@indigoai-us/hq-cloud 6.15.4 → 6.15.6

package/dist/outposts/host-deps.js

@@ -0,0 +1,93 @@
+/**
+ * The small local-environment surface the box-side commands touch, injected so
+ * they are testable without an actual EC2 host.
+ *
+ * Node-only. `self-deploy` needs the base set; `replica-sync` extends it with two
+ * filesystem probes for the repo clone, kept as an extension so the self-deploy
+ * surface stays minimal.
+ */
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as readline from "node:readline";
+import { loadCachedTokens } from "../cognito-auth.js";
+export const defaultSelfDeployDependencies = {
+    spawnSync: (command, args, options) => spawnSync(command, args, options),
+    readTextFile: (file) => fs.readFileSync(file, "utf8"),
+    loadCachedTokens: () => loadCachedTokens() ?? undefined,
+    getUid: () => process.getuid?.(),
+    isStdinTty: () => process.stdin.isTTY === true,
+    confirm: async () => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        return new Promise((resolve) => {
+            rl.question("", (answer) => {
+                rl.close();
+                resolve(/^y(es)?$/i.test(answer.trim()));
+            });
+        });
+    },
+    defaultHqRoot: () => process.env.HQ_ROOT ?? path.join(os.homedir(), "hq"),
+    invokingUser: () => process.env.SUDO_USER ?? process.env.USER ?? os.userInfo().username,
+};
+export const defaultReplicaSyncDependencies = {
+    ...defaultSelfDeployDependencies,
+    pathExists: (p) => fs.existsSync(p),
+    mkdirp: (p) => {
+        fs.mkdirSync(p, { recursive: true });
+    },
+};
+/**
+ * Run a child and throw a plain description on any failure.
+ *
+ * Child output is deliberately excluded from the thrown message: even though
+ * these callers never pass credentials in argv, several of them stream secrets
+ * through a child's stdin or environment, so the error path stays secret-safe by
+ * construction rather than by review.
+ */
+export function runChecked(deps, command, args, description, options) {
+    let result;
+    try {
+        result = deps.spawnSync(command, args, options);
+    }
+    catch {
+        throw new Error(`${description} could not be started.`);
+    }
+    if (!result || result.error || result.status !== 0) {
+        throw new Error(`${description} failed. Resolve the error and try again.`);
+    }
+}
+/** `runChecked` under `sudo` unless already root. */
+export function runPrivileged(deps, command, args, description, options) {
+    if (deps.getUid() === 0) {
+        runChecked(deps, command, args, description, options);
+        return;
+    }
+    runChecked(deps, "sudo", [command, ...args], description, options);
+}
+/** True when `command args` exits 0. Never throws. */
+export function commandSucceeded(deps, command, args) {
+    try {
+        const result = deps.spawnSync(command, args, { encoding: "utf8" });
+        return !!result && !result.error && result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Trimmed stdout of `command args`, or undefined when it failed. Never throws. */
+export function commandOutput(deps, command, args) {
+    try {
+        const result = deps.spawnSync(command, args, { encoding: "utf8" });
+        if (!result || result.error || result.status !== 0)
+            return undefined;
+        return String(result.stdout ?? "").trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=host-deps.js.map

package/dist/outposts/host-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-deps.js","sourceRoot":"","sources":["../../src/outposts/host-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AA6BtD,MAAM,CAAC,MAAM,6BAA6B,GAA2B;IACnE,SAAS,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC;IACxE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;IACrD,gBAAgB,EAAE,GAAG,EAAE,CAAC,gBAAgB,EAAE,IAAI,SAAS;IACvD,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;IAChC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;IAC9C,OAAO,EAAE,KAAK,IAAI,EAAE;QAClB,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;gBACzB,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC;IACzE,YAAY,EAAE,GAAG,EAAE,CACjB,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ;CACtE,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAA4B;IACrE,GAAG,6BAA6B;IAChC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;QACZ,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,IAA4B,EAC5B,OAAe,EACf,IAAc,EACd,WAAmB,EACnB,OAAyC;IAEzC,IAAI,MAAoC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,wBAAwB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,2CAA2C,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAC3B,IAA4B,EAC5B,OAAe,EACf,IAAc,EACd,WAAmB,EACnB,OAAyC;IAEzC,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAC9B,IAA4B,EAC5B,OAAe,EACf,IAAc;IAEd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAC3B,IAA4B,EAC5B,OAAe,EACf,IAAc;IAEd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/outposts/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `@indigoai-us/hq-cloud/outposts` — the portable Outpost control-plane client.
+ *
+ * This entry point is deliberately free of Node built-ins, CLI dependencies, and
+ * module-level side effects, so it can be imported straight into a Next.js server
+ * action, a route handler, or an edge function. It is also why the subpath exists
+ * at all: the package root (`@indigoai-us/hq-cloud`) pulls in the AWS SDK,
+ * `chokidar`, and `pino`, none of which belong in a web app's module graph.
+ *
+ * Server-side only. Every call carries a bearer token, so none of this may run in
+ * a client component.
+ *
+ * ```ts
+ * // app/lib/outposts.ts
+ * import { OutpostsClient, createOutpostTransport } from "@indigoai-us/hq-cloud/outposts";
+ *
+ * export const outposts = new OutpostsClient({
+ *   transport: createOutpostTransport(),
+ *   token: async () => (await auth())!.idToken,
+ * });
+ * ```
+ *
+ * Node-only helpers (SSH exec, the self-hosting installer, the box-side
+ * heartbeat) live at `@indigoai-us/hq-cloud/outposts/node`. The `hq outposts`
+ * command tree lives at `@indigoai-us/hq-cloud/outposts/cli`.
+ */
+export { OutpostsClient, EXEC_MAX_TIMEOUT_SECONDS } from "./client.js";
+export type { OutpostsClientOptions, OutpostTokenSource, WaitForExecOptions, } from "./client.js";
+export { createOutpostTransport, defaultOutpostApiUrl, } from "./transport.js";
+export type { FetchLike, OutpostRequest, OutpostTransport, } from "./transport.js";
+export { OutpostHttpError, parseCappedPayload, parseBillingPayload, isBillingSetupAction, } from "./errors.js";
+export { joinCommandParts, withRemoteHqDir, REMOTE_HQ_DIR_PREFIX, } from "./remote-command.js";
+export { AGENT_PRICE_CENTS, OUTPOST_PRICE_CENTS, formatUsd, mintPaymentLink, } from "./billing.js";
+export type { PaidResource } from "./billing.js";
+export type { BillingErrorPayload, BillingSetupAction, OutpostAgentRuntime, OutpostCappedPayload, OutpostExecAsyncResult, OutpostExecResult, OutpostExecStage, OutpostExecSubmission, OutpostSshAccess, OutpostSummary, ProvisionOutpostInput, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/outposts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/outposts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACtB,MAAM,YAAY,CAAC"}

package/dist/outposts/index.js

@@ -0,0 +1,32 @@
+/**
+ * `@indigoai-us/hq-cloud/outposts` — the portable Outpost control-plane client.
+ *
+ * This entry point is deliberately free of Node built-ins, CLI dependencies, and
+ * module-level side effects, so it can be imported straight into a Next.js server
+ * action, a route handler, or an edge function. It is also why the subpath exists
+ * at all: the package root (`@indigoai-us/hq-cloud`) pulls in the AWS SDK,
+ * `chokidar`, and `pino`, none of which belong in a web app's module graph.
+ *
+ * Server-side only. Every call carries a bearer token, so none of this may run in
+ * a client component.
+ *
+ * ```ts
+ * // app/lib/outposts.ts
+ * import { OutpostsClient, createOutpostTransport } from "@indigoai-us/hq-cloud/outposts";
+ *
+ * export const outposts = new OutpostsClient({
+ *   transport: createOutpostTransport(),
+ *   token: async () => (await auth())!.idToken,
+ * });
+ * ```
+ *
+ * Node-only helpers (SSH exec, the self-hosting installer, the box-side
+ * heartbeat) live at `@indigoai-us/hq-cloud/outposts/node`. The `hq outposts`
+ * command tree lives at `@indigoai-us/hq-cloud/outposts/cli`.
+ */
+export { OutpostsClient, EXEC_MAX_TIMEOUT_SECONDS } from "./client.js";
+export { createOutpostTransport, defaultOutpostApiUrl, } from "./transport.js";
+export { OutpostHttpError, parseCappedPayload, parseBillingPayload, isBillingSetupAction, } from "./errors.js";
+export { joinCommandParts, withRemoteHqDir, REMOTE_HQ_DIR_PREFIX, } from "./remote-command.js";
+export { AGENT_PRICE_CENTS, OUTPOST_PRICE_CENTS, formatUsd, mintPaymentLink, } from "./billing.js";
+//# sourceMappingURL=index.js.map

package/dist/outposts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/outposts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAOvE,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,SAAS,EACT,eAAe,GAChB,MAAM,cAAc,CAAC"}

package/dist/outposts/node.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `@indigoai-us/hq-cloud/outposts/node` — Node-only Outpost helpers.
+ *
+ * Everything here touches the filesystem, spawns processes, or talks to AWS IoT,
+ * so it cannot run on an edge runtime and is kept out of the portable
+ * `@indigoai-us/hq-cloud/outposts` entry point. A Next.js app running on the Node
+ * runtime *can* import this, but almost certainly wants the portable client
+ * instead — these are host-side and box-side operations.
+ */
+export { execViaSsh } from "./ssh.js";
+export type { SshExecResult } from "./ssh.js";
+export { defaultSelfDeployDependencies, defaultReplicaSyncDependencies, runChecked, runPrivileged, commandSucceeded, commandOutput, } from "./host-deps.js";
+export type { SelfDeployDependencies, ReplicaSyncDependencies, } from "./host-deps.js";
+export { selfDeployOutpost, selfDeployPreflight, hqIdentityFromSession, renderSelfDeploySyncScript, renderSelfDeployService, } from "./self-deploy.js";
+export { replicaSyncOutpost, parseReposManifest } from "./replica-sync.js";
+export type { ReplicaRepo } from "./replica-sync.js";
+export { runHeartbeatLoop, resolveIntervalSeconds, writeHeartbeatState, DEFAULT_HEARTBEAT_STATE_FILE, } from "./heartbeat-command.js";
+export type { HeartbeatLoopDeps, HeartbeatLoopOptions, HeartbeatCommandDeps, } from "./heartbeat-command.js";
+export { DEFAULT_HEARTBEAT_INTERVAL_SECONDS, collectSessions, nodeFileSystem, sessionsTopicForPerson, assertNoSecretsInPayload, } from "./session-heartbeat.js";
+export type { FileSystemPort, PublishPort, SessionsHeartbeatPayload, } from "./session-heartbeat.js";
+export { createIotPublishPort, defaultRealtimeCredentialsFetcher, } from "./session-heartbeat-publisher.js";
+export type { RealtimeCredentialsResponse } from "./session-heartbeat-publisher.js";
+//# sourceMappingURL=node.d.ts.map

package/dist/outposts/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/outposts/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,kCAAkC,EAClC,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,cAAc,EACd,WAAW,EACX,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/outposts/node.js

@@ -0,0 +1,22 @@
+/**
+ * `@indigoai-us/hq-cloud/outposts/node` — Node-only Outpost helpers.
+ *
+ * Everything here touches the filesystem, spawns processes, or talks to AWS IoT,
+ * so it cannot run on an edge runtime and is kept out of the portable
+ * `@indigoai-us/hq-cloud/outposts` entry point. A Next.js app running on the Node
+ * runtime *can* import this, but almost certainly wants the portable client
+ * instead — these are host-side and box-side operations.
+ */
+// SSH fallback for boxes without an SSM agent (Lightsail).
+export { execViaSsh } from "./ssh.js";
+// Injected host-environment surface shared by the box-side commands.
+export { defaultSelfDeployDependencies, defaultReplicaSyncDependencies, runChecked, runPrivileged, commandSucceeded, commandOutput, } from "./host-deps.js";
+// Turn the current host into an unmanaged, self-hosted outpost.
+export { selfDeployOutpost, selfDeployPreflight, hqIdentityFromSession, renderSelfDeploySyncScript, renderSelfDeployService, } from "./self-deploy.js";
+// Make a managed box a full replica of the operator's HQ.
+export { replicaSyncOutpost, parseReposManifest } from "./replica-sync.js";
+// Box-side agent-session heartbeat.
+export { runHeartbeatLoop, resolveIntervalSeconds, writeHeartbeatState, DEFAULT_HEARTBEAT_STATE_FILE, } from "./heartbeat-command.js";
+export { DEFAULT_HEARTBEAT_INTERVAL_SECONDS, collectSessions, nodeFileSystem, sessionsTopicForPerson, assertNoSecretsInPayload, } from "./session-heartbeat.js";
+export { createIotPublishPort, defaultRealtimeCredentialsFetcher, } from "./session-heartbeat-publisher.js";
+//# sourceMappingURL=node.js.map

package/dist/outposts/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/outposts/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2DAA2D;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGtC,qEAAqE;AACrE,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,aAAa,GACd,MAAM,gBAAgB,CAAC;AAMxB,gEAAgE;AAChE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,0DAA0D;AAC1D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG3E,oCAAoC;AACpC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,kCAAkC,EAClC,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,oBAAoB,EACpB,iCAAiC,GAClC,MAAM,kCAAkC,CAAC"}

package/dist/outposts/remote-command.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Pure string helpers for shaping a command before it is handed to a box.
+ *
+ * No imports, no I/O — these are shared verbatim between the CLI and any other
+ * caller that needs to build the same remote command line.
+ */
+/**
+ * Preserve a single command string; safely join argv when an arg parser split it.
+ *
+ * A single element is passed through untouched so an already-quoted command
+ * survives intact; multiple elements are individually quoted and joined, which
+ * is what makes `outposts exec -- ls "my dir"` behave.
+ */
+export declare function joinCommandParts(commandParts: string[]): string;
+/**
+ * Prefix that best-effort `cd`s into the box's HQ checkout before running the
+ * caller's command. `exec` runs over two transports with two different default
+ * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
+ * SSH lands in the login user's home — so without this, `exec -- pwd` printed an
+ * unhelpful, transport-dependent directory. Initialize a real root home for the
+ * SSM case before resolving the HQ folder: tools run by the caller (notably
+ * `gh`) otherwise treat the HQ checkout as their home and can create root-owned
+ * machine state inside it. The trailing `|| true` keeps the command running from
+ * the default directory when no HQ checkout is present, so exec never fails
+ * merely because the box has no HQ folder.
+ */
+export declare const REMOTE_HQ_DIR_PREFIX = "export HOME=\"${HOME:-/root}\"; cd \"$HOME/hq\" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true";
+/** Wrap `command` so it runs from the box's HQ folder (see {@link REMOTE_HQ_DIR_PREFIX}). */
+export declare function withRemoteHqDir(command: string): string;
+//# sourceMappingURL=remote-command.d.ts.map

package/dist/outposts/remote-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-command.d.ts","sourceRoot":"","sources":["../../src/outposts/remote-command.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,CAG/D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,uGACiE,CAAC;AAEnG,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/outposts/remote-command.js

@@ -0,0 +1,39 @@
+/**
+ * Pure string helpers for shaping a command before it is handed to a box.
+ *
+ * No imports, no I/O — these are shared verbatim between the CLI and any other
+ * caller that needs to build the same remote command line.
+ */
+function shellQuote(part) {
+    return `'${part.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Preserve a single command string; safely join argv when an arg parser split it.
+ *
+ * A single element is passed through untouched so an already-quoted command
+ * survives intact; multiple elements are individually quoted and joined, which
+ * is what makes `outposts exec -- ls "my dir"` behave.
+ */
+export function joinCommandParts(commandParts) {
+    if (commandParts.length === 1)
+        return commandParts[0];
+    return commandParts.map(shellQuote).join(" ");
+}
+/**
+ * Prefix that best-effort `cd`s into the box's HQ checkout before running the
+ * caller's command. `exec` runs over two transports with two different default
+ * working directories — SSM runs as root with no `$HOME` (cwd `/usr/bin`) and
+ * SSH lands in the login user's home — so without this, `exec -- pwd` printed an
+ * unhelpful, transport-dependent directory. Initialize a real root home for the
+ * SSM case before resolving the HQ folder: tools run by the caller (notably
+ * `gh`) otherwise treat the HQ checkout as their home and can create root-owned
+ * machine state inside it. The trailing `|| true` keeps the command running from
+ * the default directory when no HQ checkout is present, so exec never fails
+ * merely because the box has no HQ folder.
+ */
+export const REMOTE_HQ_DIR_PREFIX = 'export HOME="${HOME:-/root}"; cd "$HOME/hq" 2>/dev/null || cd ~ec2-user/hq 2>/dev/null || true';
+/** Wrap `command` so it runs from the box's HQ folder (see {@link REMOTE_HQ_DIR_PREFIX}). */
+export function withRemoteHqDir(command) {
+    return `${REMOTE_HQ_DIR_PREFIX}; ${command}`;
+}
+//# sourceMappingURL=remote-command.js.map

package/dist/outposts/remote-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-command.js","sourceRoot":"","sources":["../../src/outposts/remote-command.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAsB;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAC/B,gGAAgG,CAAC;AAEnG,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,GAAG,oBAAoB,KAAK,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/dist/outposts/replica-sync.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `outposts replica-sync` — make a MANAGED box a full replica of the operator's HQ.
+ *
+ * A box provisioned via `outposts provision` runs this on a systemd timer:
+ *   1. `hq auth refresh`          — freshen the seeded Cognito session
+ *   2. `hq sync pull --personal`  — the personal vault (repos.yaml, policies, …)
+ *   3. `hq rescue`                — re-lay the core kernel (needs `companies/`)
+ *   4. clone `repos.yaml`         — the operator's OWN repos, gh-authed via vault
+ *
+ * Unlike `self-deploy` (a manual, unmanaged, all-company watcher on a box you
+ * own), replica-sync is GENERIC: it works for every HQ user off their own personal
+ * vault, with no per-operator setup script.
+ *
+ * It is deliberately best-effort end to end. A repeating timer must never leave
+ * the systemd unit in `failed` just because one transient step — a mirror blip, a
+ * not-yet-signed-in box — didn't complete this cycle. Every step logs its outcome
+ * and the run continues.
+ *
+ * Node-only: shells out to `hq`, `git`, and `gh`, and probes the filesystem.
+ */
+import type { ReplicaSyncDependencies } from "./host-deps.js";
+/** One repo entry resolved from `personal/data/repos.yaml`. */
+export interface ReplicaRepo {
+    url: string;
+    visibility: "public" | "private";
+    name: string;
+}
+/**
+ * Parse `personal/data/repos.yaml` into a clone list.
+ *
+ * Mirrors `setup.sh`'s `clone_repos`: `visibility` defaults to public, `name`
+ * defaults to the URL basename. Malformed entries are skipped rather than thrown,
+ * so one bad row cannot stop the replica cycle.
+ */
+export declare function parseReposManifest(yamlText: string): ReplicaRepo[];
+/** Run one replica cycle. Best-effort throughout — see the module doc comment. */
+export declare function replicaSyncOutpost(opts: {
+    hqRoot?: string;
+}, deps: ReplicaSyncDependencies): Promise<void>;
+//# sourceMappingURL=replica-sync.d.ts.map

package/dist/outposts/replica-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replica-sync.d.ts","sourceRoot":"","sources":["../../src/outposts/replica-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAG9D,+DAA+D;AAC/D,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;CACd;AAsBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE,CAyBlE;AAiHD,kFAAkF;AAClF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACzB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/dist/outposts/replica-sync.js

@@ -0,0 +1,188 @@
+/**
+ * `outposts replica-sync` — make a MANAGED box a full replica of the operator's HQ.
+ *
+ * A box provisioned via `outposts provision` runs this on a systemd timer:
+ *   1. `hq auth refresh`          — freshen the seeded Cognito session
+ *   2. `hq sync pull --personal`  — the personal vault (repos.yaml, policies, …)
+ *   3. `hq rescue`                — re-lay the core kernel (needs `companies/`)
+ *   4. clone `repos.yaml`         — the operator's OWN repos, gh-authed via vault
+ *
+ * Unlike `self-deploy` (a manual, unmanaged, all-company watcher on a box you
+ * own), replica-sync is GENERIC: it works for every HQ user off their own personal
+ * vault, with no per-operator setup script.
+ *
+ * It is deliberately best-effort end to end. A repeating timer must never leave
+ * the systemd unit in `failed` just because one transient step — a mirror blip, a
+ * not-yet-signed-in box — didn't complete this cycle. Every step logs its outcome
+ * and the run continues.
+ *
+ * Node-only: shells out to `hq`, `git`, and `gh`, and probes the filesystem.
+ */
+import * as path from "node:path";
+import * as yaml from "js-yaml";
+function repoNameFromUrl(url) {
+    const tail = url.split("/").pop() ?? "";
+    return tail.replace(/\.git$/, "").trim();
+}
+/**
+ * A repo `name` becomes a path segment under `repos/<visibility>/`. A synced
+ * repos.yaml is operator data, but a malformed or hostile name must never escape
+ * that directory, so constrain it to a single, non-traversal component.
+ */
+function isSafePathComponent(value) {
+    return (value.length > 0 &&
+        !value.includes("/") &&
+        !value.includes("\\") &&
+        value !== "." &&
+        value !== "..");
+}
+/**
+ * Parse `personal/data/repos.yaml` into a clone list.
+ *
+ * Mirrors `setup.sh`'s `clone_repos`: `visibility` defaults to public, `name`
+ * defaults to the URL basename. Malformed entries are skipped rather than thrown,
+ * so one bad row cannot stop the replica cycle.
+ */
+export function parseReposManifest(yamlText) {
+    let doc;
+    try {
+        doc = yaml.load(yamlText);
+    }
+    catch {
+        return [];
+    }
+    const rawRepos = doc?.repos;
+    if (!Array.isArray(rawRepos))
+        return [];
+    const out = [];
+    for (const entry of rawRepos) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const e = entry;
+        const url = typeof e.url === "string" ? e.url.trim() : "";
+        if (!url)
+            continue;
+        const visibility = e.visibility === "private" ? "private" : "public";
+        const name = typeof e.name === "string" && e.name.trim()
+            ? e.name.trim()
+            : repoNameFromUrl(url);
+        if (!isSafePathComponent(name))
+            continue;
+        out.push({ url, visibility, name });
+    }
+    return out;
+}
+/**
+ * Best-effort spawn: log a one-line outcome and carry on. NEVER throws and NEVER
+ * echoes child output — the same secret-safety stance as `runChecked`, since these
+ * children (auth refresh, secrets exec) touch credentials.
+ */
+function runBestEffort(deps, command, args, description, options) {
+    let result;
+    try {
+        result = deps.spawnSync(command, args, options ?? { stdio: "inherit" });
+    }
+    catch {
+        console.warn(`replica-sync: ${description} could not run — continuing.`);
+        return false;
+    }
+    if (!result || result.error || result.status !== 0) {
+        console.warn(`replica-sync: ${description} did not complete cleanly — continuing.`);
+        return false;
+    }
+    return true;
+}
+/**
+ * Authenticate `gh` for private clones by streaming GITHUB_TOKEN through the vault
+ * into the child's ENV ONLY, unsetting it in-shell, and piping it to
+ * `gh auth login --with-token` over stdin. The token never touches argv or this
+ * process's logs. Mirrors `personal/scripts/setup.sh`'s `configure_gh`.
+ */
+function authGitHubViaVault(deps) {
+    const ghLogin = [
+        'TOKEN="$GITHUB_TOKEN"',
+        "unset GITHUB_TOKEN",
+        'printf "%s" "$TOKEN" | gh auth login --with-token',
+    ].join("\n");
+    const authed = runBestEffort(deps, "hq", [
+        "secrets",
+        "--personal",
+        "exec",
+        "--only",
+        "GITHUB_TOKEN",
+        "--",
+        "bash",
+        "-c",
+        ghLogin,
+    ], "GitHub auth via vault");
+    if (authed) {
+        // Let plain `git clone https://github.com/...` reuse gh's token so private
+        // repos don't prompt for a username/password.
+        runBestEffort(deps, "gh", ["auth", "setup-git"], "gh auth setup-git");
+    }
+}
+/** Clone any repos from `personal/data/repos.yaml` that aren't on disk yet. */
+function replicateRepos(deps, hqRoot) {
+    const manifestPath = path.join(hqRoot, "personal", "data", "repos.yaml");
+    let manifestText;
+    try {
+        manifestText = deps.readTextFile(manifestPath);
+    }
+    catch {
+        console.log("replica-sync: no personal/data/repos.yaml — skipping repo clone.");
+        return;
+    }
+    const repos = parseReposManifest(manifestText);
+    if (repos.length === 0) {
+        console.log("replica-sync: repos.yaml lists no repos — skipping.");
+        return;
+    }
+    const missing = repos.filter((repo) => !deps.pathExists(path.join(hqRoot, "repos", repo.visibility, repo.name, ".git")));
+    if (missing.length === 0) {
+        console.log("replica-sync: all repos already present.");
+        return;
+    }
+    // Private repos need gh auth first; public-only manifests skip the vault call.
+    if (missing.some((repo) => repo.visibility === "private")) {
+        authGitHubViaVault(deps);
+    }
+    for (const repo of missing) {
+        deps.mkdirp(path.join(hqRoot, "repos", repo.visibility));
+        const dest = path.join(hqRoot, "repos", repo.visibility, repo.name);
+        console.log(`replica-sync: cloning ${repo.visibility}/${repo.name}…`);
+        runBestEffort(deps, "git", ["clone", "--recurse-submodules", repo.url, dest], `clone ${repo.visibility}/${repo.name}`);
+    }
+}
+/** Run one replica cycle. Best-effort throughout — see the module doc comment. */
+export async function replicaSyncOutpost(opts, deps) {
+    const hqRoot = opts.hqRoot ?? deps.defaultHqRoot();
+    // Gate: only replicate on a box that has an HQ session. A box that was never
+    // signed in has nothing to pull — exit cleanly so the timer stays green.
+    const session = deps.loadCachedTokens();
+    if (!session?.refreshToken) {
+        console.log("replica-sync: no HQ session on this box yet — nothing to replicate.");
+        return;
+    }
+    // Auth refresh gates the run: if the seeded refresh token is dead, every
+    // authenticated step below (pull, secrets exec) would just cascade 401s. Stop
+    // the cycle cleanly instead — the timer retries next tick.
+    if (!runBestEffort(deps, "hq", ["auth", "refresh"], "HQ auth refresh")) {
+        console.warn("replica-sync: auth refresh failed — skipping this cycle (token likely expired).");
+        return;
+    }
+    runBestEffort(deps, "hq", [
+        "sync",
+        "pull",
+        "--personal",
+        "--hq-root",
+        hqRoot,
+        "--on-conflict",
+        "keep",
+    ], "personal vault pull");
+    // rescue lays down the core kernel and expects companies/ to exist.
+    deps.mkdirp(path.join(hqRoot, "companies"));
+    runBestEffort(deps, "hq", ["rescue", "--hq-root", hqRoot, "--yes"], "HQ kernel rescue");
+    replicateRepos(deps, hqRoot);
+    console.log("replica-sync: complete.");
+}
+//# sourceMappingURL=replica-sync.js.map

package/dist/outposts/replica-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replica-sync.js","sourceRoot":"","sources":["../../src/outposts/replica-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAWhC,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,CACL,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI,CACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAI,GAAkC,EAAE,KAAK,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrE,MAAM,IAAI,GACR,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;YACzC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;YACf,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,SAAS;QACzC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACpB,IAA6B,EAC7B,OAAe,EACf,IAAc,EACd,WAAmB,EACnB,OAAyC;IAEzC,IAAI,MAAoC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,iBAAiB,WAAW,8BAA8B,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,IAAI,CACV,iBAAiB,WAAW,yCAAyC,CACtE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAA6B;IACvD,MAAM,OAAO,GAAG;QACd,uBAAuB;QACvB,oBAAoB;QACpB,mDAAmD;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,aAAa,CAC1B,IAAI,EACJ,IAAI,EACJ;QACE,SAAS;QACT,YAAY;QACZ,MAAM;QACN,QAAQ;QACR,cAAc;QACd,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,OAAO;KACR,EACD,uBAAuB,CACxB,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,2EAA2E;QAC3E,8CAA8C;QAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,IAA6B,EAAE,MAAc;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACzE,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,UAAU,CACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAC/D,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;QAC1D,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,aAAa,CACX,IAAI,EACJ,KAAK,EACL,CAAC,OAAO,EAAE,sBAAsB,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EACjD,SAAS,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAyB,EACzB,IAA6B;IAE7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;IAEnD,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CACT,qEAAqE,CACtE,CAAC;QACF,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,8EAA8E;IAC9E,2DAA2D;IAC3D,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,IAAI,CACV,iFAAiF,CAClF,CAAC;QACF,OAAO;IACT,CAAC;IACD,aAAa,CACX,IAAI,EACJ,IAAI,EACJ;QACE,MAAM;QACN,MAAM;QACN,YAAY;QACZ,WAAW;QACX,MAAM;QACN,eAAe;QACf,MAAM;KACP,EACD,qBAAqB,CACtB,CAAC;IAEF,oEAAoE;IACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5C,aAAa,CACX,IAAI,EACJ,IAAI,EACJ,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EACxC,kBAAkB,CACnB,CAAC;IAEF,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AACzC,CAAC"}

package/dist/outposts/replica-sync.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=replica-sync.test.d.ts.map

package/dist/outposts/replica-sync.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replica-sync.test.d.ts","sourceRoot":"","sources":["../../src/outposts/replica-sync.test.ts"],"names":[],"mappings":""}