@cleocode/core 2026.9.26 → 2026.10.2

package/dist/cloud/nexus-attach.js

@@ -0,0 +1,267 @@
+/**
+ * Attach this machine's copy of a project to Cleo Nexus and report its
+ * presence: steps 3 to 5 of `cleo project link` with a device credential
+ * (cleo-nexus device contract §3.6, §3.7).
+ *
+ * 1. `ensureProjectReplica` binds the canonical project store to a replica
+ *    once (no `sync.*` flag is set, so capture, push and pull stay off) and
+ *    returns its id.
+ * 2. `POST /v1/projects/:projectId/replicas {deviceId, replicaId}` pins that
+ *    replica to this Nexus device. The pin never moves: a 409 `replica-copied`
+ *    whose holder is a revoked device of the same user means this machine was
+ *    re-enrolled, so the store rebinds (`device-reenrolled`) and the new id is
+ *    attached; any other holder is a genuinely copied store and fails with
+ *    `E_NEXUS_REPLICA_COPIED`.
+ * 3. `PUT /v1/projects/:projectId/replicas/:replicaId/presence` sends the
+ *    path-free presence ({@link toReplicaPresence}) built from a local git
+ *    probe. A presence failure is a warning: the attach already stands.
+ *
+ * Nothing here sends a path, a hostname or a secret.
+ *
+ * @task T12905
+ * @epic T12323
+ */
+import { ReplicaPresence } from '@cleocode/contracts/cloud';
+import { z } from 'zod';
+import { probeGitState } from '../nexus/git-state.js';
+import { Http, NexusError } from './http.js';
+import { NexusAccountError } from './nexus-auth.js';
+import { toReplicaPresence } from './presence.js';
+/** Timeout of each attach or presence call. */
+export const NEXUS_ATTACH_TIMEOUT_MS = 15_000;
+const attachAnswer = z.looseObject({ replicaId: z.string() });
+const presenceAnswer = z.looseObject({ presenceAt: z.string() });
+/**
+ * The binder over the canonical project store: opens it through the
+ * dual-scope chokepoint (never a raw file) and binds in live mode.
+ *
+ * @param projectRoot - Project root whose `.cleo/cleo.db` holds the replica.
+ * @returns A binder for {@link attachProjectReplica}.
+ */
+export function canonicalReplicaBinder(projectRoot) {
+    const open = async () => {
+        const { openDualScopeDb, getDualScopeNativeDb } = await import('../store/dual-scope-db.js');
+        const handle = await openDualScopeDb('project', projectRoot);
+        return { db: getDualScopeNativeDb(handle), dbPath: handle.dbPath };
+    };
+    return {
+        async ensure() {
+            const { ensureProjectReplica } = await import('../store/sync/replica.js');
+            const { db, dbPath } = await open();
+            return ensureProjectReplica(db, { dbPath, mode: 'live' });
+        },
+        async rebindReenrolled() {
+            const { rebindReplica } = await import('../store/sync/replica.js');
+            const { db, dbPath } = await open();
+            return rebindReplica(db, { dbPath, scope: 'project', mode: 'live' }, 'device-reenrolled');
+        },
+    };
+}
+/**
+ * The binder over the global store (`<cleoHome>/cleo.db`): binds its
+ * global-scope replica, the one the account's `home:` stream knows this
+ * device's main brain by (T12952).
+ *
+ * @returns A binder for {@link attachHomeReplica}.
+ */
+export function canonicalGlobalReplicaBinder() {
+    const open = async () => {
+        const { openDualScopeDb, getDualScopeNativeDb } = await import('../store/dual-scope-db.js');
+        const handle = await openDualScopeDb('global');
+        return { db: getDualScopeNativeDb(handle), dbPath: handle.dbPath };
+    };
+    return {
+        async ensure() {
+            const { ensureGlobalReplica } = await import('../store/sync/replica.js');
+            const { db, dbPath } = await open();
+            return ensureGlobalReplica(db, { dbPath, mode: 'live' });
+        },
+        async rebindReenrolled() {
+            const { rebindReplica } = await import('../store/sync/replica.js');
+            const { db, dbPath } = await open();
+            return rebindReplica(db, { dbPath, scope: 'global', mode: 'live' }, 'device-reenrolled');
+        },
+    };
+}
+/** True for the 409 the contract answers when this machine's own revoked device holds the replica. */
+function isReenrolledHolder(err) {
+    return (err instanceof NexusError &&
+        err.status === 409 &&
+        err.details?.['holderState'] === 'revoked' &&
+        err.details?.['holderSameUser'] === true);
+}
+/** The local git state as a presence body; never throws (a failed probe sends no git block). */
+async function presenceBody(opts, replicaId) {
+    const now = opts.now ?? (() => new Date());
+    const git = await probeGitState({
+        projectId: opts.projectId,
+        deviceId: opts.deviceId,
+        path: opts.projectRoot,
+    });
+    const location = {
+        deviceId: opts.deviceId,
+        replicaId,
+        hostname: null,
+        current: true,
+        path: opts.projectRoot,
+        state: 'live',
+        lastSeen: now().toISOString(),
+        git: git.probeErrorCode !== null && git.gitRoot === null
+            ? null
+            : {
+                branch: git.branch,
+                headSha: git.headSha,
+                headCommittedAt: git.headCommittedAt,
+                detached: git.detached,
+                dirtyCount: git.dirtyCount,
+                untrackedCount: git.untrackedCount,
+                remote: {
+                    name: git.remoteName,
+                    url: git.remoteUrl,
+                    upstream: git.upstream,
+                    headSha: git.remoteHeadSha,
+                    ahead: git.ahead,
+                    behind: git.behind,
+                    fetchedAt: git.remoteFetchedAt,
+                    stale: git.remoteStale,
+                },
+                probedAt: git.probedAt,
+                probeStale: false,
+                probeErrorCode: git.probeErrorCode,
+                probeError: git.probeError,
+            },
+        flags: [],
+    };
+    return toReplicaPresence(location, {
+        deviceId: opts.deviceId,
+        hostname: null,
+        os: null,
+        arch: null,
+        cleoVersion: opts.cliVersion,
+        lastHeartbeatAt: null,
+        heartbeatStale: false,
+        current: true,
+    });
+}
+/**
+ * Attach the project store's replica to this Nexus device and report its
+ * presence (contract §3.6 steps 3 to 5). Idempotent: a repeat attaches the
+ * same replica id (200) and re-sends presence.
+ *
+ * @param opts - Origin, credential, ids, project root and test overrides.
+ * @returns The attachment and any warnings (a failed presence report).
+ * @throws {NexusAccountError} `E_NEXUS_REPLICA_COPIED` when another live
+ *   device or another user holds this replica id; an API error from the
+ *   attach otherwise (mapped by the caller).
+ */
+export async function attachProjectReplica(opts) {
+    return attachReplicaAt({
+        ...opts,
+        binder: opts.binder ?? canonicalReplicaBinder(opts.projectRoot),
+        what: "this project's store",
+        relink: '`cleo project link`',
+        kind: 'project',
+    }, `/v1/projects/${encodeURIComponent(opts.projectId)}/replicas`, (replicaId) => presenceBody(opts, replicaId));
+}
+/**
+ * Attach this device's global store (the main brain) to the account's
+ * `home:` stream and report its presence (T12952; cleo-nexus T084): the
+ * same rules as {@link attachProjectReplica}, on `/v1/account/home/replicas`.
+ * Presence carries no git block (the global store is not a repository).
+ *
+ * @param opts - Origin, credential, ids and test overrides.
+ * @returns The attachment and any warnings.
+ * @throws {NexusAccountError} `E_NEXUS_REPLICA_COPIED`, or an API error.
+ */
+export async function attachHomeReplica(opts) {
+    return attachReplicaAt({
+        ...opts,
+        binder: opts.binder ?? canonicalGlobalReplicaBinder(),
+        what: 'your global CLEO store',
+        relink: '`cleo login nexus`',
+        kind: 'home',
+    }, '/v1/account/home/replicas', (replicaId) => toReplicaPresence({
+        deviceId: opts.deviceId,
+        replicaId,
+        hostname: null,
+        current: true,
+        path: '',
+        state: 'live',
+        lastSeen: (opts.now ?? (() => new Date()))().toISOString(),
+        git: null,
+        flags: [],
+    }, {
+        deviceId: opts.deviceId,
+        hostname: null,
+        os: null,
+        arch: null,
+        cleoVersion: opts.cliVersion,
+        lastHeartbeatAt: null,
+        heartbeatStale: false,
+        current: true,
+    }));
+}
+/** Shared attach flow over one replicas collection path. */
+async function attachReplicaAt(opts, path, presenceOf) {
+    const binder = opts.binder;
+    const timeoutMs = opts.timeoutMs ?? NEXUS_ATTACH_TIMEOUT_MS;
+    const base = opts.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    const http = new Http({
+        baseUrl: opts.apiUrl,
+        token: opts.bearer,
+        deviceId: opts.deviceId,
+        fetch: (input, init) => base(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }),
+        maxAttempts: 2,
+    });
+    const attach = (replicaId) => http.request('POST', path, attachAnswer, { deviceId: opts.deviceId, replicaId });
+    const bound = await binder.ensure();
+    let replicaId = bound.replicaId;
+    let reboundFrom = bound.reboundFrom ?? null;
+    if (opts.rebind === true) {
+        const rebound = await binder.rebindReenrolled();
+        replicaId = rebound.replicaId;
+        // If ensure() already rebound a copy, the id that was last attached is
+        // that earlier one: keep it as the reported previous id (review N3b).
+        reboundFrom = reboundFrom ?? rebound.previousReplicaId;
+    }
+    try {
+        await attach(replicaId);
+    }
+    catch (err) {
+        if (!isReenrolledHolder(err)) {
+            if (err instanceof NexusError && err.status === 409) {
+                // The deployed server's 409 does not say who holds the replica
+                // (no holderState/holderSameUser yet), so name both causes and the
+                // one remedy that fixes either: a new replica id.
+                throw new NexusAccountError('E_NEXUS_REPLICA_COPIED', `${opts.what} (replica ${replicaId}) is already attached from another Nexus device: either this machine was re-enrolled as a new device (after a revoke), or the store was copied from another machine`, opts.kind === 'project'
+                    ? 'run `cleo project link --rebind` to give this copy a new replica id and attach it; if another machine holds the original, it keeps its own'
+                    : 'revoke the stale device on cleocode.dev, then run `cleo login nexus` again');
+            }
+            throw err;
+        }
+        const rebound = await binder.rebindReenrolled();
+        replicaId = rebound.replicaId;
+        reboundFrom = rebound.previousReplicaId;
+        try {
+            await attach(replicaId);
+        }
+        catch (second) {
+            throw new NexusAccountError('E_NEXUS_REQUEST_FAILED', `this store was rebound from replica ${rebound.previousReplicaId} to ${replicaId} (this machine was re-enrolled), but attaching the new id failed: ${second instanceof Error ? second.message : String(second)}`, `re-run ${opts.relink} to finish the attach`);
+        }
+    }
+    const warnings = [];
+    let presenceAt = null;
+    try {
+        const body = ReplicaPresence.parse(await presenceOf(replicaId));
+        const answer = await http.request('PUT', `${path}/${encodeURIComponent(replicaId)}/presence`, presenceAnswer, body);
+        presenceAt = answer.presenceAt;
+    }
+    catch (err) {
+        warnings.push(`${opts.what} is attached, but its presence report failed (${err instanceof Error ? err.message : String(err)}); re-run ${opts.relink} to send it`);
+    }
+    return {
+        replica: { replicaId, deviceId: opts.deviceId, reboundFrom, presenceAt },
+        warnings,
+    };
+}
+//# sourceMappingURL=nexus-attach.js.map

package/dist/cloud/nexus-attach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-attach.js","sourceRoot":"","sources":["../../src/cloud/nexus-attach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAyC9C,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9D,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAC1E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACpC,OAAO,oBAAoB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACnE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACpC,OAAO,mBAAmB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,gBAAgB;YACpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACnE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,EAAE,CAAC;YACpC,OAAO,aAAa,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,CACL,GAAG,YAAY,UAAU;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG;QAClB,GAAG,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,SAAS;QAC1C,GAAG,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,KAAK,IAAI,CACzC,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,YAAY,CAAC,IAAiC,EAAE,SAAiB;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,WAAW;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAuB;QACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS;QACT,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;QAC7B,GAAG,EACD,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;YACjD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM,EAAE;oBACN,IAAI,EAAE,GAAG,CAAC,UAAU;oBACpB,GAAG,EAAE,GAAG,CAAC,SAAS;oBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,OAAO,EAAE,GAAG,CAAC,aAAa;oBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,eAAe;oBAC9B,KAAK,EAAE,GAAG,CAAC,WAAW;iBACvB;gBACD,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,KAAK;gBACjB,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B;QACP,KAAK,EAAE,EAAE;KACV,CAAC;IACF,OAAO,iBAAiB,CAAC,QAAQ,EAAE;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI;QACd,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAiC;IAEjC,OAAO,eAAe,CACpB;QACE,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;QAC/D,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,qBAAqB;QAC7B,IAAI,EAAE,SAAS;KAChB,EACD,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAC7D,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAC7C,CAAC;AACJ,CAAC;AAMD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAA8B;IAE9B,OAAO,eAAe,CACpB;QACE,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,4BAA4B,EAAE;QACrD,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,oBAAoB;QAC5B,IAAI,EAAE,MAAM;KACb,EACD,2BAA2B,EAC3B,CAAC,SAAS,EAAE,EAAE,CACZ,iBAAiB,CACf;QACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS;QACT,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;QAC1D,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,EAAE;KACV,EACD;QACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI;QACd,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE,IAAI;KACd,CACF,CACJ,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,KAAK,UAAU,eAAe,CAC5B,IAQC,EACD,IAAY,EACZ,UAA0C;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAClG,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,EAAE,CACnC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,IAAI,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAChC,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9B,uEAAuE;QACvE,sEAAsE;QACtE,WAAW,GAAG,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;IACzD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACpD,+DAA+D;gBAC/D,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,GAAG,IAAI,CAAC,IAAI,aAAa,SAAS,qKAAqK,EACvM,IAAI,CAAC,IAAI,KAAK,SAAS;oBACrB,CAAC,CAAC,4IAA4I;oBAC9I,CAAC,CAAC,4EAA4E,CACjF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC9B,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,CACzB,wBAAwB,EACxB,uCAAuC,OAAO,CAAC,iBAAiB,OAAO,SAAS,qEAAqE,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAChN,UAAU,IAAI,CAAC,MAAM,uBAAuB,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,KAAK,EACL,GAAG,IAAI,IAAI,kBAAkB,CAAC,SAAS,CAAC,WAAW,EACnD,cAAc,EACd,IAAI,CACL,CAAC;QACF,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,IAAI,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,aAAa,CACnJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE;QACxE,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/cloud/nexus-auth.d.ts

@@ -28,6 +28,7 @@ import { type NexusAccountErrorCode, type NexusAccountMe, type NexusAccountOrgan
 import { type DeviceCodeConfig, type DeviceCodeStartResponse, pollForToken } from '../llm/oauth/device-code.js';
 import { type FetchLike } from './http.js';
 import { type NexusTokenStore, type SealedNexusSession } from './nexus-credentials.js';
+import { NexusDeviceStore } from './nexus-device.js';
 /** Environment override for the default API origin (e.g. staging). */
 export declare const NEXUS_API_URL_ENV = "CLEO_NEXUS_API_URL";
 /** Default time budget for the server-side revocation at logout. */
@@ -82,6 +83,14 @@ export interface NexusStatusOptions {
     live?: boolean;
     /** Time budget per live check. */
     timeoutMs?: number;
+    /**
+     * Report device credentials (`nexus-device.json`) too; default `true`,
+     * whatever `CLEO_NEXUS_DEVICE` says. A device credential replaces the 9.24
+     * session row of the same user on its origin.
+     */
+    devices?: boolean;
+    /** Device store; defaults to `<cleoHome>/nexus-device.json`. */
+    deviceStore?: NexusDeviceStore;
 }
 /**
  * Resolve and validate the API URL to its origin.
@@ -175,10 +184,13 @@ export declare function logoutFromNexus(opts?: NexusLogoutOptions): Promise<Nexu
 export declare function signOutNexusSessionToken(apiUrl: string, bearer: string, timeoutMs: number, fetchImpl?: FetchLike): Promise<'revoked' | 'already-invalid'>;
 /**
  * Secret-free status rows for `cleo status` and `cleo auth list`: one per
- * stored session, or one "not signed in" row for the default origin. Makes a
- * network call only when a token is stored.
+ * device credential (when device credentials are on) and one per stored 9.24
+ * session on an origin no device credential covers, or one "not signed in"
+ * row for the default origin. Makes a network call only when a credential is
+ * stored. A device that is signed out locally (no current credential) is not
+ * signed in.
  *
- * @param opts - Origin filter, store, liveness and test overrides.
+ * @param opts - Origin filter, stores, liveness and test overrides.
  * @returns Status rows, sorted by origin.
  */
 export declare function getNexusAccountStatus(opts?: NexusStatusOptions): Promise<NexusAccountStatus[]>;

package/dist/cloud/nexus-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-auth.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAE5B,YAAY,EAEb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,SAAS,EAAiC,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,KAAK;IAOxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB;IAEpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IARvB;;;;OAIG;gBAEQ,IAAI,EAAE,qBAAqB,EACpC,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA;CAKxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACjD,mEAAmE;IACnE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,uBAAuB;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yCAAyC;IACzC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAevD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAQ7F;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAwBhF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,cAAc,GAAG,wBAAwB,GAAG,IAAI,CAE5F;AAgDD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoC1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CA0CnD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyB/F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAgBxC;AAsDD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAQ/B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}
+{"version":3,"file":"nexus-auth.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAEvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAE5B,YAAY,EAEb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,KAAK,SAAS,EAAiC,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAqB,MAAM,mBAAmB,CAAC;AAExE,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,KAAK;IAOxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB;IAEpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IARvB;;;;OAIG;gBAEQ,IAAI,EAAE,qBAAqB,EACpC,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA;CAKxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,CAAC;IACjD,mEAAmE;IACnE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,uBAAuB;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yCAAyC;IACzC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,wBAAwB;IACxB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAevD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAQ7F;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAwBhF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,cAAc,GAAG,wBAAwB,GAAG,IAAI,CAE5F;AAgDD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoC1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,EACvB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CA0CnD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyB/F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,SAAS,GACpB,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAgBxC;AAoFD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAwD/B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAY7B"}

package/dist/cloud/nexus-auth.js

@@ -28,6 +28,7 @@ import { NEXUS_CLI_CLIENT_ID, NEXUS_DEFAULT_API_URL, nexusAccountMeSchema, } fro
 import { DeviceCodeAuthError, DeviceCodeTimeoutError, pollForToken, startDeviceCodeFlow, } from '../llm/oauth/device-code.js';
 import { Http, isSecureUrl, NexusError } from './http.js';
 import { FileNexusTokenStore, } from './nexus-credentials.js';
+import { NexusDeviceStore, SealedNexusDevice } from './nexus-device.js';
 /** Environment override for the default API origin (e.g. staging). */
 export const NEXUS_API_URL_ENV = 'CLEO_NEXUS_API_URL';
 /** Default time budget for the server-side revocation at logout. */
@@ -364,22 +365,105 @@ async function checkSession(session, opts) {
         return statusRow(session.apiUrl, 'unverified', session, null);
     }
 }
+/**
+ * Check one device credential against the API (E2 `GET /v1/whoami`, the call
+ * the device contract prefers for status). A 401 (signed out, revoked or
+ * expired) reads as `expired`; no answer reads as `unverified`.
+ */
+async function checkDevice(device, bearer, opts) {
+    if (opts.live === false)
+        return statusRow(device.origin, 'unverified', null, null);
+    const timeoutMs = opts.timeoutMs ?? NEXUS_STATUS_TIMEOUT_MS;
+    const base = opts.fetch ?? ((input, init) => fetch(input, init));
+    const http = new Http({
+        baseUrl: device.origin,
+        token: bearer,
+        fetch: (input, init) => base(input, { ...init, signal: AbortSignal.timeout(timeoutMs) }),
+        maxAttempts: 1,
+    });
+    try {
+        const me = await http.request('GET', '/v1/whoami', nexusAccountMeSchema);
+        return statusRow(device.origin, 'signed-in', null, me);
+    }
+    catch (err) {
+        if (err instanceof NexusError && err.status === 401) {
+            return statusRow(device.origin, 'expired', null, null);
+        }
+        return statusRow(device.origin, 'unverified', null, null);
+    }
+}
 /**
  * Secret-free status rows for `cleo status` and `cleo auth list`: one per
- * stored session, or one "not signed in" row for the default origin. Makes a
- * network call only when a token is stored.
+ * device credential (when device credentials are on) and one per stored 9.24
+ * session on an origin no device credential covers, or one "not signed in"
+ * row for the default origin. Makes a network call only when a credential is
+ * stored. A device that is signed out locally (no current credential) is not
+ * signed in.
  *
- * @param opts - Origin filter, store, liveness and test overrides.
+ * @param opts - Origin filter, stores, liveness and test overrides.
  * @returns Status rows, sorted by origin.
  */
 export async function getNexusAccountStatus(opts = {}) {
     const store = opts.store ?? new FileNexusTokenStore();
     const only = opts.apiUrl !== undefined ? resolveNexusApiUrl(opts.apiUrl) : null;
-    const sessions = (await store.list()).filter((s) => only === null || s.apiUrl === only);
-    if (sessions.length === 0) {
+    const checks = [];
+    const extra = [];
+    /** `origin\u0000userId` pairs a device credential covers; a session of the same user is a leftover. */
+    const covered = new Set();
+    // Device credentials are always reported, whatever CLEO_NEXUS_DEVICE says:
+    // the switch picks the login flow, and hiding a live credential would let
+    // `CLEO_NEXUS_DEVICE=0` users believe they are signed out (review M2).
+    if (opts.devices ?? true) {
+        try {
+            for (const d of await (opts.deviceStore ?? new NexusDeviceStore()).list()) {
+                if (only !== null && d.origin !== only)
+                    continue;
+                if (!(d instanceof SealedNexusDevice)) {
+                    extra.push({
+                        apiUrl: d.origin,
+                        state: 'unverified',
+                        email: null,
+                        organization: null,
+                        expiresAt: null,
+                        summary: `device entry for user ${d.userId} cannot be opened on this machine (${d.reason}); run \`cleo login nexus\` to enrol this machine`,
+                    });
+                    continue;
+                }
+                // Status reads only the current credential: probing a pending
+                // rotation credential would be its first use (§2.5), a write.
+                const bearer = d.currentBearer();
+                if (bearer === null)
+                    continue;
+                covered.add(`${d.origin}\u0000${d.userId}`);
+                checks.push(checkDevice(d, bearer, opts));
+            }
+        }
+        catch (err) {
+            // A device file that cannot be read never hides the session rows (review M1).
+            extra.push({
+                apiUrl: only ?? resolveNexusApiUrl(),
+                state: 'unverified',
+                email: null,
+                organization: null,
+                expiresAt: null,
+                summary: `device credentials unreadable: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+    }
+    for (const s of await store.list()) {
+        if (only !== null && s.apiUrl !== only)
+            continue;
+        // A leftover 9.24 session of the user a device credential already covers
+        // is not shown twice; a session of any other user is (review L3).
+        if (s.user !== null && covered.has(`${s.apiUrl}\u0000${s.user.id}`))
+            continue;
+        checks.push(checkSession(s, opts));
+    }
+    const rows = [...(await Promise.all(checks)), ...extra];
+    if (rows.length === 0) {
         return [statusRow(only ?? resolveNexusApiUrl(), 'not-signed-in', null, null)];
     }
-    return Promise.all(sessions.map((s) => checkSession(s, opts)));
+    return rows.sort((a, b) => a.apiUrl.localeCompare(b.apiUrl));
 }
 /**
  * The stored session for an origin, or a `E_NEXUS_NOT_SIGNED_IN` error.

package/dist/cloud/nexus-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAEhC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AA4CD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,IAAuB,EACvB,KAAc;IAEd,MAAM,GAAG,GAAqB;QAC5B,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,wBAAwB,CACzC,MAAM,EACN,OAAO,CAAC,MAAM,EAAE,EAChB,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"nexus-auth.js","sourceRoot":"","sources":["../../src/cloud/nexus-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EAOrB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EAGnB,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAkB,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EACL,mBAAmB,GAGpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAExE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,mDAAmD;AACnD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAO/B;IAEA;IARX;;;;OAIG;IACH,YACW,IAA2B,EACpC,OAAe,EACN,GAAY;QAErB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAuB;QAE3B,QAAG,GAAH,GAAG,CAAS;QAGrB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAoDD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,0BAA0B,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,EACzB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAqB;IACzE,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,aAAa,EAAE,GAAG,MAAM,uBAAuB;QAC/C,QAAQ,EAAE,GAAG,MAAM,wBAAwB;QAC3C,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GACpB,+EAA+E,CAAC;AAElF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,MAAc;IACtE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,EACpC,kDAAkD,GAAG,0BAA0B,EAC/E,8DAA8D,CAC/D,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,YAAY,GAChB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,YAAY;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnF,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,GAAG,CAAC,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAkB;IACzD,OAAO,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAC3B,MAAc,EACd,KAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,CAAC;KACnC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;QAC1C,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,6BAA6B,EAC7B,gDAAgD,EAChD,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,IAAI,iBAAiB,CAC1B,uBAAuB,EACvB,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,4BAA4B,EAC5B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1F,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,EAAE,GAA0B,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS;QACT,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI;QACtB,YAAY;QACZ,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,IAAuB,EACvB,KAAc;IAEd,MAAM,GAAG,GAAqB;QAC5B,GAAG,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,kCAAkC,EAClC,wCAAwC,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACrG,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,MAAM,KAAK,GAA4B;QACrC,GAAG,KAAK;QACR,eAAe,EAAE,4BAA4B,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC;gBACE,uBAAuB,EAAE,4BAA4B,CACnD,KAAK,CAAC,uBAAuB,EAC7B,MAAM,CACP;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAErB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA2B,EAAE;IACjE,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAA2C,CAAC;IAChD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,wBAAwB,CACzC,MAAM,EACN,OAAO,CAAC,MAAM,EAAE,EAChB,IAAI,CAAC,eAAe,IAAI,uBAAuB,EAC/C,IAAI,CAAC,KAAK,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,QAAQ,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAqB;IAErB,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACvD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,iBAAiB,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAChB,MAAc,EACd,KAAkC,EAClC,OAAkC,EAClC,EAAyB;IAEzB,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACtF,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,KAAK,WAAW;QACnB,CAAC,CAAC,gBAAgB,GAAG,EAAE;QACvB,CAAC,CAAC,KAAK,KAAK,YAAY;YACtB,CAAC,CAAC,gBAAgB,GAAG,kCAAkC;YACvD,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,eAAe,CAAC;IAC1B,OAAO;QACL,MAAM;QACN,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;QAC/C,YAAY,EAAE,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACpD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,YAAY,CACzB,OAA2B,EAC3B,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YAChE,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,MAAyB,EACzB,MAAc,EACd,IAAwB;IAExB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,WAAW,EAAE,CAAC;KACf,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,MAAM,GAAkC,EAAE,CAAC;IACjD,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,uGAAuG;IACvG,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1E,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,SAAS;gBACjD,IAAI,CAAC,CAAC,CAAC,YAAY,iBAAiB,CAAC,EAAE,CAAC;oBACtC,KAAK,CAAC,IAAI,CAAC;wBACT,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,KAAK,EAAE,YAAY;wBACnB,KAAK,EAAE,IAAI;wBACX,YAAY,EAAE,IAAI;wBAClB,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,yBAAyB,CAAC,CAAC,MAAM,sCAAsC,CAAC,CAAC,MAAM,mDAAmD;qBAC5I,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,8DAA8D;gBAC9D,8DAA8D;gBAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;gBACjC,IAAI,MAAM,KAAK,IAAI;oBAAE,SAAS;gBAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8EAA8E;YAC9E,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,IAAI,IAAI,kBAAkB,EAAE;gBACpC,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,IAAI;gBACX,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAE,SAAS;QACjD,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAAE,SAAS;QAC9E,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,kBAAkB,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,KAAsB;IAEtB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,kCAAkC,MAAM,EAAE,EAC1C,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,oCAAoC,MAAM,IAAI,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/cloud/nexus-cloud-activity.d.ts

@@ -0,0 +1,37 @@
+/**
+ * `cleo cloud activity`: what this account's devices did on Cleo Nexus and
+ * when (snapshots pushed or refused, leases taken, forced or released,
+ * projects linked, devices enrolled or signed out), newest first.
+ *
+ * Reads E18 `GET /v1/account/activity` (the caller's own events) with the
+ * device credential and names each device from the account's device list.
+ * `--project` keeps the events whose target is that project or its stream.
+ *
+ * @task T12951
+ * @epic T12323
+ */
+import type { CloudActivityResult } from '@cleocode/contracts';
+import { type NexusCloudOptions } from './nexus-cloud.js';
+/** Largest page `GET /v1/account/activity` serves. */
+export declare const NEXUS_ACTIVITY_PAGE_MAX = 200;
+/** Options of {@link nexusCloudActivity}. */
+export interface NexusCloudActivityOptions extends NexusCloudOptions {
+    /** Events to return (1..200, default 50). */
+    limit?: number;
+    /** Page before this event id (from a previous `nextBefore`). */
+    before?: string;
+    /** Keep only events about this server project id. */
+    projectId?: string;
+    /** Keep only events by this device id. */
+    deviceId?: string;
+    /** Pages to follow while filling `limit` under a filter; default 5. */
+    maxPages?: number;
+}
+/**
+ * List this account's recent cloud activity.
+ *
+ * @param opts - Paging, project filter and overrides.
+ * @returns Events newest first, each with its device's name.
+ */
+export declare function nexusCloudActivity(opts?: NexusCloudActivityOptions): Promise<CloudActivityResult>;
+//# sourceMappingURL=nexus-cloud-activity.d.ts.map

package/dist/cloud/nexus-cloud-activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-cloud-activity.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-cloud-activity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAqB,KAAK,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AAE7F,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,6CAA6C;AAC7C,MAAM,WAAW,yBAA0B,SAAQ,iBAAiB;IAClE,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,yBAA8B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAyD9B"}

package/dist/cloud/nexus-cloud-activity.js

@@ -0,0 +1,79 @@
+/**
+ * `cleo cloud activity`: what this account's devices did on Cleo Nexus and
+ * when (snapshots pushed or refused, leases taken, forced or released,
+ * projects linked, devices enrolled or signed out), newest first.
+ *
+ * Reads E18 `GET /v1/account/activity` (the caller's own events) with the
+ * device credential and names each device from the account's device list.
+ * `--project` keeps the events whose target is that project or its stream.
+ *
+ * @task T12951
+ * @epic T12323
+ */
+import { nexusActivityPageSchema, nexusCloudDevicePageSchema } from '@cleocode/contracts';
+import { connectNexusCloud, nexusQueryPath } from './nexus-cloud.js';
+/** Largest page `GET /v1/account/activity` serves. */
+export const NEXUS_ACTIVITY_PAGE_MAX = 200;
+/**
+ * List this account's recent cloud activity.
+ *
+ * @param opts - Paging, project filter and overrides.
+ * @returns Events newest first, each with its device's name.
+ */
+export async function nexusCloudActivity(opts = {}) {
+    const conn = await connectNexusCloud(opts);
+    // A limit that is not a number (NaN) falls back to the default (T13007).
+    const requested = opts.limit !== undefined && Number.isFinite(opts.limit) ? Math.trunc(opts.limit) : 50;
+    const limit = Math.min(Math.max(requested, 1), NEXUS_ACTIVITY_PAGE_MAX);
+    const project = opts.projectId;
+    const about = (target) => project === undefined ||
+        (typeof target === 'string' &&
+            (target === `project:${project}` ||
+                target.endsWith(`:${project}`) ||
+                target.includes(project)));
+    const wanted = (e) => about(e.target) && (opts.deviceId === undefined || e.actorDeviceId === opts.deviceId);
+    // Follow `nextBefore` until `limit` matching events are found, the server
+    // has no more, or the page budget is spent.
+    const events = [];
+    let before = opts.before;
+    let nextBefore = null;
+    for (let pageNo = 0; pageNo < (opts.maxPages ?? 5); pageNo++) {
+        const page = await conn.get(nexusQueryPath('/v1/account/activity', { limit: String(NEXUS_ACTIVITY_PAGE_MAX), before }), nexusActivityPageSchema);
+        for (const e of page.events) {
+            if (events.length < limit && wanted(e))
+                events.push(e);
+        }
+        nextBefore =
+            page.nextBefore === null || page.nextBefore === undefined ? null : String(page.nextBefore);
+        if (events.length >= limit || nextBefore === null)
+            break;
+        before = nextBefore;
+    }
+    // Stopped inside a page: the next page starts after the last event returned.
+    const last = events.at(-1);
+    if (events.length >= limit && last !== undefined)
+        nextBefore = String(last.id);
+    let names = new Map();
+    try {
+        const devices = await conn.get('/v1/devices?limit=100', nexusCloudDevicePageSchema);
+        names = new Map(devices.devices.map((d) => [d.deviceId, d.name]));
+    }
+    catch {
+        // Names are a convenience; ids are still shown.
+    }
+    return {
+        apiUrl: conn.apiUrl,
+        projectId: project ?? null,
+        items: events.map((e) => ({
+            at: e.at,
+            action: e.action,
+            target: e.target ?? null,
+            deviceId: e.actorDeviceId ?? null,
+            deviceName: e.actorDeviceId ? (names.get(e.actorDeviceId) ?? null) : null,
+            thisDevice: e.actorDeviceId === conn.device.deviceId,
+        })),
+        nextBefore,
+        warnings: conn.warnings,
+    };
+}
+//# sourceMappingURL=nexus-cloud-activity.js.map