@cleocode/core 2026.9.25 → 2026.10.1

package/dist/cloud/nexus-auth.js

@@ -28,6 +28,7 @@ import { NEXUS_CLI_CLIENT_ID, NEXUS_DEFAULT_API_URL, nexusAccountMeSchema, } fro
 import { DeviceCodeAuthError, DeviceCodeTimeoutError, pollForToken, startDeviceCodeFlow, } from '../llm/oauth/device-code.js';
 import { Http, isSecureUrl, NexusError } from './http.js';
 import { FileNexusTokenStore, } from './nexus-credentials.js';
+import { NexusDeviceStore, SealedNexusDevice } from './nexus-device.js';
 /** Environment override for the default API origin (e.g. staging). */
 export const NEXUS_API_URL_ENV = 'CLEO_NEXUS_API_URL';
 /** Default time budget for the server-side revocation at logout. */
@@ -185,7 +186,52 @@ function toLoginError(err) {
 export async function loginToNexus(opts = {}) {
     const apiUrl = resolveNexusApiUrl(opts.apiUrl);
     const store = opts.store ?? new FileNexusTokenStore();
-    const cfg = nexusDeviceCodeConfig(apiUrl, opts.fetch);
+    const token = await runNexusDeviceCode(apiUrl, opts);
+    const warnings = [];
+    let me = null;
+    try {
+        me = await fetchAccountMe(apiUrl, token.accessToken, opts.fetch ? { fetch: opts.fetch } : {});
+    }
+    catch (err) {
+        warnings.push(`signed in, but the account lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const organization = me ? primaryNexusOrganization(me) : null;
+    const expiresAt = typeof token.expiresIn === 'number'
+        ? new Date(Date.now() + token.expiresIn * 1000).toISOString()
+        : null;
+    await store.put(apiUrl, {
+        token: token.accessToken,
+        tokenType: token.tokenType,
+        expiresAt,
+        user: me?.user ?? null,
+        organization,
+    });
+    return {
+        apiUrl,
+        user: me?.user ?? null,
+        organization,
+        expiresAt,
+        credentialsPath: store.location,
+        warnings,
+    };
+}
+/**
+ * The device-code grant against a Nexus origin (contract §3.3 steps 1 to 3):
+ * start, validate and show the verification URL, then poll until the user
+ * approves. The session token it returns is held in memory only; the caller
+ * decides whether to store it (9.24 behaviour) or enrol a device with it.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param opts - UI hooks and test overrides.
+ * @param scope - Optional OAuth `scope` for `/device/code` (`cleo:device` or `cleo:read-only`).
+ * @returns The token response (the session token is its only secret).
+ * @throws {NexusAccountError} On a start, poll, denial or expiry failure.
+ */
+export async function runNexusDeviceCode(apiUrl, opts, scope) {
+    const cfg = {
+        ...nexusDeviceCodeConfig(apiUrl, opts.fetch),
+        ...(scope !== undefined ? { scope } : {}),
+    };
     let start;
     try {
         start = await startDeviceCodeFlow(cfg);
@@ -215,33 +261,7 @@ export async function loginToNexus(opts = {}) {
     catch (err) {
         throw toLoginError(err);
     }
-    const warnings = [];
-    let me = null;
-    try {
-        me = await fetchAccountMe(apiUrl, token.accessToken, opts.fetch ? { fetch: opts.fetch } : {});
-    }
-    catch (err) {
-        warnings.push(`signed in, but the account lookup failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    const organization = me ? primaryNexusOrganization(me) : null;
-    const expiresAt = typeof token.expiresIn === 'number'
-        ? new Date(Date.now() + token.expiresIn * 1000).toISOString()
-        : null;
-    await store.put(apiUrl, {
-        token: token.accessToken,
-        tokenType: token.tokenType,
-        expiresAt,
-        user: me?.user ?? null,
-        organization,
-    });
-    return {
-        apiUrl,
-        user: me?.user ?? null,
-        organization,
-        expiresAt,
-        credentialsPath: store.location,
-        warnings,
-    };
+    return token;
 }
 /**
  * Sign out: delete the session locally FIRST, then revoke it server-side
@@ -265,7 +285,7 @@ export async function logoutFromNexus(opts = {}) {
     const warnings = [];
     let revocation;
     try {
-        revocation = await revokeSession(apiUrl, session, opts.revokeTimeoutMs ?? NEXUS_REVOKE_TIMEOUT_MS, opts.fetch);
+        revocation = await signOutNexusSessionToken(apiUrl, session.bearer(), opts.revokeTimeoutMs ?? NEXUS_REVOKE_TIMEOUT_MS, opts.fetch);
     }
     catch (err) {
         revocation = 'failed';
@@ -273,13 +293,23 @@ export async function logoutFromNexus(opts = {}) {
     }
     return { apiUrl, removedLocally, revocation, warnings };
 }
-/** `POST /api/auth/sign-out` with the bearer token, within `timeoutMs`. Never follows redirects. */
-async function revokeSession(apiUrl, session, timeoutMs, fetchImpl) {
+/**
+ * `POST /api/auth/sign-out` with a bearer session token, within `timeoutMs`,
+ * which deletes the session server-side. Never follows redirects.
+ *
+ * @param apiUrl - Resolved API origin.
+ * @param bearer - The session token (never logged).
+ * @param timeoutMs - Time budget for the call.
+ * @param fetchImpl - Optional `fetch` override.
+ * @returns `revoked`, or `already-invalid` on a 401.
+ * @throws On a network error, a timeout or a non-2xx, non-401 answer.
+ */
+export async function signOutNexusSessionToken(apiUrl, bearer, timeoutMs, fetchImpl) {
     const doFetch = fetchImpl ?? ((input, init) => fetch(input, init));
     const res = await doFetch(`${apiUrl}/api/auth/sign-out`, {
         method: 'POST',
         headers: {
-            authorization: `Bearer ${session.bearer()}`,
+            authorization: `Bearer ${bearer}`,
             'content-type': 'application/json',
             accept: 'application/json',
         },
@@ -335,22 +365,105 @@ async function checkSession(session, opts) {
         return statusRow(session.apiUrl, 'unverified', session, null);
     }
 }
+/**
+ * Check one device credential against the API (E2 `GET /v1/whoami`, the call
+ * the device contract prefers for status). A 401 (signed out, revoked or
+ * expired) reads as `expired`; no answer reads as `unverified`.
+ */
+async function checkDevice(device, bearer, opts) {
+    if (opts.live === false)
+        return statusRow(device.origin, 'unverified', null, null);
+    const timeoutMs = opts.timeoutMs ?? NEXUS_STATUS_TIMEOUT_MS;
+    const base = opts.fetch ?? ((input, init) => fetch(input, init));
+    const http = new Http({
+        baseUrl: device.origin,
+        token: bearer,
+        fetch: (input, init) => base(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }),
+        maxAttempts: 1,
+    });
+    try {
+        const me = await http.request('GET', '/v1/whoami', nexusAccountMeSchema);
+        return statusRow(device.origin, 'signed-in', null, me);
+    }
+    catch (err) {
+        if (err instanceof NexusError && err.status === 401) {
+            return statusRow(device.origin, 'expired', null, null);
+        }
+        return statusRow(device.origin, 'unverified', null, null);
+    }
+}
 /**
  * Secret-free status rows for `cleo status` and `cleo auth list`: one per
- * stored session, or one "not signed in" row for the default origin. Makes a
- * network call only when a token is stored.
+ * device credential (when device credentials are on) and one per stored 9.24
+ * session on an origin no device credential covers, or one "not signed in"
+ * row for the default origin. Makes a network call only when a credential is
+ * stored. A device that is signed out locally (no current credential) is not
+ * signed in.
  *
- * @param opts - Origin filter, store, liveness and test overrides.
+ * @param opts - Origin filter, stores, liveness and test overrides.
  * @returns Status rows, sorted by origin.
  */
 export async function getNexusAccountStatus(opts = {}) {
     const store = opts.store ?? new FileNexusTokenStore();
     const only = opts.apiUrl !== undefined ? resolveNexusApiUrl(opts.apiUrl) : null;
-    const sessions = (await store.list()).filter((s) => only === null || s.apiUrl === only);
-    if (sessions.length === 0) {
+    const checks = [];
+    const extra = [];
+    /** `origin\u0000userId` pairs a device credential covers; a session of the same user is a leftover. */
+    const covered = new Set();
+    // Device credentials are always reported, whatever CLEO_NEXUS_DEVICE says:
+    // the switch picks the login flow, and hiding a live credential would let
+    // `CLEO_NEXUS_DEVICE=0` users believe they are signed out (review M2).
+    if (opts.devices ?? true) {
+        try {
+            for (const d of await (opts.deviceStore ?? new NexusDeviceStore()).list()) {
+                if (only !== null && d.origin !== only)
+                    continue;
+                if (!(d instanceof SealedNexusDevice)) {
+                    extra.push({
+                        apiUrl: d.origin,
+                        state: 'unverified',
+                        email: null,
+                        organization: null,
+                        expiresAt: null,
+                        summary: `device entry for user ${d.userId} cannot be opened on this machine (${d.reason}); run \`cleo login nexus\` to enrol this machine`,
+                    });
+                    continue;
+                }
+                // Status reads only the current credential: probing a pending
+                // rotation credential would be its first use (§2.5), a write.
+                const bearer = d.currentBearer();
+                if (bearer === null)
+                    continue;
+                covered.add(`${d.origin}\u0000${d.userId}`);
+                checks.push(checkDevice(d, bearer, opts));
+            }
+        }
+        catch (err) {
+            // A device file that cannot be read never hides the session rows (review M1).
+            extra.push({
+                apiUrl: only ?? resolveNexusApiUrl(),
+                state: 'unverified',
+                email: null,
+                organization: null,
+                expiresAt: null,
+                summary: `device credentials unreadable: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+    for (const s of await store.list()) {
+        if (only !== null && s.apiUrl !== only)
+            continue;
+        // A leftover 9.24 session of the user a device credential already covers
+        // is not shown twice; a session of any other user is (review L3).
+        if (s.user !== null && covered.has(`${s.apiUrl}\u0000${s.user.id}`))
+            continue;
+        checks.push(checkSession(s, opts));
+    }
+    const rows = [...(await Promise.all(checks)), ...extra];
+    if (rows.length === 0) {
         return [statusRow(only ?? resolveNexusApiUrl(), 'not-signed-in', null, null)];
     }
-    return Promise.all(sessions.map((s) => checkSession(s, opts)));
+    return rows.sort((a, b) => a.apiUrl.localeCompare(b.apiUrl));
 }
 /**
  * The stored session for an origin, or a `E_NEXUS_NOT_SIGNED_IN` error.

package/dist/cloud/nexus-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AA4CD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtD,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,OAAO,EACP,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,OAA2B,EAC3B,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,EAAE;YAC3C,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAExE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAoDD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,IAAuB,EACvB,KAAc;IAEd,MAAM,GAAG,GAAqB;QAC5B,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,wBAAwB,CACzC,MAAM,EACN,OAAO,CAAC,MAAM,EAAE,EAChB,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,MAAyB,EACzB,MAAc,EACd,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,MAAM,GAAkC,EAAE,CAAC;IACjD,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,uGAAuG;IACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1E,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,SAAS;gBACjD,IAAI,CAAC,CAAC,CAAC,YAAY,iBAAiB,CAAC,EAAE,CAAC;oBACtC,KAAK,CAAC,IAAI,CAAC;wBACT,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,KAAK,EAAE,YAAY;wBACnB,KAAK,EAAE,IAAI;wBACX,YAAY,EAAE,IAAI;wBAClB,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,yBAAyB,CAAC,CAAC,MAAM,sCAAsC,CAAC,CAAC,MAAM,mDAAmD;qBAC5I,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,8DAA8D;gBAC9D,8DAA8D;gBAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,IAAI;oBAAE,SAAS;gBAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,IAAI,IAAI,kBAAkB,EAAE;gBACpC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,SAAS;QACjD,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAE,SAAS;QAC9E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cloud/nexus-cloud-status.d.ts

@@ -0,0 +1,132 @@
+/**
+ * `cleo cloud status`: the agent's single verification call (cleo-nexus
+ * device contract v2.15, §4.4, E3 `GET /v1/status`, §3.7).
+ *
+ * It reads local facts first (the device credential, the project, its
+ * `.cleo/nexus-link.json` entry, the store's replica id), then asks E3, and
+ * returns `{ verdict, summary, local, remote, warnings }`:
+ *
+ * - no credential: verdict `not-signed-in`, and no network call is made;
+ * - the server's verdict is downgraded to `not-linked` when the current
+ *   project has no local link entry or no bound replica;
+ * - unreachable: `E_NEXUS_UNREACHABLE`, its `publicDetails` (the envelope's `error.details`) carrying `local` and a
+ *   summary whose remote fields are null ({@link NexusCloudOfflineError});
+ * - outside a project (or `--project` naming an unknown id) the device and
+ *   account parts are still reported and the verdict comes from the device
+ *   checks only.
+ *
+ * Every request is a GET. Getting the credential may still upgrade a 9.24
+ * session (E1) and retry unsettled logouts (E9/E10), as every device-credential
+ * command does (§3.4, §3.5). The replica id is read through
+ * `activeReplica(db, 'project')` on a read-only snapshot handle
+ * (`openCleoDbSnapshot`, no migrations, no pragmas): this command never binds
+ * a replica or writes `cleo.db`. When the store cannot be read that way,
+ * `replicaId` is `null` with `W_NEXUS_REPLICA_UNREADABLE` and the verdict is
+ * `attention`, never `not-linked`: unknown is not unbound.
+ *
+ * A server without E3 (404 `E_NOT_FOUND` on `/v1/status`) gets the same
+ * `NexusStatus` shape composed client-side from E2, E14 and E15 with the
+ * contract's check and verdict rules, plus a `W_NEXUS_STATUS_COMPOSED`
+ * warning.
+ *
+ * TODO(T12905): `cleo cloud status --report` (send presence before E3) is not
+ * implemented here; it is the one write this command will gain.
+ *
+ * @task T12871
+ * @epic T12323
+ */
+import { type CloudStatusOfflineDetails, type CloudStatusResult, type CloudWarning, type NexusCloudStatus, type NexusCloudStatusCheck } from '@cleocode/contracts';
+import { NexusAccountError } from './nexus-auth.js';
+import { type NexusCloudConnection, type NexusCloudOptions } from './nexus-cloud.js';
+/** Warning: the server has no E3, so the status was composed from E2, E14 and E15. */
+export declare const W_NEXUS_STATUS_COMPOSED = "W_NEXUS_STATUS_COMPOSED";
+/** Warning: the current project has no `.cleo/nexus-link.json` entry for the origin. */
+export declare const W_NEXUS_NOT_LINKED_LOCALLY = "W_NEXUS_NOT_LINKED_LOCALLY";
+/** Warning: the current project's store has no bound replica (or none could be read). */
+export declare const W_NEXUS_NO_REPLICA = "W_NEXUS_NO_REPLICA";
+/** Warning: the store exists but could not be read read-only, so `replicaId` is null. */
+export declare const W_NEXUS_REPLICA_UNREADABLE = "W_NEXUS_REPLICA_UNREADABLE";
+/** Warning: `--project` names an id the server does not show; only the device was checked. */
+export declare const W_NEXUS_PROJECT_UNKNOWN = "W_NEXUS_PROJECT_UNKNOWN";
+/** Options for {@link getNexusCloudStatus}. */
+export interface NexusCloudStatusOptions extends NexusCloudOptions {
+    /** `--project`: the project to check; defaults to the current project. */
+    projectId?: string;
+    /** Clock for presence freshness when the status is composed (tests). */
+    now?: () => Date;
+}
+/**
+ * `E_NEXUS_UNREACHABLE` from `cleo cloud status`, carrying the local facts
+ * (§4.4 "Offline"). Holds no secret.
+ */
+export declare class NexusCloudOfflineError extends NexusAccountError {
+    /**
+     * Local state, a summary with every remote field null, and the warnings
+     * collected so far. Named `publicDetails`: the CLI forwards only this
+     * explicitly secret-free field into the error envelope.
+     */
+    readonly publicDetails: CloudStatusOfflineDetails;
+    /**
+     * @param message - Human message.
+     * @param publicDetails - Local state, summary and warnings.
+     * @param fix - Remedy.
+     */
+    constructor(message: string, publicDetails: CloudStatusOfflineDetails, fix?: string);
+}
+/**
+ * The verdict of a set of checks (E3 rules, §4.2): the first matching rule wins.
+ *
+ * @param checks - The checks that apply.
+ * @returns `not-registered`, `not-linked`, `attention` or `ok`.
+ */
+export declare function nexusStatusVerdict(checks: readonly NexusCloudStatusCheck[]): NexusCloudStatus['verdict'];
+/** What {@link readNexusLocalReplicaId} learned about the store's replica. */
+export interface NexusLocalReplicaRead {
+    /** The active replica id, or `null` (no store, no bound replica, or unreadable). */
+    readonly replicaId: string | null;
+    /**
+     * `true` when the store exists but could not be read: `replicaId: null` then
+     * means "unknown", not "unbound", so the caller must not conclude not-linked.
+     */
+    readonly unreadable: boolean;
+    /** `W_NEXUS_REPLICA_UNREADABLE` when `unreadable`. */
+    readonly warning: CloudWarning | null;
+}
+/**
+ * The active replica id of a project store, read-only: a snapshot handle with
+ * no migrations and no pragmas, closed before returning. Never binds and never
+ * writes a row.
+ *
+ * SQLite side effect: a read-only open of a WAL-mode store needs the `-wal`
+ * and `-shm` sidecars, and SQLite creates them (empty) when they are missing
+ * and the directory is writable. Run as another user (for example under
+ * `sudo`), those sidecars would be left owned by that user, so when the store
+ * has no `-wal` and the directory is not writable by the caller the open is
+ * skipped and the store reported unreadable instead.
+ *
+ * @param projectRoot - Project root.
+ * @returns The replica id, whether the store was unreadable, and a warning.
+ */
+export declare function readNexusLocalReplicaId(projectRoot: string): Promise<NexusLocalReplicaRead>;
+/**
+ * The `NexusStatus` of E3, composed from E2, E14 and E15 with the contract's
+ * check rules (§4.2 E3), for a server without E3.
+ *
+ * @param conn - Connection.
+ * @param projectId - Project to check, or `null`.
+ * @param replicaId - Replica to check, or `null`.
+ * @param now - Clock for presence freshness.
+ * @returns The composed status.
+ */
+export declare function composeNexusStatus(conn: NexusCloudConnection, projectId: string | null, replicaId: string | null, now?: () => Date): Promise<NexusCloudStatus>;
+/**
+ * `cleo cloud status [--project <id>]`.
+ *
+ * @param opts - Project, API URL, stores and test overrides.
+ * @returns The verdict, summary, local and remote facts, and warnings.
+ * @throws {NexusCloudOfflineError} `E_NEXUS_UNREACHABLE` when the server does not answer.
+ * @throws {NexusAccountError} `E_NEXUS_DEVICE_REQUIRED`, `E_NEXUS_ACCOUNT_AMBIGUOUS`,
+ *   or a mapped API refusal (§4.0.4).
+ */
+export declare function getNexusCloudStatus(opts?: NexusCloudStatusOptions): Promise<CloudStatusResult>;
+//# sourceMappingURL=nexus-cloud-status.d.ts.map

package/dist/cloud/nexus-cloud-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-cloud-status.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-cloud-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EAGtB,KAAK,YAAY,EAGjB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAK3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAsB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAKL,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGvB,MAAM,kBAAkB,CAAC;AAI1B,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,yFAAyF;AACzF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,8FAA8F;AAC9F,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,+CAA+C;AAC/C,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC;IAElD;;;;OAIG;gBACS,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,yBAAyB,EAAE,GAAG,CAAC,EAAE,MAAM;CAKpF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,qBAAqB,EAAE,GACvC,gBAAgB,CAAC,SAAS,CAAC,CAO7B;AAOD,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CACvC;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsBjG;AAgFD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,oBAAoB,EAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CA8F3B;AA0FD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,iBAAiB,CAAC,CA6E5B"}