@cleocode/core 2026.9.25 → 2026.10.1

package/dist/cloud/nexus-logout.js

@@ -0,0 +1,429 @@
+/**
+ * Cleo Nexus device logout: `cleo logout nexus [--revoke]` with device
+ * credentials (cleo-nexus device contract §3.5, review M3, T12844).
+ *
+ * A logout never reports success while a credential may still be live:
+ *
+ * 1. Under the lock, the live credentials move into `pendingSignOut`
+ *    (`--revoke`: `pendingRevoke`), newest first: `pending`, then `current`
+ *    ({@link applyBeginSignOut}, {@link applyBeginRevoke}). From then on they
+ *    are used for nothing but that request. The lock is released.
+ * 2. E9 (`POST /v1/devices/self/sign-out`) or E10 (`DELETE /v1/devices/self`)
+ *    is sent with each credential in turn, newest first, with one attempt and
+ *    a {@link NEXUS_REVOKE_TIMEOUT_MS} timeout.
+ * 3. Done means proved: 200, or a 401 whose reason proves the device state
+ *    (`device-signed-out`, `device-revoked`, or `credential-revoked` with
+ *    `revokedReason` `signed-out` / `revoked`). A revoke needs proof of a
+ *    revoke; a signed-out device is not a revoked one. Any other 401 means
+ *    that credential is dead, so the next one is tried. A network error,
+ *    timeout, 429, 5xx or a route the server does not have yet stops the run:
+ *    the slot is kept and every remaining request is left for the next run
+ *    without another call.
+ * 4. The lock is re-taken and the slot is changed only if it still holds the
+ *    credential that was answered (compare-and-swap):
+ *    - a sign-out (confirmed, or every credential dead) clears
+ *      `pendingSignOut` and keeps the device keys for the next login;
+ *    - a revoke that ended (confirmed, found the device signed out, or every
+ *      credential dead) forgets the device locally ({@link applyForgetDevice}),
+ *      so no later login re-activates the id the user asked to burn. The
+ *      entry is deleted, or kept stripped while `retired` requests of other
+ *      devices remain; the store keeps the file while other entries remain.
+ *    Only a confirmed request is reported `confirmed`; the others name the
+ *    web remedy.
+ *
+ * Unsettled slots, and the `retired` requests of replaced devices, are
+ * retried by every later logout and, best effort with a shorter timeout, by
+ * `cleo login nexus` and `cleo project link` ({@link retryNexusDeviceEnds}).
+ * Retired requests are sent before the entry's own request.
+ *
+ * No function here logs, and no result or error carries a token.
+ *
+ * @task T12870
+ * @epic T12323
+ */
+import { z } from 'zod';
+import { Http, NexusError } from './http.js';
+import { logoutFromNexus, NEXUS_REVOKE_TIMEOUT_MS, resolveNexusApiUrl } from './nexus-auth.js';
+import { FileNexusTokenStore, nexusOriginKey } from './nexus-credentials.js';
+import { applyBeginRevoke, applyBeginSignOut, applyForgetDevice, applyRetiredSettled, applySignOutConfirmed, isForgottenDevice, NexusDeviceStore, UnreadableNexusDevice, } from './nexus-device.js';
+/**
+ * Timeout of each E9/E10 call when a login or a link only retries on the way
+ * ({@link retryNexusDeviceEnds}); an explicit logout uses {@link NEXUS_REVOKE_TIMEOUT_MS}.
+ */
+export const NEXUS_END_RETRY_TIMEOUT_MS = 2_000;
+function context(opts) {
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    return {
+        apiUrl,
+        origin: nexusOriginKey(apiUrl),
+        fetch: opts.fetch ?? ((input, init) => globalThis.fetch(input, init)),
+        devices: opts.deviceStore ?? new NexusDeviceStore(),
+        now: opts.now ?? (() => new Date()),
+        timeoutMs: opts.timeoutMs ?? NEXUS_REVOKE_TIMEOUT_MS,
+    };
+}
+/** E9 answers `{ deviceId, state }`; E10 answers `{ revoked }`. Only the status matters. */
+const endAnswerSchema = z.looseObject({});
+/**
+ * What a 401 proves about the device (§4.0.4): `revoked`, `signed-out`, or
+ * nothing (`null`: only this credential is dead).
+ */
+function provenState(details) {
+    const reason = details?.['reason'];
+    const revokedReason = details?.['revokedReason'];
+    if (reason === 'device-revoked')
+        return 'revoked';
+    if (reason === 'device-signed-out')
+        return 'signed-out';
+    if (reason === 'credential-revoked' && revokedReason === 'revoked')
+        return 'revoked';
+    if (reason === 'credential-revoked' && revokedReason === 'signed-out')
+        return 'signed-out';
+    return null;
+}
+/**
+ * Send E9 or E10 with one credential: one attempt, a plain timeout, no lock held.
+ *
+ * @returns `done` for 200 or a 401 that proves the requested state,
+ *   `signed-out` for a revoke that proves only a sign-out, `stale` for any
+ *   other 401, `unanswered` for everything else, with the reason in `detail`.
+ */
+async function callEnd(ctx, action, token) {
+    const timed = (input, init) => ctx.fetch(input, { ...init, signal: AbortSignal.timeout(ctx.timeoutMs) });
+    const http = new Http({ baseUrl: ctx.apiUrl, token, fetch: timed, maxAttempts: 1 });
+    try {
+        if (action === 'sign-out') {
+            await http.request('POST', '/v1/devices/self/sign-out', endAnswerSchema, {});
+        }
+        else {
+            await http.request('DELETE', '/v1/devices/self', endAnswerSchema);
+        }
+        return { answer: 'done', detail: 'HTTP 200' };
+    }
+    catch (err) {
+        if (!(err instanceof NexusError)) {
+            return {
+                answer: 'unanswered',
+                detail: err instanceof Error ? err.message : String(err),
+                transport: true,
+            };
+        }
+        if (err.status === 401) {
+            const reason = err.details?.['reason'];
+            const detail = `HTTP 401 ${typeof reason === 'string' ? reason : err.code}`;
+            const state = provenState(err.details);
+            if (state === 'revoked' || (state === 'signed-out' && action === 'sign-out')) {
+                return { answer: 'done', detail };
+            }
+            if (state === 'signed-out')
+                return { answer: 'signed-out', detail };
+            // Only the Nexus API's own verdict on this credential counts as dead. A
+            // 401 without its envelope (a proxy or SSO gateway) or with reason
+            // `missing` (an Authorization header stripped on the way) proves
+            // nothing about the credential, so it is treated as no answer.
+            const dead = err.code === 'E_UNAUTHENTICATED' &&
+                (reason === 'invalid' ||
+                    reason === 'credential-expired' ||
+                    reason === 'credential-revoked');
+            return { answer: dead ? 'stale' : 'unanswered', detail };
+        }
+        return {
+            answer: 'unanswered',
+            detail: err.code === 'E_NETWORK' ? 'no answer' : `HTTP ${err.status} ${err.code}`,
+            transport: err.code === 'E_NETWORK',
+        };
+    }
+}
+/** Every unsettled request of one entry: its `retired` items first, then its own slot. */
+function requestsOf(userId, entry) {
+    const out = [];
+    for (const r of entry.retired ?? []) {
+        out.push({
+            userId,
+            deviceId: r.deviceId,
+            action: r.kind,
+            retired: true,
+            credentials: r.credentials,
+        });
+    }
+    const own = entry.pendingRevoke ?? entry.pendingSignOut;
+    if (own) {
+        out.push({
+            userId,
+            deviceId: entry.deviceId,
+            action: entry.pendingRevoke ? 'revoke' : 'sign-out',
+            retired: false,
+            credentials: own.credentials,
+        });
+    }
+    return out;
+}
+/** The credentials a request's slot holds now, or `null` when the slot is gone. */
+function slotNow(entry, req) {
+    if (entry === null)
+        return null;
+    if (req.retired) {
+        const item = (entry.retired ?? []).find((r) => r.deviceId === req.deviceId && r.kind === req.action);
+        return item ? item.credentials : null;
+    }
+    if (entry.deviceId !== req.deviceId)
+        return null;
+    const slot = req.action === 'revoke' ? entry.pendingRevoke : entry.pendingSignOut;
+    return slot ? slot.credentials : null;
+}
+/**
+ * End a request under the lock, only if its slot still holds `token` (CAS):
+ * clear a sign-out slot, settle a retired item, or forget the device after a
+ * revoke. An entry left with nothing to keep is deleted.
+ */
+async function settleEnded(ctx, req, token) {
+    return ctx.devices.update((tx) => {
+        const entry = tx.get(ctx.apiUrl, req.userId);
+        const creds = slotNow(entry, req);
+        if (entry === null || creds === null || !creds.some((c) => c.token === token)) {
+            return { applied: false, removed: false };
+        }
+        const next = req.retired
+            ? applyRetiredSettled(entry, req.deviceId, req.action)
+            : req.action === 'sign-out'
+                ? applySignOutConfirmed(entry)
+                : applyForgetDevice(entry);
+        if (isForgottenDevice(next)) {
+            const removed = tx.delete(ctx.apiUrl, req.userId, {
+                deviceId: entry.deviceId,
+                credentialId: entry.current?.credentialId ?? null,
+            });
+            return { applied: true, removed };
+        }
+        tx.set(ctx.apiUrl, req.userId, next);
+        return { applied: true, removed: false };
+    });
+}
+/** Try each credential of one request, newest first, and end it when it can be ended. */
+async function settleRequest(ctx, req, warnings) {
+    const row = (outcome, removedLocally = false) => ({
+        userId: req.userId,
+        deviceId: req.deviceId,
+        action: req.action,
+        retired: req.retired,
+        outcome,
+        removedLocally,
+    });
+    const what = `${req.action === 'revoke' ? 'revoke' : 'sign-out'} of device ${req.deviceId}`;
+    const web = req.action === 'revoke'
+        ? `revoke device ${req.deviceId} on cleocode.dev (Devices)`
+        : `sign out or revoke device ${req.deviceId} on cleocode.dev (Devices)`;
+    const end = async (token, outcome, note) => {
+        const settled = await settleEnded(ctx, req, token);
+        if (!settled.applied) {
+            warnings.push(`${what}: the local entry changed while the request was in flight (a login or another logout?); this machine may hold a newer credential. Run \`cleo logout nexus${req.action === 'revoke' ? ' --revoke' : ''}\` again`);
+        }
+        else if (note !== null) {
+            warnings.push(note);
+        }
+        return row(outcome, settled.removed);
+    };
+    for (const c of req.credentials) {
+        const { answer, detail, transport } = await callEnd(ctx, req.action, c.token);
+        if (answer === 'done')
+            return { row: await end(c.token, 'confirmed', null), unreachable: false };
+        if (answer === 'signed-out') {
+            const signedOut = await end(c.token, 'signed-out', `device ${req.deviceId} is signed out but not revoked, and a signed-out device's credentials cannot revoke it; this machine forgot the device, so the next login enrols a new one. To burn the old id, ${web}`);
+            return { row: signedOut, unreachable: false };
+        }
+        if (answer === 'unanswered') {
+            warnings.push(`${what} not confirmed (${detail}); it was kept and is retried by the next \`cleo logout nexus\`, \`cleo login nexus\` or \`cleo project link\``);
+            return { row: row('pending'), unreachable: transport === true };
+        }
+    }
+    // Every credential is dead: retrying can never succeed, so the request ends here.
+    const first = req.credentials[0];
+    if (first === undefined)
+        return { row: row('unconfirmed'), unreachable: false };
+    const ended = await end(first.token, 'unconfirmed', `${what} not confirmed: the server refused every credential this machine held for it as no longer valid, so none is live and none was kept${req.action === 'revoke' && !req.retired ? '; this machine forgot the device' : ''}. To make sure, ${web}`);
+    return { row: ended, unreachable: false };
+}
+/** Every unsettled request on the origin, plus a warning per entry this machine cannot open. */
+async function unsettled(ctx, warnings, warnUnreadable) {
+    const out = [];
+    for (const d of await ctx.devices.list()) {
+        if (d.origin !== ctx.origin)
+            continue;
+        if (d instanceof UnreadableNexusDevice) {
+            if (!warnUnreadable)
+                continue;
+            warnings.push(`the device entry for user ${d.userId}${d.deviceId ? ` (device ${d.deviceId})` : ''} cannot be opened on this machine (${d.reason}); sign it out or revoke it on cleocode.dev`);
+            continue;
+        }
+        out.push(...requestsOf(d.userId, d.unseal()));
+    }
+    return out;
+}
+/** Sort rows by user, then device, for a stable envelope. */
+function byUserThenDevice(a, b) {
+    return a.userId.localeCompare(b.userId) || a.deviceId.localeCompare(b.deviceId);
+}
+/**
+ * Retry every unsettled sign-out and revoke on the origin (contract §3.5,
+ * L2): each entry's `pendingSignOut` or `pendingRevoke`, and the `retired`
+ * requests of devices it replaced. Never throws for a server that cannot be
+ * reached; the rows and warnings say what is still open.
+ *
+ * @param opts - API URL, stores and test overrides.
+ * @returns One row per request tried, and the warnings.
+ */
+export async function settleNexusDeviceEnds(opts = {}) {
+    const ctx = context(opts);
+    const warnings = [];
+    const devices = [];
+    let unreachable = false;
+    let skipped = 0;
+    for (const req of await unsettled(ctx, warnings, opts.warnUnreadable ?? true)) {
+        if (unreachable) {
+            skipped += 1;
+            // The server already failed to answer in this run: leave the rest for
+            // the next run rather than wait out one timeout per request.
+            devices.push({
+                userId: req.userId,
+                deviceId: req.deviceId,
+                action: req.action,
+                retired: req.retired,
+                outcome: 'pending',
+                removedLocally: false,
+            });
+            continue;
+        }
+        try {
+            const r = await settleRequest(ctx, req, warnings);
+            // Only a transport failure (no answer at all) stops the run: an HTTP
+            // error on one request (a 404, 5xx or 429 for an old device) never
+            // keeps the entry's own sign-out or revoke from being sent.
+            if (r.unreachable)
+                unreachable = true;
+            devices.push(r.row);
+        }
+        catch (err) {
+            // A store failure on one request keeps every row collected so far.
+            warnings.push(`${req.action} of device ${req.deviceId} could not be settled locally (${err instanceof Error ? err.message : String(err)}); it is retried next time`);
+            devices.push({
+                userId: req.userId,
+                deviceId: req.deviceId,
+                action: req.action,
+                retired: req.retired,
+                outcome: 'pending',
+                removedLocally: false,
+            });
+        }
+    }
+    if (skipped > 0) {
+        warnings.push(`${skipped} more unsettled sign-out or revoke request(s) were not sent because Cleo Nexus did not answer; they are retried next time`);
+    }
+    return { devices: devices.sort(byUserThenDevice), warnings };
+}
+/**
+ * Best-effort {@link settleNexusDeviceEnds} for flows that only retry on the
+ * way (login, commands that need a credential): a store or network failure
+ * becomes a warning and never fails the caller.
+ *
+ * @param opts - API URL, stores and test overrides.
+ * @param warnings - Receives the warnings.
+ */
+export async function retryNexusDeviceEnds(opts, warnings) {
+    try {
+        const settled = await settleNexusDeviceEnds({
+            timeoutMs: NEXUS_END_RETRY_TIMEOUT_MS,
+            ...opts,
+            warnUnreadable: false,
+        });
+        warnings.push(...settled.warnings);
+    }
+    catch (err) {
+        warnings.push(`could not retry an unsettled Cleo Nexus sign-out (${err instanceof Error ? err.message : String(err)}); \`cleo logout nexus\` retries it`);
+    }
+}
+/**
+ * Under the lock, move every readable entry on the origin into its
+ * sign-out or revoke slot. A revoke of an entry with no credential left
+ * (already signed out) cannot be sent, so the device is forgotten locally
+ * and the web remedy is returned.
+ *
+ * @returns Warnings for the result envelope.
+ */
+async function beginEnds(ctx, action) {
+    const begin = action === 'revoke' ? applyBeginRevoke : applyBeginSignOut;
+    return ctx.devices.update((tx) => {
+        const notes = [];
+        for (const k of tx.keys()) {
+            if (k.origin !== ctx.origin || !k.readable)
+                continue;
+            const entry = tx.get(ctx.apiUrl, k.userId);
+            if (entry === null)
+                continue;
+            const next = begin(entry, ctx.now());
+            if (action === 'revoke' && next.pendingRevoke === null && next.keys !== null) {
+                const forgotten = applyForgetDevice(next);
+                if (isForgottenDevice(forgotten)) {
+                    tx.delete(ctx.apiUrl, k.userId, { deviceId: entry.deviceId, credentialId: null });
+                }
+                else {
+                    tx.set(ctx.apiUrl, k.userId, forgotten);
+                }
+                notes.push(`device ${next.deviceId} holds no credential (it is signed out), so it cannot be revoked from here; this machine forgot it, so the next login enrols a new device. To burn the old id, revoke device ${next.deviceId} on cleocode.dev (Devices)`);
+                continue;
+            }
+            tx.set(ctx.apiUrl, k.userId, next);
+        }
+        return [...tx.warnings, ...notes];
+    });
+}
+/**
+ * `cleo logout nexus [--revoke]` with device credentials (contract §3.5, M3).
+ *
+ * Every readable entry on the origin is moved to `pendingSignOut` (or
+ * `pendingRevoke`), then every unsettled request on the origin is sent,
+ * including ones left by earlier runs. A leftover 9.24 session for the origin
+ * is signed out too. The device keys stay after a sign-out, so a later login
+ * reuses the device id; a confirmed revoke removes the entry.
+ *
+ * @param opts - API URL, `revoke`, stores and test overrides.
+ * @returns The per-device outcomes. A row that is not `confirmed` is also
+ *   named in `warnings`; the result never claims a sign-out the server did
+ *   not confirm.
+ * A device file that cannot be read or locked is reported as a warning, and
+ * the 9.24 session is still signed out.
+ */
+export async function logoutNexusDevice(opts = {}) {
+    const ctx = context(opts);
+    const action = opts.revoke === true ? 'revoke' : 'sign-out';
+    const warnings = [];
+    let devices = [];
+    try {
+        warnings.push(...(await beginEnds(ctx, action)));
+        const settled = await settleNexusDeviceEnds({
+            ...opts,
+            apiUrl: ctx.apiUrl,
+            deviceStore: ctx.devices,
+        });
+        devices = settled.devices;
+        warnings.push(...settled.warnings);
+    }
+    catch (err) {
+        // A broken device file must not stop the 9.24 session sign-out below.
+        warnings.push(`the device credentials could not be signed out (${err instanceof Error ? err.message : String(err)}); fix the device file and run \`cleo logout nexus\` again`);
+    }
+    let session = null;
+    const sessions = opts.store ?? new FileNexusTokenStore();
+    if ((await sessions.get(ctx.apiUrl)) !== null) {
+        session = await logoutFromNexus({
+            apiUrl: ctx.apiUrl,
+            store: sessions,
+            ...(opts.fetch ? { fetch: opts.fetch } : {}),
+        });
+        warnings.push(...session.warnings);
+    }
+    if (action === 'revoke' && devices.length === 0 && session !== null) {
+        warnings.push(`no device credential is stored for ${ctx.apiUrl}, so nothing was revoked; the 9.24 session was signed out`);
+    }
+    return { apiUrl: ctx.apiUrl, action, devices, session, warnings };
+}
+//# sourceMappingURL=nexus-logout.js.map

package/dist/cloud/nexus-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-logout.js","sourceRoot":"","sources":["../../src/cloud/nexus-logout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAQH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAwB,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACnG,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EAGjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAkDhD,SAAS,OAAO,CAAC,IAA8B;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM;QACN,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3F,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,gBAAgB,EAAE;QACnD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,uBAAuB;KACrD,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAE1C;;;GAGG;AACH,SAAS,WAAW,CAClB,OAA4C;IAE5C,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,MAAM,KAAK,mBAAmB;QAAE,OAAO,YAAY,CAAC;IACxD,IAAI,MAAM,KAAK,oBAAoB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrF,IAAI,MAAM,KAAK,oBAAoB,IAAI,aAAa,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,OAAO,CACpB,GAAQ,EACR,MAA4B,EAC5B,KAAa;IAEb,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,YAAY,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,KAAK,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACpE,wEAAwE;YACxE,mEAAmE;YACnE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,mBAAmB;gBAChC,CAAC,MAAM,KAAK,SAAS;oBACnB,MAAM,KAAK,oBAAoB;oBAC/B,MAAM,KAAK,oBAAoB,CAAC,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE;YACjF,SAAS,EAAE,GAAG,CAAC,IAAI,KAAK,WAAW;SACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,MAAc,EAAE,KAAuB;IACzD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,IAAI;YACd,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,cAAc,CAAC;IACxD,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;YACnD,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CACd,KAA8B,EAC9B,GAAe;IAEf,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAC5D,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAClF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAUD;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,GAAQ,EAAE,GAAe,EAAE,KAAa;IACjE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO;YACtB,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU;gBACzB,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;gBAC9B,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;aAClD,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,aAAa,CAC1B,GAAQ,EACR,GAAe,EACf,QAAkB;IAElB,MAAM,GAAG,GAAG,CAAC,OAA8B,EAAE,cAAc,GAAG,KAAK,EAAwB,EAAE,CAAC,CAAC;QAC7F,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO;QACP,cAAc;KACf,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,cAAc,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5F,MAAM,GAAG,GACP,GAAG,CAAC,MAAM,KAAK,QAAQ;QACrB,CAAC,CAAC,iBAAiB,GAAG,CAAC,QAAQ,4BAA4B;QAC3D,CAAC,CAAC,6BAA6B,GAAG,CAAC,QAAQ,4BAA4B,CAAC;IAC5E,MAAM,GAAG,GAAG,KAAK,EAAE,KAAa,EAAE,OAA8B,EAAE,IAAmB,EAAE,EAAE;QACvF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,4JAA4J,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,CACxN,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,MAAM,KAAK,MAAM;YACnB,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAC5E,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,GAAG,CACzB,CAAC,CAAC,KAAK,EACP,YAAY,EACZ,UAAU,GAAG,CAAC,QAAQ,mLAAmL,GAAG,EAAE,CAC/M,CAAC;YACF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,mBAAmB,MAAM,gHAAgH,CACjJ,CAAC;YACF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,kFAAkF;IAClF,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,GAAG,CACrB,KAAK,CAAC,KAAK,EACX,aAAa,EACb,GAAG,IAAI,qIAAqI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,mBAAmB,GAAG,EAAE,CACtP,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,QAAkB,EAClB,cAAuB;IAEvB,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,SAAS;QACtC,IAAI,CAAC,YAAY,qBAAqB,EAAE,CAAC;YACvC,IAAI,CAAC,cAAc;gBAAE,SAAS;YAC9B,QAAQ,CAAC,IAAI,CACX,6BAA6B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC,MAAM,6CAA6C,CAC/K,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;IACxE,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,CAAC;YACb,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,SAAS;gBAClB,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClD,qEAAqE;YACrE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,CAAC,CAAC,WAAW;gBAAE,WAAW,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,QAAQ,CAAC,IAAI,CACX,GAAG,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CACtJ,CAAC;YACF,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,SAAS;gBAClB,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,2HAA2H,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B,EAC9B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;YAC1C,SAAS,EAAE,0BAA0B;YACrC,GAAG,IAAI;YACP,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,qDAAqD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAC3I,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,MAA6B;IAC9D,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACzE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,SAAS;YACrD,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7E,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;oBACjC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBACD,KAAK,CAAC,IAAI,CACR,UAAU,IAAI,CAAC,QAAQ,gLAAgL,IAAI,CAAC,QAAQ,4BAA4B,CACjP,CAAC;gBACF,SAAS;YACX,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;YAC1C,GAAG,IAAI;YACP,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,QAAQ,CAAC,IAAI,CACX,mDAAmD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4DAA4D,CAChK,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAA6B,IAAI,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACzD,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,GAAG,MAAM,eAAe,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,QAAQ;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CACX,sCAAsC,GAAG,CAAC,MAAM,2DAA2D,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC"}

package/dist/cloud/signing.d.ts

@@ -102,4 +102,24 @@ export declare function deviceGrantMessage(parts: {
     certificateHex: string;
     signerDeviceId: string;
 }): Uint8Array;
+/**
+ * The bytes a device signs (Ed25519, with its signing key) to enrol through E1
+ * (cleo-nexus device contract §2.4, §4.1): the proof of possession of the
+ * signing private key. It binds the user, the device, both public keys and the
+ * profile, so a proof cannot be moved to another account, device or profile.
+ * Mirrors cleo-nexus `packages/shared/src/signing.ts`.
+ *
+ * @param parts - The enrolment fields; public keys as lowercase hex of the raw 32 bytes.
+ * @returns `cleo-nexus/device-enroll/v1\nuserId\ndeviceId\nencHex\nsigHex\nprofile` as UTF-8.
+ * @task T12868
+ */
+export declare function deviceEnrollmentMessage(parts: {
+    userId: string;
+    deviceId: string;
+    /** Hex of the raw 32-byte X25519 public key. */
+    encryptionPublicKeyHex: string;
+    /** Hex of the raw 32-byte Ed25519 public key. */
+    signingPublicKeyHex: string;
+    profile: 'device' | 'read-only';
+}): Uint8Array;
 //# sourceMappingURL=signing.d.ts.map

package/dist/cloud/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/cloud/signing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAenC,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAQjE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,UAAU,CAUb;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAYrD;AASD,2GAA2G;AAC3G,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAIzD;AAED,+FAA+F;AAC/F,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAKjE;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAElF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,sBAAsB,GAC5B,UAAU,CAMZ;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,0BAA0B,EAAE,MAAM,CAAC;IACnC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,UAAU,CASb;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iDAAiD;IACjD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CASb;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+BAA+B,EAAE,MAAM,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,UAAU,CAYb"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/cloud/signing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAenC,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB;AAYD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAQjE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,UAAU,CAUb;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAYrD;AASD,2GAA2G;AAC3G,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAIzD;AAED,+FAA+F;AAC/F,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAKjE;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAElF;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,sBAAsB,GAC5B,UAAU,CAMZ;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,0BAA0B,EAAE,MAAM,CAAC;IACnC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,UAAU,CASb;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iDAAiD;IACjD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CASb;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+BAA+B,EAAE,MAAM,CAAC;IACxC,4BAA4B,EAAE,MAAM,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,UAAU,CAYb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iDAAiD;IACjD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,OAAO,EAAE,QAAQ,GAAG,WAAW,CAAC;CACjC,GAAG,UAAU,CASb"}

package/dist/cloud/signing.js

@@ -114,4 +114,18 @@ export function deviceCertificateMessage(parts) {
 export function deviceGrantMessage(parts) {
     return lines('cleo-nexus/device-grant/v1', parts.userId, parts.recipientDeviceId, parts.recipientEncryptionPublicKeyHex, parts.recipientSigningPublicKeyHex, parts.keyVersion, parts.sealedMasterKeyHash, parts.certificateHex, parts.signerDeviceId);
 }
+/**
+ * The bytes a device signs (Ed25519, with its signing key) to enrol through E1
+ * (cleo-nexus device contract §2.4, §4.1): the proof of possession of the
+ * signing private key. It binds the user, the device, both public keys and the
+ * profile, so a proof cannot be moved to another account, device or profile.
+ * Mirrors cleo-nexus `packages/shared/src/signing.ts`.
+ *
+ * @param parts - The enrolment fields; public keys as lowercase hex of the raw 32 bytes.
+ * @returns `cleo-nexus/device-enroll/v1\nuserId\ndeviceId\nencHex\nsigHex\nprofile` as UTF-8.
+ * @task T12868
+ */
+export function deviceEnrollmentMessage(parts) {
+    return lines('cleo-nexus/device-enroll/v1', parts.userId, parts.deviceId, parts.encryptionPublicKeyHex, parts.signingPublicKeyHex, parts.profile);
+}
 //# sourceMappingURL=signing.js.map

package/dist/cloud/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/cloud/signing.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AAEH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,KAA0B,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAW9E,MAAM,YAAY,GAAG,CAAC,MAAmB,EAAE,EAAE,CAC3C,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;KAChB,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACT,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClD,OAAO,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC,CACL,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAoB;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,aAAa,EAAE,CAAC,CAAC,aAAa;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,OAAO,KAAK,CACV,uBAAuB,EACvB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,CAAW;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;aAClB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC/C,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CACL;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,YAAY,GAAG,CAAO,CAAoB,EAAE,CAAc,EAAE,EAAE,CAClE,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;KACX,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC,CAAC,CAAC,CACjC,CAAC;AAEJ,2GAA2G;AAC3G,MAAM,UAAU,iBAAiB,CAAC,CAAe;IAC/C,OAAO,IAAI,CAAC,SAAS,CACnB,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CAAC,CAAiB;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClD,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAiBD,MAAM,gBAAgB,GAAG,CAAC,CAAyB,EAAE,EAAE,CAAC;IACtD,CAAC,CAAC,QAAQ;IACV,CAAC,CAAC,YAAY;IACd,CAAC,CAAC,kBAAkB,IAAI,GAAG;IAC3B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,QAAQ;IACV,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;IACd,CAAC,CAAC,YAAY;IACd,CAAC,CAAC,UAAU;IACZ,CAAC,CAAC,SAAS;CACZ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA6B;IACpE,OAAO,KAAK,CAAC,0BAA0B,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,gBAAwB,EACxB,KAA6B;IAE7B,OAAO,KAAK,CACV,sCAAsC,EACtC,gBAAgB,EAChB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAQvC;IACC,OAAO,KAAK,CACV,iCAAiC,EACjC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,0BAA0B,EAChC,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAQxC;IACC,OAAO,KAAK,CACV,2BAA2B,EAC3B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAWlC;IACC,OAAO,KAAK,CACV,4BAA4B,EAC5B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,4BAA4B,EAClC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,cAAc,CACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/cloud/signing.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AAEH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,KAA0B,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAW9E,MAAM,YAAY,GAAG,CAAC,MAAmB,EAAE,EAAE,CAC3C,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;KAChB,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACT,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAClD,OAAO,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC,CACL,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAoB;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,aAAa,EAAE,CAAC,CAAC,aAAa;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAOrC;IACC,OAAO,KAAK,CACV,uBAAuB,EACvB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,QAAQ,CACf,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,CAAW;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,MAAM,EAAE,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;aAClB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC/C,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CACL;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,YAAY,GAAG,CAAO,CAAoB,EAAE,CAAc,EAAE,EAAE,CAClE,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;KACX,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC,CAAC,CAAC,CACjC,CAAC;AAEJ,2GAA2G;AAC3G,MAAM,UAAU,iBAAiB,CAAC,CAAe;IAC/C,OAAO,IAAI,CAAC,SAAS,CACnB,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CACrF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,uBAAuB,CAAC,CAAiB;IACvD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAClD,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAiBD,MAAM,gBAAgB,GAAG,CAAC,CAAyB,EAAE,EAAE,CAAC;IACtD,CAAC,CAAC,QAAQ;IACV,CAAC,CAAC,YAAY;IACd,CAAC,CAAC,kBAAkB,IAAI,GAAG;IAC3B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,QAAQ;IACV,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,YAAY;IACd,CAAC,CAAC,YAAY;IACd,CAAC,CAAC,UAAU;IACZ,CAAC,CAAC,SAAS;CACZ,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA6B;IACpE,OAAO,KAAK,CAAC,0BAA0B,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,gBAAwB,EACxB,KAA6B;IAE7B,OAAO,KAAK,CACV,sCAAsC,EACtC,gBAAgB,EAChB,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAQvC;IACC,OAAO,KAAK,CACV,iCAAiC,EACjC,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,0BAA0B,EAChC,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAQxC;IACC,OAAO,KAAK,CACV,2BAA2B,EAC3B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,UAAU,CACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAWlC;IACC,OAAO,KAAK,CACV,4BAA4B,EAC5B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,+BAA+B,EACrC,KAAK,CAAC,4BAA4B,EAClC,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,cAAc,CACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAQvC;IACC,OAAO,KAAK,CACV,6BAA6B,EAC7B,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,sBAAsB,EAC5B,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,OAAO,CACd,CAAC;AACJ,CAAC"}

package/dist/crypto/credentials.d.ts

@@ -147,6 +147,67 @@ export declare function encryptProjectSecret(plaintext: string, projectId: strin
  * @task T12326
  */
 export declare function decryptProjectSecret(ciphertext: string, context: ProjectSecretContext): Promise<ProjectSecretReadResult>;
+/**
+ * The machine key and global salt of one CLEO home: the inputs of the global
+ * KDF. Held only in memory, only as long as one operation needs it.
+ *
+ * @task T12867
+ */
+export interface GlobalKeyMaterial {
+    /** The 32-byte `machine-key`. */
+    readonly machineKey: Buffer;
+    /** The 32-byte `global-salt`. */
+    readonly globalSalt: Buffer;
+}
+/**
+ * Load the global KDF inputs of a CLEO home.
+ *
+ * With `create: false` nothing is ever written: a missing `machine-key` or
+ * `global-salt` returns `null`, so a read path never mints key material
+ * (T12867 review N1). With `create: true` both are created on first use,
+ * exclusively (N2).
+ *
+ * @param options - The CLEO home, and whether missing material may be created.
+ * @returns The material, or `null` when it is missing and `create` is false.
+ * @throws {Error} When a key file exists but is unsafe (permissions, length) or unreadable.
+ * @task T12867
+ */
+export declare function loadGlobalKeyMaterial(options: CredentialKeyOptions & {
+    readonly create: boolean;
+}): Promise<GlobalKeyMaterial | null>;
+/**
+ * Derive the global KDF key for `id`: `HMAC-SHA256(machine-key || global-salt, id)`
+ * (ADR-037 §5), the same key {@link encryptGlobal} uses.
+ *
+ * @param material - The home's key material.
+ * @param id - The identity binding the ciphertext.
+ * @returns A 32-byte AES-256 key.
+ * @task T12867
+ */
+export declare function deriveGlobalKeyFromMaterial(material: GlobalKeyMaterial, id: string): Buffer;
+/**
+ * Encrypt with an already-derived global key, binding `associatedData`
+ * (authenticated, not encrypted) into the GCM tag. Same framing as
+ * {@link encryptGlobal}.
+ *
+ * @param plaintext - The secret.
+ * @param key - From {@link deriveGlobalKeyFromMaterial}.
+ * @param associatedData - Context the ciphertext is bound to (for example a field path).
+ * @returns Base64 ciphertext.
+ * @task T12867
+ */
+export declare function sealWithGlobalKey(plaintext: string, key: Buffer, associatedData: string): string;
+/**
+ * Decrypt a {@link sealWithGlobalKey} ciphertext.
+ *
+ * @param ciphertext - Base64 ciphertext.
+ * @param key - From {@link deriveGlobalKeyFromMaterial}.
+ * @param associatedData - The same context it was sealed with.
+ * @returns The plaintext, or `null` when the ciphertext is malformed, of an
+ *   unknown version, or fails authentication (wrong key, id or context).
+ * @task T12867
+ */
+export declare function openWithGlobalKey(ciphertext: string, key: Buffer, associatedData: string): string | null;
 /**
  * Encrypt a plaintext string using AES-256-GCM with a global, machine-bound key.
  *

package/dist/crypto/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/crypto/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAqBH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,CAE1E;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAuID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,IAAO,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,qCAAqC,IAAO,CAAC;AAK1D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,aAAa,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AA2BD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAqDlC;AAyCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAiBjB"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/crypto/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA2BH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,CAE1E;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAuKD;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,IAAO,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,qCAAqC,IAAO,CAAC;AAK1D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,aAAa,CAAC;AAEhE;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,4BAA4B;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AA2BD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAqDlC;AAuCD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC3D,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAUnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAI3F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GACrB,MAAM,GAAG,IAAI,CASf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,aAAa,CACjC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAiBjB"}