@tensorix/metahub 0.1.11 → 0.2.0

package/dist/core/sync/e2ee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee.d.ts","sourceRoot":"","sources":["../../../src/core/sync/e2ee.ts"],"names":[],"mappings":"AAkCA,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,CAAC,CAAC;IACL,GAAG,EAAE,eAAe,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI/C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAK/C;AAID,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,UAAU,CAE9C;AAmBD,kFAAkF;AAClF,wBAAsB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkBhG;AAED;2EAC2E;AAC3E,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAc/F;AAWD,iFAAiF;AACjF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAUjG;AAED,mFAAmF;AACnF,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAU/F"}

package/dist/core/sync/enroll.d.ts

@@ -0,0 +1,21 @@
+/** The slim bucket descriptor an enroll token carries. Mirrors the access-only
+ *  subset of S3Config — no passphrase, no master key, no node-role hints. */
+export interface EnrollPayload {
+    endpoint: string;
+    region?: string;
+    bucket: string;
+    prefix?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    encrypt?: boolean;
+    virtualHostedStyle?: boolean;
+}
+/** Encode the bucket descriptor into a base64url enroll token. Keys are emitted
+ *  in a fixed order (and undefined fields omitted) so the token is stable. */
+export declare function encodeEnroll(p: EnrollPayload): string;
+/** Decode an enroll token back into a bucket descriptor. Accepts the bare token,
+ *  an `enroll=<token>` fragment, or a full `…/#enroll=<token>` deep link, so a
+ *  user can paste whatever they copied. Throws MhError("invalid_input") on a
+ *  malformed token or a payload missing the fields needed to reach the bucket. */
+export declare function decodeEnroll(tokenOrUrl: string): EnrollPayload;
+//# sourceMappingURL=enroll.d.ts.map

package/dist/core/sync/enroll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.d.ts","sourceRoot":"","sources":["../../../src/core/sync/enroll.ts"],"names":[],"mappings":"AAaA;6EAC6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAmBD;8EAC8E;AAC9E,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAYrD;AAED;;;kFAGkF;AAClF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CAoC9D"}

package/dist/core/sync/peers-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AA6FvE,eAAO,MAAM,WAAW,EAAE,KAAK,EA+E9B,CAAC"}
+{"version":3,"file":"peers-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AA6KvE,eAAO,MAAM,WAAW,EAAE,KAAK,EA+H9B,CAAC"}

package/dist/core/sync/peers.d.ts

@@ -1,4 +1,5 @@
 import type { DbDriver } from "../driver.ts";
+import { type S3Config, type StorageSyncOpts } from "./storage.ts";
 export interface PeerRow {
     url: string;
     pull_cursor: number;
@@ -7,9 +8,16 @@ export interface PeerRow {
     label: string | null;
     node_id: string | null;
     enabled: number;
+    /** Last sync attempt, successful or failed. */
     last_sync_at: number | null;
+    /** Last successful sync. Freshness gates must use this, not last_sync_at. */
+    last_success_at: number | null;
     last_status: string | null;
     last_error: string | null;
+    /** Transport: 'http' (POST /sync) or 's3' (bucket store-and-forward). */
+    kind: string;
+    /** JSON S3Config for 's3' peers; null for 'http'. */
+    config: string | null;
 }
 export declare function listPeers(db: DbDriver): PeerRow[];
 export declare function getPeer(db: DbDriver, url: string): PeerRow | null;
@@ -21,6 +29,47 @@ export interface AddPeerInput {
 }
 /** Upsert a peer, preserving replication cursors on conflict. */
 export declare function addPeer(db: DbDriver, input: AddPeerInput): void;
+export interface AddStoragePeerInput {
+    /** Synthetic peer key, by convention s3://<bucket>/<prefix>. */
+    url: string;
+    config: S3Config;
+    label?: string | null;
+}
+/** Upsert an 's3' (bucket store-and-forward) peer, preserving cursors on conflict. */
+export declare function addStoragePeer(db: DbDriver, input: AddStoragePeerInput): void;
+/** Synthetic peer key for a storage peer: one per bucket+prefix. */
+export declare const storageUrl: (bucket: string, prefix: string) => string;
+export interface StoragePeerSpec {
+    endpoint: string;
+    region?: string;
+    bucket: string;
+    prefix?: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Virtual-hosted (COS) vs path-style addressing; undefined → auto-detect.
+     *  Carried by enroll codes so COS buckets join correctly. */
+    virtualHostedStyle?: boolean;
+    /** Default true; pass false for `--no-encrypt` plaintext buckets. */
+    encrypt?: boolean;
+    /** Required when encrypt — provisions/adopts the bucket's wrapped master key. */
+    passphrase?: string;
+    /** Mark this node the bucket's publisher (writes whole-hub snapshots). */
+    publish?: boolean;
+    priority?: number;
+    label?: string | null;
+}
+/**
+ * Resolve + persist an S3 storage peer and run one sync so a bad endpoint /
+ * credentials / missing CORS fail fast at the call site. Shared by the CLI
+ * (`mh config peer add --s3`) and the WebUI server endpoint (`POST /api/peer/s3`)
+ * so both go through the exact same provisioning + first-sync path. Returns the
+ * resolved config (incl. the wrapped master key) and the first sync outcome.
+ */
+export declare function addAndSyncStoragePeer(db: DbDriver, spec: StoragePeerSpec): Promise<{
+    url: string;
+    config: S3Config;
+    sync: PeerSyncOutcome;
+}>;
 /**
  * Remove a peer AND revoke the credential we issued to it during pairing, so
  * disconnecting is mutual: we stop syncing out to it (peers row) and it can no
@@ -36,10 +85,34 @@ export interface PeerSyncOutcome {
     ok: boolean;
     pushed?: number;
     pulled?: number;
+    pendingPush?: boolean;
     error?: string;
 }
-/** Sync once with a single peer, recording status. Errors are captured, not thrown. */
-export declare function syncPeer(db: DbDriver, url: string): Promise<PeerSyncOutcome>;
+/** Sync once with a single peer, recording status. Errors are captured, not
+ *  thrown. Dispatches on transport: 's3' peers go through the bucket
+ *  store-and-forward client, everything else POSTs /sync. */
+export declare function syncPeer(db: DbDriver, url: string, opts?: {
+    storage?: StorageSyncOpts;
+}): Promise<PeerSyncOutcome>;
 /** Sync once with every enabled peer. Used by the auto-sync timer. */
 export declare function syncAllPeers(db: DbDriver): Promise<PeerSyncOutcome[]>;
+/**
+ * Freshness gate for *non-reactive* consumers — CLI reads and the PWA's served
+ * site pages (②b). Their local DB is only as fresh as the last sync, and unlike
+ * the reactive WebUI they have no background poll and no `synced` revalidate. So
+ * if the newest successful peer sync is older than `maxAgeMs`, block on one
+ * bounded sync round before the caller reads; otherwise return immediately
+ * (read local).
+ *
+ * No enabled peers → no-op. A running daemon keeps `last_success_at` recent, so
+ * this is a near-instant no-op there and only does real work on a daemon-less node
+ * that hasn't synced successfully in a while. Failed attempts update
+ * `last_sync_at`, but never make local data fresh. Env overrides: MH_OFFLINE=1
+ * skips; MH_FRESH=1 forces; MH_SYNC_MAX_AGE=<ms> tunes the threshold.
+ */
+export declare function ensureFresh(db: DbDriver, opts?: {
+    maxAgeMs?: number;
+    force?: boolean;
+    offline?: boolean;
+}): Promise<void>;
 //# sourceMappingURL=peers.d.ts.map

package/dist/core/sync/peers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAMjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAMjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAO7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAIN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,wBAAsB,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAUlF;AAED,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E"}
+{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAWtB,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAEjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAU7E;AAmCD,oEAAoE;AACpE,eAAO,MAAM,UAAU,GAAI,QAAQ,MAAM,EAAE,QAAQ,MAAM,WAA+B,CAAC;AAEzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BnE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAS7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAWN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;6DAE6D;AAC7D,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,GACnC,OAAO,CAAC,eAAe,CAAC,CAa1B;AAiCD,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/core/sync/publisher-lease.d.ts

@@ -0,0 +1,8 @@
+import type { StorageClient } from "./storage.ts";
+/**
+ * Refresh this node's heartbeat (throttled) and return whether it is the elected
+ * publisher among currently-live candidates. Call only when a snapshot is
+ * actually due, so the lease LIST/GETs aren't paid on idle rounds.
+ */
+export declare function isElectedPublisher(client: StorageClient, base: string, node: string, priority: number, now?: number): Promise<boolean>;
+//# sourceMappingURL=publisher-lease.d.ts.map

package/dist/core/sync/publisher-lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publisher-lease.d.ts","sourceRoot":"","sources":["../../../src/core/sync/publisher-lease.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAmBlD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,OAAO,CAAC,CAgDlB"}

package/dist/core/sync/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAc3C,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAeD;;8BAE8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMlD;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACxE;AAiCD,eAAO,MAAM,MAAM,EAAE,KAAK,EAAoD,CAAC"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAe3C,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAeD;;8BAE8B;AAC9B,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAMlD;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CACxE;AAiCD,eAAO,MAAM,MAAM,EAAE,KAAK,EAAmE,CAAC"}

package/dist/core/sync/server.d.ts

@@ -1,3 +1,4 @@
+import "./storage-s3-bun.ts";
 import { MhError } from "../errors.ts";
 import { type Route } from "./routes.ts";
 export interface RunningServer {

package/dist/core/sync/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAkBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CA8JnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/core/sync/server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,OAAO,EAAU,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAmBhE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qFAAqF;IACrF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,qBAAa,cAAe,SAAQ,OAAO;IAEvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM;CASxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;kDAE8C;IAC9C,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;mEAG+D;IAC/D,GAAG,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpD,4EAA4E;IAC5E,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAYD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,GAAE,aAAkB,GAAG,aAAa,CA+NnE"}

package/dist/core/sync/sites-serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sites-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAQ5C,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAuBrF"}
+{"version":3,"file":"sites-serve.d.ts","sourceRoot":"","sources":["../../../src/core/sync/sites-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAQ5C,wBAAsB,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyBrF"}

package/dist/core/sync/storage-s3-bun.d.ts

@@ -0,0 +1,26 @@
+import { type S3Config } from "./storage.ts";
+/** Read the bucket's current CORS config (raw XML), or null if none is set. */
+export declare function getBucketCors(config: S3Config): Promise<string | null>;
+/**
+ * Build the PutBucketCors XML body from the bucket's current config. PutBucketCors
+ * replaces the whole config, so we keep every rule that isn't ours and re-emit our
+ * managed rule (id=metahub-pwa). `merge` decides our rule's origins:
+ *  - false (CLI `peer cors`): SET — exactly `origins` (lets the user shrink/reset).
+ *  - true  (auto-open on bucket-attach): UNION with the managed rule's existing
+ *    origins, so attaching the same bucket from a second shell/origin (a homelab
+ *    server origin alongside the official PWA shell) adds to the allow-list
+ *    instead of clobbering it.
+ * A wildcard `*` collapses the set. Pure (no I/O) so it's unit-testable.
+ */
+export declare function buildCorsXml(existing: string | null, origins: string[], merge: boolean): string;
+/**
+ * Allow a browser shell served from `origins` to talk to the bucket directly
+ * (GET/PUT/HEAD/DELETE) via GET-merge-PUT (see buildCorsXml). `opts.merge` unions
+ * with existing managed origins instead of replacing them — used when a second
+ * origin attaches the same bucket. Content-MD5 is required by the CORS API
+ * (S3 and COS both).
+ */
+export declare function putBucketCors(config: S3Config, origins: string[], opts?: {
+    merge?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=storage-s3-bun.d.ts.map

package/dist/core/sync/storage-s3-bun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-s3-bun.d.ts","sourceRoot":"","sources":["../../../src/core/sync/storage-s3-bun.ts"],"names":[],"mappings":"AAUA,OAAO,EAML,KAAK,QAAQ,EACd,MAAM,cAAc,CAAC;AAiHtB,+EAA+E;AAC/E,wBAAsB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAoB/F;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/core/sync/storage.d.ts

@@ -0,0 +1,170 @@
+import type { DbDriver } from "../driver.ts";
+import type { SyncResult } from "./client.ts";
+/** An 's3' peer's bucket settings, stored as JSON in peers.config (local-only). */
+export interface S3Config {
+    endpoint: string;
+    region: string;
+    bucket: string;
+    prefix: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** When false (`--no-encrypt`) segments are gzip-only plaintext. */
+    encrypt: boolean;
+    /** base64 raw 32-byte master key; present iff encrypt. Resolved at peer-add. */
+    masterKey?: string;
+    /**
+     * Address objects as `<bucket>.<host>/<key>` (virtual-hosted) instead of
+     * `<host>/<bucket>/<key>` (path-style). Some providers (Tencent COS) reject
+     * path-style outright. When undefined, the clients auto-detect: virtual-hosted
+     * iff the endpoint host already starts with `<bucket>.` (see
+     * isVirtualHostedStyle). R2/MinIO keep using path-style.
+     */
+    virtualHostedStyle?: boolean;
+    /**
+     * Node-role hints for this bucket (not bucket settings — safe to omit from
+     * shared enroll links). `publish` marks this node as the bucket's publisher
+     * (writes whole-hub snapshots; see StorageSyncOpts.publish): true for the data
+     * home (a server, or a no-origin PWA which IS the home), false for a replica
+     * that only attaches the bucket for its own away-sync. `priority` ranks
+     * publisher candidates when several are eligible (higher wins; see
+     * publisher-lease.ts) — server > desktop > laptop > phone.
+     */
+    publish?: boolean;
+    priority?: number;
+}
+/** Whether to use virtual-hosted addressing for this bucket: the explicit flag,
+ *  or — when unset — auto-detected from an endpoint whose host already carries
+ *  the bucket (e.g. COS's `<bucket>.cos.<region>.myqcloud.com`). */
+export declare function isVirtualHostedStyle(config: S3Config): boolean;
+export interface StorageObject {
+    key: string;
+    etag?: string;
+}
+/** Options for a conditional/typed put. */
+export interface StoragePutOpts {
+    contentType?: string;
+    /** Conditional create (S3 `If-None-Match: *`): fail with an MhError("conflict")
+     *  if the object already exists. Used to make first-time key provisioning a
+     *  compare-and-set so two devices initializing the same empty bucket can't
+     *  clobber each other's master key. */
+    ifNoneMatch?: boolean;
+}
+/** The minimal object-store surface storage-sync needs. Implemented per runtime:
+ *  Bun.S3Client on the CLI/desktop (storage-s3-bun.ts), aws4fetch SigV4 + fetch
+ *  in the browser worker (webui/data/storage-s3-browser.ts). */
+export interface StorageClient {
+    /** Keys under `prefix`, ascending, optionally only those strictly after
+     *  `startAfter`. With `delimiter` ("/"), collapse one level into common
+     *  prefixes (their keys end in the delimiter) to discover child "folders"
+     *  cheaply — callers must tolerate a backend that ignores it and returns full
+     *  keys instead. */
+    list(prefix: string, startAfter?: string, delimiter?: string): Promise<StorageObject[]>;
+    get(key: string): Promise<Uint8Array | null>;
+    put(key: string, body: Uint8Array, opts?: StoragePutOpts): Promise<void>;
+    del(key: string): Promise<void>;
+}
+type StorageClientFactory = (config: S3Config) => StorageClient;
+/** Register this runtime's S3 client builder (see the per-runtime impls). */
+export declare function setStorageClientFactory(f: StorageClientFactory): void;
+export declare function storageClientFor(config: S3Config): StorageClient;
+/** Upload a blob's bytes to the bucket (idempotent via If-None-Match). Returns
+ *  true when actually written, false when the object already existed. */
+export declare function putBucketBlob(config: S3Config, hash: string, bytes: Uint8Array): Promise<boolean>;
+/** Every blob hash the bucket durably holds — one paginated LIST of the `blobs/`
+ *  namespace (the client loops continuation tokens internally). Used by the
+ *  on-demand clear-presence verify; keeps the `<base>/blobs/<hash>` key layout
+ *  encapsulated here. Throws if the bucket is unreachable (caller treats the
+ *  anchor as unverified). */
+export declare function listBucketBlobHashes(config: S3Config): Promise<Set<string>>;
+/** Fetch a blob's bytes from the bucket, or null if absent. */
+export declare function getBucketBlob(config: S3Config, hash: string): Promise<Uint8Array | null>;
+/**
+ * Resolve the master key for a bucket at setup: read keys/main.json and unwrap
+ * with the passphrase, or — when absent — generate a key, wrap it, and upload
+ * it with `If-None-Match` so a concurrent first-time init can't clobber it.
+ * Returns base64(K) to store in peers.config, or null when encryption is off.
+ * Wrong passphrase throws `auth` (from unwrapMasterKey).
+ */
+export declare function provisionMasterKey(client: StorageClient, config: S3Config, passphrase: string): Promise<string | null>;
+/**
+ * Publish a winners-only snapshot and truncate this node's own segments. Every
+ * op we've uploaded so far is in the local oplog now, so the snapshot (winners
+ * as-of the current max HLC) supersedes all of them — they're safe to delete
+ * (compact.ts invariant #1). Ops produced afterwards go into fresh, higher-keyed
+ * segments; consumers reach our pre-snapshot state via the snapshot itself.
+ *
+ * The key is `<maxHlc>~<hash>.snap`: the hash (over the canonical winner set)
+ * makes converged nodes collide on one key (deduped) while two nodes that are
+ * NOT converged — same max HLC but different extra winners — get distinct keys,
+ * so neither overwrites the other. Then old snapshots (strictly lower max-HLC)
+ * are GC'd so the bucket stays bounded.
+ *
+ * Returns the snapshot key + change count, or null when the oplog is empty.
+ */
+export declare function publishSnapshot(db: DbDriver, client: StorageClient, config: S3Config, retainSegments?: number): Promise<{
+    key: string;
+    changes: number;
+} | null>;
+export interface StorageSyncOpts {
+    /** Publisher-only: publish a snapshot + truncate once this node's own segment
+     *  count reaches this. Default 200 — high enough that typical use rarely hits
+     *  it, low enough to keep the bucket bounded under heavy publisher use. */
+    snapshotEverySegments?: number;
+    /** Push-batching: defer uploading our pending own ops until there are at least
+     *  this many (default 1 → push every round). Coalesces a burst of edits into
+     *  one segment instead of many tiny ones (each is a billed request + a GET for
+     *  every puller). */
+    minPushChanges?: number;
+    /** …or until the oldest pending op is at least this old (ms; default 0 → no
+     *  age bound). Bounds how long a small trailing edit waits. */
+    maxPushAgeMs?: number;
+    /** Push regardless of the batching thresholds — use on explicit "sync now" and
+     *  when the app is backgrounding, so edits are never stranded unsynced. */
+    forcePush?: boolean;
+    /**
+     * This node is the bucket's *publisher*: keep the bucket a complete, fresh
+     * whole-hub mirror by writing a winners-only snapshot (publishSnapshot) when
+     * the bucket has none yet, or when the hub has advanced past the newest
+     * snapshot. The snapshot spans the WHOLE db, so it captures data authored by
+     * nodes that never push to this bucket themselves (e.g. a server holding the
+     * canonical hub while browsers only window onto it) — fixing the "attached a
+     * bucket but it stays empty" footgun. Any node holding the full hub can be the
+     * publisher; who is one is decided above storage.ts (server by default, else a
+     * lease — see publisher-lease.ts). Correctness never depends on a single
+     * publisher: concurrent snapshots are content-addressed and idempotent. */
+    publish?: boolean;
+    /** ⑤d snapshot trigger: publish once the whole-hub delta since the newest
+     *  snapshot reaches max(`snapshotMinDelta` ops, hub_size × `snapshotDeltaRatio`),
+     *  or `snapshotMaxIntervalMs` elapsed (safety). Replaces the old 60s timer that
+     *  re-checkpointed constantly and forced full re-downloads. Defaults:
+     *  DEFAULT_SNAPSHOT_MIN_DELTA / _DELTA_RATIO / _MAX_INTERVAL_MS. */
+    snapshotMinDelta?: number;
+    snapshotDeltaRatio?: number;
+    snapshotMaxIntervalMs?: number;
+    /** ⑤c: keep this many of our most recent own segments alive past a snapshot so
+     *  slightly-behind consumers catch up incrementally (default DEFAULT_RETAIN_SEGMENTS). */
+    snapshotRetainSegments?: number;
+    /** This node's publisher priority when contending for the lease (higher wins;
+     *  see publisher-lease.ts). Only consulted when `publish` is set. */
+    priority?: number;
+    /**
+     * Run the PULL half of the round (snapshots + other nodes' segments). Default
+     * true. Set false for *push-only* rounds: an origin-backed replica gets a
+     * superset of bucket contents from its origin (HTTP), so it never needs to PULL
+     * the bucket — it only PUSHes its own segments here for independent durability
+     * (Path B). Skipping PULL drops the two unconditional LISTs (snapshot/, oplog/)
+     * that dominate idle bucket cost. A *publisher* must always PULL (it needs the
+     * snapshot list to decide what to publish), so callers never combine
+     * `publish:true` with `pull:false`.
+     */
+    pull?: boolean;
+}
+/**
+ * One push/pull round against a storage peer. Push uploads this node's pending
+ * own ops as a new segment (subject to batching); pull hydrates from snapshots
+ * (any not yet ingested) then drains each other node's new segments. Returns
+ * { pushed, pulled } like syncWithPeer so peers.ts status writeback is shared.
+ */
+export declare function syncWithStorage(db: DbDriver, peerUrl: string, client: StorageClient, config: S3Config, opts?: StorageSyncOpts): Promise<SyncResult>;
+export {};
+//# sourceMappingURL=storage.d.ts.map

package/dist/core/sync/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/core/sync/storage.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAc9C,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;oEAEoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAO9D;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2CAGuC;IACvC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;gEAEgE;AAChE,MAAM,WAAW,aAAa;IAC5B;;;;wBAIoB;IACpB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACxF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,KAAK,oBAAoB,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,aAAa,CAAC;AAGhE,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAErE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAIhE;AAmGD;yEACyE;AACzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;6BAI6B;AAC7B,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAUjF;AAED,+DAA+D;AAC/D,wBAAsB,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAM9F;AA8ID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BxB;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,cAAc,GAAE,MAAgC,GAC/C,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAkDlD;AAID,MAAM,WAAW,eAAe;IAC9B;;+EAE2E;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;yBAGqB;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;+EAU2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;wEAIoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;8FAC0F;IAC1F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;yEACqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAwBD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAiIrB"}