@k2b/cloud 0.41.0 → 0.42.0

package/src/contracts/geo.ts

@@ -0,0 +1,248 @@
+import { z } from "zod";
+
+export const GeoPointSchema = z
+  .object({
+    lat: z.number().min(-90).max(90).describe("Latitude in degrees, -90 to 90."),
+    lon: z.number().min(-180).max(180).describe("Longitude in degrees, -180 to 180."),
+  })
+  .strict();
+export const GeoProvenanceSchema = z
+  .object({
+    provider: z.literal("geoapify").describe("Source provider."),
+    attribution: z
+      .object({
+        text: z.literal("Geoapify · OpenStreetMap").describe("Attribution to display with this result."),
+        links: z.array(z.url()).length(2).describe("Provider and data-source attribution links."),
+      })
+      .strict()
+      .describe("Required attribution; preserve when storing or reusing the result."),
+    computedAt: z.iso.datetime().describe("ISO timestamp when the provider result was computed."),
+  })
+  .strict();
+const text = z.string().max(300);
+export const GeoAddressSchema = z
+  .object({
+    line1: text.describe("Street and house number."),
+    postalCode: text.describe("Postal code."),
+    city: text.describe("City or locality."),
+    stateRegion: text.describe("State or region."),
+    countryCode: z.string().max(2).describe("ISO alpha-2 country code, or empty when unavailable."),
+    point: GeoPointSchema.describe("Resolved geographic point."),
+    formatted: z.string().max(600).describe("Formatted provider address."),
+    confidence: z.number().min(0).max(1).nullable().describe("Provider match confidence, or null when unavailable."),
+    provenance: GeoProvenanceSchema.describe("Provider source and required attribution."),
+  })
+  .strict();
+
+/** Verified Places categories; names belong to Cloud, provider keys to the adapter. */
+export const GEO_CATEGORIES = {
+  museum: "entertainment.museum",
+  cafe: "catering.cafe",
+  restaurant: "catering.restaurant",
+  bar: "catering.bar",
+  pub: "catering.pub",
+  bakery: "commercial.food_and_drink.bakery",
+  supermarket: "commercial.supermarket",
+  pharmacy: "healthcare.pharmacy",
+  hotel: "accommodation.hotel",
+  accommodation: "accommodation",
+  fuel: "service.vehicle.fuel",
+  parking: "parking",
+  charging: "service.vehicle.charging_station",
+  toilets: "amenity.toilet",
+  park: "leisure.park",
+  viewpoint: "tourism.attraction.viewpoint",
+  attraction: "tourism.attraction",
+} as const;
+export const GeoCategorySchema = z.enum([
+  "museum",
+  "cafe",
+  "restaurant",
+  "bar",
+  "pub",
+  "bakery",
+  "supermarket",
+  "pharmacy",
+  "hotel",
+  "accommodation",
+  "fuel",
+  "parking",
+  "charging",
+  "toilets",
+  "park",
+  "viewpoint",
+  "attraction",
+]);
+export const GeoAreaSchema = z.discriminatedUnion("type", [
+  z
+    .object({
+      type: z.literal("bbox").describe("Bounding box."),
+      west: z.number().describe("Western longitude."),
+      south: z.number().describe("Southern latitude."),
+      east: z.number().describe("Eastern longitude."),
+      north: z.number().describe("Northern latitude."),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("circle").describe("Circular search area."),
+      point: GeoPointSchema.describe("Center of the circle."),
+      radiusMeters: z.number().describe("Positive radius in meters."),
+    })
+    .strict(),
+]);
+// Bounds are enforced by the service, after authentication/configuration, so all consumers receive GEO_LIMIT_EXCEEDED.
+export const GeoAutocompleteInputSchema = z
+  .object({
+    text: z.string().describe("Partial address, 3–300 characters."),
+    limit: z.number().optional().describe("At most 5 suggestions; default 5."),
+    countryCode: z.string().optional().describe("Optional ISO alpha-2 country filter."),
+    type: z
+      .enum(["country", "state", "city", "postcode", "street", "amenity", "locality"])
+      .optional()
+      .describe("Optional address result type."),
+    bias: GeoPointSchema.optional().describe("Optional ranking point."),
+    area: GeoAreaSchema.optional().describe("Optional geographic filter."),
+  })
+  .strict();
+export const GeoGeocodeInputSchema = z
+  .object({
+    text: z.string().optional().describe("Address text, at most 300 characters; use text or fields."),
+    fields: z
+      .object({
+        line1: z.string().optional().describe("Street and house number, at most 200 characters."),
+        postalCode: z.string().optional().describe("Postal code, at most 200 characters."),
+        city: z.string().optional().describe("City, at most 200 characters."),
+        stateRegion: z.string().optional().describe("State or region, at most 200 characters."),
+        country: z.string().optional().describe("Country name, at most 200 characters."),
+      })
+      .strict()
+      .optional()
+      .describe("Structured address, at most 200 characters per field."),
+    countryCode: z.string().optional().describe("Optional ISO alpha-2 country filter."),
+  })
+  .strict();
+export const GeoReverseInputSchema = z.object({ point: GeoPointSchema.describe("Coordinates to reverse geocode.") }).strict();
+// 102,400 ASCII bytes matches Geoapify's documented geometry budget, bounding decode memory/work before simplification.
+export const GEO_MAX_POLYLINE_CHARS = 102_400;
+export const GeoPlaceSearchInputSchema = z
+  .object({
+    categories: z.array(GeoCategorySchema).describe("1–5 Cloud categories."),
+    near: GeoPointSchema.optional().describe("Rank by distance to this point; choose near, area, or along."),
+    area: GeoAreaSchema.optional().describe("Optional geographic filter."),
+    along: z
+      .object({
+        polyline6: z.string().describe("Full route as polyline6; at most 102,400 ASCII characters."),
+        fromKm: z.number().describe("Start position on the full route in km."),
+        toKm: z.number().describe("End position; window at most 200 km."),
+        bufferMeters: z.number().optional().describe("100–5,000 m; default 1,000."),
+      })
+      .strict()
+      .optional()
+      .describe("Route corridor with a window of at most 200 km."),
+    limit: z.number().optional().describe("1–20 results; default 20."),
+  })
+  .strict();
+export const GeoPlaceSchema = z
+  .object({
+    id: z.string().min(1).max(2048),
+    name: text,
+    categories: z.array(z.string().max(100)).max(20),
+    point: GeoPointSchema,
+    address: GeoAddressSchema,
+    distanceMeters: z.number().nonnegative().optional(),
+    atMeters: z.number().nonnegative().optional(),
+    distanceToRouteMeters: z.number().nonnegative().optional(),
+    openingHours: z.string().max(1000).optional(),
+    website: z.string().max(1000).optional(),
+    phone: text.optional(),
+    provenance: GeoProvenanceSchema,
+  })
+  .strict();
+export const GeoAutocompleteDataSchema = z
+  .object({ suggestions: z.array(GeoAddressSchema).max(5), provenance: GeoProvenanceSchema })
+  .strict();
+export const GeoGeocodeDataSchema = z.object({ address: GeoAddressSchema, provenance: GeoProvenanceSchema }).strict();
+export const GeoReverseDataSchema = GeoGeocodeDataSchema;
+export const GeoPlaceSearchDataSchema = z
+  .object({
+    places: z.array(GeoPlaceSchema).max(20),
+    provenance: GeoProvenanceSchema,
+    simplificationToleranceMeters: z.number().nonnegative().optional(),
+    truncated: z
+      .boolean()
+      .optional()
+      .describe("Candidate limit reached before filling the requested corridor results; narrow the distance window."),
+  })
+  .strict();
+export const GeoAvailabilityInputSchema = z.object({}).strict();
+const balance = z.object({ exhausted: z.boolean(), resetsAt: z.iso.datetime() }).strict();
+export const GeoAvailabilityDataSchema = z.object({ configured: z.boolean(), person: balance, cloud: balance }).strict();
+export const GeoCostsSchema = z.object({ settledCredits: z.number().nonnegative(), unknownCredits: z.number().nonnegative() }).strict();
+export const GeoErrorDetailsSchema = z.discriminatedUnion("code", [
+  z.object({ code: z.literal("GEO_NOT_CONFIGURED") }).strict(),
+  z.object({ code: z.literal("GEO_FORBIDDEN") }).strict(),
+  z.object({ code: z.literal("GEO_UNSUPPORTED_OPTION") }).strict(),
+  z.object({ code: z.literal("GEO_ADDRESS_NOT_FOUND"), stopId: z.string().optional(), costs: GeoCostsSchema.optional() }).strict(),
+  z.object({ code: z.literal("GEO_NO_ROUTE"), costs: GeoCostsSchema.optional() }).strict(),
+  z
+    .object({
+      code: z.literal("GEO_COST_OVERRUN"),
+      distanceAllowanceMeters: z.number().positive(),
+      actualDistanceMeters: z.number().nonnegative(),
+      costs: GeoCostsSchema,
+    })
+    .strict(),
+  z.object({ code: z.literal("GEO_BUDGET_EXHAUSTED"), scope: z.enum(["person", "cloud"]), resetsAt: z.iso.datetime() }).strict(),
+  z.object({ code: z.literal("GEO_BUSY"), retryAfterSeconds: z.number().positive(), costs: GeoCostsSchema.optional() }).strict(),
+  z
+    .object({
+      code: z.literal("GEO_LIMIT_EXCEEDED"),
+      limit: z.string(),
+      max: z.number(),
+      actual: z.number(),
+      costs: GeoCostsSchema.optional(),
+    })
+    .strict(),
+  z
+    .object({
+      code: z.literal("GEO_ADDRESS_AMBIGUOUS"),
+      stopId: z.string().optional(),
+      costs: GeoCostsSchema.optional(),
+      candidates: z.array(GeoAddressSchema).max(5),
+    })
+    .strict(),
+  z
+    .object({
+      code: z.literal("GEO_PROVIDER_FAILED"),
+      costs: GeoCostsSchema,
+      adminHint: z.string().optional(),
+      accounting: z
+        .object({
+          reservationCredits: z.number().nonnegative(),
+          knownReferenceCredits: z.number().nonnegative(),
+          unknownReferenceCredits: z.number().nonnegative(),
+        })
+        .strict()
+        .optional()
+        .describe("Present when ledger settlement failed: retained reservation and reference costs requiring operator reconciliation."),
+    })
+    .strict(),
+]);
+export type GeoPoint = z.infer<typeof GeoPointSchema>;
+export type GeoProvenance = z.infer<typeof GeoProvenanceSchema>;
+export type GeoAddress = z.infer<typeof GeoAddressSchema>;
+export type GeoPlace = z.infer<typeof GeoPlaceSchema>;
+export type GeoAutocompleteInput = z.infer<typeof GeoAutocompleteInputSchema>;
+export type GeoGeocodeInput = z.infer<typeof GeoGeocodeInputSchema>;
+export type GeoReverseInput = z.infer<typeof GeoReverseInputSchema>;
+export type GeoPlaceSearchInput = z.infer<typeof GeoPlaceSearchInputSchema>;
+export type GeoErrorCode = z.infer<typeof GeoErrorDetailsSchema>["code"];
+export type GeoFunction = "autocomplete" | "geocode" | "reverse" | "places" | "route";
+export const geoContract = {
+  autocomplete: { id: "address.autocomplete", input: GeoAutocompleteInputSchema, data: GeoAutocompleteDataSchema },
+  geocode: { id: "address.geocode", input: GeoGeocodeInputSchema, data: GeoGeocodeDataSchema },
+  reverse: { id: "address.reverse", input: GeoReverseInputSchema, data: GeoReverseDataSchema },
+  searchPlaces: { id: "place.search", input: GeoPlaceSearchInputSchema, data: GeoPlaceSearchDataSchema },
+  availability: { id: "geo.availability", input: GeoAvailabilityInputSchema, data: GeoAvailabilityDataSchema },
+} as const;

package/src/contracts/index.ts

@@ -7,6 +7,10 @@ export * from "./capability-compatibility";
 export * from "./commands";
 export * from "./contact-directory";
 export * from "./file-provider";
+export * from "./geo";
+export * from "./geo-admin";
+export * from "./geo-map";
+export * from "./geo-route";
 export * from "./geoip";
 export * from "./notification-types";
 export * from "./outgoing-mail";

package/src/contracts/outgoing-mail.ts

@@ -5,7 +5,9 @@ import { type RequestActor, ServiceAccountSchema, UserSchema } from "./shared";
 export const PlatformPermissionSchema = z.enum(["mail:send", "mail:read"]);
 export type PlatformPermission = z.infer<typeof PlatformPermissionSchema>;
 export const MailRetentionSchema = z.object({ contentDays: z.int().min(1).max(36500), recordDays: z.int().min(1).max(36500) }).strict();
-export type MailRetention = z.infer<typeof MailRetentionSchema>;
+export type MailRetention = z.infer<typeof MailRetentionSchema> & {
+  unreadable?: Partial<Record<"outgoing_mail.content_retention_days" | "outgoing_mail.record_retention_days", boolean>>;
+};
 
 export const MailProfileKeySchema = z.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/);
 const headerText = z
@@ -129,6 +131,8 @@ export const AdminMailAppSchema = z.object({
   readDeclared: z.boolean(),
   /** Other apps whose send log this app may read, besides its own. */
   logApps: z.array(z.string()),
+  /** Subset of logApps with explicit content access. Missing on older servers. */
+  logContentApps: z.array(z.string()).optional(),
 });
 export type AdminMailApp = z.infer<typeof AdminMailAppSchema>;
 /** Application IDs as registered, like sender access; Core's own mail is never readable by apps. */
@@ -136,11 +140,15 @@ export const MailLogAppIdSchema = z.string().min(1);
 /** How many other apps' send logs an administrator can let one app read. */
 const MAIL_LOG_GRANT_LIMIT = 100;
 export const MailLogAccessSchema = z
-  .object({ apps: z.array(MailLogAppIdSchema).max(MAIL_LOG_GRANT_LIMIT) })
+  .object({
+    apps: z.array(MailLogAppIdSchema).max(MAIL_LOG_GRANT_LIMIT),
+    contentApps: z.array(MailLogAppIdSchema).max(MAIL_LOG_GRANT_LIMIT).optional(),
+  })
   .strict()
+  .refine((value) => new Set(value.apps).size === value.apps.length && !value.apps.includes("core"), "Choose distinct apps other than core")
   .refine(
-    (value) => new Set(value.apps).size === value.apps.length && !value.apps.includes("core"),
-    "Choose distinct apps other than core",
+    ({ apps, contentApps = [] }) => new Set(contentApps).size === contentApps.length && contentApps.every((id) => apps.includes(id)),
+    "Content apps must be a distinct subset of apps",
   );
 export type MailLogAccess = z.infer<typeof MailLogAccessSchema>;
 
@@ -315,3 +323,8 @@ export type MailServiceError = ServiceError<MailErrorCode> & {
   used?: number;
   requested?: number;
 };
+
+/** One audited read; no HTML, headers, or attachment bytes. */
+export type MailContent = { purged: true; contentPurgedAt: string } | { purged: false; text: string | null; attachmentNames: string[] };
+/** Pass a currently authenticated server context, never browser JSON or a stored actor snapshot. */
+export type MailContentContext = { actor: RequestActor; requestId?: string };

package/src/contracts/registry.ts

@@ -1,4 +1,5 @@
 import type { AppAdminNavigationGroup, AppAppearance, AppAppearanceColor, AppPanel, AppPresentationCatalog, AppSearchLink } from "./app";
+import type { AppAccessRule } from "./app-access";
 import type { CapabilityManifest, CapabilityPresentationCatalog } from "./capabilities";
 import type { PlatformPermission } from "./outgoing-mail";
 import type { Role } from "./shared";
@@ -77,6 +78,7 @@ export type AppRuntimeMetadata = {
 };
 
 export type AppRegistryEntry = {
+  access?: AppAccessRule;
   platformPermissions?: readonly PlatformPermission[];
   id: string;
   name: string;

package/src/events/app-access.ts

@@ -0,0 +1,68 @@
+import type { SQL } from "bun";
+import { z } from "zod";
+import { logger } from "../services/logging";
+import { superviseRuntimeTask } from "../services/runtime-lifecycle";
+import { defineLivePublisher, liveTopic } from "./live-delivery";
+
+const change = z.object({ type: z.literal("app.access.changed"), appId: z.string() });
+// Core already owns and publishes this topic and outbox; no second delivery mechanism.
+const changes = defineLivePublisher({ appId: "core", event: change });
+
+/** Call in the grant/state mutation transaction; rolled-back changes publish nothing. */
+export const publishAppAccessChanged = (tx: SQL, appId: string): Promise<void> =>
+  changes.publish(tx, { key: `app.access:${appId}`, data: { type: "app.access.changed", appId }, access: true });
+export const wakeAppAccessChanged = (): void => changes.wake();
+
+const listeners = new Map<string, Set<() => void>>();
+let active: AbortController | undefined;
+
+/** One follower per process, released as soon as the last live connection ends. */
+export const subscribeAppAccessChanged = (appId: string, changed: () => void): (() => void) => {
+  let callbacks = listeners.get(appId);
+  if (!callbacks) {
+    callbacks = new Set();
+    listeners.set(appId, callbacks);
+  }
+  callbacks.add(changed);
+  if (!active) {
+    const controller = new AbortController();
+    active = controller;
+    const notifyAll = () => {
+      for (const callbacks of listeners.values()) for (const callback of callbacks) callback();
+    };
+    void superviseRuntimeTask({
+      name: "App access invalidations",
+      signal: controller.signal,
+      run: async (signal) => {
+        const source = liveTopic("core");
+        const after = await source.head();
+        if (signal.aborted) return;
+        // Recheck after capturing the cursor to cover changes during subscription startup/reconnect.
+        notifyAll();
+        for await (const event of source.follow({ after, signal })) {
+          const parsed = change.safeParse(event.data.d);
+          if (parsed.success) for (const callback of listeners.get(parsed.data.appId) ?? []) callback();
+        }
+      },
+      onError: ({ error }) => {
+        notifyAll();
+        logger("app-access").warn("App access invalidations failed; reconnecting", {
+          error: error instanceof Error ? error.message : String(error),
+        });
+      },
+    }).finally(() => {
+      if (active === controller) active = undefined;
+    });
+  }
+  let subscribed = true;
+  return () => {
+    if (!subscribed) return;
+    subscribed = false;
+    callbacks.delete(changed);
+    if (callbacks.size === 0) listeners.delete(appId);
+    if (listeners.size === 0) {
+      active?.abort();
+      active = undefined;
+    }
+  };
+};

package/src/events/live-delivery.ts

@@ -0,0 +1,128 @@
+import type { Topic, TopicConfig } from "@k2b/sync";
+import { type SQL, sql } from "bun";
+import type { z } from "zod";
+import { lazySync } from "../_internal/process-sync";
+import { logger } from "../services/logging";
+import { createPgOutbox } from "../services/outbox";
+import type { LiveEnvelope } from "./live-engine";
+
+const RECONCILE_INTERVAL_MS = 1_000;
+const STALE_CHECK_INTERVAL_MS = 60_000;
+
+/**
+ * The live topic of one application. Frozen: Sync rejects a declaration that
+ * differs from the existing stream, so two releases with different values
+ * would break each other during a rollout. A change ships under a new id.
+ */
+export const liveTopicConfig = (appId: string) =>
+  ({
+    id: `cloud:live:${appId}`,
+    owner: "cloud",
+    retention: { maxAgeMs: 24 * 3_600_000, maxBytes: 64 * 1024 ** 2 },
+    maxPayloadBytes: 40 * 1024,
+    deadLetterRetention: { maxBytes: 1024 ** 2 },
+  }) satisfies TopicConfig;
+
+type LiveOutboxRow = { id: string; attempts: number; ordering_key: string; payload: LiveEnvelope };
+
+const log = logger("events:live");
+
+const liveTopics = lazySync((sync) => {
+  const topics = new Map<string, Topic<LiveEnvelope>>();
+  return (appId: string): Topic<LiveEnvelope> => {
+    const existing = topics.get(appId);
+    if (existing) return existing;
+    const topic = sync.topic<LiveEnvelope>(liveTopicConfig(appId));
+    topics.set(appId, topic);
+    return topic;
+  };
+});
+
+/** Dispatcher of one application's live rows: ordered per key, deleted once published. */
+export const liveOutbox = (appId: string, publish: (row: LiveOutboxRow) => Promise<unknown>) =>
+  createPgOutbox<LiveOutboxRow>({
+    table: "events.outbox",
+    name: `events:live:${appId}`,
+    where: { kind: "live", app_id: appId },
+    orderBy: "ordering_key",
+    sequence: "seq",
+    reconcileIntervalMs: RECONCILE_INTERVAL_MS,
+    publish,
+  });
+
+/** Applications whose live updates this process defines, with the wake of their running dispatcher. */
+const dispatchers = new Map<string, (() => void) | null>();
+
+export const liveTopic = (appId: string): Topic<LiveEnvelope> => liveTopics()(appId);
+
+const logStaleRows = async (appId: string): Promise<void> => {
+  const [row] = await sql<{ count: number; oldest_seconds: number | null }[]>`
+    SELECT COUNT(*)::int AS count, EXTRACT(EPOCH FROM now() - MIN(created_at))::int AS oldest_seconds
+    FROM events.outbox
+    WHERE kind = 'live' AND app_id = ${appId} AND created_at < now() - interval '60 seconds'
+  `;
+  if (row && row.count > 0) log.warn("Live updates wait to be published", { appId, count: row.count, oldestSeconds: row.oldest_seconds });
+};
+
+/** Starts delivery for an application with registered publishers; shared with live sockets and access invalidations. */
+export const startLiveDelivery = async (appId: string): Promise<(() => Promise<void>) | null> => {
+  if (!dispatchers.has(appId)) return null;
+  const [installed] = await sql<{ ready: boolean }[]>`
+    SELECT to_regprocedure('events.enqueue(uuid,text,text,text,jsonb,text)') IS NOT NULL AS ready
+  `;
+  if (!installed?.ready) {
+    throw new Error(
+      `"${appId}" writes live updates to events.outbox, which does not exist. Update Cloud Core first: its migration creates the outbox.`,
+    );
+  }
+  const topic = liveTopics()(appId);
+  const outbox = liveOutbox(appId, (row) => topic.publish({ data: row.payload, orderingKey: row.ordering_key, idempotencyKey: row.id }));
+  outbox.start();
+  dispatchers.set(appId, () => void outbox.notify());
+  const staleCheck = setInterval(() => {
+    logStaleRows(appId).catch((error) =>
+      log.warn("Live outbox check failed", { appId, error: error instanceof Error ? error.message : String(error) }),
+    );
+  }, STALE_CHECK_INTERVAL_MS);
+  staleCheck.unref();
+  return async () => {
+    clearInterval(staleCheck);
+    dispatchers.set(appId, null);
+    await outbox.stop();
+  };
+};
+
+/** Transactional publisher using the application's existing live topic and outbox. */
+export const defineLivePublisher = <const Event extends z.ZodType>(definition: { appId: string; event: Event }) => {
+  const { appId, event } = definition;
+  if (!dispatchers.has(appId)) dispatchers.set(appId, null);
+  return {
+    /**
+     * Writes one update in `tx`, the transaction that makes the change: a
+     * rollback writes nothing, a commit publishes it at least once. Data above
+     * 32 KiB becomes a reload hint for `key`; `data` must not hold anything a
+     * reader of `key` may not see. `access: true` announces that who may read
+     * `key` changed, in a row of its own before the data: every replica checks
+     * its subscribers of `key` again before it delivers the data, and its
+     * collections right after.
+     */
+    publish: async (
+      tx: SQL,
+      input: { key: string; data: z.input<Event>; access?: true } | { key: string; data?: undefined; access: true },
+    ): Promise<void> => {
+      // Store the JSON form of the input, and validate exactly that form here:
+      // the browser parses it, and data that does not survive JSON fails this write.
+      const data: unknown = input.data === undefined ? undefined : JSON.parse(JSON.stringify(input.data));
+      if (data !== undefined) event.parse(data);
+      const enqueue = (envelope: LiveEnvelope) =>
+        tx`SELECT events.enqueue(${crypto.randomUUID()}::uuid, ${appId}, 'live', ${input.key}, ${JSON.stringify(envelope)}::text::jsonb)`;
+      // The access change is a row of its own, so data too large for the outbox cannot drop it.
+      if (input.access) await enqueue({ v: 1, k: input.key, a: true });
+      if (data !== undefined) await enqueue({ v: 1, k: input.key, d: data });
+    },
+    /** Publishes committed updates now instead of within the next second. Call it after the commit. */
+    wake: (): void => dispatchers.get(appId)?.(),
+    /** The topic head. Read it before loading the snapshot it belongs to. */
+    cursor: (): Promise<string> => liveTopics()(appId).head(),
+  };
+};