cursedbelt 2.7.0 → 3.0.0

package/dist/verify/runtime/verifyContext.js

@@ -1,269 +0,0 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
-import { CCUserClaimsSchema } from '../../core/session/claims';
-import { awaitRecordedCompletion, createCognitiveGateway, createLocalExecutionDriver, createMemoryJobResultStore, safeArgSchema, UNSCOPED_TENANT, } from '../../server/drivers';
-import { buildInstanceIndex } from '../../server/mixins';
-import { createServerPushHub } from '../../server/stream';
-/* ------------------------------------------------------------ guard verifier */
-const b64url = (input) => Buffer.from(input).toString('base64url');
-const sign = (payload, secret) => createHmac('sha256', secret).update(payload).digest('base64url');
-const constantTimeEqual = (a, b) => {
-    const left = Buffer.from(a);
-    const right = Buffer.from(b);
-    return left.length === right.length && timingSafeEqual(left, right);
-};
-/**
- * The verify-mode session verifier. HMAC rather than Ed25519 because the probe
- * suite tests the *policy* — signature validity, expiry, the jti denylist — and
- * the signature algorithm is a driver detail the production GuardEngine owns.
- * What must not differ is the decision table, and that is shared: this feeds the
- * same `guardVerify` middleware.
- */
-export function createVerifyGuard(secret = 'verify-mode-session-secret') {
-    const revoked = new Set();
-    let sequence = 0;
-    return {
-        mint(partial) {
-            sequence += 1;
-            const claims = {
-                tenantId: 'tenant-a',
-                userId: 'user-1',
-                role: 'OWNER',
-                permissions: ['infra:write', 'media:write', 'knowledge:write', 'knowledge:delete'],
-                privateScope: true,
-                exp: Math.floor(Date.now() / 1000) + 300,
-                jti: `jti_${sequence}`,
-                ...partial,
-            };
-            const payload = b64url(JSON.stringify(claims));
-            return `${payload}.${sign(payload, secret)}`;
-        },
-        verify(token) {
-            if (!token)
-                return { ok: false, failure: 'missing' };
-            const [payload, signature] = token.split('.');
-            if (!payload || !signature)
-                return { ok: false, failure: 'malformed' };
-            if (!constantTimeEqual(signature, sign(payload, secret)))
-                return { ok: false, failure: 'invalid-signature' };
-            const parsed = CCUserClaimsSchema.safeParse(JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')));
-            if (!parsed.success)
-                return { ok: false, failure: 'malformed' };
-            // Expiry before revocation: an expired token is expired regardless of
-            // whether anyone bothered to revoke it.
-            if (parsed.data.exp * 1000 <= Date.now())
-                return { ok: false, failure: 'expired' };
-            if (revoked.has(parsed.data.jti))
-                return { ok: false, failure: 'revoked' };
-            return { ok: true, claims: parsed.data };
-        },
-        revoke: (jti) => {
-            revoked.add(jti);
-        },
-        isRevoked: (jti) => revoked.has(jti),
-    };
-}
-/* ------------------------------------------------------------------ drivers */
-/**
- * The compiled command allowlist a verify run boots with — the shape
- * `cc-manifest.json` holds. `sleep-short` carries a real arg schema so probe 14
- * can prove `1; rm -rf /` is REFUSED rather than escaped.
- */
-export const VERIFY_COMMANDS = {
-    'echo-ok': { id: 'echo-ok', argv: ['echo', 'ok'], cwdRoot: '/tmp' },
-    'sleep-short': {
-        id: 'sleep-short',
-        argv: ['sleep', '{seconds}'],
-        argSchema: { seconds: safeArgSchema() },
-        cwdRoot: '/tmp',
-    },
-};
-/**
- * A fake spawn: no real child, but a real PID registered in the real tracker, so
- * probe 14's "was the PID tracked, and does the sweep kill it" assertion
- * exercises the production tracker rather than a mock of it.
- */
-export function createFakeSpawn() {
-    let pid = 40_000;
-    return () => {
-        pid += 1;
-        let release = () => { };
-        const exited = new Promise((resolve) => {
-            release = () => resolve(0);
-        });
-        return {
-            pid,
-            exited,
-            kill: () => release(),
-        };
-    };
-}
-export const createVerifyExec = () => createLocalExecutionDriver({
-    commands: VERIFY_COMMANDS,
-    spawn: createFakeSpawn(),
-    // A verify run installs its own PID jail; a second set of signal hooks would
-    // fight it.
-    installSignalHooks: false,
-});
-export function createVerifyCognitiveDriver(options = {}) {
-    return {
-        provider: 'ollama',
-        async complete(request) {
-            options.seen?.push({
-                system: request.system,
-                dataBlocks: request.dataBlocks,
-                jsonMode: request.jsonMode,
-            });
-            if (options.produceInvalid === true)
-                return { text: 'not json at all', tokensIn: 10, tokensOut: 5 };
-            // A minimal object; the caller's Zod schema decides whether it survives.
-            return { text: JSON.stringify({ ok: true, items: [] }), tokensIn: 10, tokensOut: 5 };
-        },
-    };
-}
-/**
- * An in-memory JobBroker — durability is 01's concern, not a route-surface
- * probe's. It runs jobs instantly, but completion goes through the SAME
- * `JobResultStore` + `awaitRecordedCompletion` path the local and SaaS brokers
- * use, so the harness exercises the real cross-process contract rather than a
- * simplified callback map that would hide a regression in it.
- */
-export function createVerifyJobBroker() {
-    const store = createMemoryJobResultStore();
-    const waiters = new Set();
-    const subscribe = (cb) => {
-        waiters.add(cb);
-        return () => {
-            waiters.delete(cb);
-        };
-    };
-    const wake = () => {
-        for (const cb of [...waiters])
-            cb();
-    };
-    const asResult = (recorded) => ({
-        jobId: recorded.jobId,
-        ok: recorded.ok,
-        output: recorded.output,
-        error: recorded.error,
-    });
-    let sequence = 0;
-    return {
-        async enqueue(job) {
-            sequence += 1;
-            const id = `job_${sequence}`;
-            queueMicrotask(() => {
-                void store
-                    .record({ jobId: id, ok: true, output: { kind: job.kind }, tenantId: job.tenantId })
-                    .then(wake);
-            });
-            return id;
-        },
-        onComplete(id, cb) {
-            // One path — `awaitRecordedCompletion` reads before it arms anything, so
-            // an already-recorded job still replays. Same shape as both real brokers.
-            void awaitRecordedCompletion(store, id, { pollMs: 5, timeoutMs: 30_000, subscribe }).then((result) => cb(asResult(result)), () => undefined);
-        },
-        async awaitCompletion(id, options) {
-            return asResult(await awaitRecordedCompletion(store, id, { pollMs: 5, ...options, subscribe }));
-        },
-        async cancel(id) {
-            await store.record({ jobId: id, ok: false, error: 'cancelled', tenantId: UNSCOPED_TENANT });
-            wake();
-        },
-        async status(id) {
-            const recorded = await store.read(id);
-            return recorded ? asResult(recorded) : { jobId: id, ok: null };
-        },
-    };
-}
-/** A counting no-op telemetry writer — the storage tier's own suite covers durability. */
-export function createVerifyTelemetry() {
-    const stats = {
-        apiCallsQueued: 0,
-        apiCallsWritten: 0,
-        apiCallsDropped: 0,
-        flushes: 0,
-        flushFailures: 0,
-        meterEventsWritten: 0,
-        meterEventsSpilled: 0,
-        meterEventsReplayed: 0,
-        meterEventsRejected: 0,
-        queueDepth: 0,
-    };
-    let uuid = 0;
-    return {
-        recordApiCall() {
-            stats.apiCallsQueued += 1;
-            stats.apiCallsWritten += 1;
-        },
-        recordMeterEvent(draft) {
-            stats.meterEventsWritten += 1;
-            uuid += 1;
-            return { eventUuid: draft.eventUuid ?? `evt_${uuid}`, landed: 'table' };
-        },
-        async flush() {
-            stats.flushes += 1;
-            return { written: 0, dropped: 0, deferred: false };
-        },
-        flushSync() {
-            stats.flushes += 1;
-            return { written: 0, dropped: 0, deferred: false };
-        },
-        drainSpill: () => ({ replayed: 0, duplicates: 0, deferred: 0, rejected: 0, torn: 0, corrupt: 0 }),
-        hasPendingSpill: () => false,
-        stats,
-        close() { },
-    };
-}
-/** A storage provider whose domains reject use — V7 probes routes, not repositories. */
-export function createVerifyStorage() {
-    const handle = (domain) => ({
-        domain,
-        profile: 'local',
-        async exec() {
-            throw new Error(`verify-mode storage: domain '${domain}' has no repository bound.`);
-        },
-        async transaction() {
-            throw new Error(`verify-mode storage: domain '${domain}' has no repository bound.`);
-        },
-        onMutation: () => () => { },
-        async drainMutations() { },
-    });
-    const memo = new Map();
-    return {
-        profile: 'local',
-        domain(name) {
-            const existing = memo.get(name);
-            if (existing)
-                return existing;
-            const created = handle(name);
-            memo.set(name, created);
-            return created;
-        },
-        async close() { },
-    };
-}
-export function createVerifyContext(options) {
-    const guard = options.guard ?? createVerifyGuard();
-    const exec = options.exec ?? createVerifyExec();
-    const telemetry = createVerifyTelemetry();
-    const ctx = {
-        manifest: options.manifest,
-        instanceIndex: buildInstanceIndex(options.manifest),
-        storage: createVerifyStorage(),
-        guard,
-        gateway: createCognitiveGateway({
-            appId: options.manifest.appId,
-            drivers: { ollama: options.aiDriver ?? createVerifyCognitiveDriver() },
-            telemetry,
-        }),
-        broker: createVerifyJobBroker(),
-        telemetry,
-        allowedOrigins: options.allowedOrigins ?? ['http://localhost:4747'],
-        // A real push hub: probe 11 must be able to kill a LIVE stream, not assert
-        // against a single frame that closed itself (finding 4.5).
-        push: createServerPushHub(),
-    };
-    return { ctx, guard, exec };
-}
-//# sourceMappingURL=verifyContext.js.map

package/dist/verify/runtime/verifyContext.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyContext.js","sourceRoot":"","sources":["../../../src/verify/runtime/verifyContext.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAqB,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EACL,uBAAuB,EAEvB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,EAO1B,aAAa,EAEb,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAI1D,iFAAiF;AAEjF,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5F,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,MAAc,EAAU,EAAE,CACvD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEnE,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC,CAAC;AAMF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAM,GAAG,4BAA4B;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,OAAO;QACL,IAAI,CAAC,OAA8B;YACjC,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,MAAM,GAAiB;gBAC3B,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;gBAClF,YAAY,EAAE,IAAI;gBAClB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;gBACxC,GAAG,EAAE,OAAO,QAAQ,EAAE;gBACtB,GAAG,OAAO;aACX,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC/C,CAAC;QAED,MAAM,CAAC,KAAyB;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACrD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YACvE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;YAE7G,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAC1E,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YAEhE,sEAAsE;YACtE,wCAAwC;YACxC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACnF,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC3E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;YACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,SAAS,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAA8C;IACxE,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;IACnE,aAAa,EAAE;QACb,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;QAC5B,SAAS,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE;QACvC,OAAO,EAAE,MAAM;KAChB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,EAAE;QACV,GAAG,IAAI,CAAC,CAAC;QACT,IAAI,OAAO,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YAC7C,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,OAAO;YACL,GAAG;YACH,MAAM;YACN,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE;SACtB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAoB,EAAE,CACpD,0BAA0B,CAAC;IACzB,QAAQ,EAAE,eAAe;IACzB,KAAK,EAAE,eAAe,EAAE;IACxB,6EAA6E;IAC7E,YAAY;IACZ,kBAAkB,EAAE,KAAK;CAC1B,CAAC,CAAC;AAUL,MAAM,UAAU,2BAA2B,CAAC,UAA+B,EAAE;IAC3E,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YACpG,yEAAyE;YACzE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,0BAA0B,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IACtC,MAAM,SAAS,GAAG,CAAC,EAAc,EAAgB,EAAE;QACjD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC;YAAE,EAAE,EAAE,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,QAA2B,EAAa,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC;IACH,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAY;YACxB,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,OAAO,QAAQ,EAAE,CAAC;YAC7B,cAAc,CAAC,GAAG,EAAE;gBAClB,KAAK,KAAK;qBACP,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;qBACnF,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,UAAU,CAAC,EAAE,EAAE,EAAE;YACf,yEAAyE;YACzE,0EAA0E;YAC1E,KAAK,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CACvF,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAChC,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO;YAC/B,OAAO,QAAQ,CAAC,MAAM,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5F,IAAI,EAAE,CAAC;QACT,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtC,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG;QACZ,cAAc,EAAE,CAAC;QACjB,eAAe,EAAE,CAAC;QAClB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;QACV,aAAa,EAAE,CAAC;QAChB,kBAAkB,EAAE,CAAC;QACrB,kBAAkB,EAAE,CAAC;QACrB,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;QACtB,UAAU,EAAE,CAAC;KACd,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,OAAO;QACL,aAAa;YACX,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;YAC1B,KAAK,CAAC,eAAe,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,gBAAgB,CAAC,KAAK;YACpB,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,CAAC;YACV,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,OAAgB,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,SAAS;YACP,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACjG,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK;QAC5B,KAAK;QACL,KAAK,KAAI,CAAC;KACX,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,CAAC,MAAc,EAAgB,EAAE,CAC9C,CAAC;QACC,MAAM;QACN,OAAO,EAAE,OAAO;QAChB,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,4BAA4B,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,CAAC,WAAW;YACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,4BAA4B,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC;QAC1B,KAAK,CAAC,cAAc,KAAI,CAAC;KAC1B,CAA4B,CAAC;IAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,MAAM,CAAC,IAAI;YACT,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,KAAK,KAAI,CAAC;KACjB,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;IAE1C,MAAM,GAAG,GAAiB;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnD,OAAO,EAAE,mBAAmB,EAAE;QAC9B,KAAK;QACL,OAAO,EAAE,sBAAsB,CAAC;YAC9B,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK;YAC7B,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,2BAA2B,EAAE,EAAE;YACtE,SAAS;SACV,CAAC;QACF,MAAM,EAAE,qBAAqB,EAAE;QAC/B,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,uBAAuB,CAAC;QACnE,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,EAAE,mBAAmB,EAAE;KAC5B,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/verify/runtime/verifyServer.d.ts

@@ -1,104 +0,0 @@
-import type { CognitiveDriver, ExecutionDriver } from '../../server/drivers';
-import type { BillingService } from '../../server/mixins/billing.mixin';
-import type { ServerPushHub } from '../../server/stream';
-import type { EffectiveManifest } from '../types';
-import { type InstanceRuntime, type WireHub } from '../../core/wire/wireHub';
-import { type VerifyGuard } from './verifyContext';
-export type Role = 'OWNER' | 'ADMIN' | 'MEMBER' | 'VIEWER';
-export interface VerifyClaims {
-    tenantId: string;
-    userId: string;
-    role: Role;
-    permissions: string[];
-    privateScope: boolean;
-    exp: number;
-    jti: string;
-}
-export interface VerifyServerOptions {
-    manifest: EffectiveManifest;
-    /** Origins `ccCorsPolicy` admits (03 §2.3). */
-    allowedOrigins?: readonly string[];
-    /** Mounts a mixin that tries to widen the pinned CSP — probe 10 must catch it. */
-    rogueMixinOverridesCsp?: boolean;
-    exec?: ExecutionDriver;
-    aiDriver?: CognitiveDriver;
-    /**
-     * Override the harness billing service so a probe/test can drive enforcement
-     * (11 §4) — e.g. report a tenant AT its `ai.tokens`/`storage.bytes` ceiling and
-     * assert the metered route 402s. Defaults to an unlimited plan (usage well
-     * under a very high limit), which is what every non-billing probe wants.
-     */
-    billing?: BillingService;
-}
-export interface VerifyServer {
-    fetch: (request: Request) => Response | Promise<Response>;
-    manifest: EffectiveManifest;
-    /** Mint a session token the probes can present. */
-    mintToken: (claims: Partial<VerifyClaims>) => string;
-    revoke: (jti: string) => void;
-    /**
-     * Offer a new manifest. Returns whether it was ADOPTED.
-     *
-     * Real verify-then-swap (05 §B5): the candidate is validated before anything
-     * swaps. A candidate that fails leaves `lastGood` serving and leaves
-     * `manifest` pointing at the rejected intent, so the two DIVERGE — which is
-     * what makes the HTML route's `data-error="config"` branch reachable. Before
-     * this, `reload` set both fields together and that branch was structurally
-     * dead: V7.6 could not fail no matter how broken the config was.
-     */
-    reload: (manifest: EffectiveManifest | null) => boolean;
-    exec: ExecutionDriver;
-    /**
-     * The live push hub behind the `/stream` routes. Exposed so probe 11 can assert
-     * against a REAL streaming surface — that three clients hold three
-     * subscriptions and that killing them releases all three — instead of only
-     * unit-testing the jitter maths while the stream itself was a stub (§4.5).
-     */
-    push: ServerPushHub;
-    /**
-     * The FULL composed route table (05 §B5).
-     *
-     * V7.1 used to probe five `/health` paths and call that "route surface equals
-     * the manifest". It is not: `/health` is one path per engine, and a mixin can
-     * mount twenty others beside it. A feature-off sub-block that composes anyway
-     * and merely guards per request passes a health probe perfectly, while being
-     * exactly the defect 03 §2.1 forbids — and the difference is only visible if
-     * you can see what was actually mounted.
-     */
-    routes: readonly {
-        method: string;
-        path: string;
-    }[];
-    /**
-     * The app's ONE wire hub and its per-instance runtimes, built from the
-     * manifest at construction (05 §B5).
-     *
-     * V7.4 used to build a throwaway `createWireHub()` inside the probe, subscribe
-     * its own listener to it, and assert the hub delivered. That is a tautology
-     * about `createWireHub` — a unit test the hub already has — and it was green
-     * on an app that wired no consumers at all. The guarantee V7.4 is supposed to
-     * make is that THIS APP's consumers, derived from THIS manifest, act on a
-     * payload; that needs the server to own the hub and the runtimes, which is the
-     * "new server-side plumbing" the spec asks for.
-     */
-    wire: {
-        hub: WireHub;
-        /** Keyed by instance id. `onReady` once {@link ready} resolves. */
-        runtimes: ReadonlyMap<string, InstanceRuntime>;
-        /**
-         * Resolves once every runtime has completed its `onLoad`→`onReady`
-         * transition, i.e. once the intake subscriptions exist.
-         *
-         * Explicit rather than assumed. The lifecycle is async, so a probe that read
-         * a ledger in the same turn as construction saw an EMPTY one and reported a
-         * silent drop on a perfectly wired app — a false positive that looked
-         * exactly like the true positive this probe exists to raise.
-         */
-        ready: Promise<void>;
-    };
-    privateItemIds: readonly string[];
-    publicItemIds: readonly string[];
-}
-export declare function createVerifyServer(options: VerifyServerOptions): VerifyServer;
-export type { VerifyGuard };
-//# sourceMappingURL=verifyServer.d.ts.map

package/dist/verify/runtime/verifyServer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyServer.d.ts","sourceRoot":"","sources":["../../../src/verify/runtime/verifyServer.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAIzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,OAAO,EAAwC,KAAK,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACnH,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAWxE,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,+CAA+C;IAC/C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,kFAAkF;IAClF,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,mDAAmD;IACnD,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,KAAK,OAAO,CAAC;IACxD,IAAI,EAAE,eAAe,CAAC;IACtB;;;;;OAKG;IACH,IAAI,EAAE,aAAa,CAAC;IACpB;;;;;;;;;OASG;IACH,MAAM,EAAE,SAAS;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD;;;;;;;;;;;OAWG;IACH,IAAI,EAAE;QACJ,GAAG,EAAE,OAAO,CAAC;QACb,mEAAmE;QACnE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAC/C;;;;;;;;WAQG;QACH,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;KACtB,CAAC;IACF,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAqJ7E;AAED,YAAY,EAAE,WAAW,EAAE,CAAC"}

package/dist/verify/runtime/verifyServer.js

@@ -1,166 +0,0 @@
-/**
- * Verify-mode boot (04 §2 V7): a real HTTP server composed from the
- * EffectiveManifest.
- *
- * It is not a mock, and — since the master engines landed — it is not even a
- * parallel implementation. This module now calls the production
- * {@link composeServer}: the same mixins, the same `guardVerify`, the same
- * `ccCorsPolicy`, the same pinned CSP, the same frozen O(1) instance index, the
- * same ops allowlist. Only the leaf services (an in-memory dataset), the
- * `spawn` seam and the AI driver are verify-mode.
- *
- * That matters because the previous arrangement — a hand-written stand-in
- * server the probes asserted against — could only ever prove things about the
- * stand-in. Every divergence between it and the real composition was a place
- * where V7 stayed green while production broke.
- */
-import { Hono } from 'hono';
-import { composeServer } from '../../server/mixins';
-import { createEngineOpHandlers } from '../../server/ops';
-import { readFrozenManifest, serializeFrozenManifest } from '../frozenManifest';
-import { createInstanceRuntime, createWireHub } from '../../core/wire/wireHub';
-import { createVerifyContext } from './verifyContext';
-import { createVerifyAssetService, createVerifyDevService, createVerifyGuardService, createVerifyKnowledgeService, createVerifySystemService, PRIVATE_ITEM_IDS, PUBLIC_ITEM_IDS, } from './verifyServices';
-export function createVerifyServer(options) {
-    const { ctx, guard, exec } = createVerifyContext({
-        manifest: options.manifest,
-        allowedOrigins: options.allowedOrigins,
-        exec: options.exec,
-        aiDriver: options.aiDriver,
-    });
-    let manifest = options.manifest;
-    let lastGood = options.manifest;
-    const services = {
-        asset: createVerifyAssetService(),
-        knowledge: createVerifyKnowledgeService(),
-        guard: createVerifyGuardService(guard),
-        dev: createVerifyDevService(),
-        system: createVerifySystemService(),
-    };
-    /**
-     * The PRODUCTION op table (03 §3.2), not a harness copy.
-     *
-     * This used to be a hand-written map, which is why probe 14 could pass while
-     * the shipped framework had no route that invoked the driver at all (§4.1) —
-     * the harness was the only thing wiring `exec` to an op. Composing the real
-     * table here means the jail probe now exercises the code a generated app runs,
-     * and a regression in that wiring fails V7 instead of hiding behind it.
-     */
-    const handlers = createEngineOpHandlers({
-        services,
-        broker: ctx.broker,
-        exec,
-        push: ctx.push,
-        utilities: { echo: (input) => input },
-    });
-    /**
-     * The rogue-mixin case for probe 10, seeded BEFORE `composeServer` runs.
-     *
-     * The placement is the whole point. `coreMixin` writes the pinned headers on
-     * the way OUT, and Hono unwinds post-`next()` code in reverse registration
-     * order — so anything composed AFTER core structurally cannot win, and a
-     * rogue registered later would make this probe vacuously pass. Registering
-     * ahead of core is therefore the only genuine override vector (it exists at
-     * all because `composeServer` accepts a pre-seeded `app`), and it is exactly
-     * what V7.10 must be able to catch.
-     */
-    const seeded = new Hono();
-    if (options.rogueMixinOverridesCsp === true)
-        seeded.use('/api/dev/*', async (c, next) => {
-            await next();
-            c.header('Content-Security-Policy', 'default-src *');
-        });
-    const app = composeServer({
-        app: seeded,
-        ctx,
-        services,
-        exec,
-        instance: { handlers },
-        billing: options.billing ?? {
-            async usage() {
-                return [
-                    { metric: 'ai.tokens', used: 0, limit: 1_000_000 },
-                    { metric: 'storage.bytes', used: 0, limit: 1_000_000_000 },
-                ];
-            },
-            async plan() {
-                return { id: 'pro', title: 'Pro', limits: { 'ai.tokens': 1_000_000, 'storage.bytes': 1_000_000_000 } };
-            },
-        },
-    });
-    /**
-     * The app's wire tier: ONE hub, and an `InstanceRuntime` per manifest instance
-     * subscribed to that instance's enabled inbound ports. This is the consumer
-     * side V7.4 asserts against — built here, from the manifest, exactly as a real
-     * client shell builds it.
-     */
-    const hub = createWireHub();
-    const runtimes = new Map();
-    const mounting = [];
-    for (const instance of options.manifest.instances) {
-        const intakeChannels = instance.ports
-            .filter((port) => port.enabled && port.spec.direction === 'in')
-            .map((port) => `${instance.id}:${port.spec.id}`);
-        const runtime = createInstanceRuntime({ id: instance.id, hub, intakeChannels });
-        // Drive the REAL lifecycle rather than reaching past it: intake
-        // subscriptions are established at `onReady`, so a runtime left in `created`
-        // observes nothing — which is precisely the silent drop V7.4 must catch, and
-        // therefore precisely the state the positive case must not be in.
-        mounting.push(runtime.onLoad().then(() => runtime.onReady()));
-        runtimes.set(instance.id, runtime);
-    }
-    const wireReady = Promise.all(mounting).then(() => undefined);
-    /** The HTML route: last-good serving is asserted by probe 6. */
-    app.get('/', (c) => manifest === lastGood
-        ? c.html(`<!doctype html><title>${manifest.title}</title><main data-bundle="${manifest.bundleKey}">ok</main>`)
-        : c.html(`<!doctype html><title>${manifest.title}</title><main data-error="config">last-good bundle</main>`));
-    return {
-        fetch: (request) => app.fetch(request),
-        get manifest() {
-            return manifest;
-        },
-        mintToken: (claims) => guard.mint(claims),
-        revoke: (jti) => guard.revoke(jti),
-        /**
-         * A config that failed verification is REFUSED and the previous bundle keeps
-         * serving (04 V7.6). It deliberately does not hot-swap `ctx.manifest`: the
-         * composed route table belongs to the manifest it was built from, so a live
-         * swap would leave routes the new manifest never declared.
-         */
-        reload: (next) => {
-            // No candidate at all — nothing to verify, nothing to swap, and the
-            // running bundle is untouched.
-            if (next === null)
-                return false;
-            try {
-                // The REAL validator the boot path uses, not a shape guess: a manifest
-                // that cannot round-trip the frozen codec is one no boot could have
-                // produced, so adopting it would serve routes the manifest never
-                // declared.
-                readFrozenManifest(JSON.parse(serializeFrozenManifest(next)));
-            }
-            catch {
-                // Verify FAILED. `lastGood` keeps serving; `manifest` records the
-                // rejected intent so the surface can say so out loud rather than
-                // pretending the operator's push never happened.
-                manifest = next;
-                return false;
-            }
-            manifest = next;
-            lastGood = next;
-            return true;
-        },
-        exec,
-        push: ctx.push,
-        wire: { hub, runtimes, ready: wireReady },
-        // Hono's own registration table — what `composeServer` actually mounted,
-        // not what anyone believes it mounted.
-        routes: app.routes.map((route) => ({
-            method: route.method,
-            path: route.path,
-        })),
-        privateItemIds: PRIVATE_ITEM_IDS,
-        publicItemIds: PUBLIC_ITEM_IDS,
-    };
-}
-//# sourceMappingURL=verifyServer.js.map

package/dist/verify/runtime/verifyServer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyServer.js","sourceRoot":"","sources":["../../../src/verify/runtime/verifyServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAM1D,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAsC,MAAM,yBAAyB,CAAC;AACnH,OAAO,EAAE,mBAAmB,EAAoB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAkG1B,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,GAAsB,OAAO,CAAC,QAAQ,CAAC;IAEnD,MAAM,QAAQ,GAAmB;QAC/B,KAAK,EAAE,wBAAwB,EAAE;QACjC,SAAS,EAAE,4BAA4B,EAAE;QACzC,KAAK,EAAE,wBAAwB,CAAC,KAAK,CAAC;QACtC,GAAG,EAAE,sBAAsB,EAAE;QAC7B,MAAM,EAAE,yBAAyB,EAAE;KACpC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,QAAQ,GAA8B,sBAAsB,CAAC;QACjE,QAAQ;QACR,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI;QACJ,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE;KACtC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,MAAM,MAAM,GAAW,IAAI,IAAI,EAAS,CAAC;IACzC,IAAI,OAAO,CAAC,sBAAsB,KAAK,IAAI;QACzC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,MAAM,IAAI,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAW,aAAa,CAAC;QAChC,GAAG,EAAE,MAAM;QACX,GAAG;QACH,QAAQ;QACR,IAAI;QACJ,QAAQ,EAAE,EAAE,QAAQ,EAAE;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI;YAC1B,KAAK,CAAC,KAAK;gBACT,OAAO;oBACL,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;oBAClD,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE;iBAC3D,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,IAAI;gBACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,CAAC;YACzG,CAAC;SACF;KACF,CAAC,CAAC;IAEH;;;;;OAKG;IACH,MAAM,GAAG,GAAY,aAAa,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK;aAClC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;aAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,qBAAqB,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,gEAAgE;QAChE,6EAA6E;QAC7E,6EAA6E;QAC7E,kEAAkE;QAClE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE9D,gEAAgE;IAChE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CACjB,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,KAAK,8BAA8B,QAAQ,CAAC,SAAS,aAAa,CAAC;QAC9G,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,KAAK,2DAA2D,CAAC,CAC/G,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/C,IAAI,QAAQ;YACV,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,SAAS,EAAE,CAAC,MAA6B,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAChE,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;QAC1C;;;;;WAKG;QACH,MAAM,EAAE,CAAC,IAA8B,EAAW,EAAE;YAClD,oEAAoE;YACpE,+BAA+B;YAC/B,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAChC,IAAI,CAAC;gBACH,uEAAuE;gBACvE,oEAAoE;gBACpE,iEAAiE;gBACjE,YAAY;gBACZ,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;gBAClE,iEAAiE;gBACjE,iDAAiD;gBACjD,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI;QACJ,IAAI,EAAE,GAAG,CAAC,IAAqB;QAC/B,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;QACzC,yEAAyE;QACzE,uCAAuC;QACvC,MAAM,EAAG,GAA0E,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzG,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,cAAc,EAAE,gBAAgB;QAChC,aAAa,EAAE,eAAe;KAC/B,CAAC;AACJ,CAAC"}

package/dist/verify/runtime/verifyServices.d.ts

@@ -1,23 +0,0 @@
-/**
- * Verify-mode engine services — the leaf data layer V7 boots the real mixins
- * over.
- *
- * These are the ONLY fakes in the composed server. Everything above them —
- * `composeServer`, every mixin, `guardVerify`, `ccCorsPolicy`, the pinned CSP,
- * the instance index, the ops allowlist — is production code, so a probe that
- * passes here is a claim about the code a generated app runs.
- *
- * The seeded dataset is deliberately small and adversarial: two tenants (so the
- * cross-tenant 404 is testable), and public/private items (so a locked listing
- * can be proven not to disclose the private ones).
- */
-import type { AssetService, DevService, GuardService, KnowledgeService, SystemService } from '../../server/mixins/services';
-import type { VerifyGuard } from './verifyContext';
-export declare const PUBLIC_ITEM_IDS: readonly ["itm_public_1", "itm_public_2"];
-export declare const PRIVATE_ITEM_IDS: readonly ["itm_private_1"];
-export declare function createVerifyAssetService(): AssetService;
-export declare function createVerifyKnowledgeService(): KnowledgeService;
-export declare function createVerifyGuardService(guard: VerifyGuard): GuardService;
-export declare function createVerifyDevService(): DevService;
-export declare function createVerifySystemService(): SystemService;
-//# sourceMappingURL=verifyServices.d.ts.map

package/dist/verify/runtime/verifyServices.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyServices.d.ts","sourceRoot":"","sources":["../../../src/verify/runtime/verifyServices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAGV,YAAY,EAKZ,UAAU,EAEV,YAAY,EAEZ,gBAAgB,EAMhB,aAAa,EAEd,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,eAAO,MAAM,eAAe,2CAA4C,CAAC;AACzE,eAAO,MAAM,gBAAgB,4BAA6B,CAAC;AAU3D,wBAAgB,wBAAwB,IAAI,YAAY,CA4DvD;AAiGD,wBAAgB,4BAA4B,IAAI,gBAAgB,CA0C/D;AA8MD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAqBzE;AAED,wBAAgB,sBAAsB,IAAI,UAAU,CA6DnD;AAED,wBAAgB,yBAAyB,IAAI,aAAa,CAmBzD"}