cursedbelt 2.7.0 → 3.0.0

package/dist/server/runtime/saasHost.d.ts

@@ -1,242 +0,0 @@
-/**
- * The SAAS profile's host plumbing (04 §1) — the analog of `localHost.ts`, and
- * the thing whose absence made "SaaS" a set of unit-proven parts rather than a
- * runtime.
- *
- * Every saas seam already existed and every one of them had **zero production
- * construction sites**: `createSaasStorageProvider`, `createBullmqQueueAdapter`
- * and `runSaasJobWorker` were reachable only from tests, `bootEngineApp` threw
- * `SAAS_STORAGE_UNWIRED` / `SAAS_BROKER_UNWIRED` unless a host injected a
- * fully-built provider and broker, and the generated saas `host.ts` shipped
- * them as `null` — so a freshly generated saas app died at boot before serving
- * a byte. That is the exact shape of an orphan seam (law #1): a far side with
- * no near side.
- *
- * This is the near side, once, as a tested unit. It owns what a deployment owns
- * and a library must not:
- *
- *   1. **The ONE pool.** Every repository routes through a single registered
- *      pool; a second is a V6 ERROR (`unpooled-saas-connection`), because the
- *      classic per-request client exhausts Postgres' socket limit under load
- *      and takes the whole instance down.
- *   2. **The queue.** BullMQ's three primitives are INJECTED (cursedbelt must
- *      never depend on `bullmq` — it would force Redis onto a laptop), so the
- *      adapter is constructed here from what the deployment hands in.
- *   3. **The two SHARED control-plane stores** — the durable job-outcome log and
- *      the revoked-jti denylist. These are the reason 04 §1 was blocked: both
- *      interfaces admitted only per-node implementations until `JobResultStore`
- *      became async (owner decision E17), and a per-node completion log makes
- *      the multi-node story the saas broker exists for silently false.
- *
- *   4. **The identity tier** — `tenants`/`users`/`memberships`/`invitations` on
- *      the same pool, with the same HMAC row-signing (owner decision E18/D10).
- *      Until this landed, `createRegistryIdentityStore` was `bun:sqlite`-only
- *      and every saas branch in the codebase was unit-tested and UNBOOTABLE: V2
- *      refuses a saas config without the `guard` engine, and `guard` needs a
- *      `resolveIdentity` that no saas host could construct.
- *
- * **What this host does NOT do, and says so loudly:** it does not open a socket
- * (the pool is injected — law #8, a library never learns a connection string),
- * and it does not issue DDL against the shared database on a process start (see
- * `ensureSaasControlPlaneSchema` and `ensureSaasIdentitySchema` — a shared
- * database has ONE schema owner, and a library issuing DDL on every process
- * start would be N of them racing).
- *
- * The identity store is built here but is NOT spread into `bootEngineApp`
- * directly: it belongs to `guardDeps.identity`, because the guard engine owns
- * the seam and a host that also had to know how a session becomes claims would
- * be a second place that knows. {@link assertSaasHostWiring} still refuses at
- * boot when the guard engine is active and `guardDeps` is absent.
- */
-import { type SaasPool, type SaasPoolConfig, type StatementExecutor, type StorageProvider } from 'cwip/storage';
-import type { RegistryIdentityStore, RegistryIdentityStoreOptions } from 'cwip/cc-registry';
-import type { AsyncRevocationStore } from '../guard/revocationStore';
-import { type BullmqAdapterDeps, type JobResultStore, type SaasJobBroker, type SaasQueueBackend } from '../drivers';
-import type { JobLogger } from '../jobs/types';
-import type { EngineAppHost, SearchTierFactory, SharedMeterTier } from './recipe';
-import type { EffectiveManifest } from '../../verify';
-export interface SaasHostOptions {
-    /**
-     * The deployment's connection pool — `withConnection` around
-     * `pool.connect()` + `client.release()` for `pg`, or the Turso equivalent.
-     * Injected rather than built here: a library that reads a connection string
-     * has put the deployment's topology back inside the library.
-     */
-    readonly pool: SaasPool;
-    /** Socket ceiling + a human label for diagnostics. */
-    readonly poolConfig: SaasPoolConfig;
-    /**
-     * BullMQ's three primitives, already bound to this deployment's Redis. Absent
-     * ⇒ no broker is built and {@link SaasHostServices.broker} is undefined,
-     * which is correct for a process that only reads (a migration runner, a
-     * one-shot CLI) and is refused at boot for a server.
-     */
-    readonly queue?: BullmqAdapterDeps;
-    /** Wall-clock ceiling per repository op. A hung query holds a pooled socket. */
-    readonly opTimeoutMs?: number;
-    readonly logger?: JobLogger;
-    /**
-     * Row-signing options for the identity tier. Absent ⇒ no identity store is
-     * built, which is correct for a process that has no guard surface (a
-     * migration runner, the worker) and is refused at boot for a server with the
-     * guard engine active.
-     *
-     * The signer is REQUIRED rather than defaulted because the integrity key is
-     * deployment key custody: a host that minted one silently would give every
-     * node a different key, and every row written by one node would fail
-     * verification on every other — an outage that reads as data corruption.
-     */
-    readonly identity?: RegistryIdentityStoreOptions;
-    /**
-     * The search tier (04 §3). Absent ⇒ no provider is built, which is correct
-     * for a process with no knowledge surface and is refused at boot for a server
-     * whose manifest activates the `knowledge` engine.
-     *
-     * `embed` is INJECTED here rather than derived, for the same reason it is on
-     * the local profile: a host that has wired an embedding driver gets the vector
-     * tier, and a host that has not gets an honestly keyword-only one. The
-     * generated `server.ts` routes it through the `CognitiveGateway`, so an
-     * embedding call is metered and telemetered like any other AI call.
-     */
-    readonly search?: SaasSearchOptions;
-    /**
-     * The SHARED billing meter (04 item 4e, owner decision D26 Option A). Absent ⇒
-     * no meter tier is built, which is correct for a migration runner and is
-     * REFUSED at boot for a saas server (`reportSaasHostWiring`).
-     *
-     * Its only input is this node's own identity — everything else rides the pool.
-     */
-    readonly meter?: SaasMeterOptions;
-}
-/** What the shared meter needs beyond the pool it shares with everything else. */
-export interface SaasMeterOptions {
-    /**
-     * A stable identity for THIS node — the pod name, the machine id, whatever the
-     * deployment already has. REQUIRED and never defaulted: it is the key the
-     * rollup resumes from, so two nodes sharing one would make the node with fewer
-     * local rows skip its own backlog permanently. A hostname default is exactly
-     * how that happens (two pods, one StatefulSet name).
-     */
-    readonly nodeId: string;
-}
-/**
- * The shared-meter tier — see {@link SharedMeterTier}, which is where the type
- * lives because `EngineAppHost` carries it. Aliased here so a host reading this
- * file sees the name its own option produces.
- *
- * The tier's ROLLUP half is built by the generated `server.ts` rather than here,
- * because it needs the node's own telemetry handle — which
- * `createLocalHostServices` owns and this host does not. That is the same
- * asymmetry `plans`/`billing` already has, for the same reason.
- */
-export type SaasMeterTier = SharedMeterTier;
-/** What the saas search tier needs beyond the pool it shares with everything else. */
-export interface SaasSearchOptions {
-    /**
-     * Override the recipe's embedder. Normally OMITTED: the recipe passes its own
-     * gateway-routed one, which is what makes an embedding call metered and
-     * telemetered like any other AI call. Supplying one here is a deliberate
-     * choice to run embeddings OUTSIDE the app's metering, and should be rare.
-     */
-    embed?(text: string, tenantId: string): Promise<Float32Array>;
-    /** Override the model id recorded per chunk. Normally omitted — see `embed`. */
-    embedModel?: string;
-    vectorCandidateLimit?: number;
-    onVectorTruncated?(detail: {
-        tenantId: string;
-        corpora: readonly string[];
-        scanned: number;
-    }): void;
-    onVectorError?(error: unknown, phase: 'index' | 'query'): void;
-}
-export interface SaasHostServices {
-    /** The pooled provider `bootEngineApp({ storage })` needs. */
-    readonly storage: StorageProvider;
-    /** The queue backend the worker leases from. Absent iff no `queue` was given. */
-    readonly queueBackend?: SaasQueueBackend;
-    /** The cross-process broker. Absent iff no `queue` was given. */
-    readonly broker?: SaasJobBroker;
-    /** The SHARED outcome log — the same rows on every node. */
-    readonly jobResults: JobResultStore;
-    /** The SHARED jti denylist — a revoke on node A is a 401 on node B. */
-    readonly revocationStore: AsyncRevocationStore;
-    /**
-     * An executor for the SHARED audit trail, over the same pool.
-     *
-     * Shared is the whole point: a write on node A must be readable from node B,
-     * or the trail is N partial trails and "prove what changed" cannot be answered
-     * from any one of them. It is a CONTROL-plane executor — the audit table's
-     * maintenance verbs (retention sweeps) are cross-tenant by design, and the
-     * tenant predicate on every read is REQUIRED rather than optional, which is
-     * the law `createStatementAuditTrailStore` enforces in its own `read`.
-     *
-     * Pass it to `createGovernanceTier({ auditTrail: { executor } })`, and run
-     * `ensureAuditTrailSchema` ONCE from the deployment's migration step.
-     */
-    readonly auditExecutor: StatementExecutor;
-    /**
-     * The SHARED accounts — sign up on node A, log in on node B. Absent iff no
-     * `identity` options were given. Goes to `guardDeps.identity`, not into
-     * `bootEngineApp` directly.
-     */
-    readonly identity?: RegistryIdentityStore;
-    /**
-     * The SHARED search index — indexed on node A, found on node B. Absent iff no
-     * `search` options were given. Goes to `bootEngineApp({ search })`.
-     *
-     * A FACTORY rather than a built provider, and the reason is metering: the
-     * embedder must route through the app's ONE `CognitiveGateway`, which
-     * `bootEngineApp` constructs AFTER this host has already run. So the recipe
-     * calls this with the gateway-routed `embed` and gets the tier back. A host
-     * that built the provider here would either have no vector tier or a second,
-     * UNMETERED AI path.
-     */
-    readonly search?: SearchTierFactory;
-    /**
-     * The SHARED billing meter — metered on node A, counted on node B. Absent iff
-     * no `meter` options were given. Goes to `bootEngineApp({ meter })`, and the
-     * generated `server.ts` reads both halves off it.
-     *
-     * Run `ensureSharedMeterSchema` ONCE from the deployment's migration step,
-     * beside `ensureSaasControlPlaneSchema`.
-     */
-    readonly meter?: SharedMeterTier;
-    /** Release what this host constructed. The POOL is the caller's to close. */
-    close(): Promise<void>;
-}
-/**
- * Construct every saas seam from what the deployment supplies.
- *
- * The result is spread straight into `bootEngineApp`, which is what makes the
- * generated `host.ts` a four-line call instead of the twenty lines each
- * deployment would otherwise write differently.
- */
-export declare const createSaasHostServices: (options: SaasHostOptions) => SaasHostServices;
-/** Every host field a saas app needs, missing at once rather than one per boot. */
-export interface SaasWiringReport {
-    readonly missing: readonly string[];
-    readonly ok: boolean;
-}
-export interface AssertSaasHostWiringInput {
-    readonly manifest: EffectiveManifest;
-    readonly host: EngineAppHost;
-}
-/**
- * What a saas app's host must supply, derived from the MANIFEST rather than
- * from a restated list — a new engine that needs a seam is caught by what its
- * instances declare, not by whether someone remembered to extend a constant.
- */
-export declare const reportSaasHostWiring: (input: AssertSaasHostWiringInput) => SaasWiringReport;
-/**
- * Refuse an incompletely-wired saas app with ONE error naming everything.
- *
- * The value is not the check — each of these would eventually fail on its own.
- * It is that they fail TOGETHER, at the start, naming the call that supplies
- * each one. The previous behavior was a boot that got one error further per
- * attempt, with the last two (`objects`, `vaultReaper`) not surfacing until a
- * request hit them in production.
- *
- * @throws {AppError} `SAAS_HOST_UNWIRED`
- */
-export declare const assertSaasHostWiring: (input: AssertSaasHostWiringInput) => void;
-//# sourceMappingURL=saasHost.d.ts.map

package/dist/server/runtime/saasHost.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"saasHost.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/saasHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAG5F,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAOL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IACnC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC;IACjD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACnC;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC;AAE5C,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACpG,aAAa,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAAC;CAChE;AAED,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,iFAAiF;IACjF,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IACzC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,6EAA6E;IAC7E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,eAAe,KAAG,gBAqFjE,CAAC;AAIF,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,yBAAyB,KAAG,gBAkEvE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,yBAAyB,KAAG,IAYvE,CAAC"}

package/dist/server/runtime/saasHost.js

@@ -1,227 +0,0 @@
-/**
- * The SAAS profile's host plumbing (04 §1) — the analog of `localHost.ts`, and
- * the thing whose absence made "SaaS" a set of unit-proven parts rather than a
- * runtime.
- *
- * Every saas seam already existed and every one of them had **zero production
- * construction sites**: `createSaasStorageProvider`, `createBullmqQueueAdapter`
- * and `runSaasJobWorker` were reachable only from tests, `bootEngineApp` threw
- * `SAAS_STORAGE_UNWIRED` / `SAAS_BROKER_UNWIRED` unless a host injected a
- * fully-built provider and broker, and the generated saas `host.ts` shipped
- * them as `null` — so a freshly generated saas app died at boot before serving
- * a byte. That is the exact shape of an orphan seam (law #1): a far side with
- * no near side.
- *
- * This is the near side, once, as a tested unit. It owns what a deployment owns
- * and a library must not:
- *
- *   1. **The ONE pool.** Every repository routes through a single registered
- *      pool; a second is a V6 ERROR (`unpooled-saas-connection`), because the
- *      classic per-request client exhausts Postgres' socket limit under load
- *      and takes the whole instance down.
- *   2. **The queue.** BullMQ's three primitives are INJECTED (cursedbelt must
- *      never depend on `bullmq` — it would force Redis onto a laptop), so the
- *      adapter is constructed here from what the deployment hands in.
- *   3. **The two SHARED control-plane stores** — the durable job-outcome log and
- *      the revoked-jti denylist. These are the reason 04 §1 was blocked: both
- *      interfaces admitted only per-node implementations until `JobResultStore`
- *      became async (owner decision E17), and a per-node completion log makes
- *      the multi-node story the saas broker exists for silently false.
- *
- *   4. **The identity tier** — `tenants`/`users`/`memberships`/`invitations` on
- *      the same pool, with the same HMAC row-signing (owner decision E18/D10).
- *      Until this landed, `createRegistryIdentityStore` was `bun:sqlite`-only
- *      and every saas branch in the codebase was unit-tested and UNBOOTABLE: V2
- *      refuses a saas config without the `guard` engine, and `guard` needs a
- *      `resolveIdentity` that no saas host could construct.
- *
- * **What this host does NOT do, and says so loudly:** it does not open a socket
- * (the pool is injected — law #8, a library never learns a connection string),
- * and it does not issue DDL against the shared database on a process start (see
- * `ensureSaasControlPlaneSchema` and `ensureSaasIdentitySchema` — a shared
- * database has ONE schema owner, and a library issuing DDL on every process
- * start would be N of them racing).
- *
- * The identity store is built here but is NOT spread into `bootEngineApp`
- * directly: it belongs to `guardDeps.identity`, because the guard engine owns
- * the seam and a host that also had to know how a session becomes claims would
- * be a second place that knows. {@link assertSaasHostWiring} still refuses at
- * boot when the guard engine is active and `guardDeps` is absent.
- */
-import { createSaasStorageProvider, } from 'cwip/storage';
-import { createStatementMeterUsageReader } from 'cwip/telemetry';
-import { AppError } from '../errors';
-import { createBullmqQueueAdapter, createSaasJobBroker, createPgIdentityStore, createPgJobResultStore, createPooledControlExecutor, createPgRevocationStore, } from '../drivers';
-import { createPgSearchProvider } from '../search/pgSearchProvider';
-/**
- * Construct every saas seam from what the deployment supplies.
- *
- * The result is spread straight into `bootEngineApp`, which is what makes the
- * generated `host.ts` a four-line call instead of the twenty lines each
- * deployment would otherwise write differently.
- */
-export const createSaasHostServices = (options) => {
-    const storage = createSaasStorageProvider({
-        pool: options.pool,
-        config: options.poolConfig,
-        ...(options.opTimeoutMs === undefined ? {} : { opTimeoutMs: options.opTimeoutMs }),
-    });
-    // Both stores read and write through the SAME pool the repositories use.
-    // A second pool for the control plane would be a second socket budget nobody
-    // sized — and the V6 `unpooled-saas-connection` gate exists because that is
-    // the classic way a deployment falls over under load.
-    const jobResults = createPgJobResultStore(options.pool);
-    // Per-statement checkout — an executor bound to one already-returned
-    // connection is a use-after-release. See `createPooledControlExecutor`. ONE
-    // executor serves every control-plane table (the trail, the shared meter):
-    // they share a pool, a dialect and a checkout discipline, and a second
-    // executor would be a second thing to keep in step for no property.
-    const controlExecutor = createPooledControlExecutor(options.pool);
-    const auditExecutor = controlExecutor;
-    const revocationStore = createPgRevocationStore(options.pool);
-    const identity = options.identity === undefined ? undefined : createPgIdentityStore(options.pool, options.identity);
-    // The search tier rides the SAME pool — see `jobResults` above. A search index
-    // on its own connection budget is the same mistake in a different table.
-    const searchOptions = options.search;
-    const search = searchOptions === undefined
-        ? undefined
-        : (deps) => createPgSearchProvider({
-            pool: options.pool,
-            // The recipe's gateway-routed embedder first; an explicit override
-            // second. Spread order is the policy: a host that names its own
-            // `embed` means it.
-            ...(deps.embed ? { embed: deps.embed } : {}),
-            ...(deps.embedModel ? { embedModel: deps.embedModel } : {}),
-            ...searchOptions,
-        });
-    // The shared meter rides the SAME pool, over the SAME per-statement checkout
-    // the audit trail uses — see `createPooledControlExecutor`. It is a control
-    // plane table for the same reason the others are: the rollup writes rows for
-    // every tenant a node served, and the reader is scoped in the query.
-    const meter = options.meter === undefined
-        ? undefined
-        : {
-            nodeId: options.meter.nodeId,
-            executor: controlExecutor,
-            usage: createStatementMeterUsageReader(controlExecutor),
-        };
-    const queueBackend = options.queue === undefined ? undefined : createBullmqQueueAdapter(options.queue);
-    const broker = queueBackend === undefined
-        ? undefined
-        : createSaasJobBroker({
-            queue: queueBackend,
-            // THE point of this whole module: the broker records into the shared
-            // store, so a waiter on any node reads an outcome produced on any
-            // other. Handing it a per-node store would compile and would quietly
-            // restore the single-heap behavior the saas broker replaced.
-            results: jobResults,
-            ...(options.logger === undefined ? {} : { logger: options.logger }),
-        });
-    return {
-        storage,
-        ...(queueBackend === undefined ? {} : { queueBackend }),
-        ...(broker === undefined ? {} : { broker }),
-        jobResults,
-        revocationStore,
-        auditExecutor,
-        ...(identity === undefined ? {} : { identity }),
-        ...(search === undefined ? {} : { search }),
-        ...(meter === undefined ? {} : { meter }),
-        async close() {
-            broker?.close();
-            await storage.close?.();
-            // The pool is NOT closed here. It was injected, it may be shared with a
-            // migration runner or a second entrypoint in the same process, and a
-            // library closing a handle it did not open is how a shutdown ends up
-            // racing the thing that owns it.
-        },
-    };
-};
-/**
- * What a saas app's host must supply, derived from the MANIFEST rather than
- * from a restated list — a new engine that needs a seam is caught by what its
- * instances declare, not by whether someone remembered to extend a constant.
- */
-export const reportSaasHostWiring = (input) => {
-    const { manifest, host } = input;
-    if (manifest.profile !== 'saas')
-        return { missing: [], ok: true };
-    const engines = new Set(manifest.engines);
-    const missing = [];
-    if (!host.storage)
-        missing.push('storage — createSaasHostServices({ pool, poolConfig }).storage');
-    if (!host.broker)
-        missing.push('broker — createSaasHostServices({ …, queue }).broker');
-    if (!host.jobResults)
-        missing.push('jobResults — createSaasHostServices(…).jobResults (the broker records into it)');
-    // A per-node denylist under saas means a revoked session stays valid on every
-    // other node until it expires. Missing it is not a degraded mode; it is the
-    // security property `revokeUser` exists to provide, silently absent.
-    if (!host.revocationStore)
-        missing.push('revocationStore — createSaasHostServices(…).revocationStore (a Map is per-node)');
-    // The saas profile composes the billing mixin UNCONDITIONALLY
-    // (`composeServer`), so a saas app with no BillingService cannot boot — it
-    // died with `MIXIN_DEPENDENCY_MISSING` several hundred lines further into
-    // `createCcRuntime`, after the pool was open and the queue was connected. That
-    // is the same class of late failure this gate exists to end, and it was the
-    // last thing standing between the shipped `host.ts` and a booting saas app.
-    if (!host.billing)
-        missing.push('billing — a plan resolver: `plans: (tenantId) => PlanDefinition` in host.ts (server.ts builds the service over your meter), or a BillingService of your own');
-    // 04 item 4e / D26. Without it, `BillingService` falls back to the node's OWN
-    // `meter_events` and every plan ceiling is enforced once PER NODE — two API
-    // nodes let a 100 GB tenant use 200 GB, and the quota gate inherits the same
-    // number. Nothing about that failure is visible: both nodes return plausible
-    // usage. So it is refused here rather than degraded, exactly like the
-    // per-node revocation denylist above.
-    if (!host.meter)
-        missing.push('meter — createSaasHostServices({ …, meter: { nodeId } }).meter (without it, billing counts THIS node\'s meter_events only, so every plan ceiling is enforced once per node)');
-    // Symmetry with the local profile (1c): the object-store gate fires at boot
-    // there and only surfaced through `requireDeps` mid-request here — same
-    // wiring mistake, two different failure moments, and the saas one landed on a
-    // user instead of on a deploy.
-    if (engines.has('asset') && !host.objects)
-        missing.push('objects — an S3 ObjectStore (createS3ObjectStore); the fs store is a local-profile path');
-    // The message changed with E18: the identity tier IS buildable now, so the
-    // fix is a one-liner rather than "write your own store". Naming the exact call
-    // is the difference between a gate someone satisfies and a gate someone works
-    // around by turning the guard engine off.
-    // A saas knowledge app with no search tier is not "search-less": `reindex`
-    // fails on every run and `KnowledgeService.search` silently takes its `LIKE`
-    // fallback, which returns results and looks like it works. That is the shape
-    // of failure this gate exists for — the ones that produce output.
-    if (engines.has('knowledge') && host.enableSearch !== false && !host.search)
-        missing.push('search — createSaasHostServices({ …, search: { embed } }).search (the recipe builds a search tier only from local SQLite handles, so under saas there is none)');
-    if (engines.has('guard') && !host.guardDeps)
-        missing.push('guardDeps — build it from createSaasHostServices({ …, identity: { signer } }).identity, then pass { identity, currentClaims } (02 §1b, 04 §1a)');
-    // `vaultReaper.tenants` is deliberately NOT checked here. It already has a
-    // specific typed gate further into the boot (`VAULT_REAPER_UNWIRED`, 05 §A2),
-    // and restating it would make that one unreachable — trading a precise,
-    // documented error code for a generic one is a regression in diagnosability,
-    // not a tightening. This function covers the seams that had NO gate at all
-    // (storage/broker/jobResults/revocationStore) or only a local-profile one
-    // (objects).
-    return { missing, ok: missing.length === 0 };
-};
-/**
- * Refuse an incompletely-wired saas app with ONE error naming everything.
- *
- * The value is not the check — each of these would eventually fail on its own.
- * It is that they fail TOGETHER, at the start, naming the call that supplies
- * each one. The previous behavior was a boot that got one error further per
- * attempt, with the last two (`objects`, `vaultReaper`) not surfacing until a
- * request hit them in production.
- *
- * @throws {AppError} `SAAS_HOST_UNWIRED`
- */
-export const assertSaasHostWiring = (input) => {
-    const report = reportSaasHostWiring(input);
-    if (report.ok)
-        return;
-    throw new AppError(`This saas app's host wiring is incomplete. Supply, in host.ts:\n  • ${report.missing.join('\n  • ')}`, {
-        code: 'SAAS_HOST_UNWIRED',
-        status: 500,
-        isOperational: false,
-        context: { profile: input.manifest.profile, missing: report.missing },
-    });
-};
-//# sourceMappingURL=saasHost.js.map

package/dist/server/runtime/saasHost.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"saasHost.js","sourceRoot":"","sources":["../../../src/server/runtime/saasHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EACL,yBAAyB,GAK1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,uBAAuB,GAKxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AA0JpE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAwB,EAAoB,EAAE;IACnF,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,UAAU;QAC1B,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sDAAsD;IACtD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,qEAAqE;IACrE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,eAAe,GAAG,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,eAAe,CAAC;IACtC,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEpH,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IACrC,MAAM,MAAM,GACV,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CACP,sBAAsB,CAAC;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,mEAAmE;YACnE,gEAAgE;YAChE,oBAAoB;YACpB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,aAAa;SACjB,CAAC,CAAC;IAEX,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,KAAK,GACT,OAAO,CAAC,KAAK,KAAK,SAAS;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,+BAA+B,CAAC,eAAe,CAAC;SACxD,CAAC;IAER,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvG,MAAM,MAAM,GACV,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,mBAAmB,CAAC;YAClB,KAAK,EAAE,YAAY;YACnB,qEAAqE;YACrE,kEAAkE;YAClE,qEAAqE;YACrE,6DAA6D;YAC7D,OAAO,EAAE,UAAU;YACnB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SACpE,CAAC,CAAC;IAET,OAAO;QACL,OAAO;QACP,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,UAAU;QACV,eAAe;QACf,aAAa;QACb,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,KAAK,CAAC,KAAK;YACT,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACxB,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,iCAAiC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAeF;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAgC,EAAoB,EAAE;IACzF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACjC,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAElE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,UAAU;QAClB,OAAO,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IACjG,8EAA8E;IAC9E,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,eAAe;QACvB,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAClG,8DAA8D;IAC9D,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO;QACf,OAAO,CAAC,IAAI,CAAC,6JAA6J,CAAC,CAAC;IAC9K,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,sCAAsC;IACtC,IAAI,CAAC,IAAI,CAAC,KAAK;QACb,OAAO,CAAC,IAAI,CACV,6KAA6K,CAC9K,CAAC;IACJ,4EAA4E;IAC5E,wEAAwE;IACxE,8EAA8E;IAC9E,+BAA+B;IAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;QACvC,OAAO,CAAC,IAAI,CAAC,yFAAyF,CAAC,CAAC;IAC1G,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,0CAA0C;IAC1C,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;QACzE,OAAO,CAAC,IAAI,CACV,gKAAgK,CACjK,CAAC;IACJ,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS;QACzC,OAAO,CAAC,IAAI,CACV,gJAAgJ,CACjJ,CAAC;IAEJ,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,aAAa;IAEb,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAgC,EAAQ,EAAE;IAC7E,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO;IACtB,MAAM,IAAI,QAAQ,CAChB,uEAAuE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EACtG;QACE,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;KACtE,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/server/runtime/serveCcApp.d.ts

@@ -1,48 +0,0 @@
-/**
- * `Bun.serve` for a composed cc app, with the shutdown discipline the framework
- * already assumes elsewhere.
- *
- * Three things happen on the way down, in this order, and the order is the
- * point:
- *
- *   1. **Stop accepting**, so no new request enters a runtime that is tearing
- *      down its storage.
- *   2. **Sweep the ExecutionDriver's children.** A killed dev server that leaves
- *      a tracked child alive leaves it squatting the port it claimed — the
- *      zombie-port state 04 §5.7 calls structurally impossible only because
- *      something actually runs the sweep.
- *   3. **Flush telemetry, then release the runtime.** Metrics still in the queue
- *      are lost otherwise, and `meter_events` may never be dropped (01 §4.1).
- */
-import type { TelemetryWriter } from 'cwip/telemetry';
-import type { ExecutionDriver } from '../drivers';
-import type { CcRuntime } from './createCcRuntime';
-export interface ServeCcAppOptions {
-    runtime: CcRuntime;
-    port: number;
-    hostname?: string;
-    /** Swept on shutdown. Pass the same driver the runtime was given. */
-    exec?: ExecutionDriver;
-    telemetry?: TelemetryWriter;
-    /**
-     * Install SIGINT/SIGTERM handlers. Default true — a server that does not clean
-     * up on Ctrl-C is how zombie children accumulate during development.
-     */
-    bindSignals?: boolean;
-    /** Bun.serve seam, for tests. */
-    serve?: (options: {
-        port: number;
-        hostname?: string;
-        fetch: (request: Request) => Response | Promise<Response>;
-    }) => {
-        port: number;
-        stop: (closeActiveConnections?: boolean) => void;
-    };
-}
-export interface CcServer {
-    port: number;
-    /** Idempotent. Safe to call from a signal handler and again from a test. */
-    stop(): Promise<void>;
-}
-export declare function serveCcApp(options: ServeCcAppOptions): CcServer;
-//# sourceMappingURL=serveCcApp.d.ts.map

package/dist/server/runtime/serveCcApp.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serveCcApp.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/serveCcApp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iCAAiC;IACjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,KAAK;QACnH,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;KAClD,CAAC;CACH;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,CA+B/D"}

package/dist/server/runtime/serveCcApp.js

@@ -1,28 +0,0 @@
-export function serveCcApp(options) {
-    const serve = options.serve ??
-        ((init) => Bun.serve(init));
-    const server = serve({
-        port: options.port,
-        hostname: options.hostname,
-        fetch: (request) => options.runtime.app.fetch(request),
-    });
-    let stopped = false;
-    const stop = async () => {
-        if (stopped)
-            return;
-        stopped = true;
-        server.stop(true);
-        options.exec?.sweep();
-        await options.telemetry?.flush?.();
-        await options.runtime.stop();
-    };
-    if (options.bindSignals !== false) {
-        const onSignal = () => {
-            void stop().finally(() => process.exit(0));
-        };
-        process.once('SIGINT', onSignal);
-        process.once('SIGTERM', onSignal);
-    }
-    return { port: server.port, stop };
-}
-//# sourceMappingURL=serveCcApp.js.map

package/dist/server/runtime/serveCcApp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"serveCcApp.js","sourceRoot":"","sources":["../../../src/server/runtime/serveCcApp.ts"],"names":[],"mappings":"AA6CA,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,KAAK,GACT,OAAO,CAAC,KAAK;QACb,CAAC,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,CAAC,KAA4F,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7G,MAAM,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;KAChE,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}