@cleocode/core 2026.9.26 → 2026.10.1

package/dist/build-provenance.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "gitHead": "ece9ba01e937f9281e5ee9ae1c96b211f754ceb6",
-  "builtAt": "2026-09-30T20:12:36.496Z",
+  "gitHead": "e59e96a5a5c55c7ec37d4367907603800fdc90b9",
+  "builtAt": "2026-10-01T05:29:07.574Z",
   "linkedWorktree": null
 }

package/dist/cloud/nexus-attach.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Attach this machine's copy of a project to Cleo Nexus and report its
+ * presence: steps 3 to 5 of `cleo project link` with a device credential
+ * (cleo-nexus device contract §3.6, §3.7).
+ *
+ * 1. `ensureProjectReplica` binds the canonical project store to a replica
+ *    once (no `sync.*` flag is set, so capture, push and pull stay off) and
+ *    returns its id.
+ * 2. `POST /v1/projects/:projectId/replicas {deviceId, replicaId}` pins that
+ *    replica to this Nexus device. The pin never moves: a 409 `replica-copied`
+ *    whose holder is a revoked device of the same user means this machine was
+ *    re-enrolled, so the store rebinds (`device-reenrolled`) and the new id is
+ *    attached; any other holder is a genuinely copied store and fails with
+ *    `E_NEXUS_REPLICA_COPIED`.
+ * 3. `PUT /v1/projects/:projectId/replicas/:replicaId/presence` sends the
+ *    path-free presence ({@link toReplicaPresence}) built from a local git
+ *    probe. A presence failure is a warning: the attach already stands.
+ *
+ * Nothing here sends a path, a hostname or a secret.
+ *
+ * @task T12905
+ * @epic T12323
+ */
+import type { NexusReplicaAttachment } from '@cleocode/contracts';
+import { type FetchLike } from './http.js';
+/** Timeout of each attach or presence call. */
+export declare const NEXUS_ATTACH_TIMEOUT_MS = 15000;
+/** The store binding the attach needs: bind once, and rebind on a re-enrolled device. */
+export interface ProjectReplicaBinder {
+    /** Bind the store if it is unbound; return the active replica id. */
+    ensure(): Promise<{
+        replicaId: string;
+        reboundFrom?: string;
+    }>;
+    /** Retire the active replica and mint a new id (contract §3.7, R6). */
+    rebindReenrolled(): Promise<{
+        replicaId: string;
+        previousReplicaId: string;
+    }>;
+}
+/** Options for {@link attachProjectReplica}. */
+export interface AttachProjectReplicaOptions {
+    /** Resolved API origin. */
+    apiUrl: string;
+    /** The device credential's bearer token (never logged). */
+    bearer: string;
+    /** This machine's Nexus device id. */
+    deviceId: string;
+    /** The server's project id. */
+    projectId: string;
+    /** Project root, for the local git probe only (never sent). */
+    projectRoot: string;
+    /** CLEO version reported in presence. */
+    cliVersion: string;
+    /** Store binding; defaults to the canonical project store ({@link canonicalReplicaBinder}). */
+    binder?: ProjectReplicaBinder;
+    /** `fetch` override. */
+    fetch?: FetchLike;
+    /** Clock, for the presence observation time when git cannot be probed. */
+    now?: () => Date;
+    /** Per-call timeout; default {@link NEXUS_ATTACH_TIMEOUT_MS}. */
+    timeoutMs?: number;
+    /**
+     * `cleo project link --rebind`: retire the store's replica and mint a new id
+     * before attaching. The remedy when the old id is held by another device:
+     * this machine's revoked device after a re-enrolment (when the server cannot
+     * say so itself), or the original of a copied store.
+     */
+    rebind?: boolean;
+}
+/**
+ * The binder over the canonical project store: opens it through the
+ * dual-scope chokepoint (never a raw file) and binds in live mode.
+ *
+ * @param projectRoot - Project root whose `.cleo/cleo.db` holds the replica.
+ * @returns A binder for {@link attachProjectReplica}.
+ */
+export declare function canonicalReplicaBinder(projectRoot: string): ProjectReplicaBinder;
+/**
+ * Attach the project store's replica to this Nexus device and report its
+ * presence (contract §3.6 steps 3 to 5). Idempotent: a repeat attaches the
+ * same replica id (200) and re-sends presence.
+ *
+ * @param opts - Origin, credential, ids, project root and test overrides.
+ * @returns The attachment and any warnings (a failed presence report).
+ * @throws {NexusAccountError} `E_NEXUS_REPLICA_COPIED` when another live
+ *   device or another user holds this replica id; an API error from the
+ *   attach otherwise (mapped by the caller).
+ */
+export declare function attachProjectReplica(opts: AttachProjectReplicaOptions): Promise<{
+    replica: NexusReplicaAttachment;
+    warnings: string[];
+}>;
+//# sourceMappingURL=nexus-attach.d.ts.map

package/dist/cloud/nexus-attach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-attach.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-attach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAsB,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAItF,OAAO,EAAE,KAAK,SAAS,EAAoB,MAAM,WAAW,CAAC;AAI7D,+CAA+C;AAC/C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,yFAAyF;AACzF,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,MAAM,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,uEAAuE;IACvE,gBAAgB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED,gDAAgD;AAChD,MAAM,WAAW,2BAA2B;IAC1C,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAKD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,oBAAoB,CAkBhF;AAmED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA2ElE"}

package/dist/cloud/nexus-attach.js

@@ -0,0 +1,192 @@
+/**
+ * Attach this machine's copy of a project to Cleo Nexus and report its
+ * presence: steps 3 to 5 of `cleo project link` with a device credential
+ * (cleo-nexus device contract §3.6, §3.7).
+ *
+ * 1. `ensureProjectReplica` binds the canonical project store to a replica
+ *    once (no `sync.*` flag is set, so capture, push and pull stay off) and
+ *    returns its id.
+ * 2. `POST /v1/projects/:projectId/replicas {deviceId, replicaId}` pins that
+ *    replica to this Nexus device. The pin never moves: a 409 `replica-copied`
+ *    whose holder is a revoked device of the same user means this machine was
+ *    re-enrolled, so the store rebinds (`device-reenrolled`) and the new id is
+ *    attached; any other holder is a genuinely copied store and fails with
+ *    `E_NEXUS_REPLICA_COPIED`.
+ * 3. `PUT /v1/projects/:projectId/replicas/:replicaId/presence` sends the
+ *    path-free presence ({@link toReplicaPresence}) built from a local git
+ *    probe. A presence failure is a warning: the attach already stands.
+ *
+ * Nothing here sends a path, a hostname or a secret.
+ *
+ * @task T12905
+ * @epic T12323
+ */
+import { ReplicaPresence } from '@cleocode/contracts/cloud';
+import { z } from 'zod';
+import { probeGitState } from '../nexus/git-state.js';
+import { Http, NexusError } from './http.js';
+import { NexusAccountError } from './nexus-auth.js';
+import { toReplicaPresence } from './presence.js';
+/** Timeout of each attach or presence call. */
+export const NEXUS_ATTACH_TIMEOUT_MS = 15_000;
+const attachAnswer = z.looseObject({ replicaId: z.string() });
+const presenceAnswer = z.looseObject({ presenceAt: z.string() });
+/**
+ * The binder over the canonical project store: opens it through the
+ * dual-scope chokepoint (never a raw file) and binds in live mode.
+ *
+ * @param projectRoot - Project root whose `.cleo/cleo.db` holds the replica.
+ * @returns A binder for {@link attachProjectReplica}.
+ */
+export function canonicalReplicaBinder(projectRoot) {
+    const open = async () => {
+        const { openDualScopeDb, getDualScopeNativeDb } = await import('../store/dual-scope-db.js');
+        const handle = await openDualScopeDb('project', projectRoot);
+        return { db: getDualScopeNativeDb(handle), dbPath: handle.dbPath };
+    };
+    return {
+        async ensure() {
+            const { ensureProjectReplica } = await import('../store/sync/replica.js');
+            const { db, dbPath } = await open();
+            return ensureProjectReplica(db, { dbPath, mode: 'live' });
+        },
+        async rebindReenrolled() {
+            const { rebindReplica } = await import('../store/sync/replica.js');
+            const { db, dbPath } = await open();
+            return rebindReplica(db, { dbPath, scope: 'project', mode: 'live' }, 'device-reenrolled');
+        },
+    };
+}
+/** True for the 409 the contract answers when this machine's own revoked device holds the replica. */
+function isReenrolledHolder(err) {
+    return (err instanceof NexusError &&
+        err.status === 409 &&
+        err.details?.['holderState'] === 'revoked' &&
+        err.details?.['holderSameUser'] === true);
+}
+/** The local git state as a presence body; never throws (a failed probe sends no git block). */
+async function presenceBody(opts, replicaId) {
+    const now = opts.now ?? (() => new Date());
+    const git = await probeGitState({
+        projectId: opts.projectId,
+        deviceId: opts.deviceId,
+        path: opts.projectRoot,
+    });
+    const location = {
+        deviceId: opts.deviceId,
+        replicaId,
+        hostname: null,
+        current: true,
+        path: opts.projectRoot,
+        state: 'live',
+        lastSeen: now().toISOString(),
+        git: git.probeErrorCode !== null && git.gitRoot === null
+            ? null
+            : {
+                branch: git.branch,
+                headSha: git.headSha,
+                headCommittedAt: git.headCommittedAt,
+                detached: git.detached,
+                dirtyCount: git.dirtyCount,
+                untrackedCount: git.untrackedCount,
+                remote: {
+                    name: git.remoteName,
+                    url: git.remoteUrl,
+                    upstream: git.upstream,
+                    headSha: git.remoteHeadSha,
+                    ahead: git.ahead,
+                    behind: git.behind,
+                    fetchedAt: git.remoteFetchedAt,
+                    stale: git.remoteStale,
+                },
+                probedAt: git.probedAt,
+                probeStale: false,
+                probeErrorCode: git.probeErrorCode,
+                probeError: git.probeError,
+            },
+        flags: [],
+    };
+    return toReplicaPresence(location, {
+        deviceId: opts.deviceId,
+        hostname: null,
+        os: null,
+        arch: null,
+        cleoVersion: opts.cliVersion,
+        lastHeartbeatAt: null,
+        heartbeatStale: false,
+        current: true,
+    });
+}
+/**
+ * Attach the project store's replica to this Nexus device and report its
+ * presence (contract §3.6 steps 3 to 5). Idempotent: a repeat attaches the
+ * same replica id (200) and re-sends presence.
+ *
+ * @param opts - Origin, credential, ids, project root and test overrides.
+ * @returns The attachment and any warnings (a failed presence report).
+ * @throws {NexusAccountError} `E_NEXUS_REPLICA_COPIED` when another live
+ *   device or another user holds this replica id; an API error from the
+ *   attach otherwise (mapped by the caller).
+ */
+export async function attachProjectReplica(opts) {
+    const binder = opts.binder ?? canonicalReplicaBinder(opts.projectRoot);
+    const timeoutMs = opts.timeoutMs ?? NEXUS_ATTACH_TIMEOUT_MS;
+    const base = opts.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    const http = new Http({
+        baseUrl: opts.apiUrl,
+        token: opts.bearer,
+        deviceId: opts.deviceId,
+        fetch: (input, init) => base(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }),
+        maxAttempts: 2,
+    });
+    const path = `/v1/projects/${encodeURIComponent(opts.projectId)}/replicas`;
+    const attach = (replicaId) => http.request('POST', path, attachAnswer, { deviceId: opts.deviceId, replicaId });
+    const bound = await binder.ensure();
+    let replicaId = bound.replicaId;
+    let reboundFrom = bound.reboundFrom ?? null;
+    if (opts.rebind === true) {
+        const rebound = await binder.rebindReenrolled();
+        replicaId = rebound.replicaId;
+        // If ensure() already rebound a copy, the id that was last attached is
+        // that earlier one: keep it as the reported previous id (review N3b).
+        reboundFrom = reboundFrom ?? rebound.previousReplicaId;
+    }
+    try {
+        await attach(replicaId);
+    }
+    catch (err) {
+        if (!isReenrolledHolder(err)) {
+            if (err instanceof NexusError && err.status === 409) {
+                // The deployed server's 409 does not say who holds the replica
+                // (no holderState/holderSameUser yet), so name both causes and the
+                // one remedy that fixes either: a new replica id.
+                throw new NexusAccountError('E_NEXUS_REPLICA_COPIED', `this project's store (replica ${replicaId}) is already attached from another Nexus device: either this machine was re-enrolled as a new device (after a revoke), or the store was copied from another machine`, 'run `cleo project link --rebind` to give this copy a new replica id and attach it; if another machine holds the original, it keeps its own');
+            }
+            throw err;
+        }
+        const rebound = await binder.rebindReenrolled();
+        replicaId = rebound.replicaId;
+        reboundFrom = rebound.previousReplicaId;
+        try {
+            await attach(replicaId);
+        }
+        catch (second) {
+            throw new NexusAccountError('E_NEXUS_REQUEST_FAILED', `this store was rebound from replica ${rebound.previousReplicaId} to ${replicaId} (this machine was re-enrolled), but attaching the new id failed: ${second instanceof Error ? second.message : String(second)}`, 're-run `cleo project link` to finish the attach');
+        }
+    }
+    const warnings = [];
+    let presenceAt = null;
+    try {
+        const body = ReplicaPresence.parse(await presenceBody(opts, replicaId));
+        const answer = await http.request('PUT', `${path}/${encodeURIComponent(replicaId)}/presence`, presenceAnswer, body);
+        presenceAt = answer.presenceAt;
+    }
+    catch (err) {
+        warnings.push(`the project is attached, but its presence report failed (${err instanceof Error ? err.message : String(err)}); re-run \`cleo project link\` to send it`);
+    }
+    return {
+        replica: { replicaId, deviceId: opts.deviceId, reboundFrom, presenceAt },
+        warnings,
+    };
+}
+//# sourceMappingURL=nexus-attach.js.map

package/dist/cloud/nexus-attach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-attach.js","sourceRoot":"","sources":["../../src/cloud/nexus-attach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAyC9C,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9D,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACpC,OAAO,oBAAoB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACnE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,SAAS;QAC1C,GAAG,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,KAAK,IAAI,CACzC,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,YAAY,CAAC,IAAiC,EAAE,SAAiB;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,WAAW;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAuB;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS;QACT,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;QAC7B,GAAG,EACD,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;YACjD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM,EAAE;oBACN,IAAI,EAAE,GAAG,CAAC,UAAU;oBACpB,GAAG,EAAE,GAAG,CAAC,SAAS;oBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,OAAO,EAAE,GAAG,CAAC,aAAa;oBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,eAAe;oBAC9B,KAAK,EAAE,GAAG,CAAC,WAAW;iBACvB;gBACD,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,KAAK;gBACjB,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B;QACP,KAAK,EAAE,EAAE;KACV,CAAC;IACF,OAAO,iBAAiB,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI;QACd,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAiC;IAEjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;IAC3E,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,EAAE,CACnC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAChC,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9B,uEAAuE;QACvE,sEAAsE;QACtE,WAAW,GAAG,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;IACzD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACpD,+DAA+D;gBAC/D,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,iCAAiC,SAAS,qKAAqK,EAC/M,4IAA4I,CAC7I,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9B,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,uCAAuC,OAAO,CAAC,iBAAiB,OAAO,SAAS,qEAAqE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAChN,iDAAiD,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,KAAK,EACL,GAAG,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC,WAAW,EACnD,cAAc,EACd,IAAI,CACL,CAAC;QACF,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,4DAA4D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4CAA4C,CACzJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE;QACxE,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/cloud/nexus-auth.d.ts

@@ -28,6 +28,7 @@ import { type NexusAccountErrorCode, type NexusAccountMe, type NexusAccountOrgan
 import { type DeviceCodeConfig, type DeviceCodeStartResponse, pollForToken } from '../llm/oauth/device-code.js';
 import { type FetchLike } from './http.js';
 import { type NexusTokenStore, type SealedNexusSession } from './nexus-credentials.js';
+import { NexusDeviceStore } from './nexus-device.js';
 /** Environment override for the default API origin (e.g. staging). */
 export declare const NEXUS_API_URL_ENV = "CLEO_NEXUS_API_URL";
 /** Default time budget for the server-side revocation at logout. */
@@ -82,6 +83,14 @@ export interface NexusStatusOptions {
     live?: boolean;
     /** Time budget per live check. */
     timeoutMs?: number;
+    /**
+     * Report device credentials (`nexus-device.json`) too; default `true`,
+     * whatever `CLEO_NEXUS_DEVICE` says. A device credential replaces the 9.24
+     * session row of the same user on its origin.
+     */
+    devices?: boolean;
+    /** Device store; defaults to `<cleoHome>/nexus-device.json`. */
+    deviceStore?: NexusDeviceStore;
 }
 /**
  * Resolve and validate the API URL to its origin.
@@ -175,10 +184,13 @@ export declare function logoutFromNexus(opts?: NexusLogoutOptions): Promise<Nexu
 export declare function signOutNexusSessionToken(apiUrl: string, bearer: string, timeoutMs: number, fetchImpl?: FetchLike): Promise<'revoked' | 'already-invalid'>;
 /**
  * Secret-free status rows for `cleo status` and `cleo auth list`: one per
- * stored session, or one "not signed in" row for the default origin. Makes a
- * network call only when a token is stored.
+ * device credential (when device credentials are on) and one per stored 9.24
+ * session on an origin no device credential covers, or one "not signed in"
+ * row for the default origin. Makes a network call only when a credential is
+ * stored. A device that is signed out locally (no current credential) is not
+ * signed in.
  *
- * @param opts - Origin filter, store, liveness and test overrides.
+ * @param opts - Origin filter, stores, liveness and test overrides.
  * @returns Status rows, sorted by origin.
  */
 export declare function getNexusAccountStatus(opts?: NexusStatusOptions): Promise<NexusAccountStatus[]>;

package/dist/cloud/nexus-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-auth.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAE5B,YAAY,EAEb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,SAAS,EAAiC,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,KAAK;IAOxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB;IAEpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IARvB;;;;OAIG;gBAEQ,IAAI,EAAE,qBAAqB,EACpC,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA;CAKxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACjD,mEAAmE;IACnE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,uBAAuB;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yCAAyC;IACzC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAevD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAQ7F;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAwBhF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,cAAc,GAAG,wBAAwB,GAAG,IAAI,CAE5F;AAgDD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoC1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CA0CnD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyB/F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAgBxC;AAsDD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}
+{"version":3,"file":"nexus-auth.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAE5B,YAAY,EAEb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,SAAS,EAAiC,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAqB,MAAM,mBAAmB,CAAC;AAExE,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,KAAK;IAOxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB;IAEpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IARvB;;;;OAIG;gBAEQ,IAAI,EAAE,qBAAqB,EACpC,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA;CAKxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACjD,mEAAmE;IACnE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,uBAAuB;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yCAAyC;IACzC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAevD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAQ7F;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAwBhF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,cAAc,GAAG,wBAAwB,GAAG,IAAI,CAE5F;AAgDD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoC1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CA0CnD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyB/F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAgBxC;AAoFD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAwD/B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}

package/dist/cloud/nexus-auth.js

@@ -28,6 +28,7 @@ import { NEXUS_CLI_CLIENT_ID, NEXUS_DEFAULT_API_URL, nexusAccountMeSchema, } fro
 import { DeviceCodeAuthError, DeviceCodeTimeoutError, pollForToken, startDeviceCodeFlow, } from '../llm/oauth/device-code.js';
 import { Http, isSecureUrl, NexusError } from './http.js';
 import { FileNexusTokenStore, } from './nexus-credentials.js';
+import { NexusDeviceStore, SealedNexusDevice } from './nexus-device.js';
 /** Environment override for the default API origin (e.g. staging). */
 export const NEXUS_API_URL_ENV = 'CLEO_NEXUS_API_URL';
 /** Default time budget for the server-side revocation at logout. */
@@ -364,22 +365,105 @@ async function checkSession(session, opts) {
         return statusRow(session.apiUrl, 'unverified', session, null);
     }
 }
+/**
+ * Check one device credential against the API (E2 `GET /v1/whoami`, the call
+ * the device contract prefers for status). A 401 (signed out, revoked or
+ * expired) reads as `expired`; no answer reads as `unverified`.
+ */
+async function checkDevice(device, bearer, opts) {
+    if (opts.live === false)
+        return statusRow(device.origin, 'unverified', null, null);
+    const timeoutMs = opts.timeoutMs ?? NEXUS_STATUS_TIMEOUT_MS;
+    const base = opts.fetch ?? ((input, init) => fetch(input, init));
+    const http = new Http({
+        baseUrl: device.origin,
+        token: bearer,
+        fetch: (input, init) => base(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }),
+        maxAttempts: 1,
+    });
+    try {
+        const me = await http.request('GET', '/v1/whoami', nexusAccountMeSchema);
+        return statusRow(device.origin, 'signed-in', null, me);
+    }
+    catch (err) {
+        if (err instanceof NexusError && err.status === 401) {
+            return statusRow(device.origin, 'expired', null, null);
+        }
+        return statusRow(device.origin, 'unverified', null, null);
+    }
+}
 /**
  * Secret-free status rows for `cleo status` and `cleo auth list`: one per
- * stored session, or one "not signed in" row for the default origin. Makes a
- * network call only when a token is stored.
+ * device credential (when device credentials are on) and one per stored 9.24
+ * session on an origin no device credential covers, or one "not signed in"
+ * row for the default origin. Makes a network call only when a credential is
+ * stored. A device that is signed out locally (no current credential) is not
+ * signed in.
  *
- * @param opts - Origin filter, store, liveness and test overrides.
+ * @param opts - Origin filter, stores, liveness and test overrides.
  * @returns Status rows, sorted by origin.
  */
 export async function getNexusAccountStatus(opts = {}) {
     const store = opts.store ?? new FileNexusTokenStore();
     const only = opts.apiUrl !== undefined ? resolveNexusApiUrl(opts.apiUrl) : null;
-    const sessions = (await store.list()).filter((s) => only === null || s.apiUrl === only);
-    if (sessions.length === 0) {
+    const checks = [];
+    const extra = [];
+    /** `origin\u0000userId` pairs a device credential covers; a session of the same user is a leftover. */
+    const covered = new Set();
+    // Device credentials are always reported, whatever CLEO_NEXUS_DEVICE says:
+    // the switch picks the login flow, and hiding a live credential would let
+    // `CLEO_NEXUS_DEVICE=0` users believe they are signed out (review M2).
+    if (opts.devices ?? true) {
+        try {
+            for (const d of await (opts.deviceStore ?? new NexusDeviceStore()).list()) {
+                if (only !== null && d.origin !== only)
+                    continue;
+                if (!(d instanceof SealedNexusDevice)) {
+                    extra.push({
+                        apiUrl: d.origin,
+                        state: 'unverified',
+                        email: null,
+                        organization: null,
+                        expiresAt: null,
+                        summary: `device entry for user ${d.userId} cannot be opened on this machine (${d.reason}); run \`cleo login nexus\` to enrol this machine`,
+                    });
+                    continue;
+                }
+                // Status reads only the current credential: probing a pending
+                // rotation credential would be its first use (§2.5), a write.
+                const bearer = d.currentBearer();
+                if (bearer === null)
+                    continue;
+                covered.add(`${d.origin}\u0000${d.userId}`);
+                checks.push(checkDevice(d, bearer, opts));
+            }
+        }
+        catch (err) {
+            // A device file that cannot be read never hides the session rows (review M1).
+            extra.push({
+                apiUrl: only ?? resolveNexusApiUrl(),
+                state: 'unverified',
+                email: null,
+                organization: null,
+                expiresAt: null,
+                summary: `device credentials unreadable: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+    for (const s of await store.list()) {
+        if (only !== null && s.apiUrl !== only)
+            continue;
+        // A leftover 9.24 session of the user a device credential already covers
+        // is not shown twice; a session of any other user is (review L3).
+        if (s.user !== null && covered.has(`${s.apiUrl}\u0000${s.user.id}`))
+            continue;
+        checks.push(checkSession(s, opts));
+    }
+    const rows = [...(await Promise.all(checks)), ...extra];
+    if (rows.length === 0) {
         return [statusRow(only ?? resolveNexusApiUrl(), 'not-signed-in', null, null)];
     }
-    return Promise.all(sessions.map((s) => checkSession(s, opts)));
+    return rows.sort((a, b) => a.apiUrl.localeCompare(b.apiUrl));
 }
 /**
  * The stored session for an origin, or a `E_NEXUS_NOT_SIGNED_IN` error.

package/dist/cloud/nexus-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AA4CD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,IAAuB,EACvB,KAAc;IAEd,MAAM,GAAG,GAAqB;QAC5B,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,wBAAwB,CACzC,MAAM,EACN,OAAO,CAAC,MAAM,EAAE,EAChB,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAExE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAoDD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,IAAuB,EACvB,KAAc;IAEd,MAAM,GAAG,GAAqB;QAC5B,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,wBAAwB,CACzC,MAAM,EACN,OAAO,CAAC,MAAM,EAAE,EAChB,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,MAAyB,EACzB,MAAc,EACd,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,MAAM,GAAkC,EAAE,CAAC;IACjD,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,uGAAuG;IACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1E,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,SAAS;gBACjD,IAAI,CAAC,CAAC,CAAC,YAAY,iBAAiB,CAAC,EAAE,CAAC;oBACtC,KAAK,CAAC,IAAI,CAAC;wBACT,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,KAAK,EAAE,YAAY;wBACnB,KAAK,EAAE,IAAI;wBACX,YAAY,EAAE,IAAI;wBAClB,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,yBAAyB,CAAC,CAAC,MAAM,sCAAsC,CAAC,CAAC,MAAM,mDAAmD;qBAC5I,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,8DAA8D;gBAC9D,8DAA8D;gBAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,IAAI;oBAAE,SAAS;gBAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,IAAI,IAAI,kBAAkB,EAAE;gBACpC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,SAAS;QACjD,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAE,SAAS;QAC9E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}