@tensorix/metahub 0.3.2 → 0.4.1

package/dist/core/sync/grants-routes.d.ts

@@ -0,0 +1,46 @@
+import type { DbDriver } from "../driver.ts";
+import { type GrantSet, type GrantPrincipal } from "../grants-core.ts";
+import type { AccessPolicy } from "../access-policy.ts";
+import { type VerifyTurnstile } from "./anti-abuse.ts";
+export interface GrantedApiDeps {
+    db: DbDriver;
+    set: GrantSet;
+    principal: GrantPrincipal;
+    /** Host-injected rate limit: return false to answer 429. Called once per
+     *  request with its class ("read" for GETs, "write" for mutations). */
+    allow: (cls: "read" | "write") => boolean;
+    /** Optional async gate run before a write (POST/PATCH) is accepted, after the
+     *  rate limit and before the body is read — the anti-abuse (Turnstile /
+     *  password) check on the public site mount. Throws MhError to reject. */
+    beforeWrite?: () => Promise<void>;
+}
+/**
+ * Build GrantedApiDeps from a resolved AccessPolicy — the one place a mount
+ * turns "who may do what" into the serving deps, so the grants + write-gate
+ * wiring is identical across the site / share / room adapters (the drift that
+ * once let a --password grant be enforced on one transport and skipped on
+ * another). `beforeWrite` is synthesized from policy.writeGate via the shared
+ * assertAntiAbuse.
+ *
+ * The gate is per-write ONLY for the public audience: a public site has no
+ * session, so the SDK sends the password/Turnstile proof (x-drop-pass /
+ * x-turnstile-token) on every write and this gate verifies it — the SAME gate
+ * the write-inbox enforces. Share/room audiences spend their password once at
+ * unlock and carry a session cookie thereafter, so their writeGate is an
+ * unlock-time gate, not a per-write one → no beforeWrite here.
+ */
+export declare function grantedDepsFromPolicy(policy: AccessPolicy, host: {
+    db: DbDriver;
+    principal: GrantPrincipal;
+    allow: (cls: "read" | "write") => boolean;
+    req: Request;
+    ip?: string | null;
+    verifyTurnstile?: VerifyTurnstile;
+}): GrantedApiDeps;
+/**
+ * Serve one granted-API request. `sub` is the path under the api/ mount
+ * (e.g. "records", "record", "properties"); query params ride on req.url.
+ * Never throws — every outcome is a Response.
+ */
+export declare function serveGrantedApi(req: Request, sub: string, deps: GrantedApiDeps): Promise<Response>;
+//# sourceMappingURL=grants-routes.d.ts.map

package/dist/core/sync/grants-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/grants-routes.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,cAAc,EAIpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGxD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,QAAQ,CAAC;IACb,GAAG,EAAE,QAAQ,CAAC;IACd,SAAS,EAAE,cAAc,CAAC;IAC1B;2EACuE;IACvE,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC;IAC1C;;8EAE0E;IAC1E,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE;IACJ,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,cAAc,CAAC;IAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC;IAC1C,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,GACA,cAAc,CAiBhB;AA6ED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,QAAQ,CAAC,CA6DnB"}

package/dist/core/sync/guest-session.d.ts

@@ -0,0 +1,29 @@
+export interface GuestSessionScope {
+    /** HMAC secret (host-local, e.g. meta.share_cookie_secret / room cookie secret). */
+    secret: string;
+    /** Cookie name, e.g. `mh_share_<slug>` / `mh_room_<slug>`. */
+    cookieName: string;
+    /** MAC scope discriminator — the slug. */
+    scopeKey: string;
+}
+export declare function hmacHex(secret: string, msg: string): Promise<string>;
+export declare function timingSafeStr(a: string, b: string): boolean;
+export declare function readCookie(header: string | null, name: string): string | null;
+/** Verified session payload from the cookie header, or null when absent/
+ *  expired/forged. `sub` is "" for read-only sessions (no author identity). */
+export declare function readGuestSession(scope: GuestSessionScope, cookieHeader: string | null, now?: number): Promise<{
+    exp: number;
+    sub: string;
+} | null>;
+/** Mint a fresh session cookie for `sub`, valid for `ttlMs`, scoped to `path`. */
+export declare function mintGuestSession(scope: GuestSessionScope, opts: {
+    sub: string;
+    ttlMs: number;
+    path: string;
+    secure: boolean;
+}): Promise<{
+    sub: string;
+    exp: number;
+    cookie: string;
+}>;
+//# sourceMappingURL=guest-session.d.ts.map

package/dist/core/sync/guest-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest-session.d.ts","sourceRoot":"","sources":["../../../src/core/sync/guest-session.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1E;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAK3D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO7E;AAED;+EAC+E;AAC/E,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,GAAG,SAAa,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAS9C;AAED,kFAAkF;AAClF,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClE,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAQvD"}

package/dist/core/sync/html-escape.d.ts

@@ -0,0 +1,2 @@
+export declare function escapeHtml(s: string): string;
+//# sourceMappingURL=html-escape.d.ts.map

package/dist/core/sync/html-escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html-escape.d.ts","sourceRoot":"","sources":["../../../src/core/sync/html-escape.ts"],"names":[],"mappings":"AAKA,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM5C"}

package/dist/core/sync/http-status.d.ts

@@ -0,0 +1,14 @@
+import { type MhErrorCode } from "../errors.ts";
+/** HTTP status for an MhError code (400 fallback for unknown/absent codes). */
+export declare function httpStatusForCode(code: MhErrorCode | undefined): number;
+/** The `{error, code?}` body + status for a thrown error — shared by the guest
+ *  mounts. Callers pick their own Response constructor (Response.json vs a DO
+ *  json() helper), so this returns the parts, not a Response. */
+export declare function errorBody(e: unknown): {
+    body: {
+        error: string;
+        code?: MhErrorCode;
+    };
+    status: number;
+};
+//# sourceMappingURL=http-status.d.ts.map

package/dist/core/sync/http-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-status.d.ts","sourceRoot":"","sources":["../../../src/core/sync/http-status.ts"],"names":[],"mappings":"AAKA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAY3D,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAEvE;AAED;;iEAEiE;AACjE,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAIrG"}

package/dist/core/sync/http-util.d.ts

@@ -0,0 +1,6 @@
+/** decodeURIComponent that returns null on a malformed %-escape instead of
+ *  throwing URIError. An uncaught throw on these anonymous surfaces becomes an
+ *  unhandled 500 — Bun.serve has no error handler, and workerd returns 1101 —
+ *  plus a stack in the logs, all reachable by any client sending `%E0%A4`. */
+export declare function safeDecode(s: string): string | null;
+//# sourceMappingURL=http-util.d.ts.map

package/dist/core/sync/http-util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-util.d.ts","sourceRoot":"","sources":["../../../src/core/sync/http-util.ts"],"names":[],"mappings":"AAIA;;;8EAG8E;AAC9E,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMnD"}

package/dist/core/sync/pairing.d.ts

@@ -1,4 +1,4 @@
-import type { Database } from "bun:sqlite";
+import type { DbDriver } from "../driver.ts";
 import { type PairRequest, type PairResponse } from "./protocol.ts";
 /** Default one-time pairing-code lifetime (override with METAHUB_PAIR_TTL). */
 export declare const DEFAULT_PAIR_TTL_MS: number;
@@ -7,17 +7,17 @@ export interface PairingCode {
     exp: number;
 }
 /** Mint a one-time pairing code, stored until redeemed or expired. */
-export declare function generatePairingCode(db: Database, ttlMs?: number): PairingCode;
+export declare function generatePairingCode(db: DbDriver, ttlMs?: number): PairingCode;
 /**
  * Validate and consume a pairing code. The check-and-consume is a single atomic
  * UPDATE (guarded on used=0 AND not-expired) so two concurrent redemptions of
  * the same code can't both succeed. Returns false if unknown/used/expired.
  */
-export declare function redeemPairingCode(db: Database, code: string): boolean;
+export declare function redeemPairingCode(db: DbDriver, code: string): boolean;
 /** Mint a durable credential we issue to a peer and will accept on /sync. */
-export declare function mintGrant(db: Database, peerUrl: string | null, nodeId: string | null): string;
+export declare function mintGrant(db: DbDriver, peerUrl: string | null, nodeId: string | null): string;
 /** Whether a presented token matches a credential we issued during pairing. */
-export declare function isAcceptedGrant(db: Database, token: string): boolean;
+export declare function isAcceptedGrant(db: DbDriver, token: string): boolean;
 export interface GrantRow {
     token: string;
     peer_url: string | null;
@@ -25,18 +25,18 @@ export interface GrantRow {
     created_at: number | null;
 }
 /** All credentials we have issued and still accept on /sync (inbound access). */
-export declare function listGrants(db: Database): GrantRow[];
+export declare function listGrants(db: DbDriver): GrantRow[];
 /**
  * Revoke issued credentials by exact token or a unique prefix (handy for the
  * grants minted by one-directional pairing, which removePeer can't reach since
  * they have a null peer_url). Returns the number of grants revoked.
  */
-export declare function revokeGrant(db: Database, tokenOrPrefix: string): number;
+export declare function revokeGrant(db: DbDriver, tokenOrPrefix: string): number;
 /**
  * Inbound side (device A): redeem the caller's one-time code, mint a grant for
  * the caller, register the caller back as a peer if it gave a reachable URL.
  */
-export declare function handlePairRequest(db: Database, node: string, body: PairRequest): PairResponse;
+export declare function handlePairRequest(db: DbDriver, node: string, body: PairRequest): PairResponse;
 export interface PairOutcome {
     /** The paired peer's node id. */
     node_id: string;
@@ -46,5 +46,5 @@ export interface PairOutcome {
  * Outbound side (device B): mint a grant for the remote, post the handshake to
  * its /api/pair, then register it as a peer with the grant it returned.
  */
-export declare function performPairing(db: Database, node: string, remoteUrl: string, code: string, selfUrl?: string): Promise<PairOutcome>;
+export declare function performPairing(db: DbDriver, node: string, remoteUrl: string, code: string, selfUrl?: string): Promise<PairOutcome>;
 //# sourceMappingURL=pairing.d.ts.map

package/dist/core/sync/pairing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../../src/core/sync/pairing.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,OAAO,EAAa,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAG/E,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,QAA2D,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,MAA4B,GAAG,WAAW,CAUlG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMrE;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM7F;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAInD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,YAAY,CAW7F;AAED,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC,CAoBtB"}
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../../src/core/sync/pairing.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAa,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAG/E,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,QAA2D,CAAC;AAE5F,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,GAAE,MAA4B,GAAG,WAAW,CAUlG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMrE;AAED,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM7F;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,EAAE,CAInD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,YAAY,CAW7F;AAED,MAAM,WAAW,WAAW;IAC1B,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC,CAoBtB"}

package/dist/core/sync/partition.d.ts

@@ -0,0 +1,77 @@
+import type { DbDriver } from "../driver.ts";
+import { type Change, type ChangeBatch } from "../crdt.ts";
+/** The scope of one share's partition. `siteId` is null for pure-data shares. */
+export interface PartitionScope {
+    grantedDbIds: string[];
+    siteId: string | null;
+}
+/** Identifies one row of one dataset — the unit of membership and eviction. */
+export interface RowKey {
+    dataset: string;
+    row_id: string;
+}
+export declare const PARTITION_DATASETS: readonly ["databases", "properties", "records", "sites", "site_files"];
+/** The current member set M of a scope, from the state tables. */
+export declare function computePartitionMembers(db: DbDriver, scope: PartitionScope): RowKey[];
+/** Membership check for a single row under the CURRENT state — used to
+ *  re-judge a room's need_baseline keys (member → send baseline, gone or
+ *  out-of-scope → evict). A row that no longer exists is not a member. */
+export declare function isPartitionMember(db: DbDriver, scope: PartitionScope, key: RowKey): boolean;
+export interface PartitionDiff {
+    /** In M but not yet in the shadow — need a full-row baseline. */
+    entered: RowKey[];
+    /** In the shadow but no longer in M — need an evict. */
+    left: RowKey[];
+}
+/** entered/left between the current member set and the peer's shadow.
+ *  READ-ONLY: the caller applies the diff (applyPartitionDiff) only after the
+ *  payload actually reached the room, so a lost response is re-prepared
+ *  identically on retry. */
+export declare function partitionDiff(db: DbDriver, peerKey: string, scope: PartitionScope): PartitionDiff;
+/** Commit a delivered diff into the shadow: shipped entered rows join, left
+ *  rows leave. Idempotent (INSERT OR IGNORE / blind DELETE). */
+export declare function applyPartitionDiff(db: DbDriver, peerKey: string, diff: PartitionDiff): void;
+/** Replace the peer's whole shadow (digest-mismatch full reconcile). */
+export declare function resetPartitionShadow(db: DbDriver, peerKey: string, members: RowKey[]): void;
+export interface PartitionChangesOpts {
+    /** Max rows to return — pagination, same semantics as changesAfterSeq. */
+    limit?: number;
+    /** Skip changes authored under this guest base node id (exact or
+     *  `<base>-<sub>`): the room authored those itself, echoing them back is
+     *  pure noise (the room's oplog UNIQUE would dedup, but a room that already
+     *  GC'd them would re-insert). The cursor still advances over skipped rows. */
+    excludeGuestBase?: string;
+}
+/**
+ * changesAfterSeq filtered to the peer's shadow: oplog changes with seq > `seq`
+ * whose (dataset,row_id) is in room_rows for `peerKey`, in insertion order.
+ * Cursor semantics mirror crdt.ts changesAfterSeq exactly: with `limit` the
+ * cursor stops at the last RETURNED row so the next pull resumes there; when
+ * the scan is exhausted it jumps to the table's high-water seq so filtered-out
+ * tails are skipped once, not rescanned every round.
+ */
+export declare function partitionChangesAfterSeq(db: DbDriver, seq: number, peerKey: string, opts?: PartitionChangesOpts): ChangeBatch;
+/** Current winners (max-HLC change per register) of ONE row — the baseline
+ *  shipped when a row enters the partition. Mirrors storage.ts's
+ *  winnersSnapshot NOT EXISTS shape, scoped to a single (dataset,row_id). */
+export declare function rowBaseline(db: DbDriver, dataset: string, rowId: string): Change[];
+/** Winners of every register whose row is currently in the partition —
+ *  the owner side of the digest, and the payload of a full reconcile. */
+export declare function partitionWinners(db: DbDriver, scope: PartitionScope): Change[];
+/** Winners of every MATERIALIZED register in the whole oplog — the room side
+ * of the partition digest. Oplog-only protocol state (intent receipts) is
+ * replicated and retained, but must not make anti-entropy compare a room's
+ * protocol metadata against the owner's materialized partition projection. */
+export declare function allWinners(db: DbDriver): Change[];
+/**
+ * Order-insensitive anti-entropy digest over a winner set: the winners'
+ * (dataset, row_id, col, hlc) tuples are canonically sorted, then FNV-1a-64
+ * hashed as one stream. The hlc pins the winning change exactly (the oplog's
+ * (dataset,row_id,col,hlc) UNIQUE means equal tuples imply equal values), so
+ * two ends holding the same winners produce the same digest — BOTH ends must
+ * use this same function.
+ */
+export declare function winnersDigest(rows: Pick<Change, "dataset" | "row_id" | "col" | "hlc">[]): string;
+/** The owner-side digest of a scope (winners restricted to current members). */
+export declare function partitionDigest(db: DbDriver, scope: PartitionScope): string;
+//# sourceMappingURL=partition.d.ts.map

package/dist/core/sync/partition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"partition.d.ts","sourceRoot":"","sources":["../../../src/core/sync/partition.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAIL,KAAK,MAAM,EACX,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAGpB,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,+EAA+E;AAC/E,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,kBAAkB,wEAMrB,CAAC;AAkCX,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,EAAE,CAKrF;AAED;;0EAE0E;AAC1E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CA6B3F;AAID,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wDAAwD;IACxD,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;4BAG4B;AAC5B,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,aAAa,CAiBjG;AAED;gEACgE;AAChE,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,CAO3F;AAED,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAG3F;AAID,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;mFAG+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,oBAAyB,GAC9B,WAAW,CAyBb;AAID;;6EAE6E;AAC7E,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAUlF;AAED;yEACyE;AACzE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,EAAE,CAa9E;AAED;;;8EAG8E;AAC9E,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,EAAE,CAcjD;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC,EAAE,GAAG,MAAM,CAGhG;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAE3E"}

package/dist/core/sync/peers-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AA6KvE,eAAO,MAAM,WAAW,EAAE,KAAK,EA+H9B,CAAC"}
+{"version":3,"file":"peers-routes.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,KAAK,EAAiB,MAAM,aAAa,CAAC;AAoRvE,eAAO,MAAM,WAAW,EAAE,KAAK,EA+N9B,CAAC"}

package/dist/core/sync/peers.d.ts

@@ -1,5 +1,6 @@
 import type { DbDriver } from "../driver.ts";
 import { type S3Config, type StorageSyncOpts } from "./storage.ts";
+import { type HealthResponse } from "./protocol.ts";
 export interface PeerRow {
     url: string;
     pull_cursor: number;
@@ -37,6 +38,28 @@ export interface AddStoragePeerInput {
 }
 /** Upsert an 's3' (bucket store-and-forward) peer, preserving cursors on conflict. */
 export declare function addStoragePeer(db: DbDriver, input: AddStoragePeerInput): void;
+/** Connection settings of a kind='room' peer (a Durable Object room serving
+ *  one share). Node-local like every peers.config. `base` is the worker origin,
+ *  `slug` the share/room id, `ownerSecret` the Bearer credential for the
+ *  owner-side sync endpoint — independent of the master token by design. */
+export interface RoomPeerConfig {
+    base: string;
+    slug: string;
+    ownerSecret: string;
+    /** The share's base guest node id (pull filter + sub-id derivation). Persisted
+     *  here because a read-only share row carries no guest_node_id of its own. */
+    guestBase?: string;
+    lifecycle?: "provisioning" | "active" | "cleanup_pending";
+    cleanupError?: string;
+}
+export interface AddRoomPeerInput {
+    /** Synthetic peer key, by convention room://<slug>. */
+    url: string;
+    config: RoomPeerConfig;
+    label?: string | null;
+}
+/** Upsert a 'room' peer, preserving replication cursors on conflict. */
+export declare function addRoomPeer(db: DbDriver, input: AddRoomPeerInput): void;
 export { storageUrl, storageEndpointHost } from "./storage-url.ts";
 export interface StoragePeerSpec {
     endpoint: string;
@@ -52,6 +75,10 @@ export interface StoragePeerSpec {
     encrypt?: boolean;
     /** Required when encrypt — provisions/adopts the bucket's wrapped master key. */
     passphrase?: string;
+    /** Alternative to the passphrase: an MH1- recovery code carrying the master
+     *  key directly ("忘记口令" join). Verified against the bucket's ciphertext and
+     *  used as-is — this path NEVER writes keys/main.json. */
+    recoveryCode?: string;
     /** Mark this node the bucket's publisher (writes whole-hub snapshots). */
     publish?: boolean;
     priority?: number;
@@ -69,6 +96,47 @@ export declare function addAndSyncStoragePeer(db: DbDriver, spec: StoragePeerSpe
     config: S3Config;
     sync: PeerSyncOutcome;
 }>;
+/** Replace an s3 peer's config JSON in place. Cursors, status and label are
+ *  untouched — a credential/passphrase rotation moves no bucket objects, so
+ *  replication state stays valid. */
+export declare function updateStoragePeerConfig(db: DbDriver, url: string, config: S3Config): void;
+export interface RotateStoragePeerInput {
+    /** New S3 credentials (both or neither) — minted by the user at the provider;
+     *  the old keys stay valid until the user disables them AFTER the rotate. */
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    /** Rewrap keys/main.json under this passphrase (K itself never changes). */
+    newPassphrase?: string;
+    /** Optional K sources when this device's config lost its cached master key:
+     *  the printed recovery code, or the current passphrase (unwraps the bucket
+     *  envelope). The cached key, when present, needs neither. */
+    oldPassphrase?: string;
+    recoveryCode?: string;
+}
+export interface RotateOutcome {
+    url: string;
+    rotatedCredentials: boolean;
+    rotatedPassphrase: boolean;
+    /** Whether K was cryptographically checked against bucket ciphertext:
+     *  "skipped" = K came from this device's own trusted config. */
+    keyVerified: "verified" | "no_ciphertext" | "skipped";
+    /** Post-rotate sync (effect evidence the new credentials work end-to-end).
+     *  Not rolled back on failure — the new creds are the intended end state. */
+    sync: PeerSyncOutcome;
+    /** Fresh enroll token (new credentials) for re-attaching other devices. */
+    enroll: string;
+}
+/**
+ * Rotate an S3 storage peer's credentials and/or passphrase — the "lost
+ * device" remedy. Ordered so every failure point either mutates nothing or is
+ * safely re-runnable (idempotent: same K, CAS'd envelope, upsert config):
+ * validate new creds (zero side effects) → resolve K (cached / recovery code /
+ * old passphrase) → verify K against ciphertext when it came from outside →
+ * CAS-rewrap the envelope → persist local config → one sync as effect
+ * evidence. A crash between rewrap and persist is healed by re-running the
+ * same command.
+ */
+export declare function rotateStoragePeer(db: DbDriver, url: string, input: RotateStoragePeerInput): Promise<RotateOutcome>;
 /**
  * Remove a peer AND revoke the credential we issued to it during pairing, so
  * disconnecting is mutual: we stop syncing out to it (peers row) and it can no
@@ -86,13 +154,22 @@ export interface PeerSyncOutcome {
     pulled?: number;
     pendingPush?: boolean;
     error?: string;
+    /** Non-fatal follow-up problems (e.g. channel maintenance) after a
+     * SUCCESSFUL data sync. Never flips `ok` and never sets a network error. */
+    warnings?: string[];
 }
 /** Sync once with a single peer, recording status. Errors are captured, not
  *  thrown. Dispatches on transport: 's3' peers go through the bucket
  *  store-and-forward client, everything else POSTs /sync. */
 export declare function syncPeer(db: DbDriver, url: string, opts?: {
     storage?: StorageSyncOpts;
+    timeoutMs?: number;
 }): Promise<PeerSyncOutcome>;
+/** Mixed-version workspace warning, from a peer's /health handshake. A peer
+ *  without the site_channels capability treats v2 channel rows as malformed
+ *  (validRow fail-closed), so publish/share changes silently do nothing there
+ *  — that deserves a loud line, not a shrug. Pure for tests. */
+export declare function versionWarning(local: string, health: HealthResponse | null): string | null;
 /** Sync once with every enabled peer. Used by the auto-sync timer. */
 export declare function syncAllPeers(db: DbDriver): Promise<PeerSyncOutcome[]>;
 /**

package/dist/core/sync/peers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAWtB,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAEjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAU7E;AAsCD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CA+BnE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAS7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAWN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;6DAE6D;AAC7D,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,GACnC,OAAO,CAAC,eAAe,CAAC,CAa1B;AAiCD,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../../src/core/sync/peers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAQL,KAAK,QAAQ,EACb,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AAKtB,OAAO,EAAqC,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAYvF,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,EAAE,CAEjD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAIjE;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAU/D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAU7E;AAED;;;4EAG4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;kFAC8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,cAAc,GAAG,QAAQ,GAAG,iBAAiB,CAAC;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,cAAc,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAUvE;AAsCD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEnE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB;iEAC6D;IAC7D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;8DAE0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC,CA4CnE;AAED;;qCAEqC;AACrC,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,IAAI,CAMzF;AAED,MAAM,WAAW,sBAAsB;IACrC;iFAC6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;kEAE8D;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,OAAO,CAAC;IAC3B;oEACgE;IAChE,WAAW,EAAE,UAAU,GAAG,eAAe,GAAG,SAAS,CAAC;IACtD;iFAC6E;IAC7E,IAAI,EAAE,eAAe,CAAC;IACtB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAgGxB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAW7D;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAInF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,IAAI,CAWN;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;6DAE6D;AAC7D,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,eAAe,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACvD,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED;;;gEAGgE;AAChE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAO1F;AA6ED,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAK3E;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,QAAQ,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACnE,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/core/sync/protocol.d.ts

@@ -40,6 +40,8 @@ export declare const SyncResponseSchema: z.ZodObject<{
 export declare const HealthResponseSchema: z.ZodObject<{
     ok: z.ZodBoolean;
     node: z.ZodString;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const PairRequestSchema: z.ZodObject<{
     code: z.ZodString;

package/dist/core/sync/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/core/sync/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,YAAY,CAAC;AAMvD,eAAO,MAAM,YAAY;;;;;;;;iBAUvB,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAa5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAI7B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AAKH,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,GAAG;IAAE,OAAO,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,GAAG;IAAE,OAAO,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,WAAW,YAAY,CAAC;AAGrC,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAGxC,eAAO,MAAM,SAAS,cAAc,CAAC"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/core/sync/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,YAAY,CAAC;AAMvD,eAAO,MAAM,YAAY;;;;;;;;iBAUvB,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAa5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAI7B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;iBAW/B,CAAC;AAKH,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,GAAG;IAAE,OAAO,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,GAAG;IAAE,OAAO,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,WAAW,YAAY,CAAC;AAGrC,eAAO,MAAM,UAAU,gBAAgB,CAAC;AAGxC,eAAO,MAAM,SAAS,cAAc,CAAC"}

package/dist/core/sync/rate-limit.d.ts

@@ -0,0 +1,20 @@
+export declare class FixedWindowLimiter {
+    private readonly maxEntries;
+    private hits;
+    constructor(maxEntries?: number);
+    /**
+     * Record one hit for (bucket, key) and report whether it is within `limit`
+     * for the current window. `now` is injectable for tests.
+     */
+    allow(bucket: string, key: string, limit: number, windowMs?: number, now?: number): boolean;
+    /** Drop expired entries; if still at capacity, drop oldest-inserted. */
+    private evict;
+    /** Live counter count (tests / diagnostics). */
+    get size(): number;
+}
+/** The process-wide limiter the serve paths share. */
+export declare const rateLimiter: FixedWindowLimiter;
+export declare const PUBLIC_READ_LIMIT = 120;
+export declare const PUBLIC_WRITE_LIMIT = 20;
+export declare const SHARE_LIMIT = 240;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/core/sync/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/core/sync/rate-limit.ts"],"names":[],"mappings":"AAWA,qBAAa,kBAAkB;IAGjB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAFvC,OAAO,CAAC,IAAI,CAAyD;gBAExC,UAAU,SAAS;IAEhD;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,GAAG,SAAa,GAAG,OAAO;IAe/F,wEAAwE;IACxE,OAAO,CAAC,KAAK;IAWb,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,sDAAsD;AACtD,eAAO,MAAM,WAAW,oBAA2B,CAAC;AAIpD,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC,eAAO,MAAM,WAAW,MAAM,CAAC"}

package/dist/core/sync/recovery.d.ts

@@ -0,0 +1,9 @@
+export declare const RECOVERY_PREFIX = "MH1";
+/** Encode the raw 32-byte master key as a grouped, prefixed recovery code. */
+export declare function encodeRecoveryCode(rawKey: Uint8Array): Promise<string>;
+/** Decode a (possibly sloppily pasted) recovery code back to the raw master
+ *  key. Tolerates case, spaces, dashes and the o→0 / i,l→1 confusions; throws
+ *  MhError("invalid_input") on bad characters, wrong length, or a failed
+ *  checksum (a typo the confusion-folding couldn't absorb). */
+export declare function decodeRecoveryCode(code: string): Promise<Uint8Array>;
+//# sourceMappingURL=recovery.d.ts.map

package/dist/core/sync/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../../src/core/sync/recovery.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,eAAe,QAAQ,CAAC;AA8CrC,8EAA8E;AAC9E,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAU5E;AAED;;;+DAG+D;AAC/D,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgB1E"}

package/dist/core/sync/room-client.d.ts

@@ -0,0 +1,50 @@
+import type { DbDriver } from "../driver.ts";
+import { type PartitionScope } from "./partition.ts";
+import { type OwnerSyncRequest, type OwnerSyncResponse, type ShareState } from "./room-protocol.ts";
+/** The wire. C2 wraps HTTP + Bearer ownerSecret; tests call handleOwnerSync. */
+export type RoomTransport = (req: OwnerSyncRequest) => Promise<OwnerSyncResponse>;
+export interface RoomClientConfig {
+    /** peers.url of the kind='room' row (cursor storage), e.g. room://<slug>. */
+    peerKey: string;
+    /** The share's authorization closure — computed by the caller from the
+     *  share row (grants + target site) each round, so re-grants apply next round. */
+    scope: PartitionScope;
+    /** The share's base guest node id — pulled ops must be authored under it,
+     *  and owner pushes exclude it (no echo). */
+    guestBase: string;
+}
+export interface RoomSyncOpts {
+    /** Change budget per request (increment + baselines). Default 500. */
+    limit?: number;
+    /** Attach a digest this round (anti-entropy). The caller schedules these —
+     *  every ROOM_DIGEST_INTERVAL rounds and after any grants change. */
+    digest?: boolean;
+    mhVersion?: string;
+}
+export interface RoomSyncResult {
+    pushed: number;
+    pulled: number;
+    evicted: number;
+    /** More increments/baselines are queued than the limit allowed — sync again. */
+    pending: boolean;
+    /** A digest mismatch triggered a full winners + member-set reconcile. */
+    healed: boolean;
+    /** Site-file blob hashes the room lacks — the caller pushes their bytes
+     *  through the chunked /owner/blob channel (room-peer.ts). */
+    needBlobs: string[];
+    shareState: ShareState;
+}
+/** Send a digest every this many rounds (plus after any grants change). */
+export declare const ROOM_DIGEST_INTERVAL = 16;
+/** Ensure the peers row exists (kind='room', cursors at 0). The full config
+ *  (base/slug/ownerSecret) is written by share-create --room (C2); tests and
+ *  the client itself only need the cursor columns. */
+export declare function ensureRoomPeer(db: DbDriver, peerKey: string): void;
+/**
+ * One owner↔room sync round. Throws on transport/protocol errors (the caller —
+ * peers-status bookkeeping in C2, tests here — records and retries; nothing
+ * was committed, so a retry is a byte-identical resend). Returns pending:true
+ * when the limit truncated the payload — loop until quiescent.
+ */
+export declare function syncWithRoom(db: DbDriver, cfg: RoomClientConfig, transport: RoomTransport, opts?: RoomSyncOpts): Promise<RoomSyncResult>;
+//# sourceMappingURL=room-client.d.ts.map

package/dist/core/sync/room-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-client.d.ts","sourceRoot":"","sources":["../../../src/core/sync/room-client.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAWL,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EAChB,MAAM,oBAAoB,CAAC;AAE5B,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;sFACkF;IAClF,KAAK,EAAE,cAAc,CAAC;IACtB;iDAC6C;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;yEACqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAC;IAChB;kEAC8D;IAC9D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;sDAEsD;AACtD,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAIlE;AAiFD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,aAAa,EACxB,IAAI,GAAE,YAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAwEzB"}

package/dist/core/sync/room-peer.d.ts

@@ -0,0 +1,62 @@
+import type { DbDriver } from "../driver.ts";
+import { type ShareRow } from "../shares.ts";
+import { type PeerRow, type RoomPeerConfig } from "./peers.ts";
+import { type RoomTransport } from "./room-client.ts";
+export { roomUrlOf } from "./room-url.ts";
+export type RoomBlobResolver = (db: DbDriver, hash: string) => Promise<Uint8Array | null>;
+/** Runtime adapter hook: Bun registers its blob resolver at server/CLI startup;
+ * browser replicas register spool→bucket resolution in db-worker. */
+export declare function registerRoomBlobResolver(resolve: RoomBlobResolver): void;
+/** Synthetic peers.url key of a share's room. */
+export declare function roomPeerKey(slug: string): string;
+/** The wire for room-client: POST /owner/sync with the owner secret. Statuses
+ *  map onto MhError codes; a protocol-major mismatch is the room's 409. */
+export declare function roomTransport(config: RoomPeerConfig): RoomTransport;
+/**
+ * One owner→room sync pass for a kind='room' peer: derive the partition scope
+ * from the CURRENT share row (re-grants apply immediately), loop syncWithRoom
+ * until quiescent, then push any blob bytes the room asked for. Called from
+ * peers.ts syncPeerOnce (which records last_status) and from the first seed.
+ *
+ * Lifecycle self-healing: a room peer whose share row is gone (revoke should
+ * have torn it down — e.g. a crash in between) destroys the room best-effort
+ * and removes itself; an "expired" answer tears the peer down likewise.
+ */
+export declare function syncRoomPeer(db: DbDriver, peer: PeerRow, opts?: {
+    resolveBlob?: RoomBlobResolver;
+}): Promise<{
+    pushed: number;
+    pulled: number;
+    pendingPush: boolean;
+}>;
+/**
+ * Push blob bytes the room asked for (site_files rows with encoding='blob'
+ * store only the hash — the bytes never ride the oplog). Chunked ≤1MiB per
+ * POST; a hash whose bytes this node can't resolve right now is skipped (the
+ * room re-asks every round until someone answers). `resolve` is injectable
+ * for tests.
+ */
+export declare function pushRoomBlobs(db: DbDriver, config: RoomPeerConfig, hashes: string[], resolve?: (db: DbDriver, hash: string) => Promise<Uint8Array | null>): Promise<number>;
+/**
+ * Provision a room for a freshly created share and run the first seed:
+ * POST /owner/provision (grants snapshot + password verifier + guest base +
+ * expiry) → register the kind='room' peer → sync rounds until quiescent.
+ * Returns the guest-facing room URL.
+ */
+export declare function provisionRoomForShare(db: DbDriver, share: ShareRow, edge: {
+    endpoint: string;
+    token: string;
+}, resolveBlob?: RoomBlobResolver): Promise<{
+    url: string;
+    peerKey: string;
+}>;
+/** POST /owner/destroy — the room wipes its storage and drops every socket. */
+export declare function destroyRoom(config: RoomPeerConfig): Promise<boolean>;
+/**
+ * Tear down the room bound to a share, if any: best-effort destroy (an
+ * unreachable edge must never block a revoke) + remove the peer row. Returns
+ * whether a room peer existed. Hooked into revokeShareAction so `mh share
+ * revoke` / the WebUI revoke both cascade (final decision 3).
+ */
+export declare function teardownRoomForShare(db: DbDriver, slug: string): Promise<"absent" | "destroyed" | "cleanup_pending">;
+//# sourceMappingURL=room-peer.d.ts.map

package/dist/core/sync/room-peer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"room-peer.d.ts","sourceRoot":"","sources":["../../../src/core/sync/room-peer.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAyB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAIL,KAAK,OAAO,EACZ,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAGL,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE1C,MAAM,MAAM,gBAAgB,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;AAG1F;qEACqE;AACrE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAExE;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAkED;2EAC2E;AAC3E,wBAAgB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,CAwBnE;AASD;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,OAAO,EACb,IAAI,GAAE;IACJ,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAC3B,GACL,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC,CA8HnE;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GACnE,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,QAAQ,EACf,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACzC,WAAW,CAAC,EAAE,gBAAgB,GAC7B,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAgD3C;AAED,+EAA+E;AAC/E,wBAAsB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAO1E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,QAAQ,GAAG,WAAW,GAAG,iBAAiB,CAAC,CAYrD"}