@openora/core 0.4.0

package/dist/server/plugin-host/load-plugins.d.ts

@@ -0,0 +1,21 @@
+import type { Container } from '../kernel/index.js';
+import type { Plugin } from './define-plugin.js';
+import { ModuleRegistryImpl } from './module-registry.js';
+export type PluginEntry = {
+    id: string;
+    path: string;
+    kind?: 'module' | 'infra' | 'addon';
+};
+export declare function loadPlugins(entries: PluginEntry[], container: Container): Promise<ModuleRegistryImpl>;
+/**
+ * Boot-time fail-fast for cross-domain ports (ADR-0024). A domain depends ONLY on
+ * the foundation and reaches another domain through a port token the other domain
+ * binds - never an import. So when a domain package is left out of the install, its
+ * port is simply unbound; without this check the app would boot and only blow up on
+ * the first request that resolves the token, with a generic "No provider" message.
+ * Here we verify every declared `requiresPorts` token is bound right after
+ * registration and throw one actionable error naming the plugin, the port, and the
+ * likely-missing package.
+ */
+export declare function assertRequiredPorts(plugins: Plugin[], container: Container): void;
+//# sourceMappingURL=load-plugins.d.ts.map

package/dist/server/plugin-host/load-plugins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-plugins.d.ts","sourceRoot":"","sources":["../../../src/server/plugin-host/load-plugins.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IASb,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;CACrC,CAAC;AA2DF,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EAAE,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,CAgBjF"}

package/dist/server/plugin-host/load-plugins.js

@@ -0,0 +1,91 @@
+import { ModuleRegistryImpl } from './module-registry.js';
+function validateEntries(entries) {
+    if (!Array.isArray(entries)) {
+        throw new Error(`extensions.config.ts must export \`extensions\` as an array of { id, path }. Got ${typeof entries}.`);
+    }
+    const seen = new Set();
+    entries.forEach((entry, i) => {
+        const at = `extensions[${i}]`;
+        if (typeof entry !== 'object' || entry === null) {
+            throw new Error(`${at} must be an object { id, path }. Got ${JSON.stringify(entry)}.`);
+        }
+        const { id, path } = entry;
+        if (typeof id !== 'string' || id.length === 0) {
+            throw new Error(`${at} is missing a non-empty string \`id\`. Got ${JSON.stringify(entry)}.`);
+        }
+        if (typeof path !== 'string' || path.length === 0) {
+            throw new Error(`${at} (id "${id}") is missing a non-empty string \`path\`.`);
+        }
+        if (seen.has(id)) {
+            throw new Error(`Duplicate plugin id "${id}" in extensions.config.ts - each id must be unique.`);
+        }
+        seen.add(id);
+    });
+}
+function topoSort(plugins) {
+    const byId = new Map(plugins.map((p) => [p.id, p]));
+    const visited = new Set();
+    const sorted = [];
+    function visit(plugin, stack) {
+        if (visited.has(plugin.id))
+            return;
+        if (stack.has(plugin.id)) {
+            throw new Error(`Circular plugin dependency: ${[...stack, plugin.id].join(' -> ')}`);
+        }
+        stack.add(plugin.id);
+        for (const dep of plugin.dependsOn ?? []) {
+            const depPlugin = byId.get(dep);
+            if (!depPlugin)
+                throw new Error(`Plugin "${plugin.id}" depends on "${dep}" which is not registered`);
+            visit(depPlugin, stack);
+        }
+        stack.delete(plugin.id);
+        visited.add(plugin.id);
+        sorted.push(plugin);
+    }
+    for (const plugin of plugins) {
+        visit(plugin, new Set());
+    }
+    return sorted;
+}
+export async function loadPlugins(entries, container) {
+    validateEntries(entries);
+    const plugins = [];
+    for (const entry of entries) {
+        const mod = (await import(entry.path));
+        const plugin = mod.default;
+        if (!plugin || typeof plugin.register !== 'function') {
+            throw new Error(`Plugin at "${entry.path}" does not export a valid definePlugin result`);
+        }
+        plugins.push(plugin);
+    }
+    const ordered = topoSort(plugins);
+    const registry = new ModuleRegistryImpl(container);
+    for (const plugin of ordered) {
+        await plugin.register(registry);
+    }
+    assertRequiredPorts(ordered, container);
+    return registry;
+}
+/**
+ * Boot-time fail-fast for cross-domain ports (ADR-0024). A domain depends ONLY on
+ * the foundation and reaches another domain through a port token the other domain
+ * binds - never an import. So when a domain package is left out of the install, its
+ * port is simply unbound; without this check the app would boot and only blow up on
+ * the first request that resolves the token, with a generic "No provider" message.
+ * Here we verify every declared `requiresPorts` token is bound right after
+ * registration and throw one actionable error naming the plugin, the port, and the
+ * likely-missing package.
+ */
+export function assertRequiredPorts(plugins, container) {
+    const unbound = plugins.flatMap((plugin) => (plugin.requiresPorts ?? [])
+        .filter((token) => !container.has(token))
+        .map((token) => `  - plugin "${plugin.id}" requires port ${String(token.description ?? token)}`));
+    if (unbound.length > 0) {
+        throw new Error(`[plugin-host] Required ports are unbound at boot:\n${unbound.join('\n')}\n` +
+            `A domain reaches another domain only through a port the other domain binds. ` +
+            `Install the package that provides each port (eg @openora/wallet binds WALLET_COMMANDS) ` +
+            `or remove the plugin that requires it. See ADR-0024.`);
+    }
+}
+//# sourceMappingURL=load-plugins.js.map

package/dist/server/plugin-host/load-plugins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-plugins.js","sourceRoot":"","sources":["../../../src/server/plugin-host/load-plugins.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAgB1D,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,oFAAoF,OAAO,OAAO,GAAG,CACtG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,wCAAwC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,KAAgC,CAAC;QACtD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8CAA8C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,4CAA4C,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,qDAAqD,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,OAAiB;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,SAAS,KAAK,CAAC,MAAc,EAAE,KAAkB;QAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO;QACnC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,SAAS;gBACZ,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,iBAAiB,GAAG,2BAA2B,CAAC,CAAC;YACvF,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAsB,EACtB,SAAoB;IAEpB,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAyB,CAAC;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,+CAA+C,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAED,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAExC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAiB,EAAE,SAAoB;IACzE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;SACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SACxC,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,MAAM,CAAC,EAAE,mBAAmB,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,EAAE,CAC3F,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sDAAsD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1E,8EAA8E;YAC9E,yFAAyF;YACzF,sDAAsD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/server/plugin-host/module-registry.d.ts

@@ -0,0 +1,36 @@
+import type { Container, Factory } from '../kernel/index.js';
+import type { SealedToken, Token, WorkerRegistration } from '@openora/core/contracts';
+import type { ModuleRegistry, McpToolDefinition, RouterFactory, EventHandler } from './define-plugin.js';
+export declare class ModuleRegistryImpl implements ModuleRegistry {
+    private readonly container;
+    private _routers;
+    private _slots;
+    private _events;
+    private _jobs;
+    private _mcpTools;
+    private _sealedBound;
+    constructor(container: Container);
+    provide: <T>(token: Token<T>, factory: Factory<T>) => void;
+    provideSealed: <T>(token: SealedToken<T>, factory: Factory<T>) => void;
+    routers: {
+        add: (namespace: string, factory: RouterFactory) => void;
+        getAll: () => Map<string, RouterFactory>;
+    };
+    slots: {
+        fill: (slotName: string, component: unknown) => void;
+        getAll: () => Map<string, unknown>;
+    };
+    events: {
+        on: (event: string, handler: EventHandler) => void;
+        getAll: () => Map<string, EventHandler[]>;
+    };
+    jobs: {
+        worker: <T>(registration: WorkerRegistration<T>) => void;
+        getAll: () => WorkerRegistration<unknown>[];
+    };
+    mcp: {
+        tool: (definition: McpToolDefinition) => void;
+        getAll: () => McpToolDefinition[];
+    };
+}
+//# sourceMappingURL=module-registry.d.ts.map

package/dist/server/plugin-host/module-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-registry.d.ts","sourceRoot":"","sources":["../../../src/server/plugin-host/module-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAE5B,qBAAa,kBAAmB,YAAW,cAAc;IAQ3C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAPtC,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,YAAY,CAAqB;gBAEZ,SAAS,EAAE,SAAS;IAMjD,OAAO,GAAI,CAAC,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,KAAG,IAAI,CAYvD;IAMF,aAAa,GAAI,CAAC,EAAE,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,KAAG,IAAI,CASnE;IAEF,OAAO;yBACY,MAAM,WAAW,aAAa;;MAO/C;IAEF,KAAK;yBACc,MAAM,aAAa,OAAO;;MAI3C;IAEF,MAAM;oBACQ,MAAM,WAAW,YAAY;;MAMzC;IAEF,IAAI;iBACO,CAAC,gBAAgB,kBAAkB,CAAC,CAAC,CAAC;;MAI/C;IAEF,GAAG;2BACkB,iBAAiB;;MAIpC;CACH"}

package/dist/server/plugin-host/module-registry.js

@@ -0,0 +1,75 @@
+export class ModuleRegistryImpl {
+    container;
+    _routers = new Map();
+    _slots = new Map();
+    _events = new Map();
+    _jobs = [];
+    _mcpTools = [];
+    _sealedBound = new Set();
+    constructor(container) {
+        this.container = container;
+    }
+    // Last-wins, so an overlay loaded after a module can rebind its adapter token.
+    // Sealed tokens (Symbol description prefixed `sealed:`) are rejected at runtime
+    // even though the type system already blocks them - catches plain-JS callers and cast escapes.
+    // Canonical sealed list lives in `@openora/core/compliance`.
+    provide = (token, factory) => {
+        const desc = token.description ?? '';
+        if (desc.startsWith('sealed:')) {
+            throw new Error(`[plugin-host] Refusing to bind a sealed token (${desc}). ` +
+                `Sealed services back regulatory invariants (RG enforcement, KYC writes, ` +
+                `AML/SAR, ledger writes, RNG, etc.) and may not be replaced by a plugin. ` +
+                `Its owning module binds it via ctx.provideSealed() instead. ` +
+                `See @openora/core/compliance for the canonical list.`);
+        }
+        this.container.register(token, factory);
+    };
+    // Bind-once. The owning module calls this during its own register() to bind the
+    // canonical implementation; a second call for the same token - an overlay trying
+    // to slip past provide()'s rejection, or a duplicate registration - throws instead
+    // of silently rebinding (there is no "last-wins" for a sealed token).
+    provideSealed = (token, factory) => {
+        if (this._sealedBound.has(token)) {
+            throw new Error(`[plugin-host] Sealed token (${token.description ?? '(unnamed)'}) is already bound. ` +
+                `A sealed service may be bound exactly once, by its owning module, and never rebound.`);
+        }
+        this._sealedBound.add(token);
+        this.container.register(token, factory);
+    };
+    routers = {
+        add: (namespace, factory) => {
+            if (this._routers.has(namespace)) {
+                throw new Error(`Router namespace "${namespace}" is already registered`);
+            }
+            this._routers.set(namespace, factory);
+        },
+        getAll: () => this._routers,
+    };
+    slots = {
+        fill: (slotName, component) => {
+            this._slots.set(slotName, component);
+        },
+        getAll: () => this._slots,
+    };
+    events = {
+        on: (event, handler) => {
+            const handlers = this._events.get(event) ?? [];
+            handlers.push(handler);
+            this._events.set(event, handlers);
+        },
+        getAll: () => this._events,
+    };
+    jobs = {
+        worker: (registration) => {
+            this._jobs.push(registration);
+        },
+        getAll: () => this._jobs,
+    };
+    mcp = {
+        tool: (definition) => {
+            this._mcpTools.push(definition);
+        },
+        getAll: () => this._mcpTools,
+    };
+}
+//# sourceMappingURL=module-registry.js.map

package/dist/server/plugin-host/module-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-registry.js","sourceRoot":"","sources":["../../../src/server/plugin-host/module-registry.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,kBAAkB;IAQA;IAPrB,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpC,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,KAAK,GAAkC,EAAE,CAAC;IAC1C,SAAS,GAAwB,EAAE,CAAC;IACpC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,+EAA+E;IAC/E,gFAAgF;IAChF,+FAA+F;IAC/F,6DAA6D;IAC7D,OAAO,GAAG,CAAI,KAAe,EAAE,OAAmB,EAAQ,EAAE;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,KAAK;gBACzD,0EAA0E;gBAC1E,0EAA0E;gBAC1E,8DAA8D;gBAC9D,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,gFAAgF;IAChF,iFAAiF;IACjF,mFAAmF;IACnF,sEAAsE;IACtE,aAAa,GAAG,CAAI,KAAqB,EAAE,OAAmB,EAAQ,EAAE;QACtE,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,WAAW,IAAI,WAAW,sBAAsB;gBACnF,sFAAsF,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,OAAO,GAAG;QACR,GAAG,EAAE,CAAC,SAAiB,EAAE,OAAsB,EAAE,EAAE;YACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,yBAAyB,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ;KAC5B,CAAC;IAEF,KAAK,GAAG;QACN,IAAI,EAAE,CAAC,QAAgB,EAAE,SAAkB,EAAE,EAAE;YAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM;KAC1B,CAAC;IAEF,MAAM,GAAG;QACP,EAAE,EAAE,CAAC,KAAa,EAAE,OAAqB,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO;KAC3B,CAAC;IAEF,IAAI,GAAG;QACL,MAAM,EAAE,CAAI,YAAmC,EAAE,EAAE;YACjD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK;KACzB,CAAC;IAEF,GAAG,GAAG;QACJ,IAAI,EAAE,CAAC,UAA6B,EAAE,EAAE;YACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;KAC7B,CAAC;CACH"}

package/dist/server/plugin-host/service-manifest.d.ts

@@ -0,0 +1,4 @@
+import type { PluginEntry } from './load-plugins.js';
+export declare function parseServiceManifest(raw: string | undefined): string[] | null;
+export declare function applyServiceManifest(entries: PluginEntry[], manifest: readonly string[] | null): PluginEntry[];
+//# sourceMappingURL=service-manifest.d.ts.map

package/dist/server/plugin-host/service-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-manifest.d.ts","sourceRoot":"","sources":["../../../src/server/plugin-host/service-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,IAAI,CAO7E;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GACjC,WAAW,EAAE,CAcf"}

package/dist/server/plugin-host/service-manifest.js

@@ -0,0 +1,22 @@
+export function parseServiceManifest(raw) {
+    if (raw === undefined)
+        return null;
+    const ids = raw
+        .split(/[,\s]+/)
+        .map((s) => s.trim())
+        .filter(Boolean);
+    return ids.length > 0 ? ids : null;
+}
+export function applyServiceManifest(entries, manifest) {
+    if (manifest === null)
+        return entries;
+    const known = new Set(entries.map((e) => e.id));
+    const unknown = manifest.filter((id) => !known.has(id));
+    if (unknown.length > 0) {
+        throw new Error(`SERVICE_MANIFEST names unknown module id(s): ${unknown.join(', ')}. ` +
+            `Known ids: ${[...known].join(', ')}.`);
+    }
+    const wanted = new Set(manifest);
+    return entries.filter((e) => e.kind === 'infra' || wanted.has(e.id));
+}
+//# sourceMappingURL=service-manifest.js.map

package/dist/server/plugin-host/service-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-manifest.js","sourceRoot":"","sources":["../../../src/server/plugin-host/service-manifest.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAC1D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG;SACZ,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,QAAkC;IAElC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAEtC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,gDAAgD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACpE,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/server/runtime/create-app.d.ts

@@ -0,0 +1,40 @@
+import type { ContractRouter } from '@orpc/contract';
+import { Hono } from 'hono';
+import { Container } from '../kernel/index.js';
+import { type IgamingConfig } from '@openora/core/contracts';
+import { type PluginEntry } from '../plugin-host/index.js';
+export type CreateAppConfig = {
+    plugins: PluginEntry[];
+    authSchema?: Record<string, unknown>;
+    port?: number;
+    cors?: boolean | {
+        origins?: string | string[];
+    };
+    databaseUrl?: string;
+    contract?: ContractRouter<any>;
+    openapi?: {
+        enabled?: boolean;
+        info?: {
+            title?: string;
+            version?: string;
+        };
+        outputPath?: string;
+    };
+    igaming?: IgamingConfig;
+    httpCache?: {
+        paths?: string[];
+        maxAgeSeconds?: number;
+    } | false;
+    configure?: (container: Container) => void | Promise<void>;
+    disableHealthModule?: boolean;
+};
+export type CreatedApp = {
+    app: Hono;
+    container: Container;
+    port: number;
+    listen(): Promise<void>;
+    emitOpenApiSpec(): Promise<string | null>;
+    close(): Promise<void>;
+};
+export declare function createApp(config: CreateAppConfig): Promise<CreatedApp>;
+//# sourceMappingURL=create-app.d.ts.map

package/dist/server/runtime/create-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/create-app.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,EACL,SAAS,EAgBV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAYL,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAsBxE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,WAAW,EAAE,CAAC;IAOvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,IAAI,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,CAAC;IAEjD,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,QAAQ,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,OAAO,CAAC,EAAE,aAAa,CAAC;IAIxB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAEjE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AA2CF,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CA2P5E"}

package/dist/server/runtime/create-app.js

@@ -0,0 +1,290 @@
+import { OpenAPIHandler } from '@orpc/openapi/fetch';
+import { implement, onError, ORPCError } from '@orpc/server';
+import { ResponseHeadersPlugin } from '@orpc/server/plugins';
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { etag } from 'hono/etag';
+import { serve } from '@hono/node-server';
+import { resolve } from 'node:path';
+import { generateOpenApiSpec } from './openapi.js';
+import { Container, BullMqJobQueue, InMemoryBroker, InProcessCache, InProcessJobQueue, InProcessRateLimiter, InProcessRealtimeTransport, RedisCache, RedisRateLimiter, SseClientAuthorizer, createEventBus, createLogger, createRedisClient, withRequestContext, EVENT_BUS, } from '../kernel/index.js';
+import { randomUUID } from 'node:crypto';
+import { MESSAGE_BROKER, JOB_QUEUE, REALTIME_TRANSPORT, REALTIME_CLIENT_AUTHORIZER, OUTBOX, ADMIN_PERMISSION_RESOLVER, RATE_LIMITER, CACHE, composeContract, healthContract, IGAMING_CONFIG, PLATFORM_CONFIG, } from '@openora/core/contracts';
+import { DrizzleService, DRIZZLE, DrizzleOutboxWriter, OutboxRelay } from '../db/index.js';
+import { AdminGuard, ADMIN_GUARD, SessionResolver, AUTH_SESSION } from '../auth/index.js';
+import { loadPlugins } from '../plugin-host/index.js';
+import { loadPlatformConfig, resolvePlatformConfigPath } from '../kernel/platform-config-loader.js';
+// Path prefixes safe to cache at the HTTP layer: public, non-personalized reads
+// only (lobby feeds, public CMS content, the game catalogue). NOTHING
+// authenticated or per-player (wallet, profile, notifications, admin, chat) - a
+// consumer overrides this via `httpCache.paths` or disables it with `httpCache: false`.
+// This list living in the domain-agnostic engine (rather than each module
+// declaring its own cacheable routes) is accepted debt.
+// '/cms/banners' is excluded on purpose: its `listBanners` route is unguarded and returns
+// inactive banners, so HTTP-caching it would leak draft banners to a shared cache.
+const PUBLIC_HTTP_CACHE_PATHS = [
+    '/lobby/categories',
+    '/lobby/featured',
+    '/lobby/search',
+    '/cms/pages',
+    '/gaming/games',
+];
+const DEFAULT_HTTP_CACHE_MAX_AGE_SECONDS = 30;
+const DEFAULT_HTTP_CACHE_STALE_WHILE_REVALIDATE_SECONDS = 60;
+function headersToRecord(headers) {
+    const out = {};
+    headers.forEach((value, key) => {
+        out[key] = value;
+    });
+    return out;
+}
+// Webhook signature schemes (eg aggregator callbacks) must hash the verbatim body,
+// so the runtime captures it before oRPC parses the request. Bounded to keep an
+// oversized payload from buffering into memory - past the cap rawBody stays unset
+// and the signature check fails closed (401).
+const MAX_CAPTURED_BODY_BYTES = 1_048_576;
+async function captureRawBody(req) {
+    if (!req.body)
+        return undefined;
+    const declaredLength = req.headers.get('content-length');
+    if (declaredLength && Number(declaredLength) > MAX_CAPTURED_BODY_BYTES)
+        return undefined;
+    // content-length can be absent (chunked) or lie, so bound the actual stream rather
+    // than trusting the header: stop and bail past the cap so memory stays bounded and
+    // the signature check fails closed.
+    const reader = req.clone().body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > MAX_CAPTURED_BODY_BYTES) {
+                await reader.cancel();
+                return undefined;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+export async function createApp(config) {
+    if (config.databaseUrl) {
+        process.env['DATABASE_URL'] = config.databaseUrl;
+    }
+    const container = new Container();
+    container.register(DRIZZLE, () => {
+        const svc = new DrizzleService();
+        container.onDispose(() => svc.dispose());
+        return svc;
+    });
+    container.register(MESSAGE_BROKER, () => {
+        const broker = new InMemoryBroker();
+        container.onDispose(() => broker.close());
+        return broker;
+    });
+    // Enabled when OUTBOX_ENABLED is set or a durable broker is configured (AMQP_URL) -
+    // a distributed deployment wants events that survive a crash between commit and
+    // publish. In the default in-process monolith it stays off, so emit() keeps its
+    // synchronous fan-out and emitInTransaction() guides callers to enable it.
+    const outboxEnabled = !!process.env['OUTBOX_ENABLED'] || !!process.env['AMQP_URL'] || !!process.env['RABBITMQ_URL'];
+    if (outboxEnabled) {
+        container.register(OUTBOX, () => new DrizzleOutboxWriter());
+    }
+    container.register(EVENT_BUS, (c) => createEventBus(c.get(MESSAGE_BROKER), createLogger('event-bus'), outboxEnabled ? c.get(OUTBOX) : undefined));
+    // Default in-process fan-out served as SSE; an overlay rebinds to a managed
+    // vendor (Ably/GetStream) without touching modules. See ADR-0007.
+    container.register(REALTIME_TRANSPORT, () => new InProcessRealtimeTransport());
+    // Default is first-party SSE (no token; the session cookie authorizes the stream).
+    // A managed-vendor overlay rebinds this to mint a per-player scoped token. See ADR-0007.
+    container.register(REALTIME_CLIENT_AUTHORIZER, () => new SseClientAuthorizer());
+    // When REDIS_URL is set, JOB_QUEUE, the rate limiter and cache bind to the shipped
+    // Redis reference adapters: BullMQ-backed durable jobs (survive restarts, real cron),
+    // distributed throttling and cross-replica cache invalidation - mirrors the AMQP_URL
+    // outbox precedent above. Otherwise the process-local in-process defaults stay (zero
+    // deps for dev/test). Either way a consumer overlay can rebind any of these tokens
+    // (plugins load after). The JOB_QUEUE disposer drains in-flight jobs before the DB
+    // closes (DRIZZLE is resolved before JOB_QUEUE below, and disposers run in reverse).
+    const redisUrl = process.env['REDIS_URL'];
+    if (redisUrl) {
+        container.register(JOB_QUEUE, () => {
+            const q = new BullMqJobQueue(redisUrl);
+            container.onDispose(() => q.close());
+            return q;
+        });
+        const redis = createRedisClient(redisUrl);
+        container.onDispose(() => redis.close());
+        container.register(RATE_LIMITER, () => new RedisRateLimiter(redis));
+        container.register(CACHE, () => new RedisCache(redis));
+    }
+    else {
+        container.register(JOB_QUEUE, () => {
+            const q = new InProcessJobQueue(createLogger('job-queue'));
+            container.onDispose(() => q.close());
+            return q;
+        });
+        container.register(RATE_LIMITER, () => {
+            const limiter = new InProcessRateLimiter();
+            container.onDispose(() => limiter.close());
+            return limiter;
+        });
+        container.register(CACHE, () => {
+            const cache = new InProcessCache();
+            container.onDispose(() => cache.close());
+            return cache;
+        });
+    }
+    // One shared better-auth instance for both the per-request middleware and AdminGuard -
+    // no second createAuth() over the same DB. authSchema is injected (not imported) because
+    // the engine is domain-agnostic (ADR-0019/0025).
+    container.register(AUTH_SESSION, (c) => new SessionResolver(c.get(DRIZZLE), config.authSchema));
+    container.register(ADMIN_GUARD, (c) => new AdminGuard(c.get(DRIZZLE), c.get(AUTH_SESSION), 
+    // has() avoids throwing on an unbound token so boot works without the iam module.
+    c.has(ADMIN_PERMISSION_RESOLVER) ? c.get(ADMIN_PERMISSION_RESOLVER) : undefined, c.get(EVENT_BUS)));
+    if (config.igaming) {
+        const igaming = config.igaming;
+        container.register(IGAMING_CONFIG, () => igaming);
+    }
+    // Always bound: loadPlatformConfig() falls back to an empty-but-valid config
+    // when no platform-config.{yaml,yml,json} file is present (PLATFORM_CONFIG_PATH
+    // or cwd discovery). See platform-config-loader.ts.
+    container.register(PLATFORM_CONFIG, () => loadPlatformConfig(resolvePlatformConfigPath()));
+    const registry = await loadPlugins(config.plugins, container);
+    await config.configure?.(container);
+    const bus = container.get(EVENT_BUS);
+    for (const [event, handlers] of registry.events.getAll()) {
+        for (const handler of handlers) {
+            bus.on(event, handler);
+        }
+    }
+    // Resolve DRIZZLE before JOB_QUEUE so disposers run in the right order (workers
+    // drain before the DB closes, since disposers run in reverse).
+    const drizzle = container.get(DRIZZLE);
+    const jobQueue = container.get(JOB_QUEUE);
+    for (const registration of registry.jobs.getAll()) {
+        jobQueue.registerWorker(registration);
+    }
+    if (outboxEnabled) {
+        const relay = new OutboxRelay(drizzle.db, container.get(MESSAGE_BROKER), {
+            onError: (err) => createLogger('outbox-relay').error({ err }, 'outbox drain failed'),
+        });
+        relay.start();
+        container.onDispose(() => relay.stop());
+    }
+    const router = {};
+    for (const [namespace, factory] of registry.routers.getAll()) {
+        if (namespace in router) {
+            throw new Error(`Router namespace "${namespace}" is registered by more than one plugin`);
+        }
+        router[namespace] = factory(container);
+    }
+    if (!config.disableHealthModule) {
+        const os = implement(healthContract).$context();
+        router['health'] = os.router({
+            ping: os.ping.handler(() => ({ status: 'ok', timestamp: new Date().toISOString() })),
+        });
+    }
+    const handler = new OpenAPIHandler(router, {
+        plugins: [new ResponseHeadersPlugin()],
+        interceptors: [
+            onError((error) => {
+                if (!(error instanceof ORPCError)) {
+                    createLogger('orpc').error({ err: error }, 'unhandled error');
+                }
+            }),
+        ],
+    });
+    const app = new Hono();
+    if (config.cors !== false) {
+        const origins = config.cors === true || config.cors === undefined ? undefined : config.cors.origins;
+        app.use('/*', cors({ origin: origins ?? ((origin) => origin), credentials: true }));
+    }
+    if (config.httpCache !== false) {
+        const cachePaths = config.httpCache?.paths ?? PUBLIC_HTTP_CACHE_PATHS;
+        const maxAgeSeconds = config.httpCache?.maxAgeSeconds ?? DEFAULT_HTTP_CACHE_MAX_AGE_SECONDS;
+        const staleWhileRevalidateSeconds = config.httpCache?.maxAgeSeconds
+            ? maxAgeSeconds * 2
+            : DEFAULT_HTTP_CACHE_STALE_WHILE_REVALIDATE_SECONDS;
+        // GET/HEAD only - the etag middleware short-circuits with a 304 on a matching
+        // If-None-Match, which would swallow a PUT/DELETE's response after it already
+        // ran the mutation (eg PUT /cms/pages/{id} under the /cms/pages cache prefix).
+        const etagMiddleware = etag();
+        app.use('/*', async (c, next) => {
+            const isCacheablePath = cachePaths.some((path) => c.req.path === path || c.req.path.startsWith(`${path}/`));
+            const isCacheableMethod = c.req.method === 'GET' || c.req.method === 'HEAD';
+            const isCacheable = isCacheableMethod && isCacheablePath;
+            if (isCacheable) {
+                await etagMiddleware(c, next);
+            }
+            else {
+                await next();
+            }
+            c.res.headers.set('Cache-Control', isCacheable
+                ? `public, max-age=${maxAgeSeconds}, stale-while-revalidate=${staleWhileRevalidateSeconds}`
+                : 'no-store');
+        });
+    }
+    const sessions = container.get(AUTH_SESSION);
+    app.use('/*', async (c, next) => {
+        const headers = headersToRecord(c.req.raw.headers);
+        if (!headers['x-real-ip'] && !headers['x-forwarded-for']) {
+            const remoteAddress = c.env
+                ?.incoming?.socket?.remoteAddress;
+            if (remoteAddress) {
+                headers['x-real-ip'] = remoteAddress;
+            }
+        }
+        const context = {
+            request: { headers },
+            rawBody: await captureRawBody(c.req.raw),
+        };
+        // Never identify from a client-supplied `x-user-id` header (W1, ADR-0019).
+        const userId = await sessions.resolveUserId(c.req.raw.headers);
+        const runHandler = async () => {
+            const { matched, response } = await handler.handle(c.req.raw, { context });
+            if (matched)
+                return c.newResponse(response.body, response);
+            await next();
+            return c.res;
+        };
+        const traceId = headers['x-trace-id'] ?? randomUUID();
+        if (!userId) {
+            // No valid session - context.auth stays undefined so getUserId 401s. Auth and
+            // public routes still work. Run inside the request context for trace correlation.
+            return withRequestContext({ traceId }, runHandler);
+        }
+        context.auth = { userId };
+        return withRequestContext({ userId, traceId }, runHandler);
+    });
+    const port = config.port ?? Number(process.env['PORT_API'] ?? 3001);
+    let server;
+    return {
+        app,
+        container,
+        port,
+        async listen() {
+            server = serve({ fetch: app.fetch, port });
+            process.stdout.write(`API listening on :${port}\n`);
+        },
+        async emitOpenApiSpec() {
+            if (config.openapi?.enabled === false)
+                return null;
+            const outPath = await generateOpenApiSpec(config.contract ?? composeContract({}), {
+                info: config.openapi?.info,
+                outputPath: config.openapi?.outputPath ?? resolve(process.cwd(), 'docs/openapi.json'),
+            });
+            process.stdout.write(`OpenAPI spec written to ${outPath}\n`);
+            return outPath;
+        },
+        async close() {
+            server?.close();
+            await container.dispose();
+        },
+    };
+}
+//# sourceMappingURL=create-app.js.map

package/dist/server/runtime/create-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-app.js","sourceRoot":"","sources":["../../../src/server/runtime/create-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAkB,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAmB,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EACL,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,0BAA0B,EAC1B,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,GAEV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,cAAc,EACd,SAAS,EACT,kBAAkB,EAClB,0BAA0B,EAC1B,MAAM,EACN,yBAAyB,EACzB,YAAY,EACZ,KAAK,EACL,eAAe,EACf,cAAc,EACd,cAAc,EAEd,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAoB,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAEpG,gFAAgF;AAChF,sEAAsE;AACtE,gFAAgF;AAChF,wFAAwF;AACxF,0EAA0E;AAC1E,wDAAwD;AACxD,0FAA0F;AAC1F,mFAAmF;AACnF,MAAM,uBAAuB,GAAsB;IACjD,mBAAmB;IACnB,iBAAiB;IACjB,eAAe;IACf,YAAY;IACZ,eAAe;CAChB,CAAC;AAEF,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAC9C,MAAM,iDAAiD,GAAG,EAAE,CAAC;AAiD7D,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,gFAAgF;AAChF,kFAAkF;AAClF,8CAA8C;AAC9C,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAE1C,KAAK,UAAU,cAAc,CAAC,GAAY;IACxC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,uBAAuB;QAAE,OAAO,SAAS,CAAC;IACzF,mFAAmF;IACnF,mFAAmF;IACnF,oCAAoC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAK,CAAC,SAAS,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;gBACpC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAuB;IACrD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,oFAAoF;IACpF,gFAAgF;IAChF,gFAAgF;IAChF,2EAA2E;IAC3E,MAAM,aAAa,GACjB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAChG,IAAI,aAAa,EAAE,CAAC;QAClB,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAClC,cAAc,CACZ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EACrB,YAAY,CAAC,WAAW,CAAC,EACzB,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAC1C,CACF,CAAC;IACF,4EAA4E;IAC5E,kEAAkE;IAClE,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,0BAA0B,EAAE,CAAC,CAAC;IAC/E,mFAAmF;IACnF,yFAAyF;IACzF,SAAS,CAAC,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAChF,mFAAmF;IACnF,sFAAsF;IACtF,qFAAqF;IACrF,qFAAqF;IACrF,mFAAmF;IACnF,mFAAmF;IACnF,qFAAqF;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;YACvC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC1C,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,GAAG,IAAI,iBAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3D,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACrC,OAAO,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;YACpC,MAAM,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;YAC3C,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE;YAC7B,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;YACnC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IACD,uFAAuF;IACvF,yFAAyF;IACzF,iDAAiD;IACjD,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAChG,SAAS,CAAC,QAAQ,CAChB,WAAW,EACX,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,UAAU,CACZ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;IACnB,kFAAkF;IAClF,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS,EAC/E,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CACjB,CACJ,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,6EAA6E;IAC7E,gFAAgF;IAChF,oDAAoD;IACpD,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,yBAAyB,EAAE,CAAC,CAAC,CAAC;IAE3F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClD,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;YACvE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC;SACrF,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7D,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,SAAS,yCAAyC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAc,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAc,CAAC;QAC5D,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;YAC3B,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;SAC9F,CAAc,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE;QACzC,OAAO,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACtC,YAAY,EAAE;YACZ,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAChB,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC,EAAE,CAAC;oBAClC,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC,CAAC;SACH;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACtF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,IAAI,uBAAuB,CAAC;QACtE,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,EAAE,aAAa,IAAI,kCAAkC,CAAC;QAC5F,MAAM,2BAA2B,GAAG,MAAM,CAAC,SAAS,EAAE,aAAa;YACjE,CAAC,CAAC,aAAa,GAAG,CAAC;YACnB,CAAC,CAAC,iDAAiD,CAAC;QACtD,8EAA8E;QAC9E,8EAA8E;QAC9E,+EAA+E;QAC/E,MAAM,cAAc,GAAG,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC9B,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CACrC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CACnE,CAAC;YACF,MAAM,iBAAiB,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YAC5E,MAAM,WAAW,GAAG,iBAAiB,IAAI,eAAe,CAAC;YACzD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CACf,eAAe,EACf,WAAW;gBACT,CAAC,CAAC,mBAAmB,aAAa,4BAA4B,2BAA2B,EAAE;gBAC3F,CAAC,CAAC,UAAU,CACf,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE7C,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACzD,MAAM,aAAa,GAAI,CAAC,CAAC,GAA8D;gBACrF,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC;YACpC,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC;YACvC,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAe;YAC1B,OAAO,EAAE,EAAE,OAAO,EAAE;YACpB,OAAO,EAAE,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;SACzC,CAAC;QAEF,2EAA2E;QAC3E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/D,MAAM,UAAU,GAAG,KAAK,IAAuB,EAAE;YAC/C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3E,IAAI,OAAO;gBAAE,OAAO,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,GAAG,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,UAAU,EAAE,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,8EAA8E;YAC9E,kFAAkF;YAClF,OAAO,kBAAkB,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;QAE1B,OAAO,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC;IACpE,IAAI,MAA8B,CAAC;IAEnC,OAAO;QACL,GAAG;QACH,SAAS;QACT,IAAI;QACJ,KAAK,CAAC,MAAM;YACV,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE;gBAChF,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI;gBAC1B,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC;aACtF,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,IAAI,CAAC,CAAC;YAC7D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}