@abide/abide 0.58.0 → 0.101.0

package/src/lib/server/runtime/devReloadResponse.ts

@@ -1,41 +0,0 @@
-import { NO_STORE } from '../../shared/CACHE_CONTROL_VALUES.ts'
-import type { DevReloadStamp } from './types/DevReloadStamp.ts'
-
-// Keepalive comment cadence — keeps the idle SSE connection from being dropped.
-const KEEPALIVE_INTERVAL_MS = 15000
-const TEXT_ENCODER = new TextEncoder()
-
-/*
-The dev live-reload channel (`/__abide/dev`, dev only). An SSE stream carrying
-one event: the worker's reload stamp (devClientFingerprint) as JSON. The
-connection drops when the dev orchestrator swaps the server after a rebuild;
-the browser-side client (DEV_RELOAD_CLIENT_SCRIPT) reconnects and compares — a
-changed `structure` reloads, a changed `cssHref` alone swaps the stylesheet in
-place, and a server-only edit (both equal) keeps the page alive. The opening
-`retry: 250` shortens EventSource's reconnect backoff; a periodic comment keeps
-the idle connection alive. The interval is cleared when the consumer disconnects.
-*/
-export function devReloadResponse(stamp: DevReloadStamp): Response {
-    let keepalive: ReturnType<typeof setInterval>
-    const body = new ReadableStream<Uint8Array>({
-        start(controller) {
-            controller.enqueue(
-                TEXT_ENCODER.encode(`retry: 250\ndata: ${JSON.stringify(stamp)}\n\n`),
-            )
-            keepalive = setInterval(() => {
-                controller.enqueue(TEXT_ENCODER.encode(': keepalive\n\n'))
-            }, KEEPALIVE_INTERVAL_MS)
-        },
-        cancel() {
-            clearInterval(keepalive)
-        },
-    })
-    return new Response(body, {
-        headers: {
-            'Content-Type': 'text/event-stream; charset=utf-8',
-            'Cache-Control': NO_STORE,
-            'X-Content-Type-Options': 'nosniff',
-            Connection: 'keep-alive',
-        },
-    })
-}

package/src/lib/server/runtime/disableIdleTimeoutForStream.ts

@@ -1,27 +0,0 @@
-import type { Server } from 'bun'
-import { isStreamingResponse } from '../../shared/isStreamingResponse.ts'
-
-/*
-Opts a long-lived streaming response (SSE / JSONL) out of Bun's per-connection
-idle timeout. Such a stream can stay quiet for longer than the 10s default
-between frames, which Bun would otherwise read as an idle connection and close
-mid-stream. `server.timeout(req, 0)` clears the timeout for just this in-flight
-request, leaving the global default in place for ordinary traffic. Streaming is
-detected by Content-Type (the shared signal the CLI/MCP drain paths use) rather
-than `body instanceof ReadableStream`, since every bodied Response exposes one.
-
-A streamed SSR page (`text/html`) is deliberately not opted out: it inherits the
-configured `idleTimeout` as a bounded cap on how long it can hold the connection,
-and the client re-fetches any placeholder left unresolved by a cut stream (see
-streamCacheResolutions, which yields { key, miss } markers the client re-fetches). Non-stream responses pass through.
-*/
-export function disableIdleTimeoutForStream(
-    server: Server<unknown>,
-    req: Request,
-    response: Response,
-): Response {
-    if (isStreamingResponse(response)) {
-        server.timeout(req, 0)
-    }
-    return response
-}

package/src/lib/server/runtime/envSchemaStore.ts

@@ -1,15 +0,0 @@
-import type { StandardSchemaV1 } from '../../shared/types/StandardSchemaV1.ts'
-
-/*
-Holds the schema handed to env() so the bundle launcher can project the
-first-run setup form from it (jsonSchemaForSchema) without re-running boot
-validation. `skipValidation` lets the launcher import src/server/config.ts
-purely to register the schema: env() records it and returns early instead of
-validating Bun.env — which the launcher has no business doing, that's the
-embedded server's job at its own boot. In-process module state, so the server
-child the launcher spawns gets a fresh store and validates normally.
-*/
-export const envSchemaStore: {
-    schema: StandardSchemaV1 | undefined
-    skipValidation: boolean
-} = { schema: undefined, skipValidation: false }

package/src/lib/server/runtime/finalizeResponse.ts

@@ -1,42 +0,0 @@
-import { responseBodyKind } from '../../shared/responseBodyKind.ts'
-import { gzipResponse } from './gzipResponse.ts'
-import { STREAMED_HTML_HEADER } from './STREAMED_HTML_HEADER.ts'
-import type { RequestStore } from './types/RequestStore.ts'
-
-/*
-The wire-handling step every dynamic route's response crosses after its
-handler (and app.handle) returns. The body is classified once
-(responseBodyKind) and that one decision is threaded into every consumer, in
-order: the closing-record stream monitor (store.responseStreaming), the idle
-timeout — a streaming body (SSE / JSONL, socket tail) is opted out so a quiet
-stream isn't reaped mid-flight — and gzip, which compresses compressible
-dynamic bodies (SSR HTML, rpc/json, 404) when the client accepts it and
-passes streaming frame protocols and opaque bodies through untouched.
-`exemptIdleTimeout` is the server capability (server.timeout(req, 0))
-injected by createServer, so the sequencing is testable without a live
-socket. Framework plumbing endpoints answered before the request scope
-(inspector / dev-reload SSE) don't cross this seam — they opt out via
-disableIdleTimeoutForStream directly.
-*/
-export function finalizeResponse(
-    req: Request,
-    response: Response,
-    store: RequestStore,
-    exemptIdleTimeout: () => void,
-): Response {
-    const kind = responseBodyKind(response)
-    /* Close-monitoring (defer the closing record + cache-stats snapshot until the body
-       actually drains) must also cover progressively-streamed SSR HTML — a live
-       ReadableStream marked by STREAMED_HTML_HEADER that classifies as 'compressible' (it
-       still gzips), NOT as 'streaming'. Read the marker before gzipResponse strips it.
-       Without this, a page with a slow `{#await}` logs ~1ms elapsed and near-empty cache
-       stats at header time instead of the true drain-time values. */
-    const streamedHtml = response.headers.has(STREAMED_HTML_HEADER)
-    store.responseStreaming = kind === 'streaming' || streamedHtml
-    /* Only true frame protocols (SSE/JSONL, socket tail) opt out of the idle-timeout cap;
-       streamed HTML pages deliberately rely on it (see STREAMED_HTML_HEADER). */
-    if (kind === 'streaming') {
-        exemptIdleTimeout()
-    }
-    return gzipResponse(req, response, kind)
-}

package/src/lib/server/runtime/findOpenPort.ts

@@ -1,21 +0,0 @@
-import { listenOnOpenPort } from './listenOnOpenPort.ts'
-
-/*
-Returns the first bindable TCP port at or above `start`, probing upward.
-Used when no PORT is configured so the server lands on a predictable
-3000+ port (3000, then 3001, …) instead of a random kernel-assigned one —
-running a second app just steps to the next free port. The scan policy
-(range, kernel-assigned fallback) lives in listenOnOpenPort; this variant
-binds a throwaway server and releases it, so like any release-then-rebind
-there's a tiny race before the real listener takes the port — negligible
-for a local boot.
-*/
-export function findOpenPort(start: number): number {
-    const probe = listenOnOpenPort(
-        (port) => Bun.serve({ port, fetch: () => new Response() }),
-        start,
-    )
-    const bound = probe.port as number
-    probe.stop(true)
-    return bound
-}

package/src/lib/server/runtime/flushingGzipStream.ts

@@ -1,62 +0,0 @@
-import { constants, createGzip } from 'node:zlib'
-
-/*
-A gzip TransformStream that emits a decodable block after every input chunk via
-Z_SYNC_FLUSH, instead of buffering until its deflate window fills like the web
-CompressionStream. Used for the streamed SSR document so the head reaches the
-browser compressed-but-decodable immediately — the preload scanner sees the
-entry/css links and the pending shell paints — rather than only at stream close.
-node:zlib is required here: the web CompressionStream exposes no per-chunk flush.
-*/
-export function flushingGzipStream(): TransformStream<Uint8Array, Uint8Array> {
-    const gzip = createGzip()
-    let sink: TransformStreamDefaultController<Uint8Array>
-    /* `closed` gates enqueue: once the consumer cancels (client disconnect), the node
-       gzip can still emit a trailing `data` that would throw on the closed controller. */
-    let closed = false
-    gzip.on('data', (chunk: Buffer) => {
-        if (closed) {
-            return
-        }
-        /* enqueue can still race a just-closed controller (cancel is async); treat the
-           throw as the consumer having gone and tear down. */
-        try {
-            sink.enqueue(new Uint8Array(chunk))
-        } catch {
-            closed = true
-            gzip.destroy()
-        }
-    })
-    /* The spec'd Transformer.cancel hook (consumer-cancellation) postdates this TS lib's
-       Transformer type; declare it locally so the literal type-checks while the platform
-       (Bun) still invokes it. Typing the const sidesteps the fresh-literal excess-property
-       check without weakening start/transform/flush. */
-    const transformer: Transformer<Uint8Array, Uint8Array> & {
-        cancel(reason?: unknown): void
-    } = {
-        start(controller) {
-            sink = controller
-            gzip.on('error', (error) => controller.error(error))
-        },
-        /* Resolve only once the chunk is compressed AND sync-flushed, so its bytes are
-           on the wire before the stream pulls the next (possibly delayed) chunk. */
-        transform(chunk) {
-            return new Promise((resolve) => {
-                gzip.write(chunk, () => gzip.flush(constants.Z_SYNC_FLUSH, () => resolve()))
-            })
-        },
-        /* End the deflate stream; its trailing bytes arrive as `data` before `end`. */
-        flush() {
-            return new Promise((resolve) => {
-                gzip.on('end', () => resolve())
-                gzip.end()
-            })
-        },
-        /* Consumer went away — stop enqueueing and tear down the node stream. */
-        cancel() {
-            closed = true
-            gzip.destroy()
-        },
-    }
-    return new TransformStream(transformer)
-}

package/src/lib/server/runtime/getActiveServer.ts

@@ -1,6 +0,0 @@
-import type { Server } from 'bun'
-import { serverSlot } from './serverSlot.ts'
-
-export function getActiveServer(): Server<unknown> | undefined {
-    return serverSlot.active
-}

package/src/lib/server/runtime/globToPathSet.ts

@@ -1,29 +0,0 @@
-import { Glob } from 'bun'
-
-/*
-Scans `cwd` for files matching `pattern` and returns their request paths as
-a Set, mapping each relative file path to a root-relative URL via `keyFor`.
-Used to snapshot the on-disk asset trees (the `public/` files, the `_app`
-precompressed `.gz` siblings) once at boot so the request path is a Set
-lookup instead of a filesystem stat.
-
-A missing directory makes scan throw ENOENT — swallowed to an empty Set so
-the caller just falls through. This scan-and-catch is also the reliable
-directory existence test: `Bun.file(dir).exists()` returns false for a
-directory, so guarding the scan with it silently yields an empty Set.
-*/
-export async function globToPathSet(
-    cwd: string,
-    pattern: string,
-    keyFor: (file: string) => string,
-    options?: { dot?: boolean },
-): Promise<Set<string>> {
-    try {
-        const files = await Array.fromAsync(
-            new Glob(pattern).scan({ cwd, dot: options?.dot ?? false }),
-        )
-        return new Set(files.map(keyFor))
-    } catch {
-        return new Set()
-    }
-}

package/src/lib/server/runtime/gzipResponse.ts

@@ -1,57 +0,0 @@
-import type { ResponseBodyKind } from '../../shared/responseBodyKind.ts'
-import { responseBodyKind } from '../../shared/responseBodyKind.ts'
-import { acceptsGzip } from './acceptsGzip.ts'
-import { flushingGzipStream } from './flushingGzipStream.ts'
-import { STREAMED_HTML_HEADER } from './STREAMED_HTML_HEADER.ts'
-
-/*
-Gzips a dynamic response (SSR HTML, rpc/json replies, the plain 404) when the
-client accepts it. Static assets never reach here — they already carry a
-precompressed Content-Encoding, which short-circuits the first guard. Skipped
-for: already-encoded bodies, bodiless responses (204/304/HEAD), non-compressible
-types (images, fonts, archives), and frame-delimited streams (SSE/jsonl, where
-gzip buffering would stall per-frame flush). No byte-size floor: Bun doesn't
-expose a string body's length before send, and measuring would mean buffering the
-body — the framing overhead on the rare tiny body is negligible against
-compressing every page and rpc payload.
-
-`kind` is the body class the dispatch pipeline already computed (S2: classify
-once, thread it in) — only `compressible` bodies gzip; `streaming` and `opaque`
-pass through. Standalone callers (the health probe) omit it and it's derived
-here. The streamed-HTML marker is handled independent of `kind` since it's
-stripped even on a skip path.
-
-Buffered bodies take the web CompressionStream (best ratio, one flush at close).
-The streamed SSR document self-marks (STREAMED_HTML_HEADER) and takes a
-per-chunk-flushing gzip instead: the plain CompressionStream buffers the head
-until its deflate window fills, which defeats streaming (the browser can't
-preload-scan the head or paint the pending shell until the stream nearly closes).
-The marker is stripped so it never reaches the client.
-*/
-export function gzipResponse(req: Request, response: Response, kind?: ResponseBodyKind): Response {
-    const streamedHtml = response.headers.has(STREAMED_HTML_HEADER)
-    if (streamedHtml) {
-        response.headers.delete(STREAMED_HTML_HEADER)
-    }
-    if (!response.body || response.headers.has('Content-Encoding')) {
-        return response
-    }
-    /* A streamed-HTML document classifies as `compressible` (text/html) but the
-       marker was already stripped above, so re-derive after the strip when the
-       pipeline didn't hand a kind in. */
-    const bodyKind = kind ?? responseBodyKind(response)
-    if (!acceptsGzip(req) || bodyKind !== 'compressible') {
-        return response
-    }
-    const headers = new Headers(response.headers)
-    headers.set('Content-Encoding', 'gzip')
-    headers.append('Vary', 'Accept-Encoding')
-    /* The stored length no longer matches the compressed body (and is unknown for a stream). */
-    headers.delete('Content-Length')
-    const compressor = streamedHtml ? flushingGzipStream() : new CompressionStream('gzip')
-    return new Response(response.body.pipeThrough(compressor), {
-        status: response.status,
-        statusText: response.statusText,
-        headers,
-    })
-}

package/src/lib/server/runtime/inFlightRequests.ts

@@ -1,13 +0,0 @@
-import type { RequestStore } from './types/RequestStore.ts'
-
-/*
-The set of request scopes currently executing their handler, for the inspector's
-in-flight view. `tracked` stays undefined until the inspector mounts and swaps in
-a live Set — so the request path adds nothing (no allocation, no membership
-churn) when the inspector is off. runWithRequestScope adds a store on scope entry
-and removes it when the handler settles; buildInFlightSnapshot reads it. Mirrors
-the on-demand, opt-in shape of the log/socket tap slots.
-*/
-export const inFlightRequests: { tracked: Set<RequestStore> | undefined } = {
-    tracked: undefined,
-}

package/src/lib/server/runtime/inProcessServer.ts

@@ -1,20 +0,0 @@
-import type { Server } from 'bun'
-
-/*
-The Server `server()` hands back under in-process dispatch (CLI / MCP / test
-client), where no Bun.serve has booted so there is no live connection to act on.
-Each member is the honest no-op for a request that never rode a socket: timeout
-and upgrade do nothing, publish reaches no subscribers (0 bytes sent),
-subscriberCount is 0, requestIP has no peer (null). Handlers using these idioms
-run unchanged in-process instead of throwing; createServer's live Server takes
-precedence whenever one is booted. Connection-scoped only — config-shaped
-members (port, url, hostname …) are intentionally absent: there is no server to
-describe, and a stubbed value would mislead more than their plain absence.
-*/
-export const inProcessServer = {
-    timeout() {},
-    upgrade: () => false,
-    publish: () => 0,
-    subscriberCount: () => 0,
-    requestIP: () => null,
-} as unknown as Server<unknown>

package/src/lib/server/runtime/installAmbientScopeStore.ts

@@ -1,54 +0,0 @@
-import { ambientPathBacking } from '../../ui/runtime/ambientPathBacking.ts'
-import { ambientScopeBacking } from '../../ui/runtime/ambientScopeBacking.ts'
-import { cellBarrierBacking } from '../../ui/runtime/cellBarrierBacking.ts'
-import type { Scope } from '../../ui/types/Scope.ts'
-import { pathStore } from './pathStore.ts'
-import { renderCellBarrierStore } from './renderCellBarrierStore.ts'
-import { requestContext } from './requestContext.ts'
-
-/* Ambient scope when no request is in flight (server boot, a standalone render). The path needs
-   no such fallback: `pathStore.run` establishes its value with or without a request in flight,
-   and `getStore()` fails open to `''` outside any push. */
-let outsideRequest: Scope | undefined
-
-/*
-Swaps the ambient-scope backing to one keyed off the per-request AsyncLocalStorage store and the
-ambient-PATH backing to the dedicated `pathStore.run` (ADR-0033 D1), so `CURRENT_SCOPE.current` and
-`CURRENT_PATH.current` isolate per request instead of living in one module global (see CURRENT_SCOPE
-/ CURRENT_PATH). SSR is partly async — a render `await`s inline between its `enterScope`/`exitScope`
-bracket — and the async context propagates the right value across those awaits, so a resumed render
-reads ITS OWN scope/path even while another request renders concurrently. For the path, `run`'s value
-is ALSO inherited by the render's own post-await continuation (a mutable slot restored in `finally`
-was not), which is the fix ADR-0033 buys. Called once at server boot (createServer), alongside the
-request-scope resolver install. The scope backing still falls back to a module variable outside any
-request (unchanged behaviour for standalone renders); the path backing needs no such fallback.
-*/
-export function installAmbientScopeStore(): void {
-    ambientScopeBacking.active = {
-        get: () => {
-            const store = requestContext.getStore()
-            return store ? store.currentScope : outsideRequest
-        },
-        set: (value) => {
-            const store = requestContext.getStore()
-            if (store) {
-                store.currentScope = value
-            } else {
-                outsideRequest = value
-            }
-        },
-    }
-    ambientPathBacking.active = {
-        run: (composedPath, build) => pathStore.run(composedPath, build),
-        get: () => pathStore.getStore() ?? '',
-    }
-    /* Per-render async-cell barrier isolation (ADR-0037 Phase 2): a hoisted concurrent child render
-       runs under its own pending-cells list via `renderCellBarrierStore.run`, and the barrier
-       consumers read it through `cellBarrierBacking.current`. ALS so the fresh list survives the
-       child render's own awaits; `undefined` outside any isolated render leaves the page/request
-       drain untouched. */
-    cellBarrierBacking.active = {
-        current: () => renderCellBarrierStore.getStore(),
-        run: (list, render) => renderCellBarrierStore.run(list, render),
-    }
-}

package/src/lib/server/runtime/internalErrorResponse.ts

@@ -1,28 +0,0 @@
-import { NO_STORE } from '../../shared/CACHE_CONTROL_VALUES.ts'
-import { escapeHtml } from '../../shared/escapeHtml.ts'
-
-/*
-The framework's default 500 response. Shared by the per-request scope's catch
-(runWithRequestScope) and Bun.serve's global error() fallback so the two can't
-drift. Only reached when the app supplies no `handleError` hook.
-
-Secure by default: a bare `Internal Server Error` so paths, library versions,
-and message contents never leak to clients in production. The full stack is
-shown only under `abide dev` (ABIDE_DEV=1, the orchestrator's signal); the
-cause is logged server-side regardless. The stack is HTML-escaped because a
-thrown Error built from request-influenced input can carry markup that would
-otherwise execute in the dev browser when embedded in the `<pre>`.
-*/
-export function internalErrorResponse(error: unknown): Response {
-    const body =
-        Bun.env.ABIDE_DEV === '1'
-            ? `<pre>${escapeHtml(String((error as Error)?.stack ?? error))}</pre>`
-            : 'Internal Server Error'
-    return new Response(body, {
-        status: 500,
-        headers: {
-            'Content-Type': 'text/html; charset=utf-8',
-            'Cache-Control': NO_STORE,
-        },
-    })
-}

package/src/lib/server/runtime/isCrossOriginRequest.ts

@@ -1,23 +0,0 @@
-/*
-True when the request carries a browser Origin that doesn't match the
-request's own host — the cross-site request forgery shape, in both its
-WebSocket form (CSWSH) and its HTTP form (a hostile page firing a form post
-or no-preflight fetch at an rpc/MCP URL inside a visitor's authenticated
-browser, ambient cookies attached). Native clients (CLI, MCP, curl) send no
-Origin, so an absent header is allowed; only a present-and-mismatched (or
-unparseable) Origin is rejected. An unparseable Origin is treated as
-cross-origin (fail closed). `requestUrl` lets a caller that already parsed
-the URL pass it in; otherwise the parse is deferred until an Origin is
-actually present, keeping the no-Origin hot path allocation-free.
-*/
-export function isCrossOriginRequest(request: Request, requestUrl?: URL): boolean {
-    const origin = request.headers.get('origin')
-    if (!origin) {
-        return false
-    }
-    try {
-        return new URL(origin).host !== (requestUrl ?? new URL(request.url)).host
-    } catch {
-        return true
-    }
-}

package/src/lib/server/runtime/listenOnOpenPort.ts

@@ -1,36 +0,0 @@
-import type { Server } from 'bun'
-
-// Ports tried upward from `start` before giving up and letting the kernel assign one.
-const SCAN_RANGE = 100
-
-/*
-Binds the real server, scanning upward from `start` for the first free port.
-The listener that wins a port is the one that keeps it: unlike probing a
-throwaway server and releasing it before the real bind, this leaves no window
-for the chosen port to be stolen in between — the gap that crashed boot on
-EADDRINUSE instead of stepping to the next port. `bindAt` does the actual
-Bun.serve; only an in-use port is retried, any other failure propagates. After
-SCAN_RANGE occupied ports it binds port 0 so the kernel assigns any free port.
-*/
-export function listenOnOpenPort(
-    bindAt: (port: number) => Server<unknown>,
-    start: number,
-): Server<unknown> {
-    for (let port = start; port < start + SCAN_RANGE; port++) {
-        try {
-            return bindAt(port)
-        } catch (error) {
-            if (!isAddressInUse(error)) {
-                throw error
-            }
-            // port in use — try the next one up
-        }
-    }
-    // every candidate was taken; bind to 0 so the kernel picks a free port
-    return bindAt(0)
-}
-
-// Bun reports a taken port as an Error carrying code 'EADDRINUSE'.
-function isAddressInUse(error: unknown): boolean {
-    return error instanceof Error && (error as { code?: string }).code === 'EADDRINUSE'
-}

package/src/lib/server/runtime/logExposedSurfaces.ts

@@ -1,156 +0,0 @@
-import { abideLog } from '../../shared/abideLog.ts'
-import type { Pages } from '../../ui/types/Pages.ts'
-import { rpcRegistry } from '../rpc/rpcRegistry.ts'
-import { socketRegistry } from '../sockets/socketRegistry.ts'
-import { ensureRegistriesLoaded } from './registryManifests.ts'
-
-// Cell glyphs: PRESENT, ABSENT.
-const PRESENT = '✓'
-const ABSENT = '·'
-const COLUMN_GAP = 2
-
-const hasColor = typeof Bun !== 'undefined' && Bun.enableANSIColors
-// Red foreground then `\x1b[39m` (default-foreground, not full reset) so the enclosing dim survives.
-const redden = (text: string): string =>
-    hasColor ? `${Bun.color('red', 'ansi-256')}${text}\x1b[39m` : text
-
-/*
-A declared inputSchema — OR a build-projected input-type schema (ADR-0030 input
-side), which advertises the same shape — is what makes mcp/cli safe to advertise
-(see defineRpc / defineSocket), so a declaration with neither gets a red `·` to
-flag that its machine surfaces are gated behind a missing contract.
-*/
-const schemaCell = (hasSchema: boolean): string => (hasSchema ? PRESENT : redden(ABSENT))
-const flag = (on: boolean): string => (on ? PRESENT : ABSENT)
-
-// Display width ignoring ANSI color escapes, so colored glyphs don't inflate alignment.
-// biome-ignore lint/suspicious/noControlCharactersInRegex: the ESC (\x1b) is the intended match — stripping the color escape to measure visible width
-const displayWidth = (cell: string): number => cell.replace(/\x1b\[[0-9;]*m/g, '').length
-
-// A titled table: its header row plus data rows, all sharing the column layout below.
-type SurfaceTable = { title: string; header: string[]; rows: string[][] }
-
-// Per-column width: the widest cell's display width across every row given.
-function columnWidths(rows: string[][]): number[] {
-    const columnCount = Math.max(...rows.map((row) => row.length))
-    return Array.from({ length: columnCount }, (_, column) =>
-        Math.max(...rows.map((row) => displayWidth(row[column] ?? ''))),
-    )
-}
-
-/*
-Left-aligns one row's cells into the given fixed column widths plus a gap.
-Padding is explicit spaces measured by displayWidth so embedded color escapes
-don't inflate the width and break alignment. Two-space indented.
-*/
-function renderRow(row: string[], widths: number[]): string {
-    return (
-        '  ' +
-        row
-            .map((cell, column) => {
-                /* widths covers every column (computed from the longest row); the fallback
-                   exists for noUncheckedIndexedAccess in consumer tsconfigs and pads only the gap. */
-                const width = widths[column] ?? displayWidth(cell)
-                return cell + ' '.repeat(width - displayWidth(cell) + COLUMN_GAP)
-            })
-            .join('')
-            .trimEnd()
-    )
-}
-
-/*
-Prints every non-empty table under one shared set of column widths, so the
-identifier and glyph columns line up vertically across the page/socket/rpc
-tables rather than each table aligning only within itself. Each table keeps its
-own dim header row.
-*/
-function logTables(tables: SurfaceTable[]): void {
-    const present = tables.filter((table) => table.rows.length > 0)
-    if (present.length === 0) {
-        return
-    }
-    const widths = columnWidths(present.flatMap((table) => [table.header, ...table.rows]))
-    present.forEach((table) => {
-        abideLog.info(`${table.title}:`)
-        abideLog.detail(
-            [table.header, ...table.rows].map((row) => renderRow(row, widths)).join('\n'),
-        )
-    })
-}
-
-/*
-Boot-time surface map: every page, socket, and rpc with the surfaces it is
-exposed on, so abide's routing and multimodal-by-default exposure are auditable
-rather than implicit. Three aligned tables — scan a column to spot a missing
-surface, a row to see one declaration's reach:
-
-  - pages: each route key.
-  - sockets: name + client surfaces (schema/browser/mcp/cli) and whether clients
-    may publish.
-  - rpcs: method+path (headed `http` since http/openapi are unconditional) +
-    per-declaration client surfaces.
-
-All three render under one shared column grid (see logTables): the identifier
-leads flush-left in every table — page route, socket name, or rpc method+path —
-then the surface columns, so the glyphs line up vertically across the tables.
-rpc folds its method into a left-aligned prefix of the identifier cell, so paths
-still start at a shared column. For sockets and rpcs the `schema`
-column leads: it's what unlocks the non-browser surfaces, so a missing schema
-reddens to flag the gated declaration. Loads the full registry. Runs once at boot; suppressed only via DEBUG=-abide
-(the always-on logging opt-out). Best-effort: enumeration failures are swallowed,
-this is diagnostic only.
-*/
-export async function logExposedSurfaces(routing: { pages: Pages }): Promise<void> {
-    try {
-        await ensureRegistriesLoaded()
-    } catch {
-        return
-    }
-
-    const pageRows = Object.keys(routing.pages)
-        .map((route) => [route])
-        .sort()
-
-    const socketRows = Array.from(socketRegistry.values(), (entry) => [
-        entry.socket.name,
-        schemaCell(Boolean(entry.schema)),
-        flag(entry.clients.browser),
-        flag(entry.clients.mcp),
-        flag(entry.clients.cli),
-        flag(entry.allowClientPublish),
-    ]).sort()
-
-    /*
-    rpc identifier = method left-aligned to a shared width then the path, so the
-    methods line up and every path starts at the same column — while the cell as
-    a whole still leads flush-left like the page route and socket name.
-    */
-    const methodWidth = Math.max(
-        'http'.length,
-        ...Array.from(rpcRegistry.values(), (entry) => entry.remote.method.length),
-    )
-    const withMethod = (method: string, identifier: string): string =>
-        method.padEnd(methodWidth + COLUMN_GAP) + identifier
-
-    const rpcRows = Array.from(rpcRegistry.values(), (entry) => [
-        withMethod(entry.remote.method, entry.remote.url),
-        schemaCell(entry.inputSchema !== undefined || entry.inputJsonSchema !== undefined),
-        flag(entry.remote.clients.browser),
-        flag(entry.remote.clients.mcp),
-        flag(entry.remote.clients.cli),
-    ]).sort()
-
-    logTables([
-        { title: 'pages', header: ['page'], rows: pageRows },
-        {
-            title: 'sockets',
-            header: ['socket', 'schema', 'browser', 'mcp', 'cli', 'publish'],
-            rows: socketRows,
-        },
-        {
-            title: 'rpcs',
-            header: [withMethod('http', ''), 'schema', 'browser', 'mcp', 'cli'],
-            rows: rpcRows,
-        },
-    ])
-}