@fireproof/core 0.20.0-dev-preview-54 → 0.20.0-dev-preview-57

package/index.js

@@ -5,7 +5,7 @@ var __export = (target, all) => {
 };
 
 // src/ledger.ts
-import { BuildURI as BuildURI2, KeyedResolvOnce as KeyedResolvOnce6, ResolveOnce as ResolveOnce7, URI as URI13 } from "@adviser/cement";
+import { BuildURI as BuildURI2, KeyedResolvOnce as KeyedResolvOnce5, ResolveOnce as ResolveOnce7, URI as URI13 } from "@adviser/cement";
 
 // src/utils.ts
 import {
@@ -2113,6 +2113,9 @@ var DatabaseImpl = class {
     const result = await this.ledger.writeQueue.push({ id, del: true });
     return { id, clock: result?.head, name: this.name };
   }
+  async remove(id) {
+    return this.del(id);
+  }
   async changes(since = [], opts = {}) {
     await this.ready();
     this.logger.Debug().Any("since", since).Any("opts", opts).Msg("changes");
@@ -2179,6 +2182,7 @@ __export(blockstore_exports, {
   MetaActiveStore: () => MetaActiveStore,
   PassThroughGateway: () => PassThroughGateway,
   TaskManager: () => TaskManager,
+  URIInterceptor: () => URIInterceptor,
   WALActiveStore: () => WALActiveStore,
   createAttachedStores: () => createAttachedStores,
   createDbMetaEvent: () => createDbMetaEvent,
@@ -2186,7 +2190,7 @@ __export(blockstore_exports, {
   ensureStoreEnDeFile: () => ensureStoreEnDeFile,
   getDefaultURI: () => getDefaultURI,
   getGatewayFactoryItem: () => getGatewayFactoryItem,
-  getStartedGateway: () => getStartedGateway,
+  getInterceptableGateway: () => getInterceptableGateway,
   parseCarFile: () => parseCarFile,
   registerStoreProtocol: () => registerStoreProtocol,
   toCIDBlock: () => toCIDBlock,
@@ -2246,10 +2250,10 @@ var WALActiveStore = class extends BaseActiveStore {
 };
 
 // src/blockstore/store-factory.ts
-import { KeyedResolvOnce as KeyedResolvOnce5, Result as Result11 } from "@adviser/cement";
+import { Result as Result11 } from "@adviser/cement";
 
 // src/blockstore/store.ts
-import { exception2Result as exception2Result4, ResolveOnce as ResolveOnce4, Result as Result10 } from "@adviser/cement";
+import { exception2Result as exception2Result4, ResolveOnce as ResolveOnce4, Result as Result9 } from "@adviser/cement";
 
 // src/blockstore/loader.ts
 import pLimit from "p-limit";
@@ -3579,151 +3583,11 @@ import { EventBlock as EventBlock2 } from "@fireproof/vendor/@web3-storage/pail/
 import { format as format2 } from "@ipld/dag-json";
 import pRetry from "p-retry";
 import pMap from "p-map";
-
-// src/blockstore/interceptor-gateway.ts
-import { Result as Result9 } from "@adviser/cement";
-var PassThroughGateway = class {
-  async buildUrl(ctx, url, key) {
-    const op = { url, key };
-    return Result9.Ok({ op });
-  }
-  async start(ctx, url) {
-    const op = { url };
-    return Result9.Ok({ op });
-  }
-  async close(ctx, url) {
-    const op = { url };
-    return Result9.Ok({ op });
-  }
-  async delete(ctx, url) {
-    const op = { url };
-    return Result9.Ok({ op });
-  }
-  async destroy(ctx, url) {
-    const op = { url };
-    return Result9.Ok({ op });
-  }
-  async put(ctx, url, body) {
-    const op = { url, body };
-    return Result9.Ok({ op });
-  }
-  async get(ctx, url) {
-    const op = { url };
-    return Result9.Ok({ op });
-  }
-  async subscribe(ctx, url, callback) {
-    const op = { url, callback };
-    return Result9.Ok({ op });
-  }
-};
-var passThrougthGateway = new PassThroughGateway();
-var InterceptorGateway = class {
-  constructor(sthis, innerGW, interceptor) {
-    this.innerGW = innerGW;
-    this.interceptor = interceptor || passThrougthGateway;
-  }
-  async buildUrl(ctx, baseUrl, key) {
-    const rret = await this.interceptor.buildUrl(ctx, baseUrl, key);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return this.innerGW.buildUrl(ctx, ret.op.url, ret.op.key);
-  }
-  async destroy(ctx, iurl) {
-    const rret = await this.interceptor.destroy(ctx, iurl);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return this.innerGW.destroy(ctx, ret.op.url);
-  }
-  async start(ctx, url) {
-    const rret = await this.interceptor.start(ctx, url);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return await this.innerGW.start(ctx, ret.op.url);
-  }
-  async close(ctx, url) {
-    const rret = await this.interceptor.close(ctx, url);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return await this.innerGW.close(ctx, ret.op.url);
-  }
-  async put(ctx, url, fpEnv) {
-    const rret = await this.interceptor.put(ctx, url, fpEnv);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return this.innerGW.put(ctx, ret.op.url, ret.op.body);
-  }
-  async get(ctx, url) {
-    const rret = await this.interceptor.get(ctx, url);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return this.innerGW.get(ctx, ret.op.url);
-  }
-  async subscribe(ctx, url, callback) {
-    if (!this.innerGW.subscribe) {
-      return Result9.Err(ctx.loader.sthis.logger.Error().Url(url).Msg("subscribe not supported").AsError());
-    }
-    const rret = await this.interceptor.subscribe(ctx, url, callback);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return this.innerGW.subscribe(ctx, ret.op.url, ret.op.callback);
-  }
-  async delete(ctx, url) {
-    const rret = await this.interceptor.delete(ctx, url);
-    if (rret.isErr()) {
-      return Result9.Err(rret.Err());
-    }
-    const ret = rret.unwrap();
-    if (ret.stop && ret.value) {
-      return ret.value;
-    }
-    return this.innerGW.delete(ctx, url);
-  }
-  async getPlain(ctx, url, key) {
-    return this.innerGW.getPlain(ctx, url, key);
-  }
-};
-
-// src/blockstore/store.ts
 function guardVersion(url) {
   if (!url.hasParam("version")) {
-    return Result10.Err(`missing version: ${url.toString()}`);
+    return Result9.Err(`missing version: ${url.toString()}`);
   }
-  return Result10.Ok(url);
+  return Result9.Ok(url);
 }
 var BaseStoreImpl = class {
   // readonly loader: Loadable;
@@ -3739,8 +3603,10 @@ var BaseStoreImpl = class {
       throw logger.Error().Url(this._url).Msg("missing name").AsError();
     }
     this.logger = logger.With().Str("this", this.sthis.nextId().str).Ref("url", () => this._url.toString()).Logger();
-    this.realGateway = opts.gateway;
-    this.gateway = new InterceptorGateway(this.sthis, opts.gateway, opts.gatewayInterceptor);
+    this.gateway = opts.gateway;
+  }
+  get realGateway() {
+    return this.gateway.innerGW;
   }
   url() {
     return this._url;
@@ -3890,7 +3756,7 @@ var MetaStoreImpl = class extends BaseStoreImpl {
   async close() {
     await this.gateway.close({ loader: this.loader }, this.url());
     this._onClosed.forEach((fn) => fn());
-    return Result10.Ok(void 0);
+    return Result9.Ok(void 0);
   }
   async destroy() {
     this.logger.Debug().Msg("destroy");
@@ -3957,7 +3823,7 @@ var DataStoreImpl = class extends BaseStoreImpl {
   async close() {
     await this.gateway.close({ loader: this.loader }, this.url());
     this._onClosed.forEach((fn) => fn());
-    return Result10.Ok(void 0);
+    return Result9.Ok(void 0);
   }
   destroy() {
     this.logger.Debug().Msg("destroy");
@@ -4044,7 +3910,7 @@ var WALStoreImpl = class extends BaseStoreImpl {
     const retryableUpload = (fn, description) => pRetry(fn, {
       retries: 5,
       onFailedAttempt: (error) => {
-        this.logger.Warn().Msg(`Attempt ${error.attemptNumber} failed for ${description}. There are ${error.retriesLeft} retries left.`);
+        this.logger.Warn().Any("error", error).Any("fn", fn.toString()).Msg(`Attempt ${error.attemptNumber} failed for ${description}. There are ${error.retriesLeft} retries left.`);
       }
     });
     try {
@@ -4159,7 +4025,7 @@ var WALStoreImpl = class extends BaseStoreImpl {
   async close() {
     await this.gateway.close({ loader: this.loader }, this.url());
     this._onClosed.forEach((fn) => fn());
-    return Result10.Ok(void 0);
+    return Result9.Ok(void 0);
   }
   destroy() {
     this.logger.Debug().Msg("destroy");
@@ -4167,81 +4033,200 @@ var WALStoreImpl = class extends BaseStoreImpl {
   }
 };
 
-// src/blockstore/store-factory.ts
-var onceGateway = new KeyedResolvOnce5();
-var gatewayInstances = new KeyedResolvOnce5();
-async function getStartedGateway(ctx, url) {
-  return onceGateway.get(url.toString()).once(async () => {
-    const item = getGatewayFactoryItem(url.protocol);
-    if (item) {
-      const ret = {
-        url,
-        ...await gatewayInstances.get(url.protocol).once(async () => ({
-          gateway: await item.serdegateway(ctx.loader.sthis)
-        }))
-      };
-      const res = await ret.gateway.start(ctx, url);
-      if (res.isErr()) {
-        return Result11.Err(ctx.loader.sthis.logger.Error().Result("start", res).Msg("start failed").AsError());
-      }
-      ret.url = res.Ok();
-      return Result11.Ok(ret);
+// src/blockstore/interceptor-gateway.ts
+import { Result as Result10 } from "@adviser/cement";
+var PassThroughGateway = class {
+  async buildUrl(ctx, url, key) {
+    const op = { url, key };
+    return Result10.Ok({ op });
+  }
+  async start(ctx, url) {
+    const op = { url };
+    return Result10.Ok({ op });
+  }
+  async close(ctx, url) {
+    const op = { url };
+    return Result10.Ok({ op });
+  }
+  async delete(ctx, url) {
+    const op = { url };
+    return Result10.Ok({ op });
+  }
+  async destroy(ctx, url) {
+    const op = { url };
+    return Result10.Ok({ op });
+  }
+  async put(ctx, url, body) {
+    const op = { url, body };
+    return Result10.Ok({ op });
+  }
+  async get(ctx, url) {
+    const op = { url };
+    return Result10.Ok({ op });
+  }
+  async subscribe(ctx, url, callback) {
+    const op = { url, callback };
+    return Result10.Ok({ op });
+  }
+};
+var passThrougthGateway = new PassThroughGateway();
+var InterceptorGateway = class {
+  constructor(sthis, innerGW, interceptor) {
+    this.innerGW = innerGW;
+    this.interceptor = interceptor || passThrougthGateway;
+  }
+  async buildUrl(ctx, baseUrl, key) {
+    const rret = await this.interceptor.buildUrl(ctx, baseUrl, key);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
     }
-    return Result11.Err(ctx.loader.sthis.logger.Warn().Url(url).Msg("unsupported protocol").AsError());
-  });
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return this.innerGW.buildUrl(ctx, ret.op.url, ret.op.key);
+  }
+  async destroy(ctx, iurl) {
+    const rret = await this.interceptor.destroy(ctx, iurl);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
+    }
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return this.innerGW.destroy(ctx, ret.op.url);
+  }
+  async start(ctx, url) {
+    const rret = await this.interceptor.start(ctx, url);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
+    }
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return await this.innerGW.start(ctx, ret.op.url);
+  }
+  async close(ctx, url) {
+    const rret = await this.interceptor.close(ctx, url);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
+    }
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return await this.innerGW.close(ctx, ret.op.url);
+  }
+  async put(ctx, url, fpEnv) {
+    const rret = await this.interceptor.put(ctx, url, fpEnv);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
+    }
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return this.innerGW.put(ctx, ret.op.url, ret.op.body);
+  }
+  async get(ctx, url) {
+    const rret = await this.interceptor.get(ctx, url);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
+    }
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return this.innerGW.get(ctx, ret.op.url);
+  }
+  async subscribe(ctx, url, callback) {
+    if (!this.innerGW.subscribe) {
+      return Result10.Err(ctx.loader.sthis.logger.Error().Url(url).Msg("subscribe not supported").AsError());
+    }
+    const rret = await this.interceptor.subscribe(ctx, url, callback);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
+    }
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return this.innerGW.subscribe(ctx, ret.op.url, ret.op.callback);
+  }
+  async delete(ctx, url) {
+    const rret = await this.interceptor.delete(ctx, url);
+    if (rret.isErr()) {
+      return Result10.Err(rret.Err());
+    }
+    const ret = rret.unwrap();
+    if (ret.stop && ret.value) {
+      return ret.value;
+    }
+    return this.innerGW.delete(ctx, url);
+  }
+  async getPlain(ctx, url, key) {
+    return this.innerGW.getPlain(ctx, url, key);
+  }
+};
+
+// src/blockstore/store-factory.ts
+async function getInterceptableGateway(ctx, url, opt) {
+  const item = getGatewayFactoryItem(url.protocol);
+  if (item) {
+    return Result11.Ok(new InterceptorGateway(ctx.loader.sthis, await item.serdegateway(ctx.loader.sthis), opt.gatewayInterceptor));
+  }
+  return Result11.Err(ctx.loader.sthis.logger.Warn().Url(url).Msg("unsupported protocol").AsError());
 }
 async function carStoreFactory(ctx, uai) {
   const storeUrl = uai.url.build().setParam(PARAM.STORE, "car").URI();
-  const rgateway = await getStartedGateway(ctx, storeUrl);
+  const rgateway = await getInterceptableGateway(ctx, storeUrl, uai);
   if (rgateway.isErr()) {
     throw ctx.loader.sthis.logger.Error().Result("err", rgateway).Url(uai.url).Msg("notfound").AsError();
   }
   const gateway = rgateway.Ok();
-  const store = new CarStoreImpl(ctx.loader.sthis, gateway.url, {
-    gateway: gateway.gateway,
-    gatewayInterceptor: uai.gatewayInterceptor,
+  const store = new CarStoreImpl(ctx.loader.sthis, uai.url, {
+    gateway,
     loader: ctx.loader
   });
   return store;
 }
 async function fileStoreFactory(ctx, uai) {
   const storeUrl = uai.url.build().setParam(PARAM.STORE, "file").URI();
-  const rgateway = await getStartedGateway(ctx, storeUrl);
+  const rgateway = await getInterceptableGateway(ctx, storeUrl, uai);
   if (rgateway.isErr()) {
     throw ctx.loader.sthis.logger.Error().Result("err", rgateway).Url(uai.url).Msg("notfound").AsError();
   }
   const gateway = rgateway.Ok();
-  const store = new FileStoreImpl(ctx.loader.sthis, gateway.url, {
-    gateway: gateway.gateway,
-    gatewayInterceptor: uai.gatewayInterceptor,
+  const store = new FileStoreImpl(ctx.loader.sthis, uai.url, {
+    gateway,
     loader: ctx.loader
   });
   return store;
 }
 async function metaStoreFactory(ctx, uai) {
   const storeUrl = uai.url.build().setParam(PARAM.STORE, "meta").URI();
-  const rgateway = await getStartedGateway(ctx, storeUrl);
+  const rgateway = await getInterceptableGateway(ctx, storeUrl, uai);
   if (rgateway.isErr()) {
     throw ctx.loader.sthis.logger.Error().Result("err", rgateway).Url(uai.url).Msg("notfound").AsError();
   }
   const gateway = rgateway.Ok();
-  const store = new MetaStoreImpl(ctx.loader.sthis, gateway.url, {
-    gateway: gateway.gateway,
-    gatewayInterceptor: uai.gatewayInterceptor,
+  const store = new MetaStoreImpl(ctx.loader.sthis, uai.url, {
+    gateway,
     loader: ctx.loader
   });
   return store;
 }
 async function WALStoreFactory(ctx, uai) {
   const storeUrl = uai.url.build().setParam(PARAM.STORE, "wal").URI();
-  const rgateway = await getStartedGateway(ctx, storeUrl);
+  const rgateway = await getInterceptableGateway(ctx, storeUrl, uai);
   if (rgateway.isErr()) {
     throw ctx.loader.sthis.logger.Error().Result("err", rgateway).Url(uai.url).Msg("notfound").AsError();
   }
   const gateway = rgateway.Ok();
-  const store = new WALStoreImpl(ctx.loader.sthis, gateway.url, {
-    gateway: gateway.gateway,
-    gatewayInterceptor: uai.gatewayInterceptor,
+  const store = new WALStoreImpl(ctx.loader.sthis, uai.url, {
+    gateway,
     loader: ctx.loader
   });
   return store;
@@ -4289,11 +4274,62 @@ function toStoreRuntime(sthis, endeOpts = {}) {
   };
 }
 
-// src/crdt-helpers.ts
-import { parse as parse2 } from "multiformats/link";
-import { sha256 as hasher6 } from "multiformats/hashes/sha2";
-import * as codec2 from "@ipld/dag-cbor";
-import { put, get, entries, root } from "@fireproof/vendor/@web3-storage/pail/crdt";
+// src/blockstore/uri-interceptor.ts
+var URIInterceptor = class _URIInterceptor extends PassThroughGateway {
+  static withMapper(mapper) {
+    return new _URIInterceptor().addMapper(mapper);
+  }
+  #uriMapper = /* @__PURE__ */ new Set();
+  addMapper(mapper) {
+    this.#uriMapper.add(mapper);
+    return this;
+  }
+  async #map(uri) {
+    let ret = uri;
+    for (const mapper of this.#uriMapper) {
+      ret = await mapper(ret);
+    }
+    return ret;
+  }
+  async buildUrl(ctx, url, key) {
+    const ret = await super.buildUrl(ctx, await this.#map(url), key);
+    return ret;
+  }
+  async start(ctx, url) {
+    const ret = await super.start(ctx, await this.#map(url));
+    return ret;
+  }
+  async close(ctx, url) {
+    const ret = await super.close(ctx, await this.#map(url));
+    return ret;
+  }
+  async delete(ctx, url) {
+    const ret = await super.delete(ctx, await this.#map(url));
+    return ret;
+  }
+  async destroy(ctx, url) {
+    const ret = await super.destroy(ctx, await this.#map(url));
+    return ret;
+  }
+  async put(ctx, url, body) {
+    const ret = await super.put(ctx, await this.#map(url), body);
+    return ret;
+  }
+  async get(ctx, url) {
+    const ret = await super.get(ctx, await this.#map(url));
+    return ret;
+  }
+  async subscribe(ctx, url, callback) {
+    const ret = await super.subscribe(ctx, await this.#map(url), callback);
+    return ret;
+  }
+};
+
+// src/crdt-helpers.ts
+import { parse as parse2 } from "multiformats/link";
+import { sha256 as hasher6 } from "multiformats/hashes/sha2";
+import * as codec2 from "@ipld/dag-cbor";
+import { put, get, entries, root } from "@fireproof/vendor/@web3-storage/pail/crdt";
 import { EventFetcher, vis } from "@fireproof/vendor/@web3-storage/pail/clock";
 import * as Batch from "@fireproof/vendor/@web3-storage/pail/crdt/batch";
 function time(tag) {
@@ -4942,7 +4978,7 @@ var Context = class {
 };
 
 // src/ledger.ts
-var ledgers = new KeyedResolvOnce6();
+var ledgers = new KeyedResolvOnce5();
 function keyConfigOpts(sthis, name, opts) {
   return JSON.stringify(
     toSortedArray({
@@ -5173,11 +5209,18 @@ function fireproof(name, opts) {
 // src/runtime/index.ts
 var runtime_exports = {};
 __export(runtime_exports, {
+  AddKeyToDbMetaGateway: () => AddKeyToDbMetaGateway,
   FILESTORE_VERSION: () => FILESTORE_VERSION,
   INDEXEDDB_VERSION: () => INDEXEDDB_VERSION,
   KeyBag: () => KeyBag,
+  V2SerializedMetaKeyExtractKey: () => V2SerializedMetaKeyExtractKey,
+  addKeyToDbMetaDecoder: () => addKeyToDbMetaDecoder,
+  addKeyToDbMetaEncoder: () => addKeyToDbMetaEncoder,
+  decodeAsToSerializedMeta: () => decodeAsToSerializedMeta,
   defaultKeyBagOpts: () => defaultKeyBagOpts,
   defaultKeyBagUrl: () => defaultKeyBagUrl,
+  encodeAsV1SerializedMetaKey: () => encodeAsV1SerializedMetaKey,
+  encodeAsV2SerializedMetaKey: () => encodeAsV2SerializedMetaKey,
   files: () => files_exports,
   getFileName: () => getFileName,
   getKeyBag: () => getKeyBag,
@@ -5188,7 +5231,8 @@ __export(runtime_exports, {
   keysByFingerprint: () => keysByFingerprint,
   mf: () => wait_pr_multiformats_exports,
   registerKeyBagProviderFactory: () => registerKeyBagProviderFactory,
-  runtimeFn: () => runtimeFn4,
+  runtimeFn: () => runtimeFn5,
+  sts: () => sts_service_exports,
   toKeyWithFingerPrint: () => toKeyWithFingerPrint
 });
 
@@ -5202,13 +5246,109 @@ __export(wait_pr_multiformats_exports, {
 // src/runtime/wait-pr-multiformats/codec-interface.ts
 var codec_interface_exports = {};
 
+// src/runtime/sts-service/index.ts
+var sts_service_exports = {};
+__export(sts_service_exports, {
+  SessionTokenService: () => SessionTokenService,
+  env2jwk: () => env2jwk,
+  envKeyDefaults: () => envKeyDefaults,
+  jwk2env: () => jwk2env
+});
+import { exception2Result as exception2Result5 } from "@adviser/cement";
+import { exportJWK, importJWK, jwtVerify, SignJWT } from "jose";
+import { generateKeyPair } from "jose/key/generate/keypair";
+import { base58btc as base58btc4 } from "multiformats/bases/base58";
+var envKeyDefaults = {
+  SECRET: "CLOUD_SESSION_TOKEN_SECRET",
+  PUBLIC: "CLOUD_SESSION_TOKEN_PUBLIC"
+};
+async function jwk2env(jwk, sthis = ensureSuperThis()) {
+  const inPubKey = await exportJWK(jwk);
+  return base58btc4.encode(sthis.txt.encode(JSON.stringify(inPubKey)));
+}
+async function env2jwk(env, alg, sthis = ensureSuperThis()) {
+  const inJWT = JSON.parse(sthis.txt.decode(base58btc4.decode(env)));
+  return importJWK(inJWT, alg, { extractable: true });
+}
+var SessionTokenService = class _SessionTokenService {
+  #key;
+  #param;
+  static async generateKeyPair(alg = "ES256", options = { extractable: true }, generateKeyPairFN = (alg2, options2) => generateKeyPair(alg2, options2)) {
+    const material = await generateKeyPairFN(alg, options);
+    return {
+      material,
+      strings: {
+        publicKey: await jwk2env(material.publicKey),
+        privateKey: await jwk2env(material.privateKey)
+      }
+    };
+  }
+  static async createFromEnv(sp = {}, sthis = ensureSuperThis()) {
+    let envToken = sthis.env.get(sp.privateEnvKey ?? envKeyDefaults.SECRET);
+    if (!envToken) {
+      envToken = sthis.env.get(sp.publicEnvKey ?? envKeyDefaults.PUBLIC);
+    }
+    if (!envToken) {
+      throw new Error(
+        `env not found for: ${sp.privateEnvKey ?? envKeyDefaults.SECRET} or ${sp.publicEnvKey ?? envKeyDefaults.PUBLIC}`
+      );
+    }
+    return _SessionTokenService.create({ token: envToken }, sthis);
+  }
+  static async create(stsparam, sthis = ensureSuperThis()) {
+    const key = await env2jwk(stsparam.token, stsparam.alg ?? "ES256", sthis);
+    return new _SessionTokenService(key, stsparam);
+  }
+  constructor(key, stsparam) {
+    this.#key = key;
+    this.#param = stsparam;
+  }
+  get validFor() {
+    let validFor = this.#param.validFor ?? 3600;
+    if (!(0 <= validFor && validFor <= 36e5)) {
+      validFor = 36e5;
+    }
+    return validFor;
+  }
+  get alg() {
+    return this.#param.alg ?? "ES256";
+  }
+  get isssuer() {
+    return this.#param.issuer ?? "fireproof";
+  }
+  get audience() {
+    return this.#param.audience ?? "fireproof";
+  }
+  async validate(token) {
+    return exception2Result5(async () => {
+      const ret = await jwtVerify(token, this.#key);
+      return ret;
+    });
+  }
+  // async getEnvKey(): Promise<string> {
+  //   return jwk2env(ensureSuperThis(), this.#key);
+  // }
+  async tokenFor(p) {
+    if (this.#key.type !== "private") {
+      throw new Error("key must be private");
+    }
+    const token = await new SignJWT({
+      userId: p.userId,
+      tenants: p.tenants,
+      ledgers: p.ledgers
+    }).setProtectedHeader({ alg: this.alg }).setIssuedAt().setIssuer(p.issuer ?? this.isssuer).setAudience(p.audience ?? this.audience).setExpirationTime(Date.now() + (p.validFor ?? this.validFor)).sign(this.#key);
+    return token;
+  }
+};
+
 // src/runtime/index.ts
-import { runtimeFn as runtimeFn4 } from "@adviser/cement";
+import { runtimeFn as runtimeFn5 } from "@adviser/cement";
 
 // src/runtime/gateways/index.ts
 var gateways_exports = {};
 __export(gateways_exports, {
   DefSerdeGateway: () => DefSerdeGateway,
+  cloud: () => gateway_exports2,
   dbMetaEvent2Serialized: () => dbMetaEvent2Serialized,
   decode2DbMetaEvents: () => decode2DbMetaEvents,
   file: () => file_exports,
@@ -5224,9 +5364,1838 @@ __export(file_exports, {
   sysFileSystemFactory: () => sysFileSystemFactory
 });
 
+// src/runtime/gateways/cloud/gateway.ts
+var gateway_exports2 = {};
+__export(gateway_exports2, {
+  FireproofCloudGateway: () => FireproofCloudGateway,
+  registerFireproofCloudStoreProtocol: () => registerFireproofCloudStoreProtocol,
+  toCloud: () => toCloud
+});
+import {
+  Result as Result17,
+  URI as URI17,
+  KeyedResolvOnce as KeyedResolvOnce6,
+  exception2Result as exception2Result9,
+  param,
+  ResolveOnce as ResolveOnce8,
+  to_uint8
+} from "@adviser/cement";
+
+// src/protocols/cloud/msg-types.ts
+var VERSION = "FP-MSG-1.0";
+function isAuthTypeFPCloudJWK(a) {
+  return a.type === "fp-cloud-jwk";
+}
+function isAuthTypeFPCloud(a) {
+  return a.type === "fp-cloud";
+}
+function keyTenantLedger(t) {
+  return `${t.tenant}:${t.ledger}`;
+}
+function qsidEqual(a, b) {
+  return a.reqId === b.reqId && a.resId === b.resId;
+}
+function qsidKey(qsid) {
+  return `${qsid.reqId}:${qsid.resId}`;
+}
+function MsgIsTid(msg, tid) {
+  return msg.tid === tid;
+}
+function MsgIsError(rq) {
+  return rq.type === "error";
+}
+function MsgIsQSError(rq) {
+  return rq.res.type === "error" || rq.req.type === "error";
+}
+function coerceFPStoreTypes(s) {
+  const x = s?.trim();
+  if (x === "meta" || x === "car" || x === "wal" || x === "file") {
+    return x;
+  }
+  throw new Error(`Invalid FPStoreTypes: ${s}`);
+}
+function isProtocolCapabilities(s) {
+  const x = s.trim();
+  return x === "reqRes" || x === "stream";
+}
+function defaultGestalt(msgP, gestalt) {
+  return {
+    storeTypes: ["meta", "file", "car", "wal"],
+    httpEndpoints: ["/fp"],
+    wsEndpoints: ["/ws"],
+    encodings: ["JSON"],
+    protocolCapabilities: msgP.protocolCapabilities || ["reqRes", "stream"],
+    auth: [],
+    requiresAuth: false,
+    data: msgP.hasPersistent ? {
+      inband: true,
+      outband: true
+    } : void 0,
+    meta: msgP.hasPersistent ? {
+      inband: true,
+      outband: true
+    } : void 0,
+    wal: msgP.hasPersistent ? {
+      inband: true,
+      outband: true
+    } : void 0,
+    reqTypes: [
+      "reqOpen",
+      "reqGestalt",
+      // "reqSignedUrl",
+      "reqSubscribeMeta",
+      "reqPutMeta",
+      "reqBindMeta",
+      "reqDelMeta",
+      "reqPutData",
+      "reqGetData",
+      "reqDelData",
+      "reqPutWAL",
+      "reqGetWAL",
+      "reqDelWAL",
+      "reqUpdateMeta"
+    ],
+    resTypes: [
+      "resOpen",
+      "resGestalt",
+      // "resSignedUrl",
+      "resSubscribeMeta",
+      "resPutMeta",
+      "resGetMeta",
+      "resDelMeta",
+      "resPutData",
+      "resGetData",
+      "resDelData",
+      "resPutWAL",
+      "resGetWAL",
+      "resDelWAL",
+      "updateMeta"
+    ],
+    eventTypes: ["updateMeta"],
+    ...gestalt
+  };
+}
+function buildReqChat(sthis, auth, conn, message, targets) {
+  return {
+    tid: sthis.nextId().str,
+    type: "reqChat",
+    version: VERSION,
+    auth,
+    conn,
+    message,
+    targets: targets ?? []
+  };
+}
+function buildResChat(req, conn, message, targets, auth) {
+  return {
+    ...req,
+    auth: auth || req.auth,
+    conn: conn || req.conn,
+    message: message || req.message,
+    targets: targets || req.targets,
+    type: "resChat",
+    version: VERSION
+  };
+}
+function MsgIsReqChat(msg) {
+  return msg.type === "reqChat";
+}
+function MsgIsResChat(msg) {
+  return msg.type === "resChat";
+}
+function MsgIsReqGestalt(msg) {
+  return msg.type === "reqGestalt";
+}
+function buildReqGestalt(sthis, auth, gestalt, publish) {
+  return {
+    tid: sthis.nextId().str,
+    auth,
+    type: "reqGestalt",
+    version: VERSION,
+    gestalt,
+    publish
+  };
+}
+function buildResGestalt(req, gestalt, auth) {
+  return {
+    tid: req.tid,
+    auth: auth || req.auth,
+    type: "resGestalt",
+    version: VERSION,
+    gestalt
+  };
+}
+function MsgIsResGestalt(msg) {
+  return msg.type === "resGestalt";
+}
+function buildReqOpen(sthis, auth, conn) {
+  return {
+    tid: sthis.nextId().str,
+    auth,
+    type: "reqOpen",
+    version: VERSION,
+    conn: {
+      ...conn,
+      reqId: conn.reqId || sthis.nextId().str
+    }
+  };
+}
+function MsgIsReqOpen(imsg) {
+  const msg = imsg;
+  return msg.type === "reqOpen" && !!msg.conn && !!msg.conn.reqId;
+}
+function MsgIsWithConn(msg) {
+  const mwc = msg.conn;
+  return mwc && !!mwc.reqId && !!mwc.resId;
+}
+function MsgIsWithConnAuth(msg) {
+  return MsgIsWithConn(msg) && !!msg.auth && typeof msg.auth.type === "string";
+}
+function MsgIsConnected(msg, qsid) {
+  return MsgIsWithConn(msg) && msg.conn.reqId === qsid.reqId && msg.conn.resId === qsid.resId;
+}
+function buildResOpen(sthis, req, resStreamId) {
+  if (!(req.conn && req.conn.reqId)) {
+    throw new Error("req.conn.reqId is required");
+  }
+  return {
+    ...req,
+    type: "resOpen",
+    conn: {
+      ...req.conn,
+      resId: req.conn.resId || resStreamId || sthis.nextId().str
+    }
+  };
+}
+function MsgIsResOpen(msg) {
+  return msg.type === "resOpen";
+}
+function MsgIsReqClose(msg) {
+  return msg.type === "reqClose" && MsgIsWithConn(msg);
+}
+function MsgIsResClose(msg) {
+  return msg.type === "resClose" && MsgIsWithConn(msg);
+}
+function buildResClose(req, conn) {
+  return {
+    ...req,
+    type: "resClose",
+    conn
+  };
+}
+function buildReqClose(sthis, auth, conn) {
+  return {
+    tid: sthis.nextId().str,
+    auth,
+    type: "reqClose",
+    version: VERSION,
+    conn
+  };
+}
+function buildErrorMsg(msgCtx, base, error, body, stack) {
+  if (!stack && msgCtx.sthis.env.get("FP_STACK")) {
+    stack = error.stack?.split("\n");
+  }
+  const msg = {
+    auth: base.auth || { type: "error" },
+    src: base,
+    type: "error",
+    tid: base.tid || "internal",
+    message: error.message,
+    version: VERSION,
+    body,
+    stack
+  };
+  msgCtx.logger.Any("ErrorMsg", msg);
+  return msg;
+}
+function MsgIsTenantLedger(msg) {
+  if (MsgIsWithConnAuth(msg)) {
+    const t = msg.tenant;
+    return !!t && !!t.tenant && !!t.ledger;
+  }
+  return false;
+}
+function buildReqSignedUrl(sthis, type, rparam, gwCtx) {
+  return {
+    tid: sthis.nextId().str,
+    type,
+    auth: rparam.auth,
+    methodParams: rparam.methodParam,
+    version: VERSION,
+    ...gwCtx,
+    params: rparam.params
+  };
+}
+function resAuth(msg) {
+  return msg.auth ? Promise.resolve(msg.auth) : Promise.reject(new Error("No Auth"));
+}
+async function buildRes(methodParams, type, msgCtx, req, ctx) {
+  const psm = {
+    type: "reqSignedUrl",
+    auth: await resAuth(req),
+    version: req.version,
+    methodParams,
+    params: {
+      ...req.params
+    },
+    conn: req.conn,
+    tenant: req.tenant,
+    tid: req.tid
+  };
+  const rSignedUrl = await ctx.calculatePreSignedUrl(msgCtx, psm);
+  if (rSignedUrl.isErr()) {
+    return buildErrorMsg(msgCtx, req, rSignedUrl.Err());
+  }
+  return {
+    ...req,
+    params: psm.params,
+    methodParams,
+    type,
+    signedUrl: rSignedUrl.Ok().toString()
+  };
+}
+
+// src/protocols/cloud/msger.ts
+import { BuildURI as BuildURI3, Result as Result15, runtimeFn as runtimeFn4, URI as URI15 } from "@adviser/cement";
+
+// src/protocols/cloud/http-connection.ts
+import { HttpHeader, Result as Result13, exception2Result as exception2Result6 } from "@adviser/cement";
+
+// src/protocols/cloud/msg-raw-connection-base.ts
+var MsgRawConnectionBase = class {
+  constructor(sthis, exGestalt) {
+    this.onErrorFns = /* @__PURE__ */ new Map();
+    this.sthis = sthis;
+    this.exchangedGestalt = exGestalt;
+  }
+  onError(fn) {
+    const key = this.sthis.nextId().str;
+    this.onErrorFns.set(key, fn);
+    return () => this.onErrorFns.delete(key);
+  }
+  buildErrorMsg(msgCtx, msg, err) {
+    const rmsg = Array.from(this.onErrorFns.values()).reduce((msg2, fn) => {
+      return fn(msg2, err);
+    }, msg);
+    const emsg = buildErrorMsg(msgCtx, rmsg, err);
+    msgCtx.logger.Error().Err(err).Any("msg", rmsg).Msg("connection error");
+    return emsg;
+  }
+};
+
+// src/protocols/cloud/http-connection.ts
+function toHttpProtocol(uri) {
+  const protocol = (uri.getParam("protocol") ?? uri.protocol).replace(/:$/, "");
+  const toFix = uri.build();
+  switch (protocol) {
+    case "ws":
+    case "http":
+      toFix.protocol("http");
+      break;
+    case "https":
+    case "wss":
+    default:
+      toFix.protocol("https");
+      break;
+  }
+  return toFix.URI();
+}
+var HttpConnection = class extends MsgRawConnectionBase {
+  constructor(sthis, uris, msgP, exGestalt) {
+    super(sthis, exGestalt);
+    this.#onMsg = /* @__PURE__ */ new Map();
+    this.activeBinds = /* @__PURE__ */ new Map();
+    this.logger = ensureLogger(sthis, "HttpConnection");
+    this.baseURIs = uris.map((uri) => ({
+      in: uri,
+      cleaned: toHttpProtocol(uri)
+    }));
+    this.msgP = msgP;
+  }
+  #onMsg;
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  send(_msg) {
+    throw new Error("Method not implemented.");
+  }
+  async start() {
+    return Result13.Ok(void 0);
+  }
+  async close() {
+    await Promise.all(Array.from(this.activeBinds.values()).map((state) => state.controller?.close()));
+    this.#onMsg.clear();
+    return Result13.Ok(void 0);
+  }
+  toMsg(msg) {
+    this.#onMsg.forEach((fn) => fn(msg));
+    return msg;
+  }
+  onMsg(fn) {
+    const key = this.sthis.nextId().str;
+    this.#onMsg.set(key, fn);
+    return () => this.#onMsg.delete(key);
+  }
+  #poll(state) {
+    this.request(state.bind.msg, state.bind.opts).then((msg) => {
+      try {
+        state.controller?.enqueue(msg);
+        if (MsgIsError(msg)) {
+          state.controller?.close();
+        } else {
+          state.timeout = setTimeout(() => this.#poll(state), state.bind.opts.pollInterval ?? 1e3);
+        }
+      } catch (err) {
+        state.controller?.error(err);
+        state.controller?.close();
+      }
+    }).catch((err) => {
+      state.controller?.error(err);
+    });
+  }
+  bind(req, opts) {
+    const state = {
+      id: this.sthis.nextId().str,
+      bind: {
+        msg: req,
+        opts
+      }
+    };
+    this.activeBinds.set(state.id, state);
+    return new ReadableStream({
+      cancel: () => {
+        clearTimeout(state.timeout);
+        this.activeBinds.delete(state.id);
+      },
+      start: (controller) => {
+        state.controller = controller;
+        this.#poll(state);
+      }
+    });
+  }
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  async request(req, _opts) {
+    const headers = HttpHeader.from();
+    headers.Set("Content-Type", this.msgP.mime);
+    headers.Set("Accept", this.msgP.mime);
+    const rReqBody = exception2Result6(() => this.msgP.ende.encode(req));
+    if (rReqBody.isErr()) {
+      return this.toMsg(
+        buildErrorMsg(this, req, this.logger.Error().Err(rReqBody.Err()).Any("req", req).Msg("encode error").AsError())
+      );
+    }
+    headers.Set("Content-Length", rReqBody.Ok().byteLength.toString());
+    const url = selectRandom(this.baseURIs);
+    this.logger.Debug().Any(url).Any("body", req).Msg("request");
+    const rRes = await exception2Result6(
+      () => timeout(
+        this.msgP.timeout,
+        fetch(url.cleaned.toString(), {
+          method: "PUT",
+          headers: headers.AsHeaderInit(),
+          body: rReqBody.Ok()
+        })
+      )
+    );
+    this.logger.Debug().Any(url).Any("body", rRes).Msg("response");
+    if (rRes.isErr()) {
+      return this.toMsg(buildErrorMsg(this, req, this.logger.Error().Err(rRes).Any(url).Msg("fetch error").AsError()));
+    }
+    const res = rRes.Ok();
+    if (!res.ok) {
+      const data2 = new Uint8Array(await res.arrayBuffer());
+      const ret2 = await exception2Result6(async () => this.msgP.ende.decode(data2));
+      if (ret2.isErr() || !MsgIsError(ret2.Ok())) {
+        return this.toMsg(
+          buildErrorMsg(
+            this,
+            req,
+            this.logger.Error().Any(url).Str("status", res.status.toString()).Str("statusText", res.statusText).Msg("HTTP Error").AsError(),
+            await res.text()
+          )
+        );
+      }
+      return this.toMsg(ret2.Ok());
+    }
+    const data = new Uint8Array(await res.arrayBuffer());
+    const ret = await exception2Result6(async () => this.msgP.ende.decode(data));
+    if (ret.isErr()) {
+      return this.toMsg(
+        buildErrorMsg(this, req, this.logger.Error().Err(ret.Err()).Msg("decode error").AsError(), this.sthis.txt.decode(data))
+      );
+    }
+    return this.toMsg(ret.Ok());
+  }
+  // toOnMessage<T extends MsgBase>(msg: WithErrorMsg<T>): Result<WithErrorMsg<T>> {
+  //   this.mec.msgFn?.(msg as unknown as MessageEvent<MsgBase>);
+  //   return Result.Ok(msg);
+  // }
+};
+
+// src/protocols/cloud/ws-connection.ts
+import { exception2Result as exception2Result7, Future as Future3, Result as Result14 } from "@adviser/cement";
+var WSConnection = class extends MsgRawConnectionBase {
+  constructor(sthis, ws, msgP, exGestalt) {
+    super(sthis, exGestalt);
+    // readonly baseURI: URI;
+    this.#onMsg = /* @__PURE__ */ new Map();
+    this.#onClose = /* @__PURE__ */ new Map();
+    this.waitForTid = /* @__PURE__ */ new Map();
+    this.opened = false;
+    this.#wsOnMessage = async (event) => {
+      const rMsg = await exception2Result7(() => this.msgP.ende.decode(event.data));
+      if (rMsg.isErr()) {
+        this.logger.Error().Err(rMsg).Any(event.data).Msg("Invalid message");
+        return;
+      }
+      const msg = rMsg.Ok();
+      const waitFor = this.waitForTid.get(msg.tid);
+      Array.from(this.#onMsg.values()).forEach((cb) => {
+        cb(msg);
+      });
+      if (waitFor) {
+        if (MsgIsError(msg)) {
+          this.waitForTid.delete(msg.tid);
+          waitFor.future.resolve(msg);
+        } else if (waitFor.waitFor(msg)) {
+          this.waitForTid.delete(msg.tid);
+          waitFor.future.resolve(msg);
+        } else {
+          this.waitForTid.delete(msg.tid);
+          waitFor.future.resolve(msg);
+        }
+      }
+    };
+    this.activeBinds = /* @__PURE__ */ new Map();
+    this.id = sthis.nextId().str;
+    this.logger = ensureLogger(sthis, "WSConnection");
+    this.msgP = msgP;
+    this.ws = ws;
+  }
+  #onMsg;
+  #onClose;
+  async start() {
+    const onOpenFuture = new Future3();
+    const timer = setTimeout(() => {
+      const err = this.logger.Error().Dur("timeout", this.msgP.timeout).Msg("Timeout").AsError();
+      this.toMsg(buildErrorMsg(this, {}, err));
+      onOpenFuture.resolve(Result14.Err(err));
+    }, this.msgP.timeout);
+    this.ws.onopen = () => {
+      onOpenFuture.resolve(Result14.Ok(void 0));
+      this.opened = true;
+    };
+    this.ws.onerror = (ierr) => {
+      const err = this.logger.Error().Err(ierr).Msg("WS Error").AsError();
+      onOpenFuture.resolve(Result14.Err(err));
+      const res = this.buildErrorMsg(this, {}, err);
+      this.toMsg(res);
+    };
+    this.ws.onmessage = (evt) => {
+      if (!this.opened) {
+        this.toMsg(buildErrorMsg(this, {}, this.logger.Error().Msg("Received message before onOpen").AsError()));
+      }
+      this.#wsOnMessage(evt);
+    };
+    this.ws.onclose = () => {
+      this.opened = false;
+      this.close().catch((ierr) => {
+        const err = this.logger.Error().Err(ierr).Msg("close error").AsError();
+        onOpenFuture.resolve(Result14.Err(err));
+        this.toMsg(buildErrorMsg(this, { tid: "internal" }, err));
+      });
+    };
+    const rOpen = await onOpenFuture.asPromise().finally(() => {
+      clearTimeout(timer);
+    });
+    if (rOpen.isErr()) {
+      return rOpen;
+    }
+    return Result14.Ok(void 0);
+  }
+  #wsOnMessage;
+  async close() {
+    this.#onClose.forEach((fn) => fn());
+    this.#onClose.clear();
+    this.#onMsg.clear();
+    this.ws.close();
+    return Result14.Ok(void 0);
+  }
+  toMsg(msg) {
+    this.#onMsg.forEach((fn) => fn(msg));
+    return msg;
+  }
+  send(msg) {
+    this.ws.send(this.msgP.ende.encode(msg));
+    return Promise.resolve(msg);
+  }
+  onMsg(fn) {
+    const key = this.sthis.nextId().str;
+    this.#onMsg.set(key, fn);
+    return () => this.#onMsg.delete(key);
+  }
+  onClose(fn) {
+    const key = this.sthis.nextId().str;
+    this.#onClose.set(key, fn);
+    return () => this.#onClose.delete(key);
+  }
+  bind(req, opts) {
+    const state = {
+      id: this.sthis.nextId().str,
+      bind: {
+        msg: req,
+        opts
+      }
+      // timeout: undefined,
+      // controller: undefined,
+    };
+    this.activeBinds.set(state.id, state);
+    return new ReadableStream({
+      cancel: () => {
+        this.activeBinds.delete(state.id);
+      },
+      start: (controller) => {
+        this.onMsg((msg) => {
+          if (MsgIsError(msg)) {
+            controller.enqueue(msg);
+            return;
+          }
+          if (!MsgIsTid(msg, req.tid)) {
+            return;
+          }
+          if (opts.waitFor && opts.waitFor(msg)) {
+            controller.enqueue(msg);
+          }
+        });
+        this.send(req);
+        const future = new Future3();
+        this.waitForTid.set(req.tid, { tid: req.tid, future, waitFor: opts.waitFor, timeout: opts.timeout });
+        future.asPromise().then((msg) => {
+          if (MsgIsError(msg)) {
+            controller.enqueue(msg);
+            controller.close();
+          }
+        });
+      }
+    });
+  }
+  async request(req, opts) {
+    if (!this.opened) {
+      return buildErrorMsg(this, req, this.logger.Error().Msg("Connection not open").AsError());
+    }
+    const future = new Future3();
+    this.waitForTid.set(req.tid, { tid: req.tid, future, waitFor: opts.waitFor, timeout: opts.timeout });
+    await this.send(req);
+    return future.asPromise();
+  }
+  // toOnMessage<T extends MsgBase>(msg: WithErrorMsg<T>): Result<WithErrorMsg<T>> {
+  //   this.mec.msgFn?.(msg as unknown as MessageEvent<MsgBase>);
+  //   return Result.Ok(msg);
+  // }
+};
+
+// src/protocols/cloud/msger.ts
+function selectRandom(arr) {
+  return arr[Math.floor(Math.random() * arr.length)];
+}
+function timeout(ms, promise) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`TIMEOUT after ${ms}ms`));
+    }, ms);
+    promise.then(resolve).catch(reject).finally(() => clearTimeout(timer));
+  });
+}
+function jsonEnDe(sthis) {
+  return {
+    encode: (node) => sthis.txt.encode(JSON.stringify(node)),
+    decode: (data) => JSON.parse(sthis.txt.decode(data))
+  };
+}
+function defaultMsgParams(sthis, igs) {
+  return {
+    mime: "application/json",
+    ende: jsonEnDe(sthis),
+    timeout: 3e3,
+    protocolCapabilities: ["reqRes", "stream"],
+    ...igs
+  };
+}
+async function applyStart(prC) {
+  const rC = await prC;
+  if (rC.isErr()) {
+    return rC;
+  }
+  const c = rC.Ok();
+  const r = await c.start();
+  if (r.isErr()) {
+    return Result15.Err(r.Err());
+  }
+  return rC;
+}
+async function authTypeFromUri(logger, curi) {
+  const uri = URI15.from(curi);
+  const authJWK = uri.getParam("authJWK");
+  if (!authJWK) {
+    return logger.Error().Url(uri).Msg("authJWK is required").ResultError();
+  }
+  return Result15.Ok({
+    type: "fp-cloud-jwk",
+    params: {
+      // claim: fpc.Ok().payload,
+      jwk: authJWK
+    }
+  });
+}
+var MsgConnected = class _MsgConnected {
+  static async connect(auth, mrc, conn = {}) {
+    if (Result15.Is(mrc)) {
+      if (mrc.isErr()) {
+        return Result15.Err(mrc.Err());
+      }
+      mrc = mrc.Ok();
+    }
+    const res = await mrc.request(buildReqOpen(mrc.sthis, auth, conn), { waitFor: MsgIsResOpen });
+    if (MsgIsError(res) || !MsgIsResOpen(res)) {
+      return mrc.sthis.logger.Error().Err(res).Msg("unexpected response").ResultError();
+    }
+    return Result15.Ok(new _MsgConnected(mrc, res.conn));
+  }
+  constructor(raw2, conn) {
+    this.sthis = raw2.sthis;
+    this.raw = raw2;
+    this.exchangedGestalt = raw2.exchangedGestalt;
+    this.conn = conn;
+    this.activeBinds = raw2.activeBinds;
+    this.id = this.sthis.nextId().str;
+  }
+  attachAuth(auth) {
+    return new MsgConnectedAuth(this, auth);
+  }
+};
+var MsgConnectedAuth = class {
+  constructor(conn, authFactory) {
+    this.id = conn.id;
+    this.raw = conn.raw;
+    this.conn = conn.conn;
+    this.sthis = conn.sthis;
+    this.authFactory = authFactory;
+    this.exchangedGestalt = conn.exchangedGestalt;
+    this.activeBinds = conn.activeBinds;
+  }
+  bind(req, opts) {
+    const stream = this.raw.bind({ ...req, conn: req.conn || this.conn }, opts);
+    const ts = new TransformStream({
+      transform: (chunk, controller) => {
+        if (!MsgIsTid(chunk, req.tid)) {
+          return;
+        }
+        if (MsgIsConnected(chunk, this.conn)) {
+          if (opts.waitFor?.(chunk) || MsgIsError(chunk)) {
+            controller.enqueue(chunk);
+          }
+        }
+      }
+    });
+    stream.pipeThrough(ts);
+    return ts.readable;
+  }
+  authType() {
+    return this.authFactory();
+  }
+  msgConnAuth() {
+    return this.authType().then((r) => {
+      if (r.isErr()) {
+        return Result15.Err(r);
+      }
+      return Result15.Ok({ conn: this.conn, auth: r.Ok() });
+    });
+  }
+  request(req, opts) {
+    return this.raw.request({ ...req, conn: req.conn || this.conn }, opts);
+  }
+  send(msg) {
+    return this.raw.send({ ...msg, conn: msg.conn || this.conn });
+  }
+  start() {
+    return this.raw.start();
+  }
+  async close(t) {
+    await this.request(buildReqClose(this.sthis, t.auth, this.conn), { waitFor: MsgIsResClose });
+    return await this.raw.close(t);
+  }
+  onMsg(msgFn) {
+    return this.raw.onMsg((msg) => {
+      if (MsgIsConnected(msg, this.conn)) {
+        msgFn(msg);
+      }
+    });
+  }
+};
+function initialFPUri(curl) {
+  let gestaltUrl = URI15.from(curl);
+  if (["", "/"].includes(gestaltUrl.pathname)) {
+    gestaltUrl = gestaltUrl.build().appendRelative("/fp").URI();
+  }
+  return gestaltUrl;
+}
+var Msger = class _Msger {
+  static async openHttp(sthis, urls, msgP, exGestalt) {
+    return Result15.Ok(new HttpConnection(sthis, urls, msgP, exGestalt));
+  }
+  static async openWS(sthis, url, msgP, exGestalt) {
+    let ws;
+    url = url.build().setParam("random", sthis.nextId().str).URI();
+    if (runtimeFn4().isNodeIsh) {
+      const { WebSocket: WebSocket2 } = await import("ws");
+      ws = new WebSocket2(url.toString());
+    } else {
+      ws = new WebSocket(url.toString());
+    }
+    return Result15.Ok(new WSConnection(sthis, ws, msgP, exGestalt));
+  }
+  static async open(sthis, auth, curl, imsgP = {}) {
+    const jsMsgP = defaultMsgParams(sthis, { ...imsgP, mime: "application/json", ende: jsonEnDe(sthis) });
+    const gestaltUrl = initialFPUri(curl);
+    const gs = defaultGestalt(defaultMsgParams(sthis, imsgP), { id: "FP-Universal-Client" });
+    const rHC = await _Msger.openHttp(sthis, [gestaltUrl], jsMsgP, { my: gs, remote: gs });
+    if (rHC.isErr()) {
+      return rHC;
+    }
+    const hc = rHC.Ok();
+    const resGestalt = await hc.request(buildReqGestalt(sthis, auth, gs), {
+      waitFor: MsgIsResGestalt
+    });
+    if (!MsgIsResGestalt(resGestalt)) {
+      return sthis.logger.Error().Any({ resGestalt }).Msg("should be ResGestalt").ResultError();
+    }
+    await hc.close(
+      resGestalt
+      /* as MsgWithConnAuth */
+    );
+    const exGt = { my: gs, remote: resGestalt.gestalt };
+    const msgP = defaultMsgParams(sthis, imsgP);
+    if (exGt.remote.protocolCapabilities.includes("reqRes") && !exGt.remote.protocolCapabilities.includes("stream")) {
+      return applyStart(
+        _Msger.openHttp(
+          sthis,
+          exGt.remote.httpEndpoints.map((i) => BuildURI3.from(curl).resolve(i).URI()),
+          msgP,
+          exGt
+        )
+      );
+    }
+    const wsUrl = BuildURI3.from(gestaltUrl).resolve(selectRandom(exGt.remote.wsEndpoints)).URI();
+    return applyStart(_Msger.openWS(sthis, wsUrl, msgP, exGt));
+  }
+  static connect(sthis, auth, curl, imsgP = {}, conn = {}) {
+    return _Msger.open(sthis, auth, curl, imsgP).then((srv) => MsgConnected.connect(auth, srv, conn));
+  }
+  constructor() {
+  }
+};
+
+// src/protocols/cloud/msg-types-data.ts
+function buildReqGetData(sthis, sup, ctx) {
+  return buildReqSignedUrl(sthis, "reqGetData", sup, ctx);
+}
+function MsgIsReqGetData(msg) {
+  return msg.type === "reqGetData";
+}
+function MsgIsResGetData(msg) {
+  return msg.type === "resGetData" && MsgIsTenantLedger(msg);
+}
+function buildResGetData(msgCtx, req, ctx) {
+  return buildRes(
+    { method: "GET", store: req.methodParams.store },
+    "resGetData",
+    msgCtx,
+    req,
+    ctx
+  );
+}
+function MsgIsReqPutData(msg) {
+  return msg.type === "reqPutData";
+}
+function buildReqPutData(sthis, sup, ctx) {
+  return buildReqSignedUrl(sthis, "reqPutData", sup, ctx);
+}
+function MsgIsResPutData(msg) {
+  return msg.type === "resPutData";
+}
+function buildResPutData(msgCtx, req, ctx) {
+  return buildRes(
+    { method: "PUT", store: req.methodParams.store },
+    "resPutData",
+    msgCtx,
+    req,
+    ctx
+  );
+}
+function MsgIsReqDelData(msg) {
+  return msg.type === "reqDelData";
+}
+function buildReqDelData(sthis, sup, ctx) {
+  return buildReqSignedUrl(sthis, "reqDelData", sup, ctx);
+}
+function MsgIsResDelData(msg) {
+  return msg.type === "resDelData";
+}
+function buildResDelData(msgCtx, req, ctx) {
+  return buildRes(
+    { method: "DELETE", store: req.methodParams.store },
+    "resDelData",
+    msgCtx,
+    req,
+    ctx
+  );
+}
+
+// src/protocols/cloud/msg-types-meta.ts
+import { VERSION as VERSION2 } from "@adviser/cement";
+function buildReqPutMeta(sthis, auth, signedUrlParams, meta, gwCtx) {
+  return {
+    auth,
+    tid: sthis.nextId().str,
+    type: "reqPutMeta",
+    ...gwCtx,
+    version: VERSION2,
+    methodParams: {
+      method: "PUT",
+      store: "meta"
+    },
+    params: signedUrlParams,
+    meta
+  };
+}
+function MsgIsReqPutMeta(msg) {
+  return msg.type === "reqPutMeta";
+}
+function buildResPutMeta(_msgCtx, req, meta, signedUrl) {
+  return {
+    meta,
+    tid: req.tid,
+    conn: req.conn,
+    auth: req.auth,
+    methodParams: req.methodParams,
+    params: req.params,
+    tenant: req.tenant,
+    type: "resPutMeta",
+    signedUrl,
+    version: VERSION2
+  };
+}
+function MsgIsResPutMeta(qs) {
+  return qs.type === "resPutMeta";
+}
+function MsgIsBindGetMeta(msg) {
+  return msg.type === "bindGetMeta";
+}
+function buildBindGetMeta(sthis, auth, params, gwCtx) {
+  return {
+    auth,
+    tid: sthis.nextId().str,
+    ...gwCtx,
+    type: "bindGetMeta",
+    version: VERSION2,
+    params
+  };
+}
+function buildEventGetMeta(_msgCtx, req, meta, gwCtx, signedUrl) {
+  return {
+    conn: gwCtx.conn,
+    tenant: req.tenant,
+    auth: req.auth,
+    tid: req.tid,
+    meta,
+    signedUrl,
+    type: "eventGetMeta",
+    params: req.params,
+    methodParams: { method: "GET", store: "meta" },
+    version: VERSION2
+  };
+}
+function MsgIsEventGetMeta(qs) {
+  return qs.type === "eventGetMeta";
+}
+function buildReqDelMeta(sthis, auth, params, gwCtx, meta) {
+  return {
+    auth,
+    tid: sthis.nextId().str,
+    tenant: gwCtx.tenant,
+    conn: gwCtx.conn,
+    params,
+    meta,
+    type: "reqDelMeta",
+    version: VERSION2
+    // params: signedUrlParams,
+  };
+}
+function MsgIsReqDelMeta(msg) {
+  return msg.type === "reqDelMeta";
+}
+function buildResDelMeta(req, params, signedUrl) {
+  return {
+    auth: req.auth,
+    methodParams: { method: "DELETE", store: "meta" },
+    params,
+    signedUrl,
+    tid: req.tid,
+    conn: req.conn,
+    tenant: req.tenant,
+    type: "resDelMeta",
+    // key: req.key,
+    version: VERSION2
+  };
+}
+function MsgIsResDelMeta(qs) {
+  return qs.type === "resDelMeta";
+}
+
+// src/runtime/meta-key-hack.ts
+import { exception2Result as exception2Result8, Result as Result16 } from "@adviser/cement";
+function fromV1toV2SerializedMetaKey(v1s, keys = []) {
+  const res = v1s.reduce(
+    (acc, v1) => {
+      const keys2 = [];
+      if (v1.key) {
+        if (typeof v1.key === "string") {
+          acc.keys.add(v1.key);
+        } else {
+          keys2.push(...v1.key);
+        }
+      }
+      if (v1.keys) {
+        keys2.push(...v1.keys);
+      }
+      for (const key of keys2) {
+        acc.keys.add(key);
+      }
+      if (typeof v1.cid === "string" && (!v1.data || typeof v1.data === "string") && (!v1.parents || Array.isArray(v1.parents))) {
+        acc.metas.set(v1.cid, {
+          data: v1.data ?? "",
+          parents: v1.parents ?? [],
+          cid: v1.cid
+        });
+      }
+      return acc;
+    },
+    {
+      metas: /* @__PURE__ */ new Map(),
+      keys: new Set(keys)
+    }
+  );
+  return {
+    metas: Array.from(res.metas.values()),
+    keys: Array.from(res.keys)
+  };
+}
+function isV2SerializedMetaKey(or) {
+  const my = or;
+  return my !== null && (!my.keys || Array.isArray(my.keys)) && (!my.metas || Array.isArray(my.metas));
+}
+function toV2SerializedMetaKey(or) {
+  if (Array.isArray(or)) {
+    return fromV1toV2SerializedMetaKey(or);
+  }
+  if (isV2SerializedMetaKey(or)) {
+    return fromV1toV2SerializedMetaKey(or.metas ?? [], or.keys ?? []);
+  }
+  throw new Error("not a valid serialized meta key");
+}
+async function V2SerializedMetaKeyExtractKey(ctx, v2) {
+  const kb = await ctx.loader.keyBag();
+  if (!kb) {
+    return Promise.resolve(Result16.Err(new Error("missing keybag")));
+  }
+  const dataUrl = await ctx.loader.attachedStores.local().active.car.url();
+  const keyName = dataUrl.getParam(PARAM.STORE_KEY);
+  if (!keyName) {
+    ctx.loader.sthis.logger.Warn().Url(dataUrl).Msg("missing store key");
+  } else {
+    const rKey = await kb.getNamedKey(keyName);
+    if (rKey.isErr()) {
+      ctx.loader.sthis.logger.Warn().Str("keyName", keyName).Msg("did not found a extractable key");
+    } else {
+      for (const keyStr of v2.keys) {
+        const res = await rKey.Ok().upsert(keyStr, false);
+        if (res.isErr()) {
+          ctx.loader.sthis.logger.Warn().Str("keyStr", keyStr).Msg("failed to upsert key");
+        }
+      }
+    }
+  }
+  return Promise.resolve(Result16.Ok(v2.metas));
+}
+async function decodeAsToSerializedMeta(ctx, raw2) {
+  const rJsObj = exception2Result8(() => JSON.parse(ctx.loader.sthis.txt.decode(raw2)));
+  if (rJsObj.isErr()) {
+    return Result16.Err(rJsObj);
+  }
+  const v2 = toV2SerializedMetaKey(rJsObj.unwrap());
+  const metas = await V2SerializedMetaKeyExtractKey(ctx, v2);
+  if (metas.isErr()) {
+    return Result16.Err(metas);
+  }
+  return Result16.Ok({
+    metas: metas.Ok(),
+    keys: v2.keys
+  });
+}
+function addKeyToDbMetaDecoder(ctx) {
+  const lastDecodedMetas = ctx.lastDecodedMetas ?? [];
+  return {
+    ...ctx,
+    lastDecodedMetas,
+    decoder: {
+      meta: async (sthis, raw2) => {
+        const r = await decodeAsToSerializedMeta(ctx, raw2);
+        if (r.isErr()) {
+          return Promise.resolve(Result16.Err(r));
+        }
+        if (lastDecodedMetas.length > 2) {
+          lastDecodedMetas.shift();
+        }
+        lastDecodedMetas.push(r.Ok());
+        return Promise.resolve(Result16.Ok(r.Ok().metas));
+      }
+    }
+  };
+}
+async function wrapEncode(ctx, payload, fn) {
+  const carStore = ctx.loader.attachedStores.local().active.car;
+  const kb = await ctx.loader.keyBag();
+  if (!kb) {
+    return Promise.resolve(Result16.Err(new Error("missing keybag")));
+  }
+  const keyName = carStore.url().getParam(PARAM.STORE_KEY) ?? "";
+  const rKex = await kb.getNamedKey(keyName);
+  if (rKex.isErr()) {
+    return Promise.resolve(Result16.Err(rKex.Err()));
+  }
+  const keyMaterials = await rKex.Ok().asKeysItem().then((i) => Object.values(i.keys).map((i2) => i2.key));
+  return Promise.resolve(Result16.Ok(fn(payload, keyMaterials)));
+}
+function encodeAsV1SerializedMetaKey(ctx, payload) {
+  return wrapEncode(ctx, payload, (payload2, keyM) => payload2.map((p) => ({ ...p, key: keyM })));
+}
+function encodeAsV2SerializedMetaKey(ctx, payload) {
+  return wrapEncode(
+    ctx,
+    payload,
+    (payload2, keyM) => ({
+      metas: payload2,
+      keys: keyM
+    })
+  );
+}
+function addKeyToDbMetaEncoder(ctx, version) {
+  return {
+    ...ctx,
+    encoder: {
+      meta: async (sthis, payload) => {
+        let obj;
+        switch (version) {
+          case "v1":
+            obj = await encodeAsV1SerializedMetaKey(ctx, payload);
+            break;
+          case "v2":
+            obj = await encodeAsV2SerializedMetaKey(ctx, payload);
+            break;
+          default:
+            return Promise.resolve(Result16.Err(`unknown version:[${version}]`));
+        }
+        if (obj.isErr()) {
+          return Promise.resolve(Result16.Err(obj));
+        }
+        try {
+          return Promise.resolve(Result16.Ok(sthis.txt.encode(JSON.stringify(obj.Ok()))));
+        } catch (e) {
+          return Promise.resolve(Result16.Err(e));
+        }
+      }
+    }
+  };
+}
+var AddKeyToDbMetaGateway = class {
+  constructor(gw, version) {
+    // only for tests
+    this.lastDecodedMetas = [];
+    this.sdGw = new DefSerdeGateway(gw);
+    this.version = version;
+  }
+  buildUrl(ctx, baseUrl, key) {
+    return this.sdGw.buildUrl(ctx, baseUrl, key);
+  }
+  start(ctx, baseUrl) {
+    return this.sdGw.start(ctx, baseUrl);
+  }
+  close(ctx, baseUrl) {
+    return this.sdGw.close(ctx, baseUrl);
+  }
+  async put(ctx, url, body) {
+    return this.sdGw.put(addKeyToDbMetaEncoder(ctx, this.version), url, body);
+  }
+  async get(ctx, url) {
+    return this.sdGw.get(addKeyToDbMetaDecoder({ ...ctx, lastDecodedMetas: this.lastDecodedMetas }), url);
+  }
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  delete(ctx, url, loader) {
+    return this.sdGw.delete(ctx, url);
+  }
+  subscribe(ctx, url, callback) {
+    return this.sdGw.subscribe(addKeyToDbMetaDecoder({ ...ctx, lastDecodedMetas: this.lastDecodedMetas }), url, callback);
+  }
+  getPlain(ctx, url, key) {
+    return this.sdGw.getPlain(ctx, url, key);
+  }
+  destroy(ctx, baseUrl) {
+    return this.sdGw.destroy(ctx, baseUrl);
+  }
+};
+
+// src/runtime/gateways/cloud/gateway.ts
+var VERSION3 = "v0.1-fp-cloud";
+var BaseGateway = class {
+  constructor(sthis, module) {
+    this.sthis = sthis;
+    this.logger = ensureLogger(sthis, module);
+  }
+  async buildReqSignedUrl(type, method, store, uri, conn) {
+    const rParams = uri.getParamsResult({
+      key: param.REQUIRED,
+      store: param.REQUIRED,
+      path: param.OPTIONAL,
+      tenant: param.REQUIRED,
+      name: param.REQUIRED,
+      index: param.OPTIONAL
+    });
+    if (rParams.isErr()) {
+      return buildErrorMsg(this, {}, rParams.Err());
+    }
+    const params = rParams.Ok();
+    if (store !== params.store) {
+      return buildErrorMsg(this, {}, new Error("store mismatch"));
+    }
+    const rAuth = await authTypeFromUri(this.logger, uri);
+    if (rAuth.isErr()) {
+      return buildErrorMsg(this, {}, rAuth.Err());
+    }
+    return {
+      tid: this.sthis.nextId().str,
+      auth: rAuth.Ok(),
+      type,
+      conn: conn.conn.Ok().conn,
+      tenant: {
+        tenant: params.tenant,
+        ledger: params.name
+      },
+      // tenant: conn.tenant,
+      methodParams: {
+        method,
+        store
+      },
+      params: {
+        ...params,
+        key: params.key
+      },
+      version: VERSION3
+    };
+  }
+  async getReqSignedUrl(type, method, store, waitForFn, uri, conn) {
+    const rsu = await this.buildReqSignedUrl(type, method, store, uri, conn);
+    if (MsgIsError(rsu)) {
+      return rsu;
+    }
+    return conn.conn.Ok().request(rsu, { waitFor: waitForFn });
+  }
+  async putObject(uri, uploadUrl, body, conn) {
+    this.logger.Debug().Any("url", { uploadUrl, uri }).Msg("put-fetch-url");
+    const rUpload = await exception2Result9(async () => fetch(uploadUrl, { method: "PUT", body }));
+    if (rUpload.isErr()) {
+      return this.logger.Error().Url(uploadUrl, "uploadUrl").Err(rUpload).Msg("Error in put fetch").ResultError();
+    }
+    if (!rUpload.Ok().ok) {
+      return this.logger.Error().Url(uploadUrl, "uploadUrl").Http(rUpload.Ok()).Msg("Error in put fetch").ResultError();
+    }
+    if (uri.getParam("testMode")) {
+      conn.citem.trackPuts.add(uri.toString());
+    }
+    return Result17.Ok(void 0);
+  }
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  async getObject(uri, downloadUrl, _conn) {
+    this.logger.Debug().Any("url", { downloadUrl, uri }).Msg("get-fetch-url");
+    const rDownload = await exception2Result9(async () => fetch(downloadUrl.toString(), { method: "GET" }));
+    if (rDownload.isErr()) {
+      return this.logger.Error().Url(downloadUrl, "uploadUrl").Err(rDownload).Msg("Error in get downloadUrl").ResultError();
+    }
+    const download = rDownload.Ok();
+    if (!download.ok) {
+      if (download.status === 404) {
+        return Result17.Err(new NotFoundError("Not found"));
+      }
+      return this.logger.Error().Url(downloadUrl, "uploadUrl").Err(rDownload).Msg("Error in get fetch").ResultError();
+    }
+    return Result17.Ok(to_uint8(await download.arrayBuffer()));
+  }
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  async delObject(uri, deleteUrl, _conn) {
+    this.logger.Debug().Any("url", { deleteUrl, uri }).Msg("get-fetch-url");
+    const rDelete = await exception2Result9(async () => fetch(deleteUrl.toString(), { method: "DELETE" }));
+    if (rDelete.isErr()) {
+      return this.logger.Error().Url(deleteUrl, "deleteUrl").Err(rDelete).Msg("Error in get deleteURL").ResultError();
+    }
+    const download = rDelete.Ok();
+    if (!download.ok) {
+      if (download.status === 404) {
+        return Result17.Err(new NotFoundError("Not found"));
+      }
+      return this.logger.Error().Url(deleteUrl, "deleteUrl").Err(rDelete).Msg("Error in del fetch").ResultError();
+    }
+    return Result17.Ok(void 0);
+  }
+};
+var DataGateway = class extends BaseGateway {
+  constructor(sthis) {
+    super(sthis, "DataGateway");
+  }
+  async get(ctx, uri) {
+    const store = coerceFPStoreTypes(uri.getParam("store"));
+    const rResSignedUrl = await this.getReqSignedUrl("reqGetData", "GET", store, MsgIsResGetData, uri, ctx.conn);
+    if (MsgIsError(rResSignedUrl)) {
+      return this.logger.Error().Err(rResSignedUrl).Msg("Error in buildResSignedUrl").ResultError();
+    }
+    const { signedUrl: downloadUrl } = rResSignedUrl;
+    const r = await fpDeserialize(this.sthis, uri, this.getObject(uri, downloadUrl, ctx.conn));
+    return r;
+  }
+  async put(ctx, uri, data) {
+    const store = coerceFPStoreTypes(uri.getParam("store"));
+    const rResSignedUrl = await this.getReqSignedUrl("reqPutData", "PUT", store, MsgIsResPutData, uri, ctx.conn);
+    if (MsgIsError(rResSignedUrl)) {
+      return this.logger.Error().Err(rResSignedUrl).Msg("Error in buildResSignedUrl").ResultError();
+    }
+    const { signedUrl: uploadUrl } = rResSignedUrl;
+    const rBlob = await fpSerialize(ctx.loader.sthis, data);
+    if (rBlob.isErr()) {
+      return rBlob;
+    }
+    const r = await this.putObject(uri, uploadUrl, rBlob.Ok(), ctx.conn);
+    return r;
+  }
+  async delete(ctx, uri) {
+    const store = coerceFPStoreTypes(uri.getParam("store"));
+    const rResSignedUrl = await this.getReqSignedUrl("reqDelData", "DELETE", store, MsgIsResDelData, uri, ctx.conn);
+    if (MsgIsError(rResSignedUrl)) {
+      return this.logger.Error().Err(rResSignedUrl).Msg("Error in buildResSignedUrl").ResultError();
+    }
+    const { signedUrl: deleteUrl } = rResSignedUrl;
+    return this.delObject(uri, deleteUrl, ctx.conn);
+  }
+};
+function getGwCtx(conn, uri) {
+  const rParams = uri.getParamsResult({
+    tid: param.OPTIONAL,
+    tenant: param.REQUIRED,
+    ledger: param.REQUIRED
+  });
+  if (rParams.isErr()) {
+    return Result17.Err(rParams);
+  }
+  const r = rParams.Ok();
+  return Result17.Ok({
+    tid: r.tid,
+    conn,
+    tenant: {
+      tenant: r.tenant,
+      ledger: r.ledger
+    }
+  });
+}
+var MetaGateway = class extends BaseGateway {
+  constructor(sthis) {
+    super(sthis, "MetaGateway");
+  }
+  async get(ctx, uri) {
+    const reqSignedUrl = await this.buildReqSignedUrl("bindGetMeta", "GET", "meta", uri, ctx.conn);
+    if (MsgIsError(reqSignedUrl)) {
+      return this.logger.Error().Err(reqSignedUrl).Msg("Error in buildReqSignedUrl").ResultError();
+    }
+    const rGwCtx = getGwCtx(ctx.conn.conn.Ok().conn, uri);
+    if (rGwCtx.isErr()) {
+      return Result17.Err(rGwCtx);
+    }
+    const rAuthType = await ctx.conn.conn.Ok().authType();
+    if (rAuthType.isErr()) {
+      return Result17.Err(rAuthType);
+    }
+    const res = await ctx.conn.conn.Ok().request(buildBindGetMeta(ctx.loader.sthis, rAuthType.Ok(), reqSignedUrl.params, rGwCtx.Ok()), {
+      waitFor: MsgIsEventGetMeta
+    });
+    if (MsgIsError(res)) {
+      return this.logger.Error().Err(res).Msg("Error in buildBindGetMeta").ResultError();
+    }
+    const rV2Meta = await V2SerializedMetaKeyExtractKey(ctx, res.meta);
+    const rMeta = await decode2DbMetaEvents(ctx.loader.sthis, rV2Meta);
+    if (rMeta.isErr()) {
+      return Result17.Err(rMeta);
+    }
+    return Result17.Ok({
+      type: "meta",
+      payload: rMeta.Ok()
+    });
+  }
+  async put(ctx, uri, imeta) {
+    const meta = imeta;
+    const reqSignedUrl = await this.buildReqSignedUrl("reqPutMeta", "PUT", "meta", uri, ctx.conn);
+    if (MsgIsError(reqSignedUrl)) {
+      return this.logger.Error().Err(reqSignedUrl).Msg("Error in buildReqSignedUrl").ResultError();
+    }
+    const rGwCtx = getGwCtx(ctx.conn.conn.Ok().conn, uri);
+    if (rGwCtx.isErr()) {
+      return Result17.Err(rGwCtx);
+    }
+    const rAuthType = await ctx.conn.conn.Ok().authType();
+    if (rAuthType.isErr()) {
+      return Result17.Err(rAuthType);
+    }
+    const serializedMeta = await dbMetaEvent2Serialized(ctx.loader.sthis, meta.payload);
+    const rKeyedMeta = await encodeAsV2SerializedMetaKey(ctx, serializedMeta);
+    if (rKeyedMeta.isErr()) {
+      return rKeyedMeta;
+    }
+    const reqPutMeta = buildReqPutMeta(ctx.loader.sthis, rAuthType.Ok(), reqSignedUrl.params, rKeyedMeta.Ok(), rGwCtx.Ok());
+    const resMsg = await ctx.conn.conn.Ok().request(reqPutMeta, {
+      waitFor: MsgIsResPutMeta
+    });
+    if (MsgIsError(resMsg)) {
+      return this.logger.Error().Err(resMsg).Msg("Error in buildResSignedUrl").ResultError();
+    }
+    return Result17.Ok(void 0);
+  }
+  async delete(ctx, uri) {
+    const reqSignedUrl = await this.getReqSignedUrl("reqDelMeta", "DELETE", "meta", MsgIsResDelData, uri, ctx.conn);
+    if (MsgIsError(reqSignedUrl)) {
+      return this.logger.Error().Err(reqSignedUrl).Msg("Error in buildReqSignedUrl").ResultError();
+    }
+    const rGwCtx = getGwCtx(ctx.conn.conn.Ok().conn, uri);
+    if (rGwCtx.isErr()) {
+      return Result17.Err(rGwCtx);
+    }
+    const rAuthType = await ctx.conn.conn.Ok().authType();
+    if (rAuthType.isErr()) {
+      return Result17.Err(rAuthType);
+    }
+    const reqDelMeta = buildReqDelMeta(ctx.loader.sthis, rAuthType.Ok(), reqSignedUrl.params, rGwCtx.Ok());
+    const resMsg = await ctx.conn.conn.Ok().request(reqDelMeta, {
+      waitFor: MsgIsResDelData
+    });
+    if (MsgIsError(resMsg)) {
+      return this.logger.Error().Err(resMsg).Msg("Error in buildResSignedUrl").ResultError();
+    }
+    return Result17.Ok(void 0);
+  }
+};
+var WALGateway = class extends BaseGateway {
+  constructor(sthis) {
+    super(sthis, "WALGateway");
+    // WAL will not pollute to the cloud
+    this.wals = /* @__PURE__ */ new Map();
+  }
+  getWalKeyFromUri(uri) {
+    const rKey = uri.getParamsResult({
+      key: 0,
+      name: 0
+    });
+    if (rKey.isErr()) {
+      return Result17.Err(rKey.Err());
+    }
+    const { name, key } = rKey.Ok();
+    return Result17.Ok(`${name}:${key}`);
+  }
+  async get(ctx, uri) {
+    const rKey = this.getWalKeyFromUri(uri);
+    if (rKey.isErr()) {
+      return Result17.Err(rKey.Err());
+    }
+    const wal = this.wals.get(rKey.Ok());
+    if (!wal) {
+      return Result17.Err(new NotFoundError("Not found"));
+    }
+    return Result17.Ok(wal);
+  }
+  async put(ctx, uri, body) {
+    const rKey = this.getWalKeyFromUri(uri);
+    if (rKey.isErr()) {
+      return Result17.Err(rKey.Err());
+    }
+    this.wals.set(rKey.Ok(), body);
+    return Result17.Ok(void 0);
+  }
+  async delete(ctx, uri) {
+    const rKey = this.getWalKeyFromUri(uri);
+    if (rKey.isErr()) {
+      return Result17.Err(rKey.Err());
+    }
+    this.wals.delete(rKey.Ok());
+    return Result17.Ok(void 0);
+  }
+};
+var storeTypedGateways = new KeyedResolvOnce6();
+function getStoreTypeGateway(sthis, uri) {
+  const store = uri.getParam("store");
+  switch (store) {
+    case "file":
+    case "car":
+      return storeTypedGateways.get(store).once(() => new DataGateway(sthis));
+    case "meta":
+      return storeTypedGateways.get(store).once(() => new MetaGateway(sthis));
+    case "wal":
+      return storeTypedGateways.get(store).once(() => new WALGateway(sthis));
+    default:
+      throw ensureLogger(sthis, "getStoreTypeGateway").Error().Str("store", store).Msg("Invalid store type").ResultError();
+  }
+}
+function connectionURI(uri) {
+  return uri.build().delParam("authJWK").delParam("key").delParam("store").delParam("suffix").delParam("storekey").URI();
+}
+var subscriptions = /* @__PURE__ */ new Map();
+var FireproofCloudGateway = class {
+  #connectionURIs = /* @__PURE__ */ new Map();
+  constructor(sthis) {
+    this.sthis = sthis;
+    this.logger = ensureLogger(sthis, "FireproofCloudGateway", {
+      this: true
+    });
+  }
+  async buildUrl(ctx, baseUrl, key) {
+    return Result17.Ok(baseUrl.build().setParam("key", key).URI());
+  }
+  async start(ctx, uri) {
+    await this.sthis.start();
+    const rName = uri.getParamResult("name");
+    if (rName.isErr()) {
+      return this.logger.Error().Err(rName).Msg("name not found").ResultError();
+    }
+    const ret = uri.build().defParam("version", VERSION3);
+    ret.defParam("protocol", "wss");
+    const retURI = ret.URI();
+    const matchURI = connectionURI(retURI);
+    this.#connectionURIs.set(matchURI.toString(), {
+      uri: matchURI,
+      matchRes: matchURI.match(matchURI),
+      connection: new ResolveOnce8(),
+      trackPuts: /* @__PURE__ */ new Set()
+    });
+    return Result17.Ok(retURI);
+  }
+  async get(ctx, uri) {
+    const conn = await this.getCloudConnectionItem(uri);
+    if (conn.conn.isErr()) {
+      return Result17.Err(conn.conn);
+    }
+    const ret = await getStoreTypeGateway(ctx.loader.sthis, uri).get({ ...ctx, conn }, uri);
+    return ret;
+  }
+  async put(ctx, uri, body) {
+    const conn = await this.getCloudConnectionItem(uri);
+    if (conn.conn.isErr()) {
+      return conn.conn;
+    }
+    const ret = await getStoreTypeGateway(ctx.loader.sthis, uri).put({ ...ctx, conn }, uri, body);
+    if (ret.isOk()) {
+      if (uri.getParam("testMode")) {
+        conn.citem.trackPuts.add(uri.toString());
+      }
+    }
+    return ret;
+  }
+  async delete(ctx, uri) {
+    const conn = await this.getCloudConnectionItem(uri);
+    if (conn.conn.isErr()) {
+      return conn.conn;
+    }
+    conn.citem.trackPuts.delete(uri.toString());
+    return getStoreTypeGateway(ctx.loader.sthis, uri).delete({ ...ctx, conn }, uri);
+  }
+  async close(ctx, uri) {
+    const uriStr = uri.toString();
+    for (const sub of Array.from(subscriptions.values())) {
+      for (const s of sub) {
+        if (s.uri.toString() === uriStr) {
+          s.unsub();
+        }
+      }
+    }
+    const rConn = await this.getCloudConnectionItem(uri);
+    if (rConn.conn.isErr()) {
+      return this.logger.Error().Err(rConn).Msg("Error in getCloudConnection").ResultError();
+    }
+    const conn = rConn.conn.Ok();
+    const rAuth = await conn.msgConnAuth();
+    await conn.close(rAuth.Ok());
+    this.#connectionURIs.delete(rConn.citem.uri.toString());
+    return Result17.Ok(void 0);
+  }
+  // fireproof://localhost:1999/?name=test-public-api&protocol=ws&store=meta
+  async getCloudConnection(uri) {
+    return this.getCloudConnectionItem(uri).then((r) => {
+      return r.conn;
+    });
+  }
+  async getCloudConnectionItem(uri) {
+    const matchURI = connectionURI(uri);
+    let bestMatch;
+    for (const ci of this.#connectionURIs.values()) {
+      const mci = ci.uri.match(matchURI);
+      if (mci.score >= ci.matchRes.score) {
+        bestMatch = ci;
+        break;
+      }
+    }
+    if (!bestMatch) {
+      return {
+        conn: this.logger.Error().Url(matchURI).Any("conns", Object.fromEntries(this.#connectionURIs.entries())).Msg("No connection found").ResultError(),
+        citem: {}
+      };
+    }
+    const conn = await bestMatch.connection.once(async () => {
+      const rParams = uri.getParamsResult({
+        name: param.REQUIRED,
+        protocol: "https",
+        store: param.REQUIRED,
+        storekey: param.OPTIONAL,
+        tenant: param.REQUIRED
+      });
+      if (rParams.isErr()) {
+        return this.logger.Error().Url(uri).Err(rParams).Msg("getCloudConnection:err").ResultError();
+      }
+      const params = rParams.Ok();
+      const rAuth = await authTypeFromUri(this.logger, uri);
+      if (rAuth.isErr()) {
+        return Result17.Err(rAuth);
+      }
+      const qOpen = buildReqOpen(this.sthis, rAuth.Ok(), {});
+      const cUrl = uri.build().protocol(params.protocol).cleanParams().URI();
+      return Msger.connect(this.sthis, rAuth.Ok(), cUrl, qOpen);
+    });
+    if (conn.isErr()) {
+      return { conn: Result17.Err(conn), citem: bestMatch };
+    }
+    return { conn: Result17.Ok(conn.Ok().attachAuth(() => authTypeFromUri(this.logger, uri))), citem: bestMatch };
+  }
+  // private notifySubscribers(data: Uint8Array, callbacks: ((msg: Uint8Array) => void)[] = []): void {
+  //   for (const cb of callbacks) {
+  //     try {
+  //       cb(data);
+  //     } catch (error) {
+  //       this.logger.Error().Err(error).Msg("Error in subscriber callback execution");
+  //     }
+  //   }
+  // }
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  async subscribe(ctx, url, callback) {
+    return Result17.Err(new Error("Not implemented"));
+  }
+  async destroy(ctx, uri) {
+    const item = await this.getCloudConnectionItem(uri);
+    if (item.conn.isErr()) {
+      return item.conn;
+    }
+    await Promise.all(Array.from(item.citem.trackPuts).map(async (k) => this.delete(ctx, URI17.from(k))));
+    return Result17.Ok(void 0);
+  }
+  async getPlain() {
+    return Result17.Err(new Error("Not implemented"));
+  }
+};
+var onceRegisterFireproofCloudStoreProtocol = new KeyedResolvOnce6();
+function registerFireproofCloudStoreProtocol(protocol = "fpcloud:") {
+  return onceRegisterFireproofCloudStoreProtocol.get(protocol).once(() => {
+    URI17.protocolHasHostpart(protocol);
+    return registerStoreProtocol({
+      protocol,
+      defaultURI() {
+        return URI17.from("fpcloud://fireproof.cloud/");
+      },
+      serdegateway: async (sthis) => {
+        return new FireproofCloudGateway(sthis);
+      }
+    });
+  });
+}
+registerFireproofCloudStoreProtocol();
+function toCloud(url) {
+  const urlObj = URI17.from(url);
+  if (urlObj.protocol !== "fpcloud:") {
+    throw new Error("url must have fireproof protocol");
+  }
+  return {
+    name: urlObj.protocol,
+    prepare() {
+      return Promise.resolve({
+        car: { url: urlObj },
+        file: { url: urlObj },
+        meta: { url: urlObj }
+      });
+    }
+  };
+}
+
+// src/protocols/index.ts
+var protocols_exports = {};
+__export(protocols_exports, {
+  cloud: () => cloud_exports
+});
+
+// src/protocols/cloud/index.ts
+var cloud_exports = {};
+__export(cloud_exports, {
+  HttpConnection: () => HttpConnection,
+  MsgConnected: () => MsgConnected,
+  MsgConnectedAuth: () => MsgConnectedAuth,
+  MsgIsBindGetMeta: () => MsgIsBindGetMeta,
+  MsgIsConnected: () => MsgIsConnected,
+  MsgIsError: () => MsgIsError,
+  MsgIsEventGetMeta: () => MsgIsEventGetMeta,
+  MsgIsQSError: () => MsgIsQSError,
+  MsgIsReqChat: () => MsgIsReqChat,
+  MsgIsReqClose: () => MsgIsReqClose,
+  MsgIsReqDelData: () => MsgIsReqDelData,
+  MsgIsReqDelMeta: () => MsgIsReqDelMeta,
+  MsgIsReqDelWAL: () => MsgIsReqDelWAL,
+  MsgIsReqGestalt: () => MsgIsReqGestalt,
+  MsgIsReqGetData: () => MsgIsReqGetData,
+  MsgIsReqGetWAL: () => MsgIsReqGetWAL,
+  MsgIsReqOpen: () => MsgIsReqOpen,
+  MsgIsReqPutData: () => MsgIsReqPutData,
+  MsgIsReqPutMeta: () => MsgIsReqPutMeta,
+  MsgIsReqPutWAL: () => MsgIsReqPutWAL,
+  MsgIsResChat: () => MsgIsResChat,
+  MsgIsResClose: () => MsgIsResClose,
+  MsgIsResDelData: () => MsgIsResDelData,
+  MsgIsResDelMeta: () => MsgIsResDelMeta,
+  MsgIsResDelWAL: () => MsgIsResDelWAL,
+  MsgIsResGestalt: () => MsgIsResGestalt,
+  MsgIsResGetData: () => MsgIsResGetData,
+  MsgIsResGetWAL: () => MsgIsResGetWAL,
+  MsgIsResOpen: () => MsgIsResOpen,
+  MsgIsResPutData: () => MsgIsResPutData,
+  MsgIsResPutMeta: () => MsgIsResPutMeta,
+  MsgIsResPutWAL: () => MsgIsResPutWAL,
+  MsgIsTenantLedger: () => MsgIsTenantLedger,
+  MsgIsTid: () => MsgIsTid,
+  MsgIsWithConn: () => MsgIsWithConn,
+  MsgIsWithConnAuth: () => MsgIsWithConnAuth,
+  MsgRawConnectionBase: () => MsgRawConnectionBase,
+  Msger: () => Msger,
+  VERSION: () => VERSION,
+  WSConnection: () => WSConnection,
+  applyStart: () => applyStart,
+  authTypeFromUri: () => authTypeFromUri,
+  buildBindGetMeta: () => buildBindGetMeta,
+  buildErrorMsg: () => buildErrorMsg,
+  buildEventGetMeta: () => buildEventGetMeta,
+  buildReqChat: () => buildReqChat,
+  buildReqClose: () => buildReqClose,
+  buildReqDelData: () => buildReqDelData,
+  buildReqDelMeta: () => buildReqDelMeta,
+  buildReqDelWAL: () => buildReqDelWAL,
+  buildReqGestalt: () => buildReqGestalt,
+  buildReqGetData: () => buildReqGetData,
+  buildReqGetWAL: () => buildReqGetWAL,
+  buildReqOpen: () => buildReqOpen,
+  buildReqPutData: () => buildReqPutData,
+  buildReqPutMeta: () => buildReqPutMeta,
+  buildReqPutWAL: () => buildReqPutWAL,
+  buildReqSignedUrl: () => buildReqSignedUrl,
+  buildRes: () => buildRes,
+  buildResChat: () => buildResChat,
+  buildResClose: () => buildResClose,
+  buildResDelData: () => buildResDelData,
+  buildResDelMeta: () => buildResDelMeta,
+  buildResDelWAL: () => buildResDelWAL,
+  buildResGestalt: () => buildResGestalt,
+  buildResGetData: () => buildResGetData,
+  buildResGetWAL: () => buildResGetWAL,
+  buildResOpen: () => buildResOpen,
+  buildResPutData: () => buildResPutData,
+  buildResPutMeta: () => buildResPutMeta,
+  buildResPutWAL: () => buildResPutWAL,
+  coerceFPStoreTypes: () => coerceFPStoreTypes,
+  defaultGestalt: () => defaultGestalt,
+  defaultMsgParams: () => defaultMsgParams,
+  isAuthTypeFPCloud: () => isAuthTypeFPCloud,
+  isAuthTypeFPCloudJWK: () => isAuthTypeFPCloudJWK,
+  isProtocolCapabilities: () => isProtocolCapabilities,
+  jsonEnDe: () => jsonEnDe,
+  keyTenantLedger: () => keyTenantLedger,
+  qsidEqual: () => qsidEqual,
+  qsidKey: () => qsidKey,
+  resAuth: () => resAuth,
+  selectRandom: () => selectRandom,
+  timeout: () => timeout
+});
+
+// src/protocols/cloud/msg-types-wal.ts
+function MsgIsReqGetWAL(msg) {
+  return msg.type === "reqGetWAL";
+}
+function buildReqGetWAL(sthis, sup, ctx) {
+  return buildReqSignedUrl(sthis, "reqGetWAL", sup, ctx);
+}
+function MsgIsResGetWAL(msg) {
+  return msg.type === "resGetWAL";
+}
+function buildResGetWAL(msgCtx, req, ctx) {
+  return buildRes(
+    { method: "GET", store: "wal" },
+    "resGetWAL",
+    msgCtx,
+    req,
+    ctx
+  );
+}
+function MsgIsReqPutWAL(msg) {
+  return msg.type === "reqPutWAL";
+}
+function buildReqPutWAL(sthis, sup, ctx) {
+  return buildReqSignedUrl(sthis, "reqPutWAL", sup, ctx);
+}
+function MsgIsResPutWAL(msg) {
+  return msg.type === "resPutWAL";
+}
+function buildResPutWAL(msgCtx, req, ctx) {
+  return buildRes(
+    { method: "PUT", store: "wal" },
+    "resPutWAL",
+    msgCtx,
+    req,
+    ctx
+  );
+}
+function MsgIsReqDelWAL(msg) {
+  return msg.type === "reqDelWAL";
+}
+function buildReqDelWAL(sthis, sup, ctx) {
+  return buildReqSignedUrl(sthis, "reqDelWAL", sup, ctx);
+}
+function MsgIsResDelWAL(msg) {
+  return msg.type === "resDelWAL" && MsgIsTenantLedger(msg);
+}
+function buildResDelWAL(msgCtx, req, ctx) {
+  return buildRes(
+    { method: "DELETE", store: "wal" },
+    "resDelWAL",
+    msgCtx,
+    req,
+    ctx
+  );
+}
+
 // src/version.ts
 var PACKAGE_VERSION = Object.keys({
-  "0.20.0-dev-preview-54": "xxxx"
+  "0.20.0-dev-preview-57": "xxxx"
 })[0];
 export {
   CRDTImpl,
@@ -5263,6 +7232,8 @@ export {
   keyConfigOpts,
   makeName,
   onSuperThis,
+  protocols_exports as protocols,
+  protocols_exports as ps,
   runtime_exports as rt,
   runtime_exports as runtime,
   storeType2DataMetaWal,