@cleocode/core 2026.9.26 → 2026.10.2

package/dist/cloud/nexus-logout.js

@@ -0,0 +1,429 @@
+/**
+ * Cleo Nexus device logout: `cleo logout nexus [--revoke]` with device
+ * credentials (cleo-nexus device contract §3.5, review M3, T12844).
+ *
+ * A logout never reports success while a credential may still be live:
+ *
+ * 1. Under the lock, the live credentials move into `pendingSignOut`
+ *    (`--revoke`: `pendingRevoke`), newest first: `pending`, then `current`
+ *    ({@link applyBeginSignOut}, {@link applyBeginRevoke}). From then on they
+ *    are used for nothing but that request. The lock is released.
+ * 2. E9 (`POST /v1/devices/self/sign-out`) or E10 (`DELETE /v1/devices/self`)
+ *    is sent with each credential in turn, newest first, with one attempt and
+ *    a {@link NEXUS_REVOKE_TIMEOUT_MS} timeout.
+ * 3. Done means proved: 200, or a 401 whose reason proves the device state
+ *    (`device-signed-out`, `device-revoked`, or `credential-revoked` with
+ *    `revokedReason` `signed-out` / `revoked`). A revoke needs proof of a
+ *    revoke; a signed-out device is not a revoked one. Any other 401 means
+ *    that credential is dead, so the next one is tried. A network error,
+ *    timeout, 429, 5xx or a route the server does not have yet stops the run:
+ *    the slot is kept and every remaining request is left for the next run
+ *    without another call.
+ * 4. The lock is re-taken and the slot is changed only if it still holds the
+ *    credential that was answered (compare-and-swap):
+ *    - a sign-out (confirmed, or every credential dead) clears
+ *      `pendingSignOut` and keeps the device keys for the next login;
+ *    - a revoke that ended (confirmed, found the device signed out, or every
+ *      credential dead) forgets the device locally ({@link applyForgetDevice}),
+ *      so no later login re-activates the id the user asked to burn. The
+ *      entry is deleted, or kept stripped while `retired` requests of other
+ *      devices remain; the store keeps the file while other entries remain.
+ *    Only a confirmed request is reported `confirmed`; the others name the
+ *    web remedy.
+ *
+ * Unsettled slots, and the `retired` requests of replaced devices, are
+ * retried by every later logout and, best effort with a shorter timeout, by
+ * `cleo login nexus` and `cleo project link` ({@link retryNexusDeviceEnds}).
+ * Retired requests are sent before the entry's own request.
+ *
+ * No function here logs, and no result or error carries a token.
+ *
+ * @task T12870
+ * @epic T12323
+ */
+import { z } from 'zod';
+import { Http, NexusError } from './http.js';
+import { logoutFromNexus, NEXUS_REVOKE_TIMEOUT_MS, resolveNexusApiUrl } from './nexus-auth.js';
+import { FileNexusTokenStore, nexusOriginKey } from './nexus-credentials.js';
+import { applyBeginRevoke, applyBeginSignOut, applyForgetDevice, applyRetiredSettled, applySignOutConfirmed, isForgottenDevice, NexusDeviceStore, UnreadableNexusDevice, } from './nexus-device.js';
+/**
+ * Timeout of each E9/E10 call when a login or a link only retries on the way
+ * ({@link retryNexusDeviceEnds}); an explicit logout uses {@link NEXUS_REVOKE_TIMEOUT_MS}.
+ */
+export const NEXUS_END_RETRY_TIMEOUT_MS = 2_000;
+function context(opts) {
+    const apiUrl = resolveNexusApiUrl(opts.apiUrl);
+    return {
+        apiUrl,
+        origin: nexusOriginKey(apiUrl),
+        fetch: opts.fetch ?? ((input, init) => globalThis.fetch(input, init)),
+        devices: opts.deviceStore ?? new NexusDeviceStore(),
+        now: opts.now ?? (() => new Date()),
+        timeoutMs: opts.timeoutMs ?? NEXUS_REVOKE_TIMEOUT_MS,
+    };
+}
+/** E9 answers `{ deviceId, state }`; E10 answers `{ revoked }`. Only the status matters. */
+const endAnswerSchema = z.looseObject({});
+/**
+ * What a 401 proves about the device (§4.0.4): `revoked`, `signed-out`, or
+ * nothing (`null`: only this credential is dead).
+ */
+function provenState(details) {
+    const reason = details?.['reason'];
+    const revokedReason = details?.['revokedReason'];
+    if (reason === 'device-revoked')
+        return 'revoked';
+    if (reason === 'device-signed-out')
+        return 'signed-out';
+    if (reason === 'credential-revoked' && revokedReason === 'revoked')
+        return 'revoked';
+    if (reason === 'credential-revoked' && revokedReason === 'signed-out')
+        return 'signed-out';
+    return null;
+}
+/**
+ * Send E9 or E10 with one credential: one attempt, a plain timeout, no lock held.
+ *
+ * @returns `done` for 200 or a 401 that proves the requested state,
+ *   `signed-out` for a revoke that proves only a sign-out, `stale` for any
+ *   other 401, `unanswered` for everything else, with the reason in `detail`.
+ */
+async function callEnd(ctx, action, token) {
+    const timed = (input, init) => ctx.fetch(input, { ...init, signal: AbortSignal.timeout(ctx.timeoutMs) });
+    const http = new Http({ baseUrl: ctx.apiUrl, token, fetch: timed, maxAttempts: 1 });
+    try {
+        if (action === 'sign-out') {
+            await http.request('POST', '/v1/devices/self/sign-out', endAnswerSchema, {});
+        }
+        else {
+            await http.request('DELETE', '/v1/devices/self', endAnswerSchema);
+        }
+        return { answer: 'done', detail: 'HTTP 200' };
+    }
+    catch (err) {
+        if (!(err instanceof NexusError)) {
+            return {
+                answer: 'unanswered',
+                detail: err instanceof Error ? err.message : String(err),
+                transport: true,
+            };
+        }
+        if (err.status === 401) {
+            const reason = err.details?.['reason'];
+            const detail = `HTTP 401 ${typeof reason === 'string' ? reason : err.code}`;
+            const state = provenState(err.details);
+            if (state === 'revoked' || (state === 'signed-out' && action === 'sign-out')) {
+                return { answer: 'done', detail };
+            }
+            if (state === 'signed-out')
+                return { answer: 'signed-out', detail };
+            // Only the Nexus API's own verdict on this credential counts as dead. A
+            // 401 without its envelope (a proxy or SSO gateway) or with reason
+            // `missing` (an Authorization header stripped on the way) proves
+            // nothing about the credential, so it is treated as no answer.
+            const dead = err.code === 'E_UNAUTHENTICATED' &&
+                (reason === 'invalid' ||
+                    reason === 'credential-expired' ||
+                    reason === 'credential-revoked');
+            return { answer: dead ? 'stale' : 'unanswered', detail };
+        }
+        return {
+            answer: 'unanswered',
+            detail: err.code === 'E_NETWORK' ? 'no answer' : `HTTP ${err.status} ${err.code}`,
+            transport: err.code === 'E_NETWORK',
+        };
+    }
+}
+/** Every unsettled request of one entry: its `retired` items first, then its own slot. */
+function requestsOf(userId, entry) {
+    const out = [];
+    for (const r of entry.retired ?? []) {
+        out.push({
+            userId,
+            deviceId: r.deviceId,
+            action: r.kind,
+            retired: true,
+            credentials: r.credentials,
+        });
+    }
+    const own = entry.pendingRevoke ?? entry.pendingSignOut;
+    if (own) {
+        out.push({
+            userId,
+            deviceId: entry.deviceId,
+            action: entry.pendingRevoke ? 'revoke' : 'sign-out',
+            retired: false,
+            credentials: own.credentials,
+        });
+    }
+    return out;
+}
+/** The credentials a request's slot holds now, or `null` when the slot is gone. */
+function slotNow(entry, req) {
+    if (entry === null)
+        return null;
+    if (req.retired) {
+        const item = (entry.retired ?? []).find((r) => r.deviceId === req.deviceId && r.kind === req.action);
+        return item ? item.credentials : null;
+    }
+    if (entry.deviceId !== req.deviceId)
+        return null;
+    const slot = req.action === 'revoke' ? entry.pendingRevoke : entry.pendingSignOut;
+    return slot ? slot.credentials : null;
+}
+/**
+ * End a request under the lock, only if its slot still holds `token` (CAS):
+ * clear a sign-out slot, settle a retired item, or forget the device after a
+ * revoke. An entry left with nothing to keep is deleted.
+ */
+async function settleEnded(ctx, req, token) {
+    return ctx.devices.update((tx) => {
+        const entry = tx.get(ctx.apiUrl, req.userId);
+        const creds = slotNow(entry, req);
+        if (entry === null || creds === null || !creds.some((c) => c.token === token)) {
+            return { applied: false, removed: false };
+        }
+        const next = req.retired
+            ? applyRetiredSettled(entry, req.deviceId, req.action)
+            : req.action === 'sign-out'
+                ? applySignOutConfirmed(entry)
+                : applyForgetDevice(entry);
+        if (isForgottenDevice(next)) {
+            const removed = tx.delete(ctx.apiUrl, req.userId, {
+                deviceId: entry.deviceId,
+                credentialId: entry.current?.credentialId ?? null,
+            });
+            return { applied: true, removed };
+        }
+        tx.set(ctx.apiUrl, req.userId, next);
+        return { applied: true, removed: false };
+    });
+}
+/** Try each credential of one request, newest first, and end it when it can be ended. */
+async function settleRequest(ctx, req, warnings) {
+    const row = (outcome, removedLocally = false) => ({
+        userId: req.userId,
+        deviceId: req.deviceId,
+        action: req.action,
+        retired: req.retired,
+        outcome,
+        removedLocally,
+    });
+    const what = `${req.action === 'revoke' ? 'revoke' : 'sign-out'} of device ${req.deviceId}`;
+    const web = req.action === 'revoke'
+        ? `revoke device ${req.deviceId} on cleocode.dev (Devices)`
+        : `sign out or revoke device ${req.deviceId} on cleocode.dev (Devices)`;
+    const end = async (token, outcome, note) => {
+        const settled = await settleEnded(ctx, req, token);
+        if (!settled.applied) {
+            warnings.push(`${what}: the local entry changed while the request was in flight (a login or another logout?); this machine may hold a newer credential. Run \`cleo logout nexus${req.action === 'revoke' ? ' --revoke' : ''}\` again`);
+        }
+        else if (note !== null) {
+            warnings.push(note);
+        }
+        return row(outcome, settled.removed);
+    };
+    for (const c of req.credentials) {
+        const { answer, detail, transport } = await callEnd(ctx, req.action, c.token);
+        if (answer === 'done')
+            return { row: await end(c.token, 'confirmed', null), unreachable: false };
+        if (answer === 'signed-out') {
+            const signedOut = await end(c.token, 'signed-out', `device ${req.deviceId} is signed out but not revoked, and a signed-out device's credentials cannot revoke it; this machine forgot the device, so the next login enrols a new one. To burn the old id, ${web}`);
+            return { row: signedOut, unreachable: false };
+        }
+        if (answer === 'unanswered') {
+            warnings.push(`${what} not confirmed (${detail}); it was kept and is retried by the next \`cleo logout nexus\`, \`cleo login nexus\` or \`cleo project link\``);
+            return { row: row('pending'), unreachable: transport === true };
+        }
+    }
+    // Every credential is dead: retrying can never succeed, so the request ends here.
+    const first = req.credentials[0];
+    if (first === undefined)
+        return { row: row('unconfirmed'), unreachable: false };
+    const ended = await end(first.token, 'unconfirmed', `${what} not confirmed: the server refused every credential this machine held for it as no longer valid, so none is live and none was kept${req.action === 'revoke' && !req.retired ? '; this machine forgot the device' : ''}. To make sure, ${web}`);
+    return { row: ended, unreachable: false };
+}
+/** Every unsettled request on the origin, plus a warning per entry this machine cannot open. */
+async function unsettled(ctx, warnings, warnUnreadable) {
+    const out = [];
+    for (const d of await ctx.devices.list()) {
+        if (d.origin !== ctx.origin)
+            continue;
+        if (d instanceof UnreadableNexusDevice) {
+            if (!warnUnreadable)
+                continue;
+            warnings.push(`the device entry for user ${d.userId}${d.deviceId ? ` (device ${d.deviceId})` : ''} cannot be opened on this machine (${d.reason}); sign it out or revoke it on cleocode.dev`);
+            continue;
+        }
+        out.push(...requestsOf(d.userId, d.unseal()));
+    }
+    return out;
+}
+/** Sort rows by user, then device, for a stable envelope. */
+function byUserThenDevice(a, b) {
+    return a.userId.localeCompare(b.userId) || a.deviceId.localeCompare(b.deviceId);
+}
+/**
+ * Retry every unsettled sign-out and revoke on the origin (contract §3.5,
+ * L2): each entry's `pendingSignOut` or `pendingRevoke`, and the `retired`
+ * requests of devices it replaced. Never throws for a server that cannot be
+ * reached; the rows and warnings say what is still open.
+ *
+ * @param opts - API URL, stores and test overrides.
+ * @returns One row per request tried, and the warnings.
+ */
+export async function settleNexusDeviceEnds(opts = {}) {
+    const ctx = context(opts);
+    const warnings = [];
+    const devices = [];
+    let unreachable = false;
+    let skipped = 0;
+    for (const req of await unsettled(ctx, warnings, opts.warnUnreadable ?? true)) {
+        if (unreachable) {
+            skipped += 1;
+            // The server already failed to answer in this run: leave the rest for
+            // the next run rather than wait out one timeout per request.
+            devices.push({
+                userId: req.userId,
+                deviceId: req.deviceId,
+                action: req.action,
+                retired: req.retired,
+                outcome: 'pending',
+                removedLocally: false,
+            });
+            continue;
+        }
+        try {
+            const r = await settleRequest(ctx, req, warnings);
+            // Only a transport failure (no answer at all) stops the run: an HTTP
+            // error on one request (a 404, 5xx or 429 for an old device) never
+            // keeps the entry's own sign-out or revoke from being sent.
+            if (r.unreachable)
+                unreachable = true;
+            devices.push(r.row);
+        }
+        catch (err) {
+            // A store failure on one request keeps every row collected so far.
+            warnings.push(`${req.action} of device ${req.deviceId} could not be settled locally (${err instanceof Error ? err.message : String(err)}); it is retried next time`);
+            devices.push({
+                userId: req.userId,
+                deviceId: req.deviceId,
+                action: req.action,
+                retired: req.retired,
+                outcome: 'pending',
+                removedLocally: false,
+            });
+        }
+    }
+    if (skipped > 0) {
+        warnings.push(`${skipped} more unsettled sign-out or revoke request(s) were not sent because Cleo Nexus did not answer; they are retried next time`);
+    }
+    return { devices: devices.sort(byUserThenDevice), warnings };
+}
+/**
+ * Best-effort {@link settleNexusDeviceEnds} for flows that only retry on the
+ * way (login, commands that need a credential): a store or network failure
+ * becomes a warning and never fails the caller.
+ *
+ * @param opts - API URL, stores and test overrides.
+ * @param warnings - Receives the warnings.
+ */
+export async function retryNexusDeviceEnds(opts, warnings) {
+    try {
+        const settled = await settleNexusDeviceEnds({
+            timeoutMs: NEXUS_END_RETRY_TIMEOUT_MS,
+            ...opts,
+            warnUnreadable: false,
+        });
+        warnings.push(...settled.warnings);
+    }
+    catch (err) {
+        warnings.push(`could not retry an unsettled Cleo Nexus sign-out (${err instanceof Error ? err.message : String(err)}); \`cleo logout nexus\` retries it`);
+    }
+}
+/**
+ * Under the lock, move every readable entry on the origin into its
+ * sign-out or revoke slot. A revoke of an entry with no credential left
+ * (already signed out) cannot be sent, so the device is forgotten locally
+ * and the web remedy is returned.
+ *
+ * @returns Warnings for the result envelope.
+ */
+async function beginEnds(ctx, action) {
+    const begin = action === 'revoke' ? applyBeginRevoke : applyBeginSignOut;
+    return ctx.devices.update((tx) => {
+        const notes = [];
+        for (const k of tx.keys()) {
+            if (k.origin !== ctx.origin || !k.readable)
+                continue;
+            const entry = tx.get(ctx.apiUrl, k.userId);
+            if (entry === null)
+                continue;
+            const next = begin(entry, ctx.now());
+            if (action === 'revoke' && next.pendingRevoke === null && next.keys !== null) {
+                const forgotten = applyForgetDevice(next);
+                if (isForgottenDevice(forgotten)) {
+                    tx.delete(ctx.apiUrl, k.userId, { deviceId: entry.deviceId, credentialId: null });
+                }
+                else {
+                    tx.set(ctx.apiUrl, k.userId, forgotten);
+                }
+                notes.push(`device ${next.deviceId} holds no credential (it is signed out), so it cannot be revoked from here; this machine forgot it, so the next login enrols a new device. To burn the old id, revoke device ${next.deviceId} on cleocode.dev (Devices)`);
+                continue;
+            }
+            tx.set(ctx.apiUrl, k.userId, next);
+        }
+        return [...tx.warnings, ...notes];
+    });
+}
+/**
+ * `cleo logout nexus [--revoke]` with device credentials (contract §3.5, M3).
+ *
+ * Every readable entry on the origin is moved to `pendingSignOut` (or
+ * `pendingRevoke`), then every unsettled request on the origin is sent,
+ * including ones left by earlier runs. A leftover 9.24 session for the origin
+ * is signed out too. The device keys stay after a sign-out, so a later login
+ * reuses the device id; a confirmed revoke removes the entry.
+ *
+ * @param opts - API URL, `revoke`, stores and test overrides.
+ * @returns The per-device outcomes. A row that is not `confirmed` is also
+ *   named in `warnings`; the result never claims a sign-out the server did
+ *   not confirm.
+ * A device file that cannot be read or locked is reported as a warning, and
+ * the 9.24 session is still signed out.
+ */
+export async function logoutNexusDevice(opts = {}) {
+    const ctx = context(opts);
+    const action = opts.revoke === true ? 'revoke' : 'sign-out';
+    const warnings = [];
+    let devices = [];
+    try {
+        warnings.push(...(await beginEnds(ctx, action)));
+        const settled = await settleNexusDeviceEnds({
+            ...opts,
+            apiUrl: ctx.apiUrl,
+            deviceStore: ctx.devices,
+        });
+        devices = settled.devices;
+        warnings.push(...settled.warnings);
+    }
+    catch (err) {
+        // A broken device file must not stop the 9.24 session sign-out below.
+        warnings.push(`the device credentials could not be signed out (${err instanceof Error ? err.message : String(err)}); fix the device file and run \`cleo logout nexus\` again`);
+    }
+    let session = null;
+    const sessions = opts.store ?? new FileNexusTokenStore();
+    if ((await sessions.get(ctx.apiUrl)) !== null) {
+        session = await logoutFromNexus({
+            apiUrl: ctx.apiUrl,
+            store: sessions,
+            ...(opts.fetch ? { fetch: opts.fetch } : {}),
+        });
+        warnings.push(...session.warnings);
+    }
+    if (action === 'revoke' && devices.length === 0 && session !== null) {
+        warnings.push(`no device credential is stored for ${ctx.apiUrl}, so nothing was revoked; the 9.24 session was signed out`);
+    }
+    return { apiUrl: ctx.apiUrl, action, devices, session, warnings };
+}
+//# sourceMappingURL=nexus-logout.js.map

package/dist/cloud/nexus-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-logout.js","sourceRoot":"","sources":["../../src/cloud/nexus-logout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAQH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAwB,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACnG,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EAGjB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAkDhD,SAAS,OAAO,CAAC,IAA8B;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM;QACN,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,IAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3F,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,gBAAgB,EAAE;QACnD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,uBAAuB;KACrD,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAE1C;;;GAGG;AACH,SAAS,WAAW,CAClB,OAA4C;IAE5C,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,MAAM,KAAK,mBAAmB;QAAE,OAAO,YAAY,CAAC;IACxD,IAAI,MAAM,KAAK,oBAAoB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrF,IAAI,MAAM,KAAK,oBAAoB,IAAI,aAAa,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,OAAO,CACpB,GAAQ,EACR,MAA4B,EAC5B,KAAa;IAEb,MAAM,KAAK,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,2BAA2B,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,YAAY,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACpC,CAAC;YACD,IAAI,KAAK,KAAK,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;YACpE,wEAAwE;YACxE,mEAAmE;YACnE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,mBAAmB;gBAChC,CAAC,MAAM,KAAK,SAAS;oBACnB,MAAM,KAAK,oBAAoB;oBAC/B,MAAM,KAAK,oBAAoB,CAAC,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE;YACjF,SAAS,EAAE,GAAG,CAAC,IAAI,KAAK,WAAW;SACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,MAAc,EAAE,KAAuB;IACzD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,IAAI;YACd,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,cAAc,CAAC;IACxD,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;YACnD,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CACd,KAA8B,EAC9B,GAAe;IAEf,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAC5D,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAClF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAUD;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,GAAQ,EAAE,GAAe,EAAE,KAAa;IACjE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO;YACtB,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU;gBACzB,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC;gBAC9B,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;aAClD,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,aAAa,CAC1B,GAAQ,EACR,GAAe,EACf,QAAkB;IAElB,MAAM,GAAG,GAAG,CAAC,OAA8B,EAAE,cAAc,GAAG,KAAK,EAAwB,EAAE,CAAC,CAAC;QAC7F,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO;QACP,cAAc;KACf,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,cAAc,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC5F,MAAM,GAAG,GACP,GAAG,CAAC,MAAM,KAAK,QAAQ;QACrB,CAAC,CAAC,iBAAiB,GAAG,CAAC,QAAQ,4BAA4B;QAC3D,CAAC,CAAC,6BAA6B,GAAG,CAAC,QAAQ,4BAA4B,CAAC;IAC5E,MAAM,GAAG,GAAG,KAAK,EAAE,KAAa,EAAE,OAA8B,EAAE,IAAmB,EAAE,EAAE;QACvF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,4JAA4J,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,CACxN,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,MAAM,KAAK,MAAM;YACnB,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAC5E,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,MAAM,GAAG,CACzB,CAAC,CAAC,KAAK,EACP,YAAY,EACZ,UAAU,GAAG,CAAC,QAAQ,mLAAmL,GAAG,EAAE,CAC/M,CAAC;YACF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,mBAAmB,MAAM,gHAAgH,CACjJ,CAAC;YACF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,kFAAkF;IAClF,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,GAAG,CACrB,KAAK,CAAC,KAAK,EACX,aAAa,EACb,GAAG,IAAI,qIAAqI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,mBAAmB,GAAG,EAAE,CACtP,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,QAAkB,EAClB,cAAuB;IAEvB,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,SAAS;QACtC,IAAI,CAAC,YAAY,qBAAqB,EAAE,CAAC;YACvC,IAAI,CAAC,cAAc;gBAAE,SAAS;YAC9B,QAAQ,CAAC,IAAI,CACX,6BAA6B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC,MAAM,6CAA6C,CAC/K,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,SAAS,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;IACxE,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,CAAC;YACb,sEAAsE;YACtE,6DAA6D;YAC7D,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,SAAS;gBAClB,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClD,qEAAqE;YACrE,mEAAmE;YACnE,4DAA4D;YAC5D,IAAI,CAAC,CAAC,WAAW;gBAAE,WAAW,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,QAAQ,CAAC,IAAI,CACX,GAAG,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CACtJ,CAAC;YACF,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,SAAS;gBAClB,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,2HAA2H,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B,EAC9B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;YAC1C,SAAS,EAAE,0BAA0B;YACrC,GAAG,IAAI;YACP,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,qDAAqD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAC3I,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,MAA6B;IAC9D,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACzE,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,SAAS;YACrD,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAS;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7E,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;oBACjC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBACD,KAAK,CAAC,IAAI,CACR,UAAU,IAAI,CAAC,QAAQ,gLAAgL,IAAI,CAAC,QAAQ,4BAA4B,CACjP,CAAC;gBACF,SAAS;YACX,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;YAC1C,GAAG,IAAI;YACP,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAE,GAAG,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,QAAQ,CAAC,IAAI,CACX,mDAAmD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4DAA4D,CAChK,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAA6B,IAAI,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,mBAAmB,EAAE,CAAC;IACzD,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,GAAG,MAAM,eAAe,CAAC;YAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,QAAQ;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CACX,sCAAsC,GAAG,CAAC,MAAM,2DAA2D,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC"}

package/dist/cloud/nexus-vault-keys.d.ts

@@ -0,0 +1,129 @@
+/**
+ * The vault's connection and keys: a read-write device connection, the
+ * account master key, this device's certificate, and the stream data keys.
+ *
+ * Owner decision (2026-10-01): adding a device needs only `cleo login` and
+ * the one-time browser approval; that approval also hands the device the
+ * encryption key. So the account master key (MK) is escrowed on Cleo Nexus:
+ *
+ * 1. `GET /v1/account/keys/escrow` returns MK sealed to this device's X25519
+ *    key (`sealTo`), released only to an approved, active device. The client
+ *    opens it with the device's private key and checks it against the
+ *    escrow's verifier.
+ * 2. No escrow and no account keys: this is the account's first vault use.
+ *    The client mints MK and escrows it (`PUT`, insert-only). A concurrent
+ *    first device loses the insert with 409 and reads the winner's key.
+ * 3. The device certifies itself under MK (a self-grant, `PUT
+ *    /v1/devices/:id/key`), so other devices can verify its snapshots.
+ * 4. Signer trust comes from `certifiedSigners` over `GET /v1/devices/trust`,
+ *    with the trust state persisted in {@link NexusVaultState}.
+ *
+ * Threat model (cleo-nexus T082): the escrow `PUT` sends MK to the server
+ * over TLS, and the server stores it encrypted under a server-held key
+ * (`KEY_ESCROW_SECRET`). Snapshots are therefore encrypted at rest with keys
+ * Cleo Nexus can recover: this is server-escrowed encryption, not
+ * zero-knowledge end-to-end encryption. What the escrow does guarantee is
+ * that MK is released only to an approved, active device of the account,
+ * sealed to that device's key.
+ *
+ * A project's data key (PDK) is minted by its first pusher and stored
+ * wrapped by MK (`PUT /v1/projects/:id/keys/:userId`); the home stream key
+ * is derived from MK.
+ *
+ * No function here logs a key, and no error carries one.
+ *
+ * @task T12336
+ * @epic T12322
+ */
+import type { CloudWarning } from '@cleocode/contracts';
+import { type KeyPair } from './crypto.js';
+import { type FetchLike, Http, type ResponseSchema } from './http.js';
+import { type TrustedSigners } from './keys.js';
+import { resolveNexusApiUrl } from './nexus-auth.js';
+import { type NexusCloudOptions } from './nexus-cloud.js';
+import type { SealedNexusDevice } from './nexus-device.js';
+import { NexusVaultState } from './nexus-vault-state.js';
+/** Timeout of a snapshot blob upload or download. */
+export declare const NEXUS_VAULT_BLOB_TIMEOUT_MS: number;
+/** The sealed-box context of an escrow release (must match the server, cleo-nexus T082). */
+export declare const escrowContext: (userId: string, deviceId: string) => string;
+/** Options of every vault command. */
+export interface NexusVaultOptions extends NexusCloudOptions {
+    /** Vault state store (tests). */
+    vaultState?: NexusVaultState;
+    /** Timeout of a blob transfer; default {@link NEXUS_VAULT_BLOB_TIMEOUT_MS}. */
+    blobTimeoutMs?: number;
+}
+/** A read-write connection with this machine's device credential and keys. */
+export interface NexusVaultConnection {
+    readonly apiUrl: string;
+    readonly userId: string;
+    readonly deviceId: string;
+    readonly device: SealedNexusDevice;
+    /** Device keys: X25519 for sealed boxes, Ed25519 for signatures. */
+    readonly keys: {
+        encryption: KeyPair;
+        signing: KeyPair;
+    };
+    /** The authenticated client (sends `X-Cleo-Device-Id`). For the journal. */
+    readonly http: Http;
+    /** `fetch` for presigned blob transfers (long timeout, no credential). */
+    readonly blobFetch: FetchLike;
+    readonly state: NexusVaultState;
+    readonly warnings: CloudWarning[];
+    /** A request whose failure stays a raw {@link NexusError} (callers handle server codes). */
+    raw<T>(method: string, path: string, schema: ResponseSchema<T>, body?: unknown): Promise<T>;
+    /** {@link NexusVaultConnection.raw}, with failures mapped to {@link NexusAccountError}. */
+    call<T>(method: string, path: string, schema: ResponseSchema<T>, body?: unknown): Promise<T>;
+    /** `GET`, mapped; a 404 answers `null`. */
+    find<T>(path: string, schema: ResponseSchema<T>): Promise<T | null>;
+}
+/**
+ * Open a read-write vault connection with this machine's device credential.
+ *
+ * @param opts - API URL, account, stores and test overrides.
+ * @returns The connection.
+ * @throws {NexusAccountError} Not signed in, device mode off, or no device keys.
+ */
+export declare function connectNexusVault(opts?: NexusVaultOptions): Promise<NexusVaultConnection>;
+/** The unlocked account key and the signers this device trusts. */
+export interface NexusAccountKey {
+    masterKey: Buffer;
+    keyVersion: number;
+    signers: TrustedSigners;
+}
+/**
+ * Get the account master key for this device, minting and escrowing it on
+ * the account's first vault use, and certify this device under it.
+ *
+ * @param conn - A vault connection.
+ * @param opts - `readOnly`: never mint, escrow or certify (GET only); a missing escrow is
+ *   `E_NEXUS_VAULT_EMPTY`.
+ * @returns The key, its version and the trusted signers.
+ * @throws {NexusAccountError} `E_NEXUS_VAULT_KEY_UNAVAILABLE` when the key
+ *   cannot be obtained or verified; a mapped API error otherwise.
+ */
+export declare function unlockNexusAccountKey(conn: NexusVaultConnection, opts?: {
+    readOnly?: boolean;
+}): Promise<NexusAccountKey>;
+/**
+ * The data key of a project stream: unwrap the newest wrapped key, or mint
+ * and store one when the project has none yet (its first push).
+ *
+ * @param conn - A vault connection.
+ * @param mk - The unlocked master key.
+ * @param projectId - The server's project id.
+ * @param mint - Whether a missing key may be created (push: yes; restore: no).
+ * @returns The project data key, or `null` when none exists and `mint` is false.
+ */
+export declare function nexusProjectDataKey(conn: NexusVaultConnection, mk: Buffer, projectId: string, mint: boolean): Promise<Buffer | null>;
+/**
+ * The data key of the account's `home:` stream (derived from MK, never stored).
+ *
+ * @param mk - The unlocked master key.
+ * @returns The home stream key.
+ */
+export declare function nexusHomeDataKey(mk: Buffer): Buffer;
+/** Re-export for callers that only need the URL resolver. */
+export { resolveNexusApiUrl };
+//# sourceMappingURL=nexus-vault-keys.d.ts.map

package/dist/cloud/nexus-vault-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nexus-vault-keys.d.ts","sourceRoot":"","sources":["../../src/cloud/nexus-vault-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AASxD,OAAO,EAAE,KAAK,OAAO,EAAyB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,KAAK,SAAS,EAAE,IAAI,EAAc,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAML,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAqB,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,qDAAqD;AACrD,eAAO,MAAM,2BAA2B,QAAc,CAAC;AAEvD,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,WAChB,CAAC;AAE/C,sCAAsC;AACtC,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,iCAAiC;IACjC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IACzD,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;IAClC,4FAA4F;IAC5F,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5F,2FAA2F;IAC3F,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7F,2CAA2C;IAC3C,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;CACrE;AAQD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA8D/B;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,cAAc,CAAC;CACzB;AA8FD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,oBAAoB,EAC1B,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC,CAoC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6DAA6D;AAC7D,OAAO,EAAE,kBAAkB,EAAE,CAAC"}