@pithy-sh/core 0.9.0 → 0.11.0

package/dist/createBackend.js

@@ -1,25 +1,31 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
+import { noActingOrganization } from "./access/acting.js";
 import { noopEmit } from "./audit/recorder.js";
 import { ValidationError } from "./error/pithyError.js";
+import { pithyCommandOf } from "./cli/command.js";
 import { BindingSpec } from "./capability/bindings.js";
 import { recordComposition } from "./capability/composition.js";
 import { validateBindings } from "./capability/validateBindings.js";
 import { workerVersion } from "./worker/identity.js";
+import { describeRoute } from "./http/routeSpec.js";
+import { buildDbRegistry, composeDatabases } from "./data/databases.js";
 import { isControlPlaneCapability } from "./controlPlane/capability.js";
 import { allowedOriginSet, corsSurface, registerControlPlaneCors } from "./controlPlane/http/cors.js";
-import { buildDbRegistry, composeDatabases } from "./data/databases.js";
+import { registerReadinessGuards } from "./controlPlane/http/readiness.js";
 import { noEntitlementProvider } from "./entitlement/entitlement.js";
 import { bakedTranslator } from "./i18n/translator.js";
 import { catalogFor, composeMessages } from "./i18n/registry.js";
 import { buildKvRegistry, composeKv } from "./kv/namespaces.js";
 import { bindRequestContext, createWorkerLogger } from "./logger/worker.js";
 import { loggingErrorHandler } from "./logger/errorHandler.js";
+import { recordRouteGroups } from "./openapi/routeGroups.js";
 import { HEALTH_PATH } from "./worker/health.js";
 import { registeredWorkflowBinding } from "./workflow/bindings.js";
 import { buildWorkflowDispatcher } from "./workflow/dispatch.js";
 import { composeWorkflows } from "./workflow/register.js";
 import { Hono } from "hono";
+import { z } from "zod";
 //#region src/createBackend.ts
 /**
 * Collapse duplicate bindings (same `type:name`) — capability and derived specs overlap. A binding
@@ -55,6 +61,11 @@ function versionOf(env) {
 function envNameOf(env, fallback) {
 	return typeof env.ENVIRONMENT === "string" && env.ENVIRONMENT.length > 0 ? env.ENVIRONMENT : fallback ?? "unknown";
 }
+/** What `GET /health` answers. */
+const HealthBody = z.object({
+	status: z.literal("ok").describe("Always `ok`: an answer at all is the liveness signal."),
+	version: z.string().nullable().describe("The Cloudflare version id of the build answering, or null where the Worker cannot say.")
+}).describe("Liveness, and which build is answering.");
 /**
 * Assemble capabilities into a deployable Hono app — a valid Worker `fetch` handler.
 *
@@ -77,7 +88,10 @@ function createBackend(options) {
 	const present = new Set(all.map((cap) => cap.name));
 	for (const cap of all) for (const dep of cap.dependsOn ?? []) if (!present.has(dep)) throw new ValidationError({
 		message: `Capability "${cap.name}" requires the "${dep}" capability, which is not composed.`,
-		action: `Add ${dep}() to createBackend's capabilities (run \`pithy add ${dep}\`).`
+		action: `Add ${dep}() to createBackend's capabilities (run \`${pithyCommandOf("add", {
+			args: [dep],
+			flags: { "--with-prerequisites": true }
+		}, { runtime: true })}\`).`
 	});
 	for (const cap of all) cap.compose?.({ capabilities: all });
 	recordComposition(all);
@@ -101,10 +115,11 @@ function createBackend(options) {
 	const app = new Hono();
 	app.onError(loggingErrorHandler);
 	const baseLogger = options.logger ?? createWorkerLogger();
+	const adminSurface = corsSurface(all);
 	const controlPlane = all.find(isControlPlaneCapability);
 	if (controlPlane) {
 		const cors = controlPlane.controlPlaneConfig;
-		registerControlPlaneCors(app, corsSurface(all), allowedOriginSet(cors), cors.corsMaxAgeSeconds);
+		registerControlPlaneCors(app, adminSurface, allowedOriginSet(cors), cors.corsMaxAgeSeconds);
 	}
 	let validated = false;
 	app.use("*", async (c, next) => {
@@ -114,6 +129,7 @@ function createBackend(options) {
 			validated = true;
 		}
 		if (c.get("auth") === void 0) c.set("auth", null);
+		if (c.get("actingOrganization") === void 0) c.set("actingOrganization", noActingOrganization);
 		if (c.get("locale") === void 0) c.set("locale", null);
 		if (c.get("t") === void 0) c.set("t", defaultTranslator);
 		if (c.get("controlPlane") === void 0) c.set("controlPlane", null);
@@ -161,13 +177,32 @@ function createBackend(options) {
 	* before `version_metadata` was declared reports "I cannot tell you", and `deploy` reports the check
 	* as inconclusive instead of failing it.
 	*/
-	app.get(HEALTH_PATH, (c) => c.json({
+	const groups = [];
+	const healthStart = app.routes.length;
+	app.get(HEALTH_PATH, describeRoute({
+		summary: "Report liveness, and which build is answering.",
+		verification: "public",
+		responses: { 200: HealthBody }
+	}), (c) => c.json({
 		status: "ok",
 		version: workerVersion(c.env)
 	}));
+	groups.push({
+		tag: "core",
+		routes: app.routes.slice(healthStart)
+	});
 	for (const cap of all) for (const middleware of cap.middleware ?? []) middleware(app);
-	for (const cap of all) cap.routes?.(app);
+	registerReadinessGuards(app, adminSurface, all.flatMap((cap) => cap.readiness ?? []));
+	for (const cap of all) {
+		const start = app.routes.length;
+		cap.routes?.(app);
+		groups.push({
+			tag: cap.name,
+			routes: app.routes.slice(start)
+		});
+	}
+	recordRouteGroups(app, groups);
 	return app;
 }
 //#endregion
-export { createBackend };
+export { HealthBody, createBackend };

package/dist/createEntrypoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createEntrypoint.d.ts","sourceRoot":"","sources":["../src/createEntrypoint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,iBAAiB,CAAC;AAI3E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/G;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzG;AAkBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,eAAe,CAoD3D"}
+{"version":3,"file":"createEntrypoint.d.ts","sourceRoot":"","sources":["../src/createEntrypoint.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAA0B,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,KAAK,oBAAoB,EAAiB,MAAM,iBAAiB,CAAC;AAK3E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/G;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjH;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACzG;AAkBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,eAAe,CAyD3D"}

package/dist/createEntrypoint.js

@@ -3,6 +3,7 @@
 import { triggerWorkflow } from "./workflow/dispatch.js";
 import { composeWorkflows, scheduledWorkflows } from "./workflow/register.js";
 import { createBackend } from "./createBackend.js";
+import { withLocalServices } from "./worker/serviceLoopback.js";
 //#region src/createEntrypoint.ts
 /**
 * The raw MIME stream of a `ForwardableEmailMessage` is **single-use** — once one handler reads it,
@@ -31,17 +32,18 @@ function createEntrypoint(options) {
 	for (const cap of all) cap.boot?.({ capabilities: all });
 	const registry = composeWorkflows(all);
 	const scheduled = scheduledWorkflows(registry);
-	const entrypoint = { fetch: (request, env, ctx) => app.fetch(request, env, ctx) };
+	const entrypoint = { fetch: (request, env, ctx) => app.fetch(request, withLocalServices(env), ctx) };
 	if (scheduled.length > 0) entrypoint.scheduled = async (_controller, env) => {
 		const failures = [];
 		for (const entry of scheduled) try {
-			await triggerWorkflow(env, registry, entry.key, {});
+			await triggerWorkflow(withLocalServices(env), registry, entry.key, {});
 		} catch (error) {
 			failures.push(error);
 		}
 		if (failures[0] !== void 0) throw failures[0];
 	};
-	if (handlers.length > 0) entrypoint.email = async (message, env, ctx) => {
+	if (handlers.length > 0) entrypoint.email = async (message, given, ctx) => {
+		const env = withLocalServices(given);
 		if (handlers.length === 1) {
 			await handlers[0]?.(message, env, ctx);
 			return;

package/dist/entitlement/allowance.d.ts

@@ -0,0 +1,25 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Context } from "hono";
+import type { PithyHonoEnv } from "../capability/capability";
+import type { MeterLimit } from "./entitlement";
+/** How many of `name` the caller's holder may have: a whole number, or `null` for unlimited. */
+export declare function quota(c: Context<PithyHonoEnv>, name: string): Promise<number | null>;
+/** Whether `name` is on for the caller's holder. Always a boolean. */
+export declare function feature(c: Context<PithyHonoEnv>, name: string): Promise<boolean>;
+/**
+ * The ceiling a capability enforces on a meter it counts itself, for the current caller.
+ *
+ * **No provider, or one that binds nothing to this meter, is `{ enforced: false }`** — and the capability
+ * keeps its own configured ceiling. Enforcement is opt-in per meter because a cap that arrives by surprise
+ * breaks an adopter who was already over it.
+ *
+ * **A provider that throws refuses, and logs.** Storage already says which way round to err: over-counting
+ * briefly and reclaiming is the right way round, and under-counting has no recovery. Treating a failed read
+ * as unenforced would hand a customer an unbounded allowance for as long as the read kept failing. The cost
+ * is real and is stated rather than discovered: our bug becomes a refused write for a paying customer.
+ * Enforcement being opt-in is what bounds it — an adopter who would rather over-serve leaves the meter
+ * advisory.
+ */
+export declare function meterLimit(c: Context<PithyHonoEnv>, meter: string): Promise<MeterLimit>;
+//# sourceMappingURL=allowance.d.ts.map

package/dist/entitlement/allowance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowance.d.ts","sourceRoot":"","sources":["../../src/entitlement/allowance.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAqChD,gGAAgG;AAChG,wBAAsB,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI1F;AAED,sEAAsE;AACtE,wBAAsB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAa7F"}

package/dist/entitlement/allowance.js

@@ -0,0 +1,80 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import { InternalError, messageOf } from "../error/pithyError.js";
+//#region src/entitlement/allowance.ts
+/**
+* The allowance readers — how much the current caller may have, and whether a switch is on.
+*
+*   const seats = await quota(c, "seats");                  // number, or null for unlimited
+*   if (seats !== null && (await countMembers(orgId)) >= seats) throw new SeatLimitReached(…);
+*   if (await feature(c, "auditExport")) { … }               // boolean, never null
+*
+* **Neither takes an entitlement key, and that is the point.** A route does not know which tier the
+* caller's holder is on, and during an upgrade overlap it holds two. The provider resolves across every
+* key the holder has and answers the higher, so an adopter compares numbers and never ranks tiers.
+*
+* **Read, never enforced.** A quota denies nothing on its own and a feature set to `false` denies
+* nothing either — `requireEntitlement` still gates on the key alone. What a number means for a request
+* is the adopter's code to decide, because only the adopter can count what it owns.
+*
+* **They live in core for the reason `requireEntitlement` does.** A reader that arrived with
+* `@pithy-sh/payments` would be absent when payments is, and a route reading an allowance must then fail
+* rather than read something. So with no provider composed — or one that declares no allowances — both
+* throw `core/internal` naming the gap. Never `0`, which is a paywall shut for a reason nobody can see;
+* never unlimited, which is a paywall that does not exist.
+*/
+/** The refusal when nothing on the request can answer an allowance. The adopter's wiring, so `core/internal`. */
+function noProvider(c, kind, name) {
+	const provider = c.var.entitlements?.provider ?? null;
+	return new InternalError({
+		message: `No ${kind} "${name}" can be resolved here.`,
+		action: "Compose a payments capability that declares its entitlements in this Worker's pithy.config.ts.",
+		detail: provider === null ? `no entitlement provider is composed, so ${kind}("${name}") has nothing to read.` : `${provider} resolves entitlements and declares no allowances, so ${kind}("${name}") has nothing to read.`
+	});
+}
+/** How many of `name` the caller's holder may have: a whole number, or `null` for unlimited. */
+async function quota(c, name) {
+	const resolver = c.var.entitlements;
+	if (!resolver?.quota) throw noProvider(c, "quota", name);
+	return resolver.quota(name);
+}
+/** Whether `name` is on for the caller's holder. Always a boolean. */
+async function feature(c, name) {
+	const resolver = c.var.entitlements;
+	if (!resolver?.feature) throw noProvider(c, "feature", name);
+	return resolver.feature(name);
+}
+/**
+* The ceiling a capability enforces on a meter it counts itself, for the current caller.
+*
+* **No provider, or one that binds nothing to this meter, is `{ enforced: false }`** — and the capability
+* keeps its own configured ceiling. Enforcement is opt-in per meter because a cap that arrives by surprise
+* breaks an adopter who was already over it.
+*
+* **A provider that throws refuses, and logs.** Storage already says which way round to err: over-counting
+* briefly and reclaiming is the right way round, and under-counting has no recovery. Treating a failed read
+* as unenforced would hand a customer an unbounded allowance for as long as the read kept failing. The cost
+* is real and is stated rather than discovered: our bug becomes a refused write for a paying customer.
+* Enforcement being opt-in is what bounds it — an adopter who would rather over-serve leaves the meter
+* advisory.
+*/
+async function meterLimit(c, meter) {
+	const resolver = c.var.entitlements;
+	if (!resolver?.meterLimit) return { enforced: false };
+	try {
+		return await resolver.meterLimit(meter);
+	} catch (error) {
+		c.var.log?.error("meter limit resolution failed", {
+			provider: resolver.provider,
+			meter,
+			cause: messageOf(error)
+		});
+		throw new InternalError({
+			message: "Usage could not be checked, so nothing was written.",
+			action: "Read the preceding log line for why the allowance read failed.",
+			detail: `${resolver.provider} threw resolving the ${meter} meter's ceiling; refusing rather than serving unbounded.`
+		});
+	}
+}
+//#endregion
+export { feature, meterLimit, quota };

package/dist/entitlement/entitlement.d.ts

@@ -66,7 +66,48 @@ export interface EntitlementResolver {
      * See {@link EntitlementHolder} for why this is a label and a tenant rather than the holder itself.
      */
     holder?(): Promise<EntitlementHolder | undefined>;
+    /**
+     * How many of `name` the current caller's holder may have — a whole number, or `null` for unlimited.
+     * Optional: a provider with no allowances omits it, and {@link import("./allowance").quota} refuses
+     * rather than inventing a number. A provider throws for a name it does not declare, never answers 0.
+     */
+    quota?(name: string): Promise<number | null>;
+    /** Whether `name` is on for the current caller's holder. Never null. Optional, as {@link quota} is. */
+    feature?(name: string): Promise<boolean>;
+    /**
+     * The ceiling a capability that counts its own rows enforces for `meter` — storage's bytes, media's
+     * items — or `{ enforced: false }` where the provider binds no ceiling to it. Optional, and absent is
+     * `{ enforced: false }`: a capability composed with no provider keeps its own configured behavior.
+     */
+    meterLimit?(meter: string): Promise<MeterLimit>;
 }
+/**
+ * What a provider says about one meter for the current caller: whether it binds a ceiling at all, and if
+ * it does, what the ceiling is and whose rows it covers. `limit: null` is unlimited — an enforced meter on
+ * a subject whose plan or override says so.
+ *
+ * Two states rather than a nullable number, because "this meter is advisory here" and "this subject is
+ * unlimited" are different facts and a capability must fall back to its own configured ceiling on the
+ * first and never on the second.
+ *
+ * **An enforced ceiling says which rows it is the whole of**, because a ceiling counted against the wrong
+ * rows is a different allowance. Under organization billing the plan's 10 GB is the company's: counted
+ * against one member's files it becomes 10 GB per member, and a paid quota is bypassed by an invitation.
+ * So `tenant` is the organization the ceiling was resolved for, exactly as {@link EntitlementHolder.tenant}
+ * is, and a capability sums every row it holds for that tenant, whoever wrote it. `null` means the holder
+ * is not a tenant: the ceiling is the caller's own, and the caller's rows are what count.
+ *
+ * It is a counting key, never a gate. A capability that would write a row for a different tenant than the
+ * one the ceiling covers refuses the write — that row would sit outside the sum, and under-counting has no
+ * recovery.
+ */
+export type MeterLimit = {
+    readonly enforced: false;
+} | {
+    readonly enforced: true;
+    readonly limit: number | null;
+    readonly tenant: string | null;
+};
 /**
  * How a resolver's holder appears in a denial's `detail` and on the denial's audit row — and **nothing a
  * gate may compare**.

package/dist/entitlement/entitlement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../../src/entitlement/entitlement.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,cAAc,aAUxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW;;;;;iBAqBuF,CAAC;AAChH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAGpF;AAED,2GAA2G;AAC3G,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAMnG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,wGAAwG;IACxG,IAAI,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACxC;;;;;OAKG;IACH,MAAM,CAAC,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,mBAGnC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC"}
+{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../../src/entitlement/entitlement.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA2BxB,eAAO,MAAM,cAAc,aAUxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW;;;;;iBAqBuF,CAAC;AAChH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAGpF;AAED,2GAA2G;AAC3G,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAMnG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,wGAAwG;IACxG,IAAI,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACxC;;;;;OAKG;IACH,MAAM,CAAC,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;IAClD;;;;OAIG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,uGAAuG;IACvG,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC;;;;OAIG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,mBAGnC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC"}

package/dist/entitlement/meter.d.ts

@@ -0,0 +1,57 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+import type { Capability } from "../capability/capability";
+import type { Logger } from "../logger/logger";
+/**
+ * The usage-meter seam — how a capability that writes the rows a meter counts asks whether one more is
+ * allowed, when there is no request to ask through.
+ *
+ * `@pithy-sh/email` enqueues from a route, from a Workflow step and from a cron, and only the first has a
+ * `c.var.entitlements`. So the meter it charges is found the way the ledger is found — among the composed
+ * capabilities, by a structural predicate — and it is handed the holder explicitly. Nothing here imports the
+ * provider: an email capability composed with no payments finds no meter and enqueues as it always did.
+ *
+ * **A meter refuses; it never bills.** `charge` either records the use or throws the provider's own refusal
+ * (`payments/quota_exceeded`, 402). What it counted is never reported to a store — the kit does not sell
+ * overage — so this seam has no way to read a count back out.
+ */
+/** Who a charge is against: the holder pair, exactly as the provider keys it. */
+export interface MeterSubject {
+    /** The kind of holder — `user` or `organization` under `@pithy-sh/payments`. */
+    readonly subjectType: string;
+    /** The holder's id. */
+    readonly subjectId: string;
+}
+/** One charge against one meter. */
+export interface MeterCharge {
+    /** Who uses it. */
+    readonly subject: MeterSubject;
+    /** Which meter — `emails`. */
+    readonly meter: string;
+    /** How many. A whole number from 1. */
+    readonly amount: number;
+    /** The clock. Defaults to now. */
+    readonly now?: Date;
+    /** Where a refused or failed charge is logged. Optional; the provider logs through its own when absent. */
+    readonly log?: Logger;
+}
+/** The meter a provider exposes. */
+export interface UsageMeter {
+    /** The capability answering — `payments`. */
+    readonly provider: string;
+    /**
+     * Record `amount` of `meter` against `subject`, or refuse. An advisory meter records nothing and refuses
+     * nothing. **A charge that cannot be checked refuses**, because under-counting has no recovery.
+     */
+    charge(env: Record<string, unknown>, charge: MeterCharge): Promise<void>;
+}
+/** A composed capability that provides a meter. */
+export interface UsageMeterProvider extends Capability {
+    /** The meter. */
+    readonly usageMeter: UsageMeter;
+}
+/** Whether a composed capability provides a usage meter. Structural, so no provider package is imported. */
+export declare function isUsageMeterProvider(capability: Capability): capability is UsageMeterProvider;
+/** The composed usage meter, or undefined when nothing composed provides one. */
+export declare function composedUsageMeter(capabilities: readonly Capability[]): UsageMeter | undefined;
+//# sourceMappingURL=meter.d.ts.map

package/dist/entitlement/meter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meter.d.ts","sourceRoot":"","sources":["../../src/entitlement/meter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;;;;;;;;;;GAYG;AAEH,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,2GAA2G;IAC3G,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,iBAAiB;IACjB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,4GAA4G;AAC5G,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,IAAI,kBAAkB,CAG7F;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,GAAG,SAAS,CAE9F"}

package/dist/entitlement/meter.js

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/entitlement/meter.ts
+/** Whether a composed capability provides a usage meter. Structural, so no provider package is imported. */
+function isUsageMeterProvider(capability) {
+	return typeof capability.usageMeter?.charge === "function";
+}
+/** The composed usage meter, or undefined when nothing composed provides one. */
+function composedUsageMeter(capabilities) {
+	return capabilities.find(isUsageMeterProvider)?.usageMeter;
+}
+//#endregion
+export { composedUsageMeter, isUsageMeterProvider };

package/dist/entitlement/require.js

@@ -8,7 +8,7 @@ import { ENTITLEMENT_DENIED_ACTION, EntitlementKey, grantedEntitlementKeys } fro
 * `verification`-strategy sibling every paid route carries: it says what the caller must *hold*, the
 * way `requireAuth()` says who the caller must *be*, and it belongs on the route line beside it.
 *
-*   app.get("/reports", requireAuth(), requireEntitlement("pro"), zValidator(…), handler)
+*   app.get("/reports", requireAuth(), requireEntitlement("pro"), validate(…), handler)
 *
 * It lives in `@pithy-sh/core` rather than in `@pithy-sh/payments` for the same reason `requireAuth()`
 * is copied into each capability instead of imported from `@pithy-sh/auth`: a gate that arrives with a

package/dist/error/cause.d.ts

@@ -10,8 +10,12 @@
  * This module holds only what does not — the facts about the shapes a runtime hands over, and the filter
  * that decides whether one of its strings is safe to put in front of an adopter.
  *
+ * The one exception is an import that would not resolve, and it has its own module: `unresolved.ts`
+ * decides the kind and the remedy for all three surfaces, because three surfaces deciding it kept
+ * disagreeing (#709).
+ *
  * **The filter is here for the same reason the facts are, and the argument took two issues to finish.**
- * #223 moved `rootCause`, `prop` and `isBuildFailureWrapper` in and deliberately left `safeReason` beside
+ * #223 moved `rootCause` and `prop` in and deliberately left `safeReason` beside
  * the three refusals, on the reading that what a surface may say is that surface's business. That is true
  * of the sentences and false of the filter: whether a string carries a path, a stack frame or half a
  * parser's ANSI box is a property of the string, and the answer cannot differ between the CLI, a
@@ -24,11 +28,12 @@
 /**
  * Read a property off an unknown throwable without widening anything to `any`.
  *
- * Deliberately duck-typed. Bun's `ResolveMessage` and `BuildMessage` — the two shapes the CLI's `bin` and
- * the vite plugin actually catch, since both run on Bun — are their own classes and are **not**
- * `instanceof Error`. An `instanceof` gate here passes a whole suite under vitest, which runs on Node,
- * and silently drops the parser's own sentence on the runtime that ships. That is #207, and it is why
- * every reader of a cause in this kit goes through this function.
+ * Deliberately duck-typed. A cause is `unknown`, and an `instanceof Error` gate is a claim about a
+ * runtime's classes that the runtime can break. Bun did: on 1.3 its `ResolveMessage` and `BuildMessage`
+ * were **not** `instanceof Error`, so a gate passed a whole suite under vitest, which runs on Node, and
+ * silently dropped the parser's own sentence on the runtime that ships. That is #207. Bun 1.4 made both
+ * real `Error`s (measured on 1.4.2), and nothing here had to change, which is the point: every reader of
+ * a cause in this kit goes through this function and reads fields, never a class.
  *
  * Non-enumerable properties are read too — `AggregateError.errors` is one, and {@link rootCause}
  * depends on it.
@@ -43,7 +48,7 @@ export declare function prop(cause: unknown, key: string): unknown;
  * and only by running on Bun with a failure of the *realistic* shape.
  *
  * **And the realistic shape is the wrapped one.** A stray brace cascades — one missing `}` in a
- * `pithy.config.ts` produced four diagnostics on Bun 1.3.14 — so a syntax error arrives wrapped far more
+ * `pithy.config.ts` produces four diagnostics on Bun 1.4.2 — so a syntax error arrives wrapped far more
  * often than bare. Classified as-is, the wrapper matches nothing: not a resolution failure, not a parse
  * error, just something with a message. The refusal then says *the config threw while loading, run the
  * file directly* while holding the line and column in its hand. #207 fixed the bare case and left this
@@ -58,26 +63,6 @@ export declare function prop(cause: unknown, key: string): unknown;
  * a runtime that stops wrapping needs no change here.
  */
 export declare function rootCause(cause: unknown): unknown;
-/**
- * The wrapper **after the diagnostics are gone** — a build that failed, and that is all that is left.
- *
- * {@link rootCause} handles the first `import()`. It cannot handle the second: Bun caches a failed module
- * and re-throws an `AggregateError` with **no `errors` at all**, just the count and the path. There is
- * nothing to unwrap, so a classifier that only unwraps reads a syntax error as "it threw" from the second
- * caller onward — which is what `pithy doctor` shows an adopter, because resolving the project's account
- * loads the root config before the report does (#206, #223).
- *
- * Nothing else Bun throws degrades this way: a `ResolveMessage`, a bare `BuildMessage` and a module's own
- * `Error` are byte-identical on every import. Only the wrapper forgets.
- *
- * So the wrapper is recognized by its own message. **What it proves is narrow and worth stating:** the
- * module reached the builder and the builder produced diagnostics. It did not fail to resolve — Bun
- * throws the first `ResolveMessage` bare, wrapping nothing, even for a file with several bad imports —
- * and it did not run, so it cannot have thrown. It failed to parse or to build. A caller may say that
- * much and no more: the message itself carries an absolute path and a count, neither of which is the
- * adopter's business, so it is a *predicate* here rather than a string anyone is tempted to print.
- */
-export declare function isBuildFailureWrapper(cause: unknown): boolean;
 /**
  * The thrown value's message, **de-colored** — `undefined` when it has none.
  *
@@ -100,15 +85,6 @@ export declare function causeMessage(cause: unknown): string | undefined;
  * developer one frame of digging, and a mistake puts a path, a source line or a stack frame in a field
  * that is rendered.
  *
- * **Provenance first, then content.** Bun's build-failure wrapper is refused outright, before a single
- * content test runs. The content tests exist for a diagnostic that *might* be safe; the wrapper never is,
- * because its whole message is a count nobody asked for and a path that must not travel. Leaving it to
- * the content tests is what leaked: `2 errors building "app/config:12:5.ts"` has no leading slash, sailed
- * through the absolute-path check, and produced *The config does not parse: 2 errors building
- * "app/config:12:5.ts". Line 12, column 5.* — a path the adopter never wrote, and a position fabricated
- * out of a file name (#223). That suppression was written three times because the filter was. It is
- * written once here, and {@link failurePosition} refuses the same shape for the same reason.
- *
  * A trailing period comes off: every caller puts this inside a sentence of its own.
  */
 export declare function safeReason(cause: unknown): string | undefined;
@@ -127,85 +103,9 @@ export interface FailurePosition {
  * path they are appended to. Whether a surface prints them is that surface's policy: two of the three
  * classifiers do, and the capability loader deliberately does not.
  *
- * Refuses Bun's build-failure wrapper on provenance, exactly as {@link safeReason} does. That message
- * holds a file name and a count and nothing about where anything failed, so a `:12:5` found in it is a
- * coincidence of the path's own characters — and a fabricated position reads as authoritative.
- */
-export declare function failurePosition(cause: unknown): FailurePosition | undefined;
-/** What kind of thing failed to resolve. Three causes that wore one sentence until #489. */
-export type UnresolvedKind = 
-/** A bare specifier for a package that is not installed. Installing dependencies is the remedy. */
-"package"
-/** An installed package asked for a subpath it does not provide. Installing again changes nothing. */
- | "package-subpath"
-/** A relative import of a file in the project's own tree. Installing again changes nothing. */
- | "local-file";
-/**
- * Which of the three unresolved-import causes this was, or `undefined` when it cannot be told.
- *
- * **The discriminator was already in the message and was being thrown away.** `unresolvedSpecifier`
- * matches `Cannot find (?:package|module)` — and `package` versus `module` is exactly the fact that
- * separates a missing dependency from the other two. It sat in a non-capturing group, so every cause
- * arrived wearing one sentence, and for two of the three that sentence advised an install which is
- * *guaranteed* to change nothing. That is #489's class exactly: guidance a caller cannot follow, worst
- * for the caller it is written for, which has no human to shrug and try something else.
- *
- * Measured across Node 24.13.0 and Bun 1.3.14, because the two runtimes hand back different halves and
- * each hands back exactly one usable one:
- *
- * | cause | Node says | Bun's `specifier` |
- * |---|---|---|
- * | package absent | `Cannot find package 'pkg'`, no `url` | `pkg` |
- * | subpath missing | `Cannot find module '/abs/node_modules/pkg/src/nope.js'`, `url` under node_modules | `pkg/src/nope` |
- * | adopter's file | `Cannot find module '/abs/apps/board/src/x'`, `url` outside node_modules | `./src/x` |
- *
- * Bun gives the **specifier as written**, so a leading `.` settles it. Node gives the **already-resolved
- * path**, where being under `node_modules` settles it. Neither read works on both runtimes; the pair
- * does, and it is the same predicate — *is this inside node_modules* — applied to whichever fact the
- * runtime supplied.
- */
-export declare function unresolvedKind(cause: unknown): UnresolvedKind | undefined;
-/**
- * The specifier that did not resolve.
- *
- * A recorded fact about two runtimes: Bun's `ResolveMessage` carries it as a **field**, and Node states it
- * in prose. The field is preferred wherever there is one, because the prose around it names the referrer's
- * absolute path — the specifier is the adopter's own import, the referrer is our frame.
- *
- * Whether a surface names it, and what it advises when it does, is that surface's policy and stays there.
- */
-export declare function unresolvedSpecifier(cause: unknown): string | undefined;
-/**
- * The package whose own source contained the import that did not resolve — **never a path**.
- *
- * {@link unresolvedSpecifier} answers *what* did not resolve. This answers *where the import lives*, and
- * the two are different facts whenever the failing import is not the adopter's own. #480 is that case
- * verbatim: `pithy add email` on a fresh project refused with
- *
- * > Nothing resolves "@pithy-sh/core/src/capability/capability".
- *
- * while `@pithy-sh/core` resolved from the Worker at every step of the run, before and after. The
- * specifier was honest — the runtime really could not resolve it — but the import belonged to
- * `@pithy-sh/email`, which had just been installed and was the package genuinely not linked. So the
- * refusal named the one dependency that was definitely fine, and an adopter following it ran `bun
- * install` against a tree that already had core in it. The importer is the half that would have pointed
- * at `email`, and both runtimes hand it over: **Bun's `ResolveMessage` carries `referrer` as a field**
- * (measured on 1.3.14) and Node states it in prose as `imported from <path>`.
- *
- * **A package name, or nothing.** The referrer is an absolute path — our frame, and the reason
- * {@link unresolvedSpecifier} drops the prose around the specifier — so what travels is the one part of
- * it that is not a path: the package directory it sits under. A referrer outside `node_modules` is the
- * adopter's own file, and there is nothing to say about it that the refusal does not already say by
- * naming the config, so it answers `undefined` rather than a path. The path itself is never returned
- * from this module, which is what makes leaking it impossible rather than merely discouraged.
- *
- * The **last** `node_modules` in the path, because every store layout nests: pnpm's
- * `node_modules/.pnpm/<id>/node_modules/<pkg>` and Bun's isolated linker's
- * `node_modules/.bun/<pkg>@<version>/node_modules/<pkg>` (both measured) put the real owner last, and so
- * does an ordinary nested install. The name is then checked against what npm allows, so a store's own
- * bookkeeping directory (`.bun`, `.pnpm`, `hono@4.6.3`) can only ever answer nothing.
- *
- * Whether a surface names it, and what it advises when it does, is that surface's policy and stays there.
+ * `isOwn`, when given, is asked about the file a structured position names, and a position in a file it
+ * disowns is no position at all: Bun's line and column in a file the config imports, quoted as the config's,
+ * send the adopter to a place in their config that is fine (#709).
  */
-export declare function importingPackage(cause: unknown): string | undefined;
+export declare function failurePosition(cause: unknown, isOwn?: (file: string) => boolean): FailurePosition | undefined;
 //# sourceMappingURL=cause.d.ts.map

package/dist/error/cause.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cause.d.ts","sourceRoot":"","sources":["../../src/error/cause.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQjD;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG7D;AAeD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAQ7D;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAS3E;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc;AACxB,mGAAmG;AACjG,SAAS;AACX,sGAAsG;GACpG,iBAAiB;AACnB,+FAA+F;GAC7F,YAAY,CAAC;AAOjB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAiBzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAKtE;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CASnE"}
+{"version":3,"file":"cause.d.ts","sourceRoot":"","sources":["../../src/error/cause.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQjD;AAeD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAO7D;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,eAAe,GAAG,SAAS,CAU9G"}