@cleocode/core 2026.9.25 → 2026.10.1

package/dist/cloud/nexus-cloud-status.js

@@ -0,0 +1,440 @@
+/**
+ * `cleo cloud status`: the agent's single verification call (cleo-nexus
+ * device contract v2.15, §4.4, E3 `GET /v1/status`, §3.7).
+ *
+ * It reads local facts first (the device credential, the project, its
+ * `.cleo/nexus-link.json` entry, the store's replica id), then asks E3, and
+ * returns `{ verdict, summary, local, remote, warnings }`:
+ *
+ * - no credential: verdict `not-signed-in`, and no network call is made;
+ * - the server's verdict is downgraded to `not-linked` when the current
+ *   project has no local link entry or no bound replica;
+ * - unreachable: `E_NEXUS_UNREACHABLE`, its `publicDetails` (the envelope's `error.details`) carrying `local` and a
+ *   summary whose remote fields are null ({@link NexusCloudOfflineError});
+ * - outside a project (or `--project` naming an unknown id) the device and
+ *   account parts are still reported and the verdict comes from the device
+ *   checks only.
+ *
+ * Every request is a GET. Getting the credential may still upgrade a 9.24
+ * session (E1) and retry unsettled logouts (E9/E10), as every device-credential
+ * command does (§3.4, §3.5). The replica id is read through
+ * `activeReplica(db, 'project')` on a read-only snapshot handle
+ * (`openCleoDbSnapshot`, no migrations, no pragmas): this command never binds
+ * a replica or writes `cleo.db`. When the store cannot be read that way,
+ * `replicaId` is `null` with `W_NEXUS_REPLICA_UNREADABLE` and the verdict is
+ * `attention`, never `not-linked`: unknown is not unbound.
+ *
+ * A server without E3 (404 `E_NOT_FOUND` on `/v1/status`) gets the same
+ * `NexusStatus` shape composed client-side from E2, E14 and E15 with the
+ * contract's check and verdict rules, plus a `W_NEXUS_STATUS_COMPOSED`
+ * warning.
+ *
+ * TODO(T12905): `cleo cloud status --report` (send presence before E3) is not
+ * implemented here; it is the one write this command will gain.
+ *
+ * @task T12871
+ * @epic T12323
+ */
+import { accessSync, existsSync, constants as fsConstants } from 'node:fs';
+import { join } from 'node:path';
+import { NEXUS_PRESENCE_FRESH_SECONDS, nexusCloudProjectDetailSchema, nexusCloudStatusSchema, nexusCloudWhoamiSchema, } from '@cleocode/contracts';
+import { resolveCleoDir } from '../paths.js';
+import { NexusAccountError, resolveNexusApiUrl } from './nexus-auth.js';
+import { assertNexusCloudDeviceMode, connectNexusCloud, currentNexusCloudProject, listNexusCloudReplicas, nexusQueryPath, } from './nexus-cloud.js';
+import { FileNexusTokenStore, nexusOriginKey } from './nexus-credentials.js';
+import { NexusDeviceStore, UnreadableNexusDevice } from './nexus-device.js';
+/** Warning: the server has no E3, so the status was composed from E2, E14 and E15. */
+export const W_NEXUS_STATUS_COMPOSED = 'W_NEXUS_STATUS_COMPOSED';
+/** Warning: the current project has no `.cleo/nexus-link.json` entry for the origin. */
+export const W_NEXUS_NOT_LINKED_LOCALLY = 'W_NEXUS_NOT_LINKED_LOCALLY';
+/** Warning: the current project's store has no bound replica (or none could be read). */
+export const W_NEXUS_NO_REPLICA = 'W_NEXUS_NO_REPLICA';
+/** Warning: the store exists but could not be read read-only, so `replicaId` is null. */
+export const W_NEXUS_REPLICA_UNREADABLE = 'W_NEXUS_REPLICA_UNREADABLE';
+/** Warning: `--project` names an id the server does not show; only the device was checked. */
+export const W_NEXUS_PROJECT_UNKNOWN = 'W_NEXUS_PROJECT_UNKNOWN';
+/**
+ * `E_NEXUS_UNREACHABLE` from `cleo cloud status`, carrying the local facts
+ * (§4.4 "Offline"). Holds no secret.
+ */
+export class NexusCloudOfflineError extends NexusAccountError {
+    /**
+     * Local state, a summary with every remote field null, and the warnings
+     * collected so far. Named `publicDetails`: the CLI forwards only this
+     * explicitly secret-free field into the error envelope.
+     */
+    publicDetails;
+    /**
+     * @param message - Human message.
+     * @param publicDetails - Local state, summary and warnings.
+     * @param fix - Remedy.
+     */
+    constructor(message, publicDetails, fix) {
+        super('E_NEXUS_UNREACHABLE', message, fix);
+        this.name = 'NexusCloudOfflineError';
+        this.publicDetails = publicDetails;
+    }
+}
+/**
+ * The verdict of a set of checks (E3 rules, §4.2): the first matching rule wins.
+ *
+ * @param checks - The checks that apply.
+ * @returns `not-registered`, `not-linked`, `attention` or `ok`.
+ */
+export function nexusStatusVerdict(checks) {
+    const failed = (id) => checks.some((c) => c.id === id && !c.ok);
+    if (failed('device.registered') || failed('device.active'))
+        return 'not-registered';
+    if (failed('project.registered') || failed('replica.attached'))
+        return 'not-linked';
+    if (checks.some((c) => c.required && !c.ok))
+        return 'attention';
+    return 'ok';
+}
+/** The device and credential checks only (for "outside a project"). */
+function deviceOnly(checks) {
+    return checks.filter((c) => c.id.startsWith('credential.') || c.id.startsWith('device.'));
+}
+/** An unreadable-store result with its warning. */
+function unreadableStore(reason) {
+    return {
+        replicaId: null,
+        unreadable: true,
+        warning: {
+            code: W_NEXUS_REPLICA_UNREADABLE,
+            message: `could not read the project store read-only, so the replica id is unknown: ${reason}`,
+        },
+    };
+}
+/**
+ * The active replica id of a project store, read-only: a snapshot handle with
+ * no migrations and no pragmas, closed before returning. Never binds and never
+ * writes a row.
+ *
+ * SQLite side effect: a read-only open of a WAL-mode store needs the `-wal`
+ * and `-shm` sidecars, and SQLite creates them (empty) when they are missing
+ * and the directory is writable. Run as another user (for example under
+ * `sudo`), those sidecars would be left owned by that user, so when the store
+ * has no `-wal` and the directory is not writable by the caller the open is
+ * skipped and the store reported unreadable instead.
+ *
+ * @param projectRoot - Project root.
+ * @returns The replica id, whether the store was unreadable, and a warning.
+ */
+export async function readNexusLocalReplicaId(projectRoot) {
+    // The project store path, as resolveDualScopeDbPath('project', root) builds it.
+    const dir = resolveCleoDir(projectRoot);
+    const path = join(dir, 'cleo.db');
+    if (!existsSync(path))
+        return { replicaId: null, unreadable: false, warning: null };
+    if (!existsSync(`${path}-wal`) && !isWritable(dir)) {
+        return unreadableStore('the store has no -wal file and its directory is not writable, so a read-only open would fail or leave sidecars behind');
+    }
+    const { openCleoDbSnapshot } = await import('../store/open-cleo-db.js');
+    const { activeReplica } = await import('../store/sync/replica.js');
+    let snap;
+    try {
+        snap = openCleoDbSnapshot(path, { readOnly: true, applyPragmas: false });
+        const replicaId = activeReplica(snap.db, 'project')?.replicaId ?? null;
+        return { replicaId, unreadable: false, warning: null };
+    }
+    catch (err) {
+        return unreadableStore(err instanceof Error ? err.message : String(err));
+    }
+    finally {
+        snap?.close();
+    }
+}
+/** True when the caller may write into `dir`. */
+function isWritable(dir) {
+    try {
+        accessSync(dir, fsConstants.W_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** True when a device credential (or a 9.24 session to upgrade) is stored for the origin. */
+async function hasLocalCredential(apiUrl, devices, sessions) {
+    const origin = nexusOriginKey(apiUrl);
+    for (const d of await devices.list()) {
+        if (d instanceof UnreadableNexusDevice || d.origin !== origin)
+            continue;
+        if (d.currentBearer() !== null || d.unseal().raceCandidate)
+            return true;
+    }
+    return (await sessions.get(apiUrl)) !== null;
+}
+/** A summary with no remote facts. */
+function emptySummary(local) {
+    return {
+        signedIn: local.signedIn,
+        registered: false,
+        profile: local.profile,
+        linked: false,
+        replicaAttached: false,
+        devices: 0,
+        lastPresenceAt: null,
+        lastSyncAt: null,
+        headSeq: null,
+        openConflicts: null,
+    };
+}
+/** One check. */
+function check(id, ok, required, detail) {
+    return { id, ok, required, detail };
+}
+/** E2's device and credential checks. */
+function deviceChecks(whoami) {
+    const d = whoami.device;
+    const out = [
+        check('credential.valid', true, true, `${whoami.credential.kind} credential accepted`),
+        check('device.registered', d !== null, true, d ? `device ${d.deviceId}` : 'no device'),
+        check('device.active', d?.state === 'active', true, `state ${d?.state ?? 'none'}`),
+    ];
+    if (d && d.certificate !== undefined) {
+        out.push(check('device.certified', d.certificate !== null, false, 'device certificate'));
+    }
+    return out;
+}
+/** The replica row of `replicaId`, from E14's list or, when that was cut, from E15. */
+async function findReplica(conn, projectId, replicaId, listed, truncated) {
+    const hit = listed.find((r) => r.replicaId === replicaId);
+    if (hit || !truncated)
+        return hit ?? null;
+    const all = await listNexusCloudReplicas(conn, projectId);
+    return all.replicas.find((r) => r.replicaId === replicaId) ?? null;
+}
+/**
+ * The `NexusStatus` of E3, composed from E2, E14 and E15 with the contract's
+ * check rules (§4.2 E3), for a server without E3.
+ *
+ * @param conn - Connection.
+ * @param projectId - Project to check, or `null`.
+ * @param replicaId - Replica to check, or `null`.
+ * @param now - Clock for presence freshness.
+ * @returns The composed status.
+ */
+export async function composeNexusStatus(conn, projectId, replicaId, now = () => new Date()) {
+    const whoami = await conn.get('/v1/whoami', nexusCloudWhoamiSchema);
+    const checks = deviceChecks(whoami);
+    const base = { user: whoami.user, credential: whoami.credential, device: whoami.device };
+    if (projectId === null) {
+        return {
+            ...base,
+            project: null,
+            replica: null,
+            stream: null,
+            checks,
+            verdict: nexusStatusVerdict(checks),
+        };
+    }
+    const detail = await conn.find(`/v1/projects/${encodeURIComponent(projectId)}`, nexusCloudProjectDetailSchema);
+    checks.push(check('project.registered', detail !== null, true, detail ? 'visible' : 'not visible'));
+    if (detail === null) {
+        const project = {
+            projectId,
+            registered: false,
+            organizationId: null,
+            organizationName: null,
+            role: null,
+        };
+        return {
+            ...base,
+            project,
+            replica: null,
+            stream: null,
+            checks,
+            verdict: nexusStatusVerdict(checks),
+        };
+    }
+    const writable = detail.role === 'writer' || detail.role === 'owner';
+    const writeRequired = whoami.credential.kind === 'device' && whoami.credential.profile === 'device';
+    checks.push(check('project.writable', writable, writeRequired, `role ${detail.role}`));
+    let replica = null;
+    if (replicaId !== null) {
+        const row = await findReplica(conn, projectId, replicaId, detail.replicas, detail.truncated);
+        const mine = row !== null && row.deviceId === whoami.device?.deviceId;
+        replica = {
+            replicaId,
+            attached: mine,
+            attachedElsewhere: row !== null && !mine,
+            attachedAt: row?.attachedAt ?? null,
+            lastSyncAt: row?.lastSyncAt ?? null,
+            presenceAt: row?.presenceAt ?? null,
+            lastReplicaSeq: null,
+        };
+        const fresh = replica.presenceAt !== null &&
+            now().getTime() - Date.parse(replica.presenceAt) <= NEXUS_PRESENCE_FRESH_SECONDS * 1000;
+        const syncOn = row?.presence?.sync?.enabled === true;
+        checks.push(check('replica.attached', mine, true, mine ? 'attached from this device' : row ? 'attached from another device' : 'not attached'), check('presence.fresh', fresh, false, replica.presenceAt ?? 'no presence'), check('replica.synced', replica.lastSyncAt !== null, syncOn, replica.lastSyncAt ?? 'never synced'));
+    }
+    checks.push(check('conflicts.none', detail.openConflicts === 0, true, `${detail.openConflicts} open`));
+    return {
+        ...base,
+        project: {
+            projectId,
+            registered: true,
+            organizationId: detail.project.organizationId,
+            organizationName: detail.project.organizationName ?? null,
+            role: detail.role,
+        },
+        replica,
+        stream: detail.stream
+            ? { ...detail.stream, openConflicts: detail.openConflicts, devices: detail.devices }
+            : null,
+        checks,
+        verdict: nexusStatusVerdict(checks),
+    };
+}
+/** E3, or the composed status when the server has no E3. */
+async function remoteStatus(conn, projectId, replicaId, now, warnings) {
+    const path = nexusQueryPath('/v1/status', {
+        projectId: projectId ?? undefined,
+        // E3 refuses a replicaId without a projectId.
+        replicaId: projectId !== null && replicaId !== null ? replicaId : undefined,
+    });
+    const status = await conn.find(path, nexusCloudStatusSchema);
+    if (status !== null)
+        return status;
+    warnings.push({
+        code: W_NEXUS_STATUS_COMPOSED,
+        message: 'the server has no GET /v1/status yet; the status was composed from /v1/whoami and the project reads',
+    });
+    return composeNexusStatus(conn, projectId, replicaId, now);
+}
+/** Apply the local downgrades (§4.4) to the remote verdict. */
+function localVerdict(remote, project, isLocal, replica, warnings) {
+    if (remote.project !== null && !remote.project.registered && !isLocal) {
+        warnings.push({
+            code: W_NEXUS_PROJECT_UNKNOWN,
+            message: `project ${remote.project.projectId} is not registered or not visible; only the device was checked`,
+        });
+        return nexusStatusVerdict(deviceOnly(remote.checks));
+    }
+    if (!isLocal || project === null || (remote.verdict !== 'ok' && remote.verdict !== 'attention')) {
+        return remote.verdict;
+    }
+    if (project.link === null) {
+        warnings.push({
+            code: W_NEXUS_NOT_LINKED_LOCALLY,
+            message: 'this project has no .cleo/nexus-link.json entry for the origin; run `cleo project link`',
+        });
+        return 'not-linked';
+    }
+    if (replica.unreadable) {
+        // Unknown is not unbound: never conclude not-linked from an unreadable
+        // store (W_NEXUS_REPLICA_UNREADABLE already says why).
+        return 'attention';
+    }
+    if (replica.replicaId === null) {
+        warnings.push({
+            code: W_NEXUS_NO_REPLICA,
+            message: "this project's store has no bound replica; run `cleo project link`",
+        });
+        return 'not-linked';
+    }
+    return remote.verdict;
+}
+/** The summary of a remote status. */
+function summaryOf(remote, local, project, isLocal) {
+    const ok = (id) => remote.checks.some((c) => c.id === id && c.ok);
+    const registeredRemotely = remote.project?.registered === true;
+    return {
+        signedIn: true,
+        registered: ok('device.registered') && ok('device.active'),
+        profile: remote.credential.profile ?? local.profile,
+        linked: registeredRemotely && (!isLocal || (project?.link ?? null) !== null),
+        replicaAttached: remote.replica?.attached === true,
+        devices: remote.stream?.devices.active ?? 0,
+        lastPresenceAt: remote.replica?.presenceAt ?? null,
+        lastSyncAt: remote.replica?.lastSyncAt ?? null,
+        headSeq: remote.stream?.headSeq ?? null,
+        openConflicts: remote.stream?.openConflicts ?? null,
+    };
+}
+/**
+ * `cleo cloud status [--project <id>]`.
+ *
+ * @param opts - Project, API URL, stores and test overrides.
+ * @returns The verdict, summary, local and remote facts, and warnings.
+ * @throws {NexusCloudOfflineError} `E_NEXUS_UNREACHABLE` when the server does not answer.
+ * @throws {NexusAccountError} `E_NEXUS_DEVICE_REQUIRED`, `E_NEXUS_ACCOUNT_AMBIGUOUS`,
+ *   or a mapped API refusal (§4.0.4).
+ */
+export async function getNexusCloudStatus(opts = {}) {
+    assertNexusCloudDeviceMode();
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    const devices = opts.deviceStore ?? new NexusDeviceStore();
+    const sessions = opts.store ?? new FileNexusTokenStore();
+    const warnings = [];
+    const project = currentNexusCloudProject(apiUrl, opts.projectRoot);
+    const projectHere = project ? (project.link?.remoteProjectId ?? project.projectId) : null;
+    const isLocal = project !== null &&
+        (opts.projectId === undefined ||
+            opts.projectId === project.projectId ||
+            opts.projectId === project.link?.remoteProjectId);
+    // The current project (bare, or named by its local or remote id) is asked
+    // about by its linked remote id, like the bare command.
+    const projectId = isLocal ? projectHere : (opts.projectId ?? null);
+    let replica = { replicaId: null, unreadable: false, warning: null };
+    if (isLocal && project !== null) {
+        replica = await readNexusLocalReplicaId(project.root);
+        if (replica.warning)
+            warnings.push(replica.warning);
+    }
+    const replicaId = replica.replicaId;
+    const local = {
+        apiUrl,
+        signedIn: false,
+        nexusDeviceId: null,
+        profile: null,
+        projectId,
+        replicaId,
+        linkPath: isLocal && project?.link ? project.linkPath : null,
+        credentialsPath: devices.location,
+    };
+    const notSignedIn = () => ({
+        verdict: 'not-signed-in',
+        summary: emptySummary(local),
+        local,
+        remote: null,
+        warnings,
+    });
+    if (!(await hasLocalCredential(apiUrl, devices, sessions)))
+        return notSignedIn();
+    try {
+        const conn = await connectNexusCloud({
+            ...opts,
+            apiUrl,
+            deviceStore: devices,
+            store: sessions,
+        });
+        warnings.push(...conn.warnings);
+        local.signedIn = true;
+        local.nexusDeviceId = conn.device.deviceId;
+        local.profile = conn.device.unseal().current?.profile ?? null;
+        const remote = await remoteStatus(conn, projectId, replicaId, opts.now, warnings);
+        const verdict = localVerdict(remote, project, isLocal, replica, warnings);
+        return {
+            verdict,
+            summary: summaryOf(remote, local, project, isLocal),
+            local,
+            remote,
+            warnings,
+        };
+    }
+    catch (err) {
+        if (err instanceof NexusAccountError &&
+            err.code === 'E_NEXUS_NOT_SIGNED_IN' &&
+            !local.signedIn) {
+            return notSignedIn();
+        }
+        if (err instanceof NexusAccountError && err.code === 'E_NEXUS_UNREACHABLE') {
+            throw new NexusCloudOfflineError(err.message, { local, summary: emptySummary(local), warnings }, err.fix);
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=nexus-cloud-status.js.map

package/dist/cloud/nexus-cloud-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-cloud-status.js","sourceRoot":"","sources":["../../src/cloud/nexus-cloud-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAOL,4BAA4B,EAK5B,6BAA6B,EAC7B,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EAItB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAwB,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,wFAAwF;AACxF,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,yFAAyF;AACzF,MAAM,CAAC,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAEvE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAUjE;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,iBAAiB;IAC3D;;;;OAIG;IACM,aAAa,CAA4B;IAElD;;;;OAIG;IACH,YAAY,OAAe,EAAE,aAAwC,EAAE,GAAY;QACjF,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAwC;IAExC,MAAM,MAAM,GAAG,CAAC,EAA+B,EAAW,EAAE,CAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACpF,IAAI,MAAM,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,kBAAkB,CAAC;QAAE,OAAO,YAAY,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,WAAW,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,MAAwC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5F,CAAC;AAeD,mDAAmD;AACnD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,6EAA6E,MAAM,EAAE;SAC/F;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IAC/D,gFAAgF;IAChF,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpF,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,OAAO,eAAe,CACpB,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACxE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACnE,IAAI,IAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;QACvE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,kBAAkB,CAC/B,MAAc,EACd,OAAyB,EACzB,QAAyB;IAEzB,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,qBAAqB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QACxE,IAAI,CAAC,CAAC,aAAa,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,sCAAsC;AACtC,SAAS,YAAY,CAAC,KAAuB;IAC3C,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK;QACb,eAAe,EAAE,KAAK;QACtB,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,IAAI;KACpB,CAAC;AACJ,CAAC;AAED,iBAAiB;AACjB,SAAS,KAAK,CACZ,EAA+B,EAC/B,EAAW,EACX,QAAiB,EACjB,MAAc;IAEd,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,yCAAyC;AACzC,SAAS,YAAY,CAAC,MAAwB;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,MAAM,GAAG,GAAG;QACV,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,sBAAsB,CAAC;QACtF,KAAK,CAAC,mBAAmB,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACtF,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,KAAK,KAAK,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,KAAK,IAAI,MAAM,EAAE,CAAC;KACnF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,WAAW,CACxB,IAA0B,EAC1B,SAAiB,EACjB,SAAiB,EACjB,MAAoC,EACpC,SAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC1D,IAAI,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,IAAI,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA0B,EAC1B,SAAwB,EACxB,SAAwB,EACxB,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACzF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC;SACpC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAC5B,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAC/C,6BAA6B,CAC9B,CAAC;IACF,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,oBAAoB,EAAE,MAAM,KAAK,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CACvF,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG;YACd,SAAS;YACT,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;YACpB,gBAAgB,EAAE,IAAI;YACtB,IAAI,EAAE,IAAI;SACX,CAAC;QACF,OAAO;YACL,GAAG,IAAI;YACP,OAAO;YACP,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC;SACpC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;IACrE,MAAM,aAAa,GACjB,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC;IAChF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,GAAgC,IAAI,CAAC;IAChD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;QACtE,OAAO,GAAG;YACR,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,iBAAiB,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI;YACxC,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI;YACnC,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI;YACnC,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI;YACnC,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,KAAK,GACT,OAAO,CAAC,UAAU,KAAK,IAAI;YAC3B,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,4BAA4B,GAAG,IAAI,CAAC;QAC1F,MAAM,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;QACrD,MAAM,CAAC,IAAI,CACT,KAAK,CACH,kBAAkB,EAClB,IAAI,EACJ,IAAI,EACJ,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,cAAc,CAC3F,EACD,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,EAC1E,KAAK,CACH,gBAAgB,EAChB,OAAO,CAAC,UAAU,KAAK,IAAI,EAC3B,MAAM,EACN,OAAO,CAAC,UAAU,IAAI,cAAc,CACrC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,aAAa,OAAO,CAAC,CAC1F,CAAC;IACF,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE;YACP,SAAS;YACT,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc;YAC7C,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI;YACzD,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB;QACD,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,MAAM;YACnB,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;YACpF,CAAC,CAAC,IAAI;QACR,MAAM;QACN,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,SAAwB,EACxB,SAAwB,EACxB,GAA6B,EAC7B,QAAwB;IAExB,MAAM,IAAI,GAAG,cAAc,CAAC,YAAY,EAAE;QACxC,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,8CAA8C;QAC9C,SAAS,EAAE,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EACL,qGAAqG;KACxG,CAAC,CAAC;IACH,OAAO,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,+DAA+D;AAC/D,SAAS,YAAY,CACnB,MAAwB,EACxB,OAAiC,EACjC,OAAgB,EAChB,OAA8B,EAC9B,QAAwB;IAExB,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,WAAW,MAAM,CAAC,OAAO,CAAC,SAAS,gEAAgE;SAC7G,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,EAAE,CAAC;QAChG,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,0BAA0B;YAChC,OAAO,EACL,yFAAyF;SAC5F,CAAC,CAAC;QACH,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,uEAAuE;QACvE,uDAAuD;QACvD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CAAC;QACH,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,sCAAsC;AACtC,SAAS,SAAS,CAChB,MAAwB,EACxB,KAAuB,EACvB,OAAiC,EACjC,OAAgB;IAEhB,MAAM,EAAE,GAAG,CAAC,EAA+B,EAAW,EAAE,CACtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IAC/D,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC;QAC1D,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;QACnD,MAAM,EAAE,kBAAkB,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;QAC5E,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI;QAClD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;QAC3C,cAAc,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;QAClD,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;QAC9C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI;QACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgC,EAAE;IAElC,0BAA0B,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,OAAO,GACX,OAAO,KAAK,IAAI;QAChB,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAC3B,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YACpC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACtD,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACnE,IAAI,OAAO,GAA0B,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3F,IAAI,OAAO,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,KAAK,GAAqB;QAC9B,MAAM;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,IAAI;QACb,SAAS;QACT,SAAS;QACT,QAAQ,EAAE,OAAO,IAAI,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QAC5D,eAAe,EAAE,OAAO,CAAC,QAAQ;KAClC,CAAC;IACF,MAAM,WAAW,GAAG,GAAsB,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,eAAe;QACxB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;QAC5B,KAAK;QACL,MAAM,EAAE,IAAI;QACZ,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,WAAW,EAAE,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;YACnC,GAAG,IAAI;YACP,MAAM;YACN,WAAW,EAAE,OAAO;YACpB,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC3C,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1E,OAAO;YACL,OAAO;YACP,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;YACnD,KAAK;YACL,MAAM;YACN,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,iBAAiB;YAChC,GAAG,CAAC,IAAI,KAAK,uBAAuB;YACpC,CAAC,KAAK,CAAC,QAAQ,EACf,CAAC;YACD,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC3E,MAAM,IAAI,sBAAsB,CAC9B,GAAG,CAAC,OAAO,EACX,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EACjD,GAAG,CAAC,GAAG,CACR,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/cloud/nexus-cloud.d.ts

@@ -0,0 +1,179 @@
+/**
+ * `cleo cloud whoami|devices|projects`: read-only Cleo Nexus reads with the
+ * device credential (cleo-nexus device contract v2.15, §4.2 E2, E5, E13, E14,
+ * E15; CLI mapping §4.4).
+ *
+ * - Every request is a `GET`. Nothing here writes to the server or to a
+ *   project store. The one side effect is the one every device-credential
+ *   command has: {@link ensureNexusDeviceCredential} retries unsettled
+ *   logouts and upgrades a 9.24 session once (§3.4, §3.5).
+ * - Lists follow `nextCursor` (§4.0.3) with the largest page the server takes,
+ *   up to a page budget, and report the server's `truncated` flags.
+ * - Failures are mapped by {@link nexusApiErrorToAccountError}, whose table
+ *   lives in `@cleocode/contracts` (§4.0.4).
+ *
+ * No function here logs, and no result or error carries a token.
+ *
+ * @task T12871
+ * @epic T12323
+ */
+import { type CloudDevicesResult, type CloudPaging, type CloudProjectShowResult, type CloudProjectsResult, type CloudWarning, type CloudWhoamiResult, type NexusCloudReplica, type NexusDeviceListState, type NexusProjectLink } from '@cleocode/contracts';
+import { type ResponseSchema } from './http.js';
+import { NexusDeviceStore, type SealedNexusDevice } from './nexus-device.js';
+import { type NexusDeviceCredentialOptions } from './nexus-enrol.js';
+/** Timeout of one `cleo cloud` request. */
+export declare const NEXUS_CLOUD_TIMEOUT_MS = 15000;
+/** Warning code for a non-fatal problem met while getting the device credential. */
+export declare const W_NEXUS_CREDENTIAL = "W_NEXUS_CREDENTIAL";
+/** Warning code: a list stopped at its page budget while the server had more. */
+export declare const W_NEXUS_PAGE_LIMIT = "W_NEXUS_PAGE_LIMIT";
+/** Warning code: a server ceiling cut a list (§4.0.3 `truncated`). */
+export declare const W_NEXUS_TRUNCATED = "W_NEXUS_TRUNCATED";
+/** Options shared by every `cleo cloud` read; all optional (tests inject them). */
+export interface NexusCloudOptions extends NexusDeviceCredentialOptions {
+    /** Project root; defaults to the current project (when there is one). */
+    projectRoot?: string;
+    /** Per-request timeout; default {@link NEXUS_CLOUD_TIMEOUT_MS}. */
+    timeoutMs?: number;
+    /** Most pages a list follows; default {@link NEXUS_CLOUD_MAX_PAGES}. */
+    maxPages?: number;
+    /** Page size sent as `limit`; default {@link NEXUS_PAGE_LIMIT_MAX}. */
+    pageLimit?: number;
+}
+/** A signed-in, read-only connection to the API. Holds the bearer inside {@link Http} only. */
+export interface NexusCloudConnection {
+    /** API origin. */
+    readonly apiUrl: string;
+    /** The device entry whose credential the requests carry. */
+    readonly device: SealedNexusDevice;
+    /** Warnings from getting the credential. */
+    readonly warnings: CloudWarning[];
+    /** `GET path`, parsed against `schema`; failures mapped per §4.0.4. */
+    get<T>(path: string, schema: ResponseSchema<T>): Promise<T>;
+    /** {@link NexusCloudConnection.get}, but a 404 `E_NOT_FOUND` answers `null`. */
+    find<T>(path: string, schema: ResponseSchema<T>): Promise<T | null>;
+}
+/** The current CLEO project, as far as the cloud reads need it. */
+export interface NexusCloudProject {
+    /** Project root. */
+    readonly root: string;
+    /** The tracked project id (`.cleo/project.json`, legacy `.cleo/project-id`). */
+    readonly projectId: string;
+    /** The `.cleo/nexus-link.json` entry for the origin, if any. */
+    readonly link: NexusProjectLink | null;
+    /** Path of `.cleo/nexus-link.json` (whether or not it exists). */
+    readonly linkPath: string;
+}
+/**
+ * Refuse with `E_NEXUS_DEVICE_REQUIRED` when device credentials are off
+ * (`CLEO_NEXUS_DEVICE=0`): the cloud reads never fall back to a 9.24 session.
+ *
+ * @throws {NexusAccountError} `E_NEXUS_DEVICE_REQUIRED`.
+ */
+export declare function assertNexusCloudDeviceMode(): void;
+/** Wrap credential warnings (plain strings) as envelope warnings. */
+export declare function nexusCredentialWarnings(warnings: readonly string[]): CloudWarning[];
+/**
+ * Open a read-only connection with this machine's device credential.
+ *
+ * @param opts - API URL, account, stores and test overrides.
+ * @returns The connection.
+ * @throws {NexusAccountError} `E_NEXUS_DEVICE_REQUIRED`, `E_NEXUS_NOT_SIGNED_IN`,
+ *   `E_NEXUS_ACCOUNT_AMBIGUOUS`, or an upgrade failure.
+ */
+export declare function connectNexusCloud(opts?: NexusCloudOptions): Promise<NexusCloudConnection>;
+/** A path with its query string; `undefined` values are left out. */
+export declare function nexusQueryPath(path: string, query: Readonly<Record<string, string | number | undefined>>): string;
+/** One page of a cursor-paged list. */
+interface Page {
+    readonly nextCursor: string | null;
+    readonly truncated: boolean;
+}
+/**
+ * Follow `nextCursor` until the server has no more or the budget is spent.
+ *
+ * @param fetchPage - Fetch the page after `cursor` (`null` for the first).
+ * @param maxPages - Page budget (at least 1).
+ * @returns Every page fetched and the paging facts.
+ */
+export declare function followNexusPages<P extends Page>(fetchPage: (cursor: string | null) => Promise<P>, maxPages: number): Promise<{
+    pages: P[];
+    paging: CloudPaging;
+}>;
+/** The warnings a list's paging facts call for. */
+export declare function nexusPagingWarnings(what: string, paging: CloudPaging): CloudWarning[];
+/**
+ * The current CLEO project, or `null` outside one (or without a project id).
+ *
+ * @param apiUrl - API origin whose link entry to read.
+ * @param projectRoot - Explicit project root; defaults to the current one.
+ * @returns The project, its id and link entry, or `null`.
+ */
+export declare function currentNexusCloudProject(apiUrl: string, projectRoot?: string): NexusCloudProject | null;
+/**
+ * `cleo cloud whoami`: E2 `GET /v1/whoami`.
+ *
+ * @param opts - API URL, account, stores and test overrides.
+ * @returns Who is calling: user, organizations, credential and device.
+ */
+export declare function nexusCloudWhoami(opts?: NexusCloudOptions): Promise<CloudWhoamiResult>;
+/** Options for {@link listNexusCloudDevices}. */
+export interface NexusCloudDevicesOptions extends NexusCloudOptions {
+    /** `--state`; the server's default (`active` for device callers) when absent. */
+    state?: NexusDeviceListState;
+}
+/**
+ * `cleo cloud devices`: E5 `GET /v1/devices`, every page.
+ *
+ * @param opts - State filter, paging and test overrides.
+ * @returns Every device, newest first, with paging facts.
+ */
+export declare function listNexusCloudDevices(opts?: NexusCloudDevicesOptions): Promise<CloudDevicesResult>;
+/** Options for {@link listNexusCloudProjects}. */
+export interface NexusCloudProjectsOptions extends NexusCloudOptions {
+    /** `--org`: only this organization's projects. */
+    organizationId?: string;
+}
+/**
+ * `cleo cloud projects`: E13 `GET /v1/projects`, every page.
+ *
+ * @param opts - Organization filter, paging and test overrides.
+ * @returns Every visible project, newest first, with paging facts.
+ */
+export declare function listNexusCloudProjects(opts?: NexusCloudProjectsOptions): Promise<CloudProjectsResult>;
+/**
+ * Every replica of a project from E15, following its cursors.
+ *
+ * @param conn - Connection.
+ * @param projectId - Project id.
+ * @param opts - Paging overrides.
+ * @returns The replicas, oldest attachment first, and the paging facts.
+ */
+export declare function listNexusCloudReplicas(conn: NexusCloudConnection, projectId: string, opts?: Pick<NexusCloudOptions, 'maxPages' | 'pageLimit'>): Promise<{
+    replicas: NexusCloudReplica[];
+    paging: CloudPaging;
+}>;
+/** Options for {@link showNexusCloudProject}. */
+export interface NexusCloudProjectShowOptions extends NexusCloudOptions {
+    /** The project; defaults to the current project. */
+    projectId?: string;
+}
+/**
+ * `cleo cloud projects show [<id>]`: E14 `GET /v1/projects/:projectId`. When
+ * E14 cut its replica list at 50, the full list is read from E15.
+ *
+ * @param opts - Project id (default: the current project), paging and test overrides.
+ * @returns The project detail.
+ * @throws {NexusAccountError} `E_NEXUS_NOT_A_PROJECT` with no id outside a
+ *   project; `E_NEXUS_REQUEST_FAILED` for an unknown or invisible project.
+ */
+export declare function showNexusCloudProject(opts?: NexusCloudProjectShowOptions): Promise<CloudProjectShowResult>;
+/**
+ * The device credential store's location, for reports (never its contents).
+ *
+ * @param store - The store in use, if injected.
+ * @returns Absolute path of `nexus-device.json`.
+ */
+export declare function nexusCloudCredentialsPath(store?: NexusDeviceStore): string;
+export {};
+//# sourceMappingURL=nexus-cloud.d.ts.map

package/dist/cloud/nexus-cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-cloud.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EAGtB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAMtB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAElF,OAAO,EAAwB,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EAEL,KAAK,4BAA4B,EAElC,MAAM,kBAAkB,CAAC;AAG1B,2CAA2C;AAC3C,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mFAAmF;AACnF,MAAM,WAAW,iBAAkB,SAAQ,4BAA4B;IACrE,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,kBAAkB;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClC,uEAAuE;IACvE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5D,gFAAgF;IAChF,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACrE;AAED,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IAChC,oBAAoB;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAOjD;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,EAAE,CAEnF;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAwC/B;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC,GAC3D,MAAM,CAKR;AAED,uCAAuC;AACvC,UAAU,IAAI;IACZ,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,IAAI,EACnD,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAChD,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAiB9C;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,YAAY,EAAE,CAerF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACnB,iBAAiB,GAAG,IAAI,CAe1B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAI/F;AAED,iDAAiD;AACjD,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,iFAAiF;IACjF,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAoB7B;AAED,kDAAkD;AAClD,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB;IAClE,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,oBAAoB,EAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,WAAW,CAAM,GAC3D,OAAO,CAAC;IAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAcjE;AAED,iDAAiD;AACjD,MAAM,WAAW,4BAA6B,SAAQ,iBAAiB;IACrE,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAwCjC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAE1E"}