cursedbelt 2.7.0 → 3.0.0

package/dist/server/runtime/recipe.js

@@ -1,722 +0,0 @@
-/**
- * The runtime recipe — ONE wiring point (spec 02 §2, the keystone).
- *
- * Before this file, `createCcRuntime` was invoked by tests and nothing else: a
- * production entrypoint with no caller. The generated app (02 §1) is a ~30-line
- * shell that calls `bootEngineApp` here; every real host — the generator's
- * `server.ts` and the saas `worker.ts` — routes through this ONE tested library
- * function rather than re-hand-wiring the tier N times into N subtly divergent
- * hosts.
- *
- * This file is where the binding laws become MECHANICAL rather than aspirational:
- *
- *   * **Law #9 (wire both halves in one place).** The two standing footguns of
- *     the refactor — search dual-wiring (read side to `createKnowledgeService`,
- *     write side to `createCcRuntime`) and job-kind/handler drift — die here
- *     structurally. The search provider is constructed ONCE and handed to every
- *     consumer; the job-handler map is assembled beside the enqueueable-kind
- *     inventory and reconciled by `assertJobKindsHandled` before anything serves.
- *
- *   * **Law #1 (no orphan seams).** A platform service the recipe does not
- *     construct is visibly unreachable in review — this is the file where "does
- *     anything call it?" has one answer to check.
- *
- *   * **Law #3 (boot-loud on wiring).** A missing driver for an effective AI
- *     feature, a missing ObjectStore for an effective asset engine, or an
- *     enqueueable job kind with no handler is a startup failure here, never a
- *     500 (or a 202 into a void) on the first request that needs the piece.
- *
- * Construction order (there is NO cycle, despite appearances):
- *   job handlers ── depend on storage/gateway/search only
- *        └─► broker ── depends on the handler map
- *              └─► engine services ── depend on the broker
- *                    └─► createCcRuntime ── depends on services + broker + search
- *
- * `buildJobHandlers` (jobs seam) and `buildEngineServices` (services seam) are
- * split so that ordering is honest: the spec sketched a single
- * `buildEngineServices` returning both, but the broker sits between the two
- * halves, so folding them into one call would have required either building the
- * broker twice or passing a broker that did not yet know its own handlers. Two
- * clearly-named seam functions, composed by `bootEngineApp`, is the faithful
- * realization of law #9.
- */
-import { Database } from 'bun:sqlite';
-import { mkdirSync } from 'node:fs';
-import path from 'node:path';
-import { KNOWLEDGE_MIGRATIONS, KNOWLEDGE_NAMESPACE, MEDIA_MIGRATIONS, MEDIA_NAMESPACE, SEARCH_MIGRATIONS, SEARCH_NAMESPACE, STAGING_MIGRATIONS, STAGING_NAMESPACE, SYSTEM_MIGRATIONS, SYSTEM_NAMESPACE, LOCAL_TENANT_ID, } from 'cwip/domains';
-import { createFsObjectStore, createLocalStorageProvider, } from 'cwip/storage';
-import { createSqliteSearchProvider } from 'cwip/search-provider';
-import { assertCcPragmas, createSqliteBackupService, getTxnLifetimeGuard, runNamespacedMigrations, } from 'cwip/sqlite';
-import { createCognitiveGateway, createLocalJobBroker, createSqliteJobResultStore } from '../drivers';
-import { assertSaasHostWiring } from './saasHost';
-import { createProviderDriver, PROVIDER_DEFAULT_ENDPOINT, } from '../drivers/providers';
-import { createPlanEnforcer } from '../mixins/enforcement';
-import { AppError } from '../errors';
-import { createSessionSigner } from '../guard/sessionSigner';
-import { effectiveSignupMode } from '../../config/appConfig';
-import { createServerPushHub, DOMAIN_OWNER_ENGINE } from '../stream';
-import { createAssetJobHandlers, createAccountService, createAssetService, createVaultMediaSource, createDevJobHandlers, createDevService, createGuardService, createKnowledgeJobHandlers, createKnowledgeReindexSource, createKnowledgeService, createSearchJobHandlers, createSystemService, createVaultUploadReaper, } from '../services';
-import { createCcRuntime } from './createCcRuntime';
-/**
- * Resolve `host.search` against a gateway — the ONE place a factory is called.
- *
- * Exported because there are TWO processes that build a handler map: this recipe
- * (the API node) and the generated `worker.ts`. A worker that resolved the tier
- * differently — or, as it did before 04 §3, not at all — would lease a `reindex`
- * job off the shared queue and run the loud placeholder against it, so the job
- * the API node enqueued would fail on the other side of Redis with an error
- * about a seam the API node has. Both callers now go through this.
- */
-export const resolveSearchTier = (search, deps) => {
-    if (search === undefined)
-        return undefined;
-    if (typeof search !== 'function')
-        return search;
-    const { embedModel } = deps;
-    return search(embedModel
-        ? {
-            embed: (text, tenantId) => deps.gateway.embed({ text, model: embedModel, tenantId }),
-            embedModel: `${embedModel.provider}:${embedModel.model}`,
-        }
-        : {});
-};
-const DOMAIN_CHAINS = Object.freeze({
-    knowledge: { namespace: KNOWLEDGE_NAMESPACE, migrations: KNOWLEDGE_MIGRATIONS },
-    media: { namespace: MEDIA_NAMESPACE, migrations: MEDIA_MIGRATIONS },
-    search: { namespace: SEARCH_NAMESPACE, migrations: SEARCH_MIGRATIONS },
-    system: { namespace: SYSTEM_NAMESPACE, migrations: SYSTEM_MIGRATIONS },
-    staging: { namespace: STAGING_NAMESPACE, migrations: STAGING_MIGRATIONS },
-});
-/**
- * The domains a manifest's active engines own. `search` is owned by `knowledge`
- * but only opened when search is actually consumed (default: `knowledge`
- * active); `staging` is a dev sandbox never present in an export, so it is
- * excluded unless a caller explicitly opts in.
- */
-export function resolveManagedDomains(manifest, options = {}) {
-    const engines = new Set(manifest.engines);
-    const enableSearch = options.enableSearch ?? engines.has('knowledge');
-    const includeStaging = options.includeStaging ?? false;
-    return Object.keys(DOMAIN_CHAINS).filter((domain) => {
-        if (!engines.has(DOMAIN_OWNER_ENGINE[domain]))
-            return false;
-        if (domain === 'search')
-            return enableSearch;
-        if (domain === 'staging')
-            return includeStaging;
-        return true;
-    });
-}
-/**
- * Open exactly the domain DBs the manifest's active engines own, apply the
- * pragma profile and the namespaced migration chain per handle, and return the
- * local `StorageProvider` built over them. The saas variant is a gated seam:
- * until the dialect repositories (03 §2) can execute against Postgres, a saas
- * profile must inject its own `StorageProvider` upstream (`bootEngineApp`'s
- * `storage` option) rather than have this function open sockets it cannot yet
- * run repositories through.
- */
-export function openDomainHandles(manifest, options = {}) {
-    if (manifest.profile === 'saas') {
-        throw new AppError('openDomainHandles builds the LOCAL sqlite provider only. Under saas, inject a StorageProvider built over the pooled connection (03 §2) via bootEngineApp({ storage }).', { code: 'SAAS_STORAGE_UNWIRED', status: 500, isOperational: false, context: { profile: manifest.profile } });
-    }
-    const domains = options.domains ??
-        resolveManagedDomains(manifest, { enableSearch: options.enableSearch, includeStaging: options.includeStaging });
-    const openDatabase = options.openDatabase ?? ((file) => new Database(file));
-    const handles = {};
-    const owned = [];
-    for (const domain of domains) {
-        const injected = options.handles?.[domain];
-        let db;
-        if (injected) {
-            db = injected;
-        }
-        else {
-            if (options.root === undefined)
-                throw new AppError(`No root and no injected handle for domain "${domain}". A host resolves the storage root and passes it — the library never derives a path from env (handle-injection law).`, { code: 'DOMAIN_ROOT_MISSING', status: 500, isOperational: false, context: { domain } });
-            db = openDatabase(path.join(options.root, `${domain}.db`));
-            owned.push(db);
-        }
-        assertCcPragmas(db);
-        const chain = DOMAIN_CHAINS[domain];
-        runNamespacedMigrations(db, chain.migrations, { namespace: chain.namespace });
-        handles[domain] = db;
-    }
-    const storage = createLocalStorageProvider({
-        handles,
-        ...(options.auditCdc ? { auditCdc: true } : {}),
-        ...(options.interceptors ? { interceptors: options.interceptors } : {}),
-    });
-    return {
-        storage,
-        handles,
-        searchDb: handles.search,
-        async close() {
-            // Only close what we opened — an injected handle stays the host's to close.
-            for (const db of owned) {
-                getTxnLifetimeGuard(db)?.dispose();
-                db.close();
-            }
-        },
-    };
-}
-// ---------------------------------------------------------------------------
-// The job-kind ↔ handler inventory assert (closes audit G8 for every kind).
-// ---------------------------------------------------------------------------
-/**
- * The kinds each engine's ops table + services can enqueue. Derived from
- * `OP_JOB_KINDS` (`engineOps.ts`) plus the service-enqueued kinds (`organize`,
- * `ocr`): asset ops enqueue media `reindex`/`transcode` and the service `ocr`;
- * knowledge ops enqueue `reindex`/`import` and the service `organize`; dev ops
- * enqueue `deploy`.
- */
-const ENGINE_ENQUEUEABLE_KINDS = Object.freeze({
-    asset: ['reindex', 'transcode', 'ocr'],
-    knowledge: ['reindex', 'organize', 'import'],
-    dev: ['deploy'],
-    guard: [],
-    system: [],
-});
-/** Every job kind the manifest's active engines can put on the broker. */
-export function enqueueableKindsFor(manifest) {
-    const kinds = new Set();
-    for (const engine of manifest.engines)
-        for (const kind of ENGINE_ENQUEUEABLE_KINDS[engine] ?? [])
-            kinds.add(kind);
-    return [...kinds];
-}
-/**
- * The boot assert (audit G8, forever): a kind the active surface can enqueue
- * with no registered handler is a startup failure on BOTH the server and the
- * saas worker — never a 202 into a void. `bootEngineApp` calls it before
- * `createCcRuntime`; the generated `worker.ts` calls it against its own map.
- */
-export function assertJobKindsHandled(options) {
-    const missing = options.enqueueableKinds.filter((kind) => !(kind in options.handlers));
-    if (missing.length > 0)
-        throw new AppError(`Job kinds are enqueueable with no registered handler: ${missing.join(', ')}. A kind that can be enqueued must have a handler on both the server and the worker (law #9); register a real handler or an explicit unimplemented one — silent absence is banned.`, { code: 'JOB_KIND_UNHANDLED', status: 500, isOperational: false, context: { missing } });
-}
-/** A handler that fails a job LOUDLY for a kind whose vertical is not yet built. */
-function unimplementedHandler(kind, owner) {
-    return () => {
-        throw new AppError(`Job kind "${kind}" is enqueueable but its handler is not yet implemented (${owner}).`, {
-            code: 'JOB_HANDLER_UNIMPLEMENTED',
-            status: 501,
-            isOperational: true,
-            context: { kind, owner },
-        });
-    };
-}
-export function buildJobHandlers(options) {
-    const { manifest, storage, gateway, search } = options;
-    const engines = new Set(manifest.engines);
-    const enqueueableKinds = enqueueableKindsFor(manifest);
-    const handlers = {};
-    // reindex — real when a search provider is wired (steady-state CDC indexing
-    // works regardless; this is the bulk rebuild path). Knowledge is the landed
-    // reindex source; media's is 04 §2, so a media reindex over this handler is a
-    // no-op until then (documented, not silent — the source list is explicit).
-    if ((engines.has('knowledge') || engines.has('asset')) && search) {
-        const sources = engines.has('knowledge') ? [createKnowledgeReindexSource(storage)] : [];
-        Object.assign(handlers, createSearchJobHandlers({ search, sources, pageSize: options.reindexPageSize }));
-    }
-    // organize — real when a model is wired; else loud-unimplemented.
-    if (engines.has('knowledge')) {
-        if (options.jobModel)
-            Object.assign(handlers, createKnowledgeJobHandlers({ storage, gateway, model: options.jobModel, applyProposals: options.applyProposals }));
-    }
-    // deploy — real when the dev engine has both an execution driver and a plan
-    // (03 §4b). Either missing ⇒ the loud placeholder below, never a silent no-op.
-    if (engines.has('dev') && options.exec && options.deployPlan) {
-        Object.assign(handlers, createDevJobHandlers({ exec: options.exec, plan: options.deployPlan, push: options.push }));
-    }
-    // transcode + ocr (04 §2d) — real whenever the asset engine is active, which
-    // guarantees an ObjectStore (boot fails OBJECT_STORE_MISSING without one). OCR
-    // feeds knowledge, so its sink is present only when that engine is too.
-    if (engines.has('asset') && options.objects) {
-        Object.assign(handlers, createAssetJobHandlers({
-            storage,
-            objects: options.objects,
-            gateway,
-            hasKnowledge: engines.has('knowledge'),
-            // OCR's optional titling pass reuses the app's job model when one is wired.
-            ocrModel: options.jobModel,
-        }));
-    }
-    // Every remaining enqueueable kind gets an explicit loud handler so a stray
-    // enqueue fails visibly in the job result rather than silently vanishing.
-    const ownerOf = {
-        reindex: 'search reindex needs a wired SearchProvider',
-        organize: 'knowledge organize needs a wired jobModel (03 §1 AI drivers)',
-        transcode: 'asset transcode handler — 04 §2',
-        ocr: 'asset ocr handler — 04 §2',
-        import: 'knowledge lists import handler — 04',
-        deploy: 'dev deploy needs an ExecutionDriver (exec) and a deployPlan wired (03 §4b)',
-    };
-    for (const kind of enqueueableKinds)
-        if (!(kind in handlers))
-            handlers[kind] = unimplementedHandler(kind, ownerOf[kind] ?? 'not yet built');
-    return { handlers: Object.freeze(handlers), enqueueableKinds };
-}
-/**
- * Wire the guard engine's identity (02 §1b/§2): build ONE `AccountService` over
- * the injected identity store (it backs both the `resolveIdentity` seam AND the
- * mixin's login/signup/password routes), and pick the resolver:
- *
- *   - an explicit `deps.resolveIdentity` always wins (a test, or an exotic host);
- *   - else default from the account service — the bootstrap OWNER under `local`,
- *     or the request-session resolver under `saas` WHEN a `currentClaims` accessor
- *     was supplied (the saas server sets it per request);
- *   - else a boot failure (loud, not a silent "guard never turns on"): saas with
- *     neither a resolver nor a session accessor cannot resolve anyone.
- *
- * When no identity store is wired at all, only an explicit resolver is possible
- * (no account routes) — anything else is `GUARD_IDENTITY_UNWIRED`.
- */
-function resolveGuardIdentity(deps, manifest, signer) {
-    const profile = manifest.profile;
-    if (deps.identity) {
-        const account = createAccountService({
-            identity: deps.identity,
-            profile,
-            signer,
-            currentClaims: deps.currentClaims,
-            deriver: deps.deriver,
-            // The launch gate (D33): the manifest's strictest configured value, so the
-            // service refuses what the config closed even for a caller that bypasses
-            // the mixin's own short-circuit.
-            signupMode: effectiveSignupMode(manifest.instances),
-        });
-        if (deps.resolveIdentity)
-            return { resolveIdentity: deps.resolveIdentity, account };
-        if (profile === 'local' || deps.currentClaims)
-            return { resolveIdentity: account.resolveIdentity, account };
-        // saas with an identity store but no way to read the request session, and no
-        // explicit resolver — the account routes exist but nobody can be resolved.
-        throw new AppError('The guard engine is active under saas with an identity store but no currentClaims accessor and no explicit resolveIdentity — the recipe cannot invent a per-request session accessor (02 §2).', { code: 'GUARD_IDENTITY_UNWIRED', status: 500, isOperational: false, context: { profile } });
-    }
-    if (deps.resolveIdentity)
-        return { resolveIdentity: deps.resolveIdentity };
-    throw new AppError('The guard engine is active but neither resolveIdentity nor an identity store was provided to guardDeps (02 §1b).', { code: 'GUARD_IDENTITY_UNWIRED', status: 500, isOperational: false, context: { profile } });
-}
-/**
- * `VACUUM INTO` over the handle the recipe already holds (01 §6.1). Copying a
- * live `.db` with a `-wal` beside it silently loses the most recent committed
- * transactions, which is why a file copy is a V6 ERROR and this is the only
- * snapshot path.
- */
-function defaultSnapshotFn(handles) {
-    const backups = createSqliteBackupService();
-    return (domain, destination) => {
-        const db = handles[domain];
-        if (!db)
-            throw new AppError(`Cannot snapshot domain "${domain}": this app's active engines do not open it.`, {
-                code: 'SNAPSHOT_DOMAIN_INACTIVE',
-                status: 404,
-                context: { domain },
-            });
-        // The snapshot root is a defaulted path, so nothing has created it yet — and
-        // `VACUUM INTO` reports a missing directory as an opaque "unable to open
-        // database file" against the DESTINATION, which reads like source corruption.
-        mkdirSync(path.dirname(destination), { recursive: true });
-        backups.snapshot(db, destination, { overwrite: true });
-    };
-}
-function requireDeps(value, engine, code) {
-    if (value === undefined)
-        throw new AppError(`The "${engine}" engine is active but its injected dependencies were not provided to buildEngineServices.`, {
-            code,
-            status: 500,
-            isOperational: false,
-            context: { engine },
-        });
-    return value;
-}
-/**
- * Construct each active engine's service. Absent engines get no service;
- * `composeServer` throws on a required missing one (boot-loud). The search
- * provider passed here is the READ side — the SAME instance must reach
- * `createCcRuntime` for the write tap, which `bootEngineApp` guarantees by
- * threading one value to both.
- */
-export function buildEngineServices(options) {
-    const { manifest, storage, broker, telemetry } = options;
-    const engines = new Set(manifest.engines);
-    const services = {};
-    if (engines.has('asset'))
-        services.asset = createAssetService({
-            storage,
-            objects: requireDeps(options.objects, 'asset', 'OBJECT_STORE_MISSING'),
-            broker,
-            telemetry,
-            verifySignedUrl: options.verifySignedUrl,
-            mintId: options.mintId,
-            onOrphanedObject: options.onOrphanedObject,
-            // Register the vault as an extra source so its `mv_assets` appear through
-            // the asset engine (§2b) — AssetStudio then replaces Media Vault.
-            sources: manifestHasVaultSource(manifest) ? [createVaultMediaSource(storage)] : undefined,
-        });
-    if (engines.has('knowledge'))
-        services.knowledge = createKnowledgeService({ storage, broker, search: options.search });
-    if (engines.has('system'))
-        services.system = createSystemService({ storage });
-    if (engines.has('guard')) {
-        const deps = requireDeps(options.guardDeps, 'guard', 'GUARD_DEPS_MISSING');
-        const wiring = resolveGuardIdentity(deps, manifest, options.signer);
-        services.guard = createGuardService({
-            manager: deps.manager,
-            secrets: deps.secrets,
-            signer: options.signer,
-            appId: manifest.appId,
-            resolveIdentity: wiring.resolveIdentity,
-            onLocked: deps.onLocked,
-        });
-        // The account surface backs the guard mixin's login/signup/password routes
-        // (02 §2). Present only when an identity store was wired.
-        services.account = wiring.account;
-    }
-    if (engines.has('dev')) {
-        const deps = requireDeps(options.devDeps, 'dev', 'DEV_DEPS_MISSING');
-        const snapshotRoot = deps.snapshotRoot ?? options.snapshotRoot;
-        const snapshot = deps.snapshot ?? (options.domainHandles ? defaultSnapshotFn(options.domainHandles) : undefined);
-        if (snapshotRoot === undefined || snapshot === undefined)
-            throw new AppError('The dev engine is active but its snapshot seam is unwired: no devDeps.snapshot/snapshotRoot, and the caller injected its own StorageProvider so there are no handles to default from.', { code: 'DEV_SNAPSHOT_UNWIRED', status: 500, isOperational: false, context: { engine: 'dev' } });
-        services.dev = createDevService({
-            registry: deps.registry,
-            portSigner: deps.portSigner,
-            broker,
-            snapshotRoot,
-            snapshot,
-            config: deps.config,
-            diskUsage: deps.diskUsage,
-            isProcessAlive: deps.isProcessAlive,
-            // The three 03 §1e read-side seams. Each is optional here and required by
-            // its own feature at request time: the service throws a typed 501 naming
-            // the missing wiring rather than answering an empty list, so "the surface
-            // is unwired" and "nothing has happened yet" stay different screens.
-            exec: options.exec,
-            jobResults: options.jobResults,
-            screenshots: deps.screenshots,
-        });
-    }
-    return services;
-}
-// ---------------------------------------------------------------------------
-// 2c. buildDrivers — declared providers → constructed drivers + CSP endpoints,
-// with the AI boot gate (mirror of assertArgon2idReady).
-// ---------------------------------------------------------------------------
-/** Effective feature keys that require an AI driver to run at all. */
-const AI_FEATURE_KEYS = new Set([
-    'aiOrganizer',
-    'ragChat',
-    'ragDiskIndexing',
-    'oralHistory',
-    'imageStudio',
-]);
-/**
- * Whether any effective feature in the manifest needs a cognitive driver.
- *
- * Note the interaction with capability downgrade, because it decides which of two
- * behaviors an app gets: when the boot probe reports no AI provider, verification
- * downgrades AI features to effective-OFF, so their routes are never composed and
- * this returns false — a missing local model takes the AI SURFACE away rather than
- * taking the app down. The gate below therefore fires exactly when an effective AI
- * feature SURVIVES with no driver behind it (a last-good bundle compiled on a
- * capable machine, or an explicitly configured model), which is the case where
- * serving would mean shipping a route with nothing behind it.
- */
-export function manifestNeedsAi(manifest) {
-    return manifest.instances.some((instance) => Object.entries(instance.effective).some(([key, value]) => AI_FEATURE_KEYS.has(key) && value === true));
-}
-/**
- * Whether any asset instance has the `vaultSource` feature effective-on — the
- * signal to register the content-addressed vault as an AssetService source (04
- * §2b), which is what lets AssetStudio replace `plugin-media-vault`. Absent ⇒ the
- * asset service is the file catalogue alone, exactly as before.
- */
-export function manifestHasVaultSource(manifest) {
-    return manifest.instances.some((instance) => instance.engine === 'asset' && instance.effective.vaultSource === true);
-}
-export function buildDrivers(manifest, options = {}) {
-    const declared = options.providers ?? {};
-    const drivers = {};
-    const cspEndpoints = new Set(options.modelEndpoints ?? []);
-    for (const [provider, credentials] of Object.entries(declared)) {
-        // Construction throws AI_DRIVER_UNAVAILABLE for a missing key or a missing
-        // ObjectStore — at boot, naming the piece, rather than at first request.
-        drivers[provider] = createProviderDriver(provider, credentials, options.deps);
-        cspEndpoints.add(credentials.endpoint ?? PROVIDER_DEFAULT_ENDPOINT[provider]);
-    }
-    // Explicit drivers win: a host that constructed one itself meant it.
-    Object.assign(drivers, options.drivers ?? {});
-    if (manifestNeedsAi(manifest) && Object.keys(drivers).length === 0)
-        throw new AppError('The manifest has an effective AI feature but no cognitive driver is wired. Declare a provider (host.ts `providers`) or pass a constructed driver — an AI feature with no driver is a boot failure, not a first-request 503.', { code: 'AI_DRIVER_UNAVAILABLE', status: 500, isOperational: false, context: { profile: manifest.profile } });
-    const unwired = [...new Set(options.requiredProviders ?? [])].filter((provider) => !drivers[provider]);
-    if (unwired.length > 0)
-        throw new AppError(`Configured models name cognitive providers with no driver: ${unwired.join(', ')}. Declare each provider in host.ts, or stop configuring a model against it.`, {
-            code: 'AI_DRIVER_UNAVAILABLE',
-            status: 500,
-            isOperational: false,
-            context: { profile: manifest.profile, unwired },
-        });
-    return { drivers, cspEndpoints: [...cspEndpoints] };
-}
-/**
- * Compose an EffectiveManifest into a running runtime. The one audited file
- * where every seam is wired; a new platform service that this function does not
- * construct is visibly unreachable (law #1).
- */
-export function bootEngineApp(options) {
-    const { manifest, telemetry } = options;
-    const engines = new Set(manifest.engines);
-    const enableSearch = options.enableSearch ?? engines.has('knowledge');
-    // ── the saas readiness gate (04 §1c) ───────────────────────────────────────
-    // FIRST, and all at once. Each of these seams fails on its own eventually,
-    // but they used to fail one per boot attempt — and the last two only when a
-    // request reached them, which under saas meant in front of a user rather than
-    // in front of a deploy. A no-op under the local profile.
-    assertSaasHostWiring({ manifest, host: options });
-    // ── storage (2a) ─────────────────────────────────────────────────────────
-    let storage;
-    let searchDb;
-    let closeHandles;
-    // Kept so the dev engine's snapshot seam can VACUUM INTO the handles this
-    // call already holds instead of a host opening a second connection per file.
-    let domainHandles;
-    if (options.storage) {
-        storage = options.storage;
-    }
-    else {
-        const opened = openDomainHandles(manifest, {
-            root: options.root,
-            handles: options.handles,
-            enableSearch,
-            ...(options.auditCdc ? { auditCdc: true } : {}),
-            ...(options.interceptors ? { interceptors: options.interceptors } : {}),
-        });
-        storage = opened.storage;
-        searchDb = opened.searchDb;
-        closeHandles = opened.close;
-        domainHandles = opened.handles;
-    }
-    // ── object store (2d) ──────────────────────────────────────────────────────
-    let objects = options.objects;
-    let verifySignedUrl;
-    /**
-     * An INJECTED store that carries its own verifier (the fs store exposes
-     * `verifySignedUrl` on the store precisely so signer and verifier can never
-     * disagree about the key) gets that verifier wired automatically. Without
-     * this, a host that injects `createFsObjectStore(...)` — the single-box saas
-     * shape, D34 = A — passed the `objects` boot gate and then silently lost the
-     * object-serving route: `readSignedObject` only exists when a verifier is
-     * present, so every URL the store signed 404'd. An S3 store exposes no
-     * verifier (its presigned URLs never reach the app), so this stays unset
-     * there, exactly as before.
-     */
-    if (objects !== undefined) {
-        const injectedVerifier = objects.verifySignedUrl;
-        if (typeof injectedVerifier === 'function')
-            verifySignedUrl = injectedVerifier.bind(objects);
-    }
-    if (!objects && engines.has('asset') && manifest.profile === 'local') {
-        if (options.objectStoreRoot === undefined || options.objectStoreSigningKey === undefined)
-            throw new AppError('The asset engine is active but no ObjectStore (nor objectStoreRoot+objectStoreSigningKey) was provided. A file product with no object store is a boot failure (OBJECT_STORE_MISSING).', { code: 'OBJECT_STORE_MISSING', status: 500, isOperational: false, context: { profile: manifest.profile } });
-        const fsStore = createFsObjectStore({ root: options.objectStoreRoot, signingKey: options.objectStoreSigningKey });
-        objects = fsStore;
-        verifySignedUrl = fsStore.verifySignedUrl;
-    }
-    // ── drivers (2c) + gateway ──────────────────────────────────────────────────
-    // Constructed BEFORE the search provider: search's optional embedder routes
-    // through the gateway, so the gateway cannot depend on search in turn.
-    const { drivers } = buildDrivers(manifest, {
-        providers: options.providers,
-        drivers: options.drivers,
-        deps: { objects },
-        modelEndpoints: options.modelEndpoints,
-        // Every model this app is CONFIGURED to use must have a driver — a stricter
-        // gate than "some driver exists", and the one that catches a jobModel
-        // pointing at a provider the host forgot to declare.
-        requiredProviders: [options.jobModel?.provider, options.embedModel?.provider].filter((provider) => provider !== undefined),
-    });
-    const gateway = createCognitiveGateway({
-        appId: manifest.appId,
-        drivers,
-        telemetry,
-        // Defense in depth (03 §1d): the SAME enforcer the routes use, so AI work
-        // that never crossed a route — a job handler, internal automation — is held
-        // to the identical ceiling. Undefined under local, where there is no plan.
-        enforce: options.billing ? createPlanEnforcer(options.billing).assert : undefined,
-    });
-    // ── search provider (dual-wired: read + write from ONE instance) ───────────
-    //
-    // An injected provider WINS. It has to: under saas the recipe opens no
-    // `search.db` (the host injected `storage`), so `searchDb` is undefined and
-    // the branch below produces nothing — which is exactly how the saas profile
-    // came to have no search tier at all. `createSaasHostServices(…).search`
-    // supplies the far side, and `reportSaasHostWiring` refuses a saas knowledge
-    // app without it rather than letting `reindex` fail per run.
-    // The gateway-routed embedder, built once and shared by both construction
-    // paths so a metered embedding call means the same thing on both profiles.
-    const gatewayEmbed = options.embedModel
-        ? (text, tenantId) => gateway.embed({ text, model: options.embedModel, tenantId })
-        : undefined;
-    const embedModelId = options.embedModel
-        ? `${options.embedModel.provider}:${options.embedModel.model}`
-        : undefined;
-    const search = resolveSearchTier(options.search, {
-        gateway,
-        ...(options.embedModel ? { embedModel: options.embedModel } : {}),
-    }) ??
-        (enableSearch && searchDb
-            ? createSqliteSearchProvider({
-                db: searchDb,
-                // The vector half, real only when a host declares an embedding model.
-                // Routed through the gateway rather than straight at a driver so an
-                // embedding call is metered and telemetered exactly like a completion.
-                ...(gatewayEmbed ? { embed: gatewayEmbed } : {}),
-                // Recorded on every chunk and used as a query predicate: vectors from
-                // two models are not comparable even at the same width.
-                ...(embedModelId ? { embedModel: embedModelId } : {}),
-            })
-            : undefined);
-    // The ONE push hub for this runtime: constructed here (not inside
-    // createCcRuntime) so a long job handler — deploy — can publish progress onto
-    // the exact channel the `/stream` routes serve. Passed to both the handler map
-    // and the runtime below.
-    const push = createServerPushHub();
-    // ── job handlers (jobs seam) + the inventory assert (G8) ────────────────────
-    const { handlers: jobHandlers, enqueueableKinds } = buildJobHandlers({
-        manifest,
-        storage,
-        gateway,
-        search,
-        objects,
-        jobModel: options.jobModel,
-        applyProposals: options.applyProposals,
-        // deploy (03 §4b): real when the dev engine has an execution driver AND a
-        // host-supplied plan; the recipe keeps the loud placeholder otherwise.
-        exec: options.exec,
-        deployPlan: options.devDeps?.deployPlan,
-        push,
-    });
-    assertJobKindsHandled({ enqueueableKinds, handlers: jobHandlers });
-    // ── broker (depends on the handler map) ──────────────────────────────────────
-    let broker;
-    let stopBroker;
-    // The durable outcome log. Constructed HERE rather than left to the broker's
-    // own default so the `orchestration` surface reads the very rows the broker
-    // records (03 §1e) — a second store over the same file would be a second DDL
-    // owner and an empty read.
-    let jobResults = options.jobResults;
-    if (options.broker) {
-        broker = options.broker;
-    }
-    else if (manifest.profile === 'local') {
-        const jobsDb = options.jobsDb ?? new Database(options.root ? path.join(options.root, 'jobs.db') : ':memory:');
-        jobResults ??= createSqliteJobResultStore(jobsDb);
-        const local = createLocalJobBroker({ db: jobsDb, handlers: jobHandlers, results: jobResults });
-        local.start();
-        broker = local;
-        stopBroker = async () => {
-            await local.stop();
-            if (!options.jobsDb)
-                jobsDb.close();
-        };
-    }
-    else {
-        throw new AppError('A saas profile must inject its cross-process broker (createSaasJobBroker over the queue backend). bootEngineApp does not construct a queue connection.', { code: 'SAAS_BROKER_UNWIRED', status: 500, isOperational: false, context: { profile: manifest.profile } });
-    }
-    // ── engine services (services seam) ──────────────────────────────────────────
-    const signer = options.signer ??
-        createSessionSigner({
-            ttlSeconds: options.sessionTtlSeconds ?? 3600,
-            // Under saas the host passes the shared store; under local it is undefined
-            // and the signer's in-process Map is the whole denylist (03 §4a).
-            revocationStore: options.revocationStore,
-        });
-    const services = buildEngineServices({
-        manifest,
-        storage,
-        broker,
-        telemetry,
-        objects,
-        verifySignedUrl,
-        search,
-        signer,
-        guardDeps: options.guardDeps,
-        devDeps: options.devDeps,
-        ...(domainHandles ? { domainHandles } : {}),
-        ...(options.root === undefined ? {} : { snapshotRoot: path.join(options.root, 'snapshots') }),
-        // The SAME driver `createCcRuntime` puts on the dev mixin context below, and
-        // the SAME result store the broker records into — the `pipelines` and
-        // `orchestration` surfaces read exactly what the app runs (03 §1e).
-        ...(options.exec === undefined ? {} : { exec: options.exec }),
-        ...(jobResults === undefined ? {} : { jobResults }),
-        mintId: options.mintId,
-        onOrphanedObject: options.onOrphanedObject,
-    });
-    // ── the stale-upload reaper (05 §A2) ────────────────────────────────────────
-    // An `mv_uploads` row is opened before a byte moves, so a killed process or a
-    // store error after the object settled strands it in `processing` with an
-    // unreferenced object behind it. Nothing swept those, and nothing ever would
-    // have: the sweep is the ONE piece the vault replacement dropped from
-    // `plugin-media-vault`. Started here rather than in a host because a seam no
-    // host constructs is an orphan (law #1) — which is the shape this same file
-    // has already been caught in twice (`devDeps`, `resolveIdentity`).
-    let vaultReaper;
-    if (services.asset && manifestHasVaultSource(manifest)) {
-        const tenants = options.vaultReaper?.tenants ??
-            (manifest.profile === 'local'
-                ? () => [LOCAL_TENANT_ID]
-                : () => {
-                    throw new AppError('This app has the vault source on under the saas profile but wired no vaultReaper.tenants. Enumerating tenants is an unscoped read RLS forbids, so the host must name them — otherwise every abandoned upload leaks an object forever (05 §A2).', { code: 'VAULT_REAPER_UNWIRED', status: 500, isOperational: false, context: { profile: manifest.profile } });
-                });
-        // Fail at BOOT, not at the first tick an hour later: a refusal nobody is
-        // watching for is not a refusal.
-        if (manifest.profile !== 'local' && options.vaultReaper?.tenants === undefined)
-            void tenants();
-        vaultReaper = createVaultUploadReaper({
-            assets: services.asset,
-            tenants,
-            ...(options.vaultReaper?.intervalMs === undefined ? {} : { intervalMs: options.vaultReaper.intervalMs }),
-            ...(options.vaultReaper?.olderThanMs === undefined ? {} : { olderThanMs: options.vaultReaper.olderThanMs }),
-            ...(options.vaultReaper?.limit === undefined ? {} : { limit: options.vaultReaper.limit }),
-            ...(options.vaultReaper?.onError === undefined ? {} : { onError: options.vaultReaper.onError }),
-        });
-    }
-    // ── the runtime — search on BOTH sides, exec iff dev, billing iff saas ───────
-    const runtime = createCcRuntime({
-        manifest,
-        storage,
-        guard: signer,
-        gateway,
-        broker,
-        telemetry,
-        services,
-        allowedOrigins: options.allowedOrigins,
-        exec: options.exec,
-        billing: options.billing,
-        // The trail's READ side. Passed beside the pipeline rather than derived from
-        // it: the pipeline hangs on the storage provider and this backs a route, and
-        // a host that wires one without the other gets a trail nothing can read.
-        ...(options.auditTrail ? { auditTrail: options.auditTrail } : {}),
-        ...(options.siteCopy ? { siteCopy: options.siteCopy } : {}),
-        search,
-        onSearchIndexError: options.onSearchIndexError,
-        meterSpillDrainIntervalMs: options.meterSpillDrainIntervalMs,
-        // The SAME hub the deploy handler publishes progress onto.
-        push,
-    });
-    return {
-        ...runtime,
-        drivers,
-        jobHandlers,
-        async stop() {
-            vaultReaper?.stop();
-            await runtime.stop();
-            await stopBroker?.();
-            await closeHandles?.();
-        },
-    };
-}
-//# sourceMappingURL=recipe.js.map