts = {}) {
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    const store = opts.store ?? new FileNexusTokenStore();
+    const session = await store.get(apiUrl);
+    if (!session) {
+        return { apiUrl, removedLocally: false, revocation: 'skipped', warnings: [] };
+    }
+    const removedLocally = await store.delete(apiUrl, session);
+    const warnings = [];
+    let revocation;
+    try {
+        revocation = await revokeSession(apiUrl, session, opts.revokeTimeoutMs ?? NEXUS_REVOKE_TIMEOUT_MS, opts.fetch);
+    }
+    catch (err) {
+        revocation = 'failed';
+        warnings.push(`server-side sign-out failed (${err instanceof Error ? err.message : String(err)}); the local token was deleted`);
+    }
+    return { apiUrl, removedLocally, revocation, warnings };
+}
+/** `POST /api/auth/sign-out` with the bearer token, within `timeoutMs`. Never follows redirects. */
+async function revokeSession(apiUrl, session, timeoutMs, fetchImpl) {
+    const doFetch = fetchImpl ?? ((input, init) => fetch(input, init));
+    const res = await doFetch(`${apiUrl}/api/auth/sign-out`, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${session.bearer()}`,
+            'content-type': 'application/json',
+            accept: 'application/json',
+        },
+        body: '{}',
+        redirect: 'error',
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (res.status === 401)
+        return 'already-invalid';
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    return 'revoked';
+}
+/** Build one status row from a stored session and an optional live check. */
+function statusRow(apiUrl, state, session, me) {
+    const email = me?.user.email ?? session?.user?.email ?? null;
+    const org = (me ? primaryNexusOrganization(me) : session?.organization)?.name ?? null;
+    const who = `${email ?? 'unknown user'}${org ? ` (${org})` : ''}`;
+    const summary = state === 'signed-in'
+        ? `signed in as ${who}`
+        : state === 'unverified'
+            ? `signed in as ${who}; not verified (API unreachable)`
+            : state === 'expired'
+                ? 'session expired; run `cleo login nexus`'
+                : 'not signed in';
+    return {
+        apiUrl,
+        state,
+        email: state === 'not-signed-in' ? null : email,
+        organization: state === 'not-signed-in' ? null : org,
+        expiresAt: session?.expiresAt ?? null,
+        summary,
+    };
+}
+/** Check one stored session against the API. 401 means expired, never a crash. */
+async function checkSession(session, opts) {
+    if (opts.live === false)
+        return statusRow(session.apiUrl, 'unverified', session, null);
+    const timeoutMs = opts.timeoutMs ?? NEXUS_STATUS_TIMEOUT_MS;
+    const base = opts.fetch ?? ((input, init) => fetch(input, init));
+    const timed = (input, init) => base(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+    try {
+        const me = await fetchAccountMe(session.apiUrl, session.bearer(), {
+            fetch: timed,
+            maxAttempts: 1,
+        });
+        return statusRow(session.apiUrl, 'signed-in', session, me);
+    }
+    catch (err) {
+        if (err instanceof NexusError && err.status === 401) {
+            return statusRow(session.apiUrl, 'expired', session, null);
+        }
+        return statusRow(session.apiUrl, 'unverified', session, null);
+    }
+}
+/**
+ * Secret-free status rows for `cleo status` and `cleo auth list`: one per
+ * stored session, or one "not signed in" row for the default origin. Makes a
+ * network call only when a token is stored.
+ *
+ * @param opts - Origin filter, store, liveness and test overrides.
+ * @returns Status rows, sorted by origin.
+ */
+export async function getNexusAccountStatus(opts = {}) {
+    const store = opts.store ?? new FileNexusTokenStore();
+    const only = opts.apiUrl !== undefined ? resolveNexusApiUrl(opts.apiUrl) : null;
+    const sessions = (await store.list()).filter((s) => only === null || s.apiUrl === only);
+    if (sessions.length === 0) {
+        return [statusRow(only ?? resolveNexusApiUrl(), 'not-signed-in', null, null)];
+    }
+    return Promise.all(sessions.map((s) => checkSession(s, opts)));
+}
+/**
+ * The stored session for an origin, or a `E_NEXUS_NOT_SIGNED_IN` error.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param store - Token store.
+ * @returns The sealed session.
+ * @throws {NexusAccountError} When no session is stored.
+ */
+export async function requireNexusSession(apiUrl, store) {
+    const session = await store.get(apiUrl);
+    if (!session) {
+        throw new NexusAccountError('E_NEXUS_NOT_SIGNED_IN', `not signed in to Cleo Nexus at ${apiUrl}`, apiUrl === NEXUS_DEFAULT_API_URL
+            ? 'run `cleo login nexus`'
+            : `run \`cleo login nexus --api-url ${apiUrl}\``);
+    }
+    return session;
+}
+//# sourceMappingURL=nexus-auth.js.map

package/dist/cloud/nexus-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AA4CD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtD,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,OAAO,EACP,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,OAA2B,EAC3B,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,EAAE;YAC3C,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}