@cleocode/core 2026.9.23 → 2026.9.25

package/dist/cloud/nexus-credentials.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Cleo Nexus session-token store.
+ *
+ * Stored at `<cleoHome>/nexus-credentials.json` (resolved through
+ * `@cleocode/paths`, arch gate 2) with 0600 permissions, one session per API
+ * origin. Modelled on `../decide/credentials.ts`:
+ *
+ * - Writes go through `withLock` and `writeJsonFileAtomic({ mode: 0o600 })`,
+ *   so neither the live file, the temp file nor a rotated backup is ever
+ *   looser than owner-only. Deleting a session also purges the rotated
+ *   backups, which would otherwise keep a copy of the token.
+ * - Reads return a {@link SealedNexusSession}: the token sits in a private
+ *   field, so `JSON.stringify`, `util.inspect` and template strings of the
+ *   handle show a masked preview only. {@link SealedNexusSession.bearer} is the
+ *   one accessor, called where the HTTP request is built.
+ *
+ * Everything goes through the {@link NexusTokenStore} interface, so an OS
+ * keychain store can replace the file later without touching the callers.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { inspect } from 'node:util';
+import { type NexusAccountOrganization, type NexusAccountUser } from '@cleocode/contracts';
+import { z } from 'zod';
+/** File name of the store, directly under the CLEO home. */
+export declare const NEXUS_CREDENTIALS_FILE = "nexus-credentials.json";
+declare const sessionSchema: z.ZodObject<{
+    token: z.ZodString;
+    tokenType: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    organization: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        role: z.ZodOptional<z.ZodString>;
+        personal: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+/** A session to store. The token is the only secret. */
+export interface NexusSessionInput {
+    /** Bearer session token issued by the device-code grant. */
+    readonly token: string;
+    /** Token type the server reported (`Bearer`). */
+    readonly tokenType: string;
+    /** ISO expiry, when the server reported one. */
+    readonly expiresAt: string | null;
+    /** The signed-in user, when known. */
+    readonly user: NexusAccountUser | null;
+    /** Primary organization, when known. */
+    readonly organization: NexusAccountOrganization | null;
+}
+/**
+ * Pluggable storage for Nexus session tokens, keyed by API origin.
+ *
+ * The file store below is the default. A keychain-backed store implements the
+ * same four methods.
+ */
+export interface NexusTokenStore {
+    /** Absolute location shown to the user (a path, or a keychain service name). */
+    readonly location: string;
+    /** The session for `apiUrl`'s origin, or `null`. */
+    get(apiUrl: string): Promise<SealedNexusSession | null>;
+    /** Store (replace) the session for `apiUrl`'s origin. */
+    put(apiUrl: string, session: NexusSessionInput): Promise<void>;
+    /**
+     * Delete the session for `apiUrl`'s origin. With `expected`, delete only if
+     * the stored token is still that session's token (checked under the store's
+     * lock), so a login that finished meanwhile is not wiped. Returns `true` when
+     * a session was deleted.
+     */
+    delete(apiUrl: string, expected?: SealedNexusSession): Promise<boolean>;
+    /** Every stored session. */
+    list(): Promise<SealedNexusSession[]>;
+}
+/**
+ * Mask a token down to a short, non-reversible preview.
+ *
+ * @param token - Plaintext token (read transiently, not retained).
+ * @returns `…` plus at most the last 4 characters.
+ */
+export declare function maskNexusToken(token: string): string;
+/**
+ * Opaque handle to a stored session. The token is held in a private field;
+ * serialising or inspecting the handle yields the masked preview only.
+ */
+export declare class SealedNexusSession {
+    #private;
+    /** API origin the session belongs to. */
+    readonly apiUrl: string;
+    /** Token type (`Bearer`). */
+    readonly tokenType: string;
+    /** ISO expiry, when known. */
+    readonly expiresAt: string | null;
+    /** Signed-in user, when known. */
+    readonly user: NexusAccountUser | null;
+    /** Primary organization, when known. */
+    readonly organization: NexusAccountOrganization | null;
+    /** ISO time the session was stored. */
+    readonly createdAt: string;
+    /** Masked token preview. */
+    readonly tokenPreview: string;
+    /**
+     * @param apiUrl - API origin.
+     * @param record - Stored record; the token is captured privately.
+     */
+    constructor(apiUrl: string, record: z.infer<typeof sessionSchema>);
+    /**
+     * The plaintext token. Call only where the `Authorization` header is built.
+     *
+     * @returns The bearer token.
+     */
+    bearer(): string;
+    /** Secret-free JSON form. */
+    toJSON(): Record<string, unknown>;
+    /** Secret-free string form. */
+    toString(): string;
+    /** Secret-free `util.inspect` form. */
+    [inspect.custom](): string;
+}
+/** Thrown when the store cannot be written safely. */
+export declare class NexusCredentialsError extends Error {
+    constructor(message: string);
+}
+/**
+ * The storage key for an API URL: its origin (scheme, host and port).
+ *
+ * @param apiUrl - Any URL on the API host.
+ * @returns The origin, e.g. `https://api.cleocode.dev`.
+ */
+export declare function nexusOriginKey(apiUrl: string): string;
+/**
+ * Absolute path of the default file store.
+ *
+ * @returns `<cleoHome>/nexus-credentials.json`.
+ */
+export declare function nexusCredentialsPath(): string;
+/**
+ * File-backed {@link NexusTokenStore}: `<cleoHome>/nexus-credentials.json`,
+ * mode 0600, one entry per API origin.
+ */
+export declare class FileNexusTokenStore implements NexusTokenStore {
+    /** Absolute path of the store file. */
+    readonly location: string;
+    /** @param path - Store path; defaults to {@link nexusCredentialsPath}. */
+    constructor(path?: string);
+    get(apiUrl: string): Promise<SealedNexusSession | null>;
+    put(apiUrl: string, session: NexusSessionInput): Promise<void>;
+    delete(apiUrl: string, expected?: SealedNexusSession): Promise<boolean>;
+    list(): Promise<SealedNexusSession[]>;
+    /**
+     * Read and validate the file; a missing or malformed file reads as empty. A
+     * file readable or writable by group/others, or owned by another user, is
+     * refused: its token may already be exposed or planted.
+     */
+    private read;
+    /** Locked, atomic, owner-only read-modify-write. */
+    private write;
+    /**
+     * Create the store file owner-only if it does not exist. `O_EXCL` plus
+     * `O_NOFOLLOW` close the window between the symlink check and the create: a
+     * symlink planted meanwhile makes the open fail instead of being followed.
+     * On `EEXIST` the existing entry is re-opened with `O_NOFOLLOW`, which fails
+     * (`ELOOP`) on a symlink, so a planted link is refused before the locked
+     * write can touch it.
+     */
+    private seed;
+    /**
+     * Throw when the store exists with a mode wider than 0600 or another owner.
+     * Skipped on Windows, where Node reports every file as 0o666 and uids do not
+     * apply; the file lives in the user's profile, protected by its ACL.
+     */
+    private assertPrivate;
+    /** Refuse to write a token through a symlink (it could point anywhere). */
+    private assertNoSymlinks;
+    /** Rotated backups of the store file. */
+    private backupFiles;
+    /** Delete every rotated backup (best effort). */
+    private purgeBackups;
+}
+export {};
+//# sourceMappingURL=nexus-credentials.d.ts.map

package/dist/cloud/nexus-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-credentials.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAeH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EAGtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,4DAA4D;AAC5D,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,QAAA,MAAM,aAAa;;;;;;;;;;;;;;;;;iBAOjB,CAAC;AAcH,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,wCAAwC;IACxC,QAAQ,CAAC,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACxD,yDAAyD;IACzD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;;OAKG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,4BAA4B;IAC5B,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,qBAAa,kBAAkB;;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,wCAAwC;IACxC,QAAQ,CAAC,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACvD,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4BAA4B;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAG9B;;;OAGG;gBACS,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC;IAWjE;;;;OAIG;IACH,MAAM,IAAI,MAAM;IAIhB,6BAA6B;IAC7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAYjC,+BAA+B;IAC/B,QAAQ,IAAI,MAAM;IAIlB,uCAAuC;IACvC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM;CAG3B;AAED,sDAAsD;AACtD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,0EAA0E;gBAC9D,IAAI,GAAE,MAA+B;IAI3C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAMvD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB9D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoBvE,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAM3C;;;;OAIG;IACH,OAAO,CAAC,IAAI;IAiBZ,oDAAoD;YACtC,KAAK;IAenB;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI;IA2BZ;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAgBrB,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IAgBxB,yCAAyC;IACzC,OAAO,CAAC,WAAW;IAYnB,iDAAiD;IACjD,OAAO,CAAC,YAAY;CASrB"}

package/dist/cloud/nexus-credentials.js

@@ -0,0 +1,323 @@
+/**
+ * Cleo Nexus session-token store.
+ *
+ * Stored at `<cleoHome>/nexus-credentials.json` (resolved through
+ * `@cleocode/paths`, arch gate 2) with 0600 permissions, one session per API
+ * origin. Modelled on `../decide/credentials.ts`:
+ *
+ * - Writes go through `withLock` and `writeJsonFileAtomic({ mode: 0o600 })`,
+ *   so neither the live file, the temp file nor a rotated backup is ever
+ *   looser than owner-only. Deleting a session also purges the rotated
+ *   backups, which would otherwise keep a copy of the token.
+ * - Reads return a {@link SealedNexusSession}: the token sits in a private
+ *   field, so `JSON.stringify`, `util.inspect` and template strings of the
+ *   handle show a masked preview only. {@link SealedNexusSession.bearer} is the
+ *   one accessor, called where the HTTP request is built.
+ *
+ * Everything goes through the {@link NexusTokenStore} interface, so an OS
+ * keychain store can replace the file later without touching the callers.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import { closeSync, constants as fsConstants, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, statSync, unlinkSync, writeSync, } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { inspect } from 'node:util';
+import { nexusAccountOrganizationSchema, nexusAccountUserSchema, } from '@cleocode/contracts';
+import { getCleoHome } from '@cleocode/paths';
+import { z } from 'zod';
+import { withLock } from '../store/file-utils.js';
+/** File name of the store, directly under the CLEO home. */
+export const NEXUS_CREDENTIALS_FILE = 'nexus-credentials.json';
+const sessionSchema = z.object({
+    token: z.string().min(1),
+    tokenType: z.string(),
+    expiresAt: z.string().nullable(),
+    user: nexusAccountUserSchema.nullable(),
+    organization: nexusAccountOrganizationSchema.nullable(),
+    createdAt: z.string(),
+});
+const storeSchema = z.object({
+    version: z.literal(1),
+    sessions: z.record(z.string(), sessionSchema),
+});
+const EMPTY_STORE = { version: 1, sessions: {} };
+/** `O_NOFOLLOW` where the platform has it (not on Windows). */
+const NO_FOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+/**
+ * Mask a token down to a short, non-reversible preview.
+ *
+ * @param token - Plaintext token (read transiently, not retained).
+ * @returns `…` plus at most the last 4 characters.
+ */
+export function maskNexusToken(token) {
+    return token.length > 12 ? `…${token.slice(-4)}` : '…';
+}
+/**
+ * Opaque handle to a stored session. The token is held in a private field;
+ * serialising or inspecting the handle yields the masked preview only.
+ */
+export class SealedNexusSession {
+    /** API origin the session belongs to. */
+    apiUrl;
+    /** Token type (`Bearer`). */
+    tokenType;
+    /** ISO expiry, when known. */
+    expiresAt;
+    /** Signed-in user, when known. */
+    user;
+    /** Primary organization, when known. */
+    organization;
+    /** ISO time the session was stored. */
+    createdAt;
+    /** Masked token preview. */
+    tokenPreview;
+    #token;
+    /**
+     * @param apiUrl - API origin.
+     * @param record - Stored record; the token is captured privately.
+     */
+    constructor(apiUrl, record) {
+        this.apiUrl = apiUrl;
+        this.tokenType = record.tokenType;
+        this.expiresAt = record.expiresAt;
+        this.user = record.user;
+        this.organization = record.organization;
+        this.createdAt = record.createdAt;
+        this.#token = record.token;
+        this.tokenPreview = maskNexusToken(record.token);
+    }
+    /**
+     * The plaintext token. Call only where the `Authorization` header is built.
+     *
+     * @returns The bearer token.
+     */
+    bearer() {
+        return this.#token;
+    }
+    /** Secret-free JSON form. */
+    toJSON() {
+        return {
+            apiUrl: this.apiUrl,
+            tokenType: this.tokenType,
+            expiresAt: this.expiresAt,
+            user: this.user,
+            organization: this.organization,
+            createdAt: this.createdAt,
+            tokenPreview: this.tokenPreview,
+        };
+    }
+    /** Secret-free string form. */
+    toString() {
+        return `SealedNexusSession(${this.apiUrl}, token ${this.tokenPreview})`;
+    }
+    /** Secret-free `util.inspect` form. */
+    [inspect.custom]() {
+        return this.toString();
+    }
+}
+/** Thrown when the store cannot be written safely. */
+export class NexusCredentialsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'NexusCredentialsError';
+    }
+}
+/**
+ * The storage key for an API URL: its origin (scheme, host and port).
+ *
+ * @param apiUrl - Any URL on the API host.
+ * @returns The origin, e.g. `https://api.cleocode.dev`.
+ */
+export function nexusOriginKey(apiUrl) {
+    return new URL(apiUrl).origin;
+}
+/**
+ * Absolute path of the default file store.
+ *
+ * @returns `<cleoHome>/nexus-credentials.json`.
+ */
+export function nexusCredentialsPath() {
+    return join(getCleoHome(), NEXUS_CREDENTIALS_FILE);
+}
+/**
+ * File-backed {@link NexusTokenStore}: `<cleoHome>/nexus-credentials.json`,
+ * mode 0600, one entry per API origin.
+ */
+export class FileNexusTokenStore {
+    /** Absolute path of the store file. */
+    location;
+    /** @param path - Store path; defaults to {@link nexusCredentialsPath}. */
+    constructor(path = nexusCredentialsPath()) {
+        this.location = path;
+    }
+    async get(apiUrl) {
+        const key = nexusOriginKey(apiUrl);
+        const record = this.read().sessions[key];
+        return record ? new SealedNexusSession(key, record) : null;
+    }
+    async put(apiUrl, session) {
+        const key = nexusOriginKey(apiUrl);
+        const record = sessionSchema.parse({
+            token: session.token,
+            tokenType: session.tokenType,
+            expiresAt: session.expiresAt,
+            user: session.user,
+            organization: session.organization,
+            createdAt: new Date().toISOString(),
+        });
+        await this.write((current) => ({
+            version: 1,
+            sessions: { ...current.sessions, [key]: record },
+        }));
+    }
+    async delete(apiUrl, expected) {
+        const key = nexusOriginKey(apiUrl);
+        let deleted = false;
+        if (key in this.read().sessions) {
+            await this.write((current) => {
+                const stored = current.sessions[key];
+                if (!stored || (expected !== undefined && stored.token !== expected.bearer())) {
+                    return current;
+                }
+                deleted = true;
+                const sessions = { ...current.sessions };
+                delete sessions[key];
+                return { version: 1, sessions };
+            });
+        }
+        // Rotated backups hold earlier copies of the file, and so of the token.
+        this.purgeBackups();
+        return deleted;
+    }
+    async list() {
+        return Object.entries(this.read().sessions)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, record]) => new SealedNexusSession(key, record));
+    }
+    /**
+     * Read and validate the file; a missing or malformed file reads as empty. A
+     * file readable or writable by group/others, or owned by another user, is
+     * refused: its token may already be exposed or planted.
+     */
+    read() {
+        this.assertPrivate();
+        let raw;
+        try {
+            raw = readFileSync(this.location, 'utf-8');
+        }
+        catch {
+            return EMPTY_STORE;
+        }
+        if (!raw.trim())
+            return EMPTY_STORE;
+        try {
+            const parsed = storeSchema.safeParse(JSON.parse(raw));
+            return parsed.success ? parsed.data : EMPTY_STORE;
+        }
+        catch {
+            return EMPTY_STORE;
+        }
+    }
+    /** Locked, atomic, owner-only read-modify-write. */
+    async write(transform) {
+        this.assertNoSymlinks();
+        this.seed();
+        await withLock(this.location, (current) => {
+            const parsed = storeSchema.safeParse(current);
+            return transform(parsed.success ? parsed.data : EMPTY_STORE);
+        }, { mode: 0o600 });
+    }
+    /**
+     * Create the store file owner-only if it does not exist. `O_EXCL` plus
+     * `O_NOFOLLOW` close the window between the symlink check and the create: a
+     * symlink planted meanwhile makes the open fail instead of being followed.
+     * On `EEXIST` the existing entry is re-opened with `O_NOFOLLOW`, which fails
+     * (`ELOOP`) on a symlink, so a planted link is refused before the locked
+     * write can touch it.
+     */
+    seed() {
+        mkdirSync(dirname(this.location), { recursive: true, mode: 0o700 });
+        let fd;
+        try {
+            fd = openSync(this.location, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY | NO_FOLLOW, 0o600);
+        }
+        catch (err) {
+            if (!(err instanceof Error && 'code' in err && err.code === 'EEXIST'))
+                throw err;
+            try {
+                closeSync(openSync(this.location, fsConstants.O_RDONLY | NO_FOLLOW));
+            }
+            catch {
+                throw new NexusCredentialsError(`refusing to write Nexus credentials through a symlink: ${this.location}`);
+            }
+            return;
+        }
+        try {
+            writeSync(fd, `${JSON.stringify(EMPTY_STORE)}\n`);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    /**
+     * Throw when the store exists with a mode wider than 0600 or another owner.
+     * Skipped on Windows, where Node reports every file as 0o666 and uids do not
+     * apply; the file lives in the user's profile, protected by its ACL.
+     */
+    assertPrivate() {
+        if (process.platform === 'win32')
+            return;
+        let st;
+        try {
+            st = statSync(this.location);
+        }
+        catch {
+            return; // absent: created 0600 on first write
+        }
+        const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+        if ((st.mode & 0o077) !== 0 || (uid !== null && st.uid !== uid)) {
+            throw new NexusCredentialsError(`refusing to read ${this.location}: it must be owned by you with mode 0600 (it is ${(st.mode & 0o777).toString(8)}). Run: chmod 600 ${this.location}`);
+        }
+    }
+    /** Refuse to write a token through a symlink (it could point anywhere). */
+    assertNoSymlinks() {
+        for (const candidate of [this.location, ...this.backupFiles()]) {
+            let isLink = false;
+            try {
+                isLink = lstatSync(candidate).isSymbolicLink();
+            }
+            catch {
+                continue;
+            }
+            if (isLink) {
+                throw new NexusCredentialsError(`refusing to write Nexus credentials through a symlink: ${candidate}`);
+            }
+        }
+    }
+    /** Rotated backups of the store file. */
+    backupFiles() {
+        const backupDir = join(dirname(this.location), '.backups');
+        const prefix = `${basename(this.location)}.`;
+        try {
+            return readdirSync(backupDir)
+                .filter((entry) => entry.startsWith(prefix))
+                .map((entry) => join(backupDir, entry));
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Delete every rotated backup (best effort). */
+    purgeBackups() {
+        for (const file of this.backupFiles()) {
+            try {
+                unlinkSync(file);
+            }
+            catch {
+                /* best effort */
+            }
+        }
+    }
+}
+//# sourceMappingURL=nexus-credentials.js.map

package/dist/cloud/nexus-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-credentials.js","sourceRoot":"","sources":["../../src/cloud/nexus-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAGL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC;CAC9C,CAAC,CAAC;AAIH,MAAM,WAAW,GAAyB,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAEvE,+DAA+D;AAC/D,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC;AAwC9C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAC7B,yCAAyC;IAChC,MAAM,CAAS;IACxB,6BAA6B;IACpB,SAAS,CAAS;IAC3B,8BAA8B;IACrB,SAAS,CAAgB;IAClC,kCAAkC;IACzB,IAAI,CAA0B;IACvC,wCAAwC;IAC/B,YAAY,CAAkC;IACvD,uCAAuC;IAC9B,SAAS,CAAS;IAC3B,4BAA4B;IACnB,YAAY,CAAS;IACrB,MAAM,CAAS;IAExB;;;OAGG;IACH,YAAY,MAAc,EAAE,MAAqC;QAC/D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,6BAA6B;IAC7B,MAAM;QACJ,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,QAAQ;QACN,OAAO,sBAAsB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,YAAY,GAAG,CAAC;IAC1E,CAAC;IAED,uCAAuC;IACvC,CAAC,OAAO,CAAC,MAAM,CAAC;QACd,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAED,sDAAsD;AACtD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAC9B,uCAAuC;IAC9B,QAAQ,CAAS;IAE1B,0EAA0E;IAC1E,YAAY,OAAe,oBAAoB,EAAE;QAC/C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,OAA0B;QAClD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE;SACjD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAA6B;QACxD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBAC9E,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACK,IAAI;QACV,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,OAAO,WAAW,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;IAED,oDAAoD;IAC5C,KAAK,CAAC,KAAK,CACjB,SAAkE;QAElE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,CACZ,IAAI,CAAC,QAAQ,EACb,CAAC,OAAO,EAAE,EAAE;YACV,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC/D,CAAC,EACD,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,IAAI;QACV,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CACX,IAAI,CAAC,QAAQ,EACb,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,QAAQ,GAAG,SAAS,EAC3E,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC;gBAAE,MAAM,GAAG,CAAC;YACjF,IAAI,CAAC;gBACH,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,IAAI,CAAC,QAAQ,EAAE,CAC1E,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,aAAa;QACnB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO;QACzC,IAAI,EAA+B,CAAC;QACpC,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,sCAAsC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,qBAAqB,CAC7B,oBAAoB,IAAI,CAAC,QAAQ,mDAAmD,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CACtJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,gBAAgB;QACtB,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,IAAI,qBAAqB,CAC7B,0DAA0D,SAAS,EAAE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,yCAAyC;IACjC,WAAW;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,SAAS,CAAC;iBAC1B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,iDAAiD;IACzC,YAAY;QAClB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/cloud/nexus-link.d.ts

@@ -0,0 +1,85 @@
+/**
+ * `cleo project link`: register the current project with Cleo Nexus and bind
+ * the remote project to the local one.
+ *
+ * ## What is sent
+ *
+ * `POST /v1/projects` with `{ projectId, label }` only:
+ *
+ * - `projectId` is the tracked, immutable `.cleo/project-id`
+ *   (`readDeclaredProjectIdentity`), the key the server stores projects under,
+ *   so the remote id IS the local id.
+ * - `label` is the project's display name in plaintext
+ *   ({@link getProjectDisplayName}), or `--label`. It must not look like a path.
+ *
+ * No filesystem path, git remote or directory layout is ever sent.
+ *
+ * ## Idempotency
+ *
+ * Registering the same id again answers 200 (201 on first registration) and
+ * sets the server label to the one sent, so re-linking after a rename updates
+ * the label. Linking twice is safe.
+ *
+ * ## Where the binding lives
+ *
+ * `<project>/.cleo/nexus-link.json`, keyed by API origin. It is machine-local:
+ * `.cleo/.gitignore` denies everything not allow-listed, so the binding (which
+ * names an account's organization) is never committed. It is not
+ * `project-context.json`, which is tracked in git and regenerated by
+ * `cleo upgrade`, and not the project `cleo.db`, so linking never opens or
+ * migrates the task store. Each clone links itself, the same way each machine
+ * signs itself in.
+ *
+ * @task T12712
+ * @epic T12322
+ */
+import type { NexusProjectLink, NexusProjectLinkResult } from '@cleocode/contracts';
+import { type NexusFlowOptions } from './nexus-auth.js';
+/** File name of the binding, inside the project's `.cleo/` directory. */
+export declare const NEXUS_LINK_FILE = "nexus-link.json";
+/** Longest label the server accepts (`RegisterProjectRequest.label`). */
+export declare const NEXUS_LABEL_MAX = 120;
+/** Options for {@link linkProjectToNexus}. */
+export interface NexusLinkOptions extends NexusFlowOptions {
+    /** Project root; defaults to the resolved current project. */
+    projectRoot?: string;
+    /** Label to register (`--label`); defaults to {@link getProjectDisplayName}. */
+    label?: string;
+}
+/**
+ * Validate a project label: 1-120 characters; no path separator or look-alike
+ * slash, no drive letter (`C:`), no leading `~`, no control characters; and
+ * not the OS username, which would leak the account name. A label is a name,
+ * never a path.
+ *
+ * @param raw - Candidate label.
+ * @returns The trimmed label.
+ * @throws {NexusAccountError} `E_NEXUS_INVALID_LABEL`.
+ */
+export declare function validateNexusProjectLabel(raw: string): string;
+/**
+ * Path of the binding file for a project.
+ *
+ * @param projectRoot - Project root.
+ * @returns `<project>/.cleo/nexus-link.json`.
+ */
+export declare function nexusLinkPath(projectRoot: string): string;
+/**
+ * The stored binding for a project and origin, if any.
+ *
+ * @param projectRoot - Project root.
+ * @param apiUrl - API URL (any URL on the origin).
+ * @returns The binding, or `null`.
+ */
+export declare function readNexusProjectLink(projectRoot: string, apiUrl: string): NexusProjectLink | null;
+/**
+ * Register the project with Nexus (label only, never a path) and persist the
+ * binding in `.cleo/nexus-link.json`. Idempotent.
+ *
+ * @param opts - Project root, label, API URL, store and test overrides.
+ * @returns The binding and whether it already existed.
+ * @throws {NexusAccountError} Not signed in, expired session, invalid label,
+ *   not a CLEO project, or an API refusal (e.g. the id belongs to another account).
+ */
+export declare function linkProjectToNexus(opts?: NexusLinkOptions): Promise<NexusProjectLinkResult>;
+//# sourceMappingURL=nexus-link.d.ts.map

package/dist/cloud/nexus-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-link.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAOpF,OAAO,EAEL,KAAK,gBAAgB,EAGtB,MAAM,iBAAiB,CAAC;AAIzB,yEAAyE;AACzE,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD,yEAAyE;AACzE,eAAO,MAAM,eAAe,MAAM,CAAC;AAmBnC,8CAA8C;AAC9C,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmBD;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmB7D;AAmBD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAaD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAEjG;AAkBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,sBAAsB,CAAC,CAmEjC"}