cursedbelt 2.7.0 → 3.0.0

package/dist/server/mixins/core.mixin.js

@@ -1,180 +0,0 @@
-/**
- * `coreMixin` (03 §2.4) — always composed: health, config, the signal stream,
- * and the pinned security headers.
- *
- * The CSP is **non-overrideable, structurally**. This middleware sets the
- * headers AFTER `next()` returns, so whatever an engine handler wrote is
- * overwritten on the way out. That ordering is the whole enforcement mechanism:
- * a mixin cannot widen `connect-src` by setting its own header, because its
- * header no longer exists by the time the response leaves. V7 probe 10 asserts
- * this by mounting a deliberately rogue mixin and checking the wire.
- *
- * `connect-src` is compiled at V2 from the declared external providers
- * (CognitiveGateway driver endpoints, ObjectStore/CDN hosts), which is what
- * turns "please don't exfiltrate" into a browser-enforced impossibility: a
- * sub-feature cannot open a socket to a domain the manifest never declared.
- */
-import { AppError } from '../errors';
-import { createServerPushHub, sseResponse } from '../stream/serverPush';
-import { claimsOrNull, optionalSessionFor } from './security';
-/**
- * The fallback when a host wired no push hub. Deliberately a REAL hub rather
- * than a stub that closes the response: the channel still heartbeats and still
- * reconnects, so the client's stream lifecycle is identical whether or not the
- * host taps CDC. Nothing ever publishes into it.
- */
-const emptyHub = createServerPushHub();
-/**
- * `?instances=a,b,a` → `['a','b']`.
- *
- * Deduplicated, because a repeated id is a client bug that would otherwise
- * double every handshake frame, and order-preserving so the handshake sequence
- * is a function of the request rather than of `Set` iteration luck.
- */
-const parseInstancesParam = (raw) => {
-    if (!raw)
-        return [];
-    const seen = new Set();
-    for (const part of raw.split(',')) {
-        const id = part.trim();
-        if (id !== '')
-            seen.add(id);
-    }
-    return [...seen];
-};
-/**
- * Build the pinned policy. Exported so the V7 probe and the generated app's
- * static asset server assert against the SAME string rather than a copy that can
- * drift.
- */
-export function buildCsp(manifest) {
-    const extra = manifest.cspConnectAllowlist.length > 0 ? ` ${manifest.cspConnectAllowlist.join(' ')}` : '';
-    return [
-        "default-src 'self'",
-        "script-src 'self'",
-        // 'unsafe-inline' for styles only: the theme layer writes CSS custom
-        // properties inline. Scripts get no such allowance.
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' blob: data:",
-        "media-src 'self' blob:",
-        `connect-src 'self' http://localhost:*${extra}`,
-        "frame-src 'none'",
-        "object-src 'none'",
-        "base-uri 'self'",
-        "form-action 'self'",
-    ].join('; ');
-}
-export const SECURITY_HEADERS = {
-    'X-Content-Type-Options': 'nosniff',
-    'Referrer-Policy': 'same-origin',
-};
-export const coreMixin = (app, ctx) => {
-    const csp = buildCsp(ctx.manifest);
-    // Set last, unconditionally — see the module note. This is the reason engines
-    // "may never widen these headers" is a property of the code and not a rule in
-    // a document someone has to remember.
-    app.use('*', async (c, next) => {
-        await next();
-        c.header('Content-Security-Policy', csp);
-        for (const [name, value] of Object.entries(SECURITY_HEADERS))
-            c.header(name, value);
-    });
-    app.get('/api/core/health', (c) => c.json({
-        success: true,
-        appId: ctx.manifest.appId,
-        bundleKey: ctx.manifest.bundleKey,
-        profile: ctx.manifest.profile,
-    }));
-    /**
-     * The client's view of the compiled manifest. Deliberately NOT the whole
-     * manifest: port specs and op permission tables are compile-time concerns, and
-     * shipping them would let a reader enumerate the privileged surface.
-     */
-    app.get('/api/core/config', (c) => c.json({
-        success: true,
-        appId: ctx.manifest.appId,
-        title: ctx.manifest.title,
-        profile: ctx.manifest.profile,
-        engines: ctx.manifest.engines,
-        bundleKey: ctx.manifest.bundleKey,
-        cspConnectAllowlist: ctx.manifest.cspConnectAllowlist,
-        instances: ctx.manifest.instances.map((i) => ({
-            id: i.id,
-            engine: i.engine,
-            title: i.title,
-            effective: i.effective,
-            effectiveFeaturesHash: i.effectiveFeaturesHash,
-            routes: i.routes,
-            fills: i.fills,
-            cssIsolation: i.cssIsolation,
-        })),
-    }));
-    /**
-     * **THE app stream** — one live connection carrying app-level lifecycle events
-     * (lock broadcasts, redeploys, usage limits) AND, when `?instances=` names
-     * them, every instance's CDC and job frames multiplexed together (D28).
-     *
-     * The multiplexing is not an optimization; it is a correctness fix. A browser
-     * allows six concurrent connections per origin over HTTP/1.1, an SSE
-     * connection is long-lived, and one stream per instance therefore consumes the
-     * budget at `instances × open tabs` — an app a customer composes from six
-     * instances exhausts it in a SINGLE tab, and because ordinary `fetch`es queue
-     * behind the streams the app does not error, it HANGS. Measured before the
-     * fix: three instances passed, four hung. With the mux, an app opens ONE
-     * connection whatever its instance count.
-     *
-     * Each named instance gets its `state` handshake frame here, exactly as the
-     * per-instance route emits, so a client demultiplexing this stream sees the
-     * same open sequence it saw across N of them.
-     *
-     * An UNKNOWN instance id is a typed 404 rather than a silently-ignored name.
-     * Dropping it would leave the client waiting forever for frames that can never
-     * arrive — a stream that is live and empty is the hardest failure of this tier
-     * to diagnose, and it is exactly what a typo in a hand-edited client produces.
-     *
-     * `retry:` tells the browser's EventSource its reconnect floor, but the client
-     * uses its own jittered schedule (03 §6.5) — a fixed retry hint across N tabs
-     * is precisely the synchronized stampede J5-2 rules out.
-     *
-     * `optionalSession` rather than `session`: the shell opens this before login
-     * to learn about bundle changes, and gains tenant-scoped events once a token
-     * is presented. An anonymous connection therefore receives untenanted frames
-     * ONLY — a stream is a data surface and obeys the same tenant law as a query.
-     */
-    app.get('/api/core/stream', optionalSessionFor(ctx), (c) => {
-        const claims = claimsOrNull(c);
-        const requested = parseInstancesParam(c.req.query('instances'));
-        const instances = requested.map((instanceId) => {
-            const instance = ctx.instanceIndex.get(instanceId);
-            if (!instance)
-                throw new AppError(`No instance '${instanceId}'.`, {
-                    code: 'UNKNOWN_INSTANCE',
-                    status: 404,
-                    context: { instanceId, param: 'instances' },
-                });
-            return instance;
-        });
-        return sseResponse(ctx.push ?? emptyHub, { tenantId: claims?.tenantId, instanceIds: instances.map((instance) => instance.id) }, {
-            signal: c.req.raw.signal,
-            initial: [
-                {
-                    event: 'ready',
-                    data: { appId: ctx.manifest.appId, bundleKey: ctx.manifest.bundleKey },
-                },
-                ...instances.map((instance) => ({
-                    event: 'state',
-                    data: { instanceId: instance.id, effectiveFeaturesHash: instance.effectiveFeaturesHash },
-                    instanceId: instance.id,
-                })),
-            ],
-        });
-    });
-    app.notFound((c) => {
-        throw new AppError(`No route ${c.req.method} ${c.req.path}.`, {
-            code: 'ROUTE_NOT_FOUND',
-            status: 404,
-            context: { method: c.req.method, path: c.req.path },
-        });
-    });
-};
-//# sourceMappingURL=core.mixin.js.map

package/dist/server/mixins/core.mixin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"core.mixin.js","sourceRoot":"","sources":["../../../src/server/mixins/core.mixin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAG9D;;;;;GAKG;AACH,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,GAAuB,EAAqB,EAAE;IACzE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,EAAE,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,QAA2B;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,OAAO;QACL,oBAAoB;QACpB,mBAAmB;QACnB,qEAAqE;QACrE,oDAAoD;QACpD,kCAAkC;QAClC,4BAA4B;QAC5B,wBAAwB;QACxB,wCAAwC,KAAK,EAAE;QAC/C,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,aAAa;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAgB,CAAC,GAAW,EAAE,GAAiB,EAAE,EAAE;IACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnC,8EAA8E;IAC9E,8EAA8E;IAC9E,sCAAsC;IACtC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK;QACzB,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;QACjC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;KAC9B,CAAC,CACH,CAAC;IAEF;;;;OAIG;IACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,IAAI,CAAC;QACL,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK;QACzB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK;QACzB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;QAC7B,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;QAC7B,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;QACjC,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,mBAAmB;QACrD,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;YAC9C,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAC,CAAC;KACJ,CAAC,CACH,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;YAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ;gBACX,MAAM,IAAI,QAAQ,CAAC,gBAAgB,UAAU,IAAI,EAAE;oBACjD,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE;iBAC5C,CAAC,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,OAAO,WAAW,CAChB,GAAG,CAAC,IAAI,IAAI,QAAQ,EACpB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EACrF;YACE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM;YACxB,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE;iBACvE;gBACD,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;oBAC9B,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE;oBACxF,UAAU,EAAE,QAAQ,CAAC,EAAE;iBACxB,CAAC,CAAC;aACJ;SACF,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE;YAC5D,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;SACpD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/server/mixins/dev.mixin.d.ts

@@ -1,4 +0,0 @@
-import type { DevService } from './services';
-import { type CCHono, type DevMixinContext } from './types';
-export declare function createDevMixin(service: DevService): (app: CCHono, ctx: DevMixinContext) => void;
-//# sourceMappingURL=dev.mixin.d.ts.map

package/dist/server/mixins/dev.mixin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev.mixin.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/dev.mixin.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,eAAe,EAAqC,MAAM,SAAS,CAAC;AAE/F,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,IACxC,KAAK,MAAM,EAAE,KAAK,eAAe,KAAG,IAAI,CA2JjD"}

package/dist/server/mixins/dev.mixin.js

@@ -1,164 +0,0 @@
-/**
- * DevStudio's server block — `/api/dev/*` (03 §1): the app board and one app's
- * detail, the fleet, deploy, docs, pipelines, screenshots, orchestration, config
- * and database.
- *
- * **The five late arrivals (03 §1e, second half).** `app-detail`, `docs`,
- * `pipelines`, `screenshots` and `orchestration` were the last unbacked studio
- * views in the catalog, and the gap was HERE: this mixin mounted nothing behind
- * them, so a shell would have been an affordance whose every use was a 404. Each
- * now has a feature-gated read. They are gated one-for-one with their view's
- * `requiredFeature`, so a surface and its route appear and disappear together
- * (R-3, composition-time absence) — a nav entry whose route does not exist is the
- * same lie in the other direction.
- *
- * This is the **only** mixin whose context carries `exec` (J3-4). Its signature
- * takes `DevMixinContext`, so passing it a plain `MixinContext` does not
- * typecheck and passing an `ExecutionDriver` to any other mixin is impossible by
- * construction. That is deliberate over-engineering of a boundary: OS execution
- * reachable from a public-facing media route is a privilege escalation waiting
- * for one careless refactor.
- *
- * `configEditor` and `dbAdmin` are **privileged features** (J2-2). Their
- * sub-blocks compose with a declared `infra:write` permission, and — this is the
- * half people forget — the UI *omits* their routes and fills rather than
- * disabling them, so a MEMBER never sees a control that would 403. The server
- * check here is what makes the UI omission safe rather than cosmetic.
- */
-import { INFRA_WRITE } from '../../core/session/claims';
-import { guardFor } from './security';
-import { featureOnAnyInstance, rbacEnabled } from './types';
-export function createDevMixin(service) {
-    return (app, ctx) => {
-        const rbacOn = rbacEnabled(ctx);
-        const session = guardFor(ctx, rbacOn);
-        /**
-         * `onlyWhenRbac: false` — `infra:write` is enforced even in the local
-         * single-user profile. Local DX is unaffected because the bootstrap user
-         * carries the claim by default (02 §4.4); what this prevents is a SaaS
-         * tenant inheriting local's "everyone is an owner" assumption.
-         */
-        const privileged = guardFor(ctx, rbacOn, { permission: INFRA_WRITE, onlyWhenRbac: false });
-        const registryOn = featureOnAnyInstance(ctx, 'dev', 'appRegistry');
-        const fleetOn = featureOnAnyInstance(ctx, 'dev', 'fleet');
-        const deployOn = featureOnAnyInstance(ctx, 'dev', 'deploy');
-        const diskOn = featureOnAnyInstance(ctx, 'dev', 'diskUsage');
-        const configEditorOn = featureOnAnyInstance(ctx, 'dev', 'configEditor');
-        const dbAdminOn = featureOnAnyInstance(ctx, 'dev', 'dbAdmin');
-        const docsOn = featureOnAnyInstance(ctx, 'dev', 'docs');
-        const pipelinesOn = featureOnAnyInstance(ctx, 'dev', 'pipelines');
-        const screenshotsOn = featureOnAnyInstance(ctx, 'dev', 'screenshots');
-        const orchestrationOn = featureOnAnyInstance(ctx, 'dev', 'orchestration');
-        app.get('/api/dev/health', (c) => c.json({ success: true, engine: 'dev' }));
-        if (registryOn) {
-            app.get('/api/dev/apps', session, async (c) => {
-                const apps = await service.listApps({ claims: c.get('claims') });
-                return c.json({ success: true, apps });
-            });
-            // The `app-detail` view's far side (03 §1e). Registered under the SAME
-            // feature as the board it is opened from: a detail page for a surface you
-            // cannot list is a link to nowhere.
-            app.get('/api/dev/apps/:appId', session, async (c) => {
-                const app_ = await service.appDetail({ claims: c.get('claims') }, c.req.param('appId'));
-                return c.json({ success: true, app: app_ });
-            });
-        }
-        if (fleetOn)
-            app.get('/api/dev/fleet', session, async (c) => {
-                const apps = await service.fleet({ claims: c.get('claims') });
-                return c.json({ success: true, apps });
-            });
-        if (deployOn)
-            app.post('/api/dev/deploy/:appId', privileged, async (c) => {
-                // Deploys are long-running, so they go through the JobBroker rather
-                // than holding the request open (03 §7.3).
-                const result = await service.deploy({ claims: c.get('claims') }, c.req.param('appId'));
-                return c.json({ success: true, ...result }, 202);
-            });
-        if (diskOn)
-            app.get('/api/dev/disk', session, async (c) => {
-                const usage = await service.diskUsage({ claims: c.get('claims') });
-                return c.json({ success: true, usage });
-            });
-        /* -------------------- docs (03 §1e) — declared files only -------------- */
-        if (docsOn) {
-            app.get('/api/dev/docs', session, async (c) => {
-                const docs = await service.listDocs({ claims: c.get('claims') });
-                return c.json({ success: true, docs });
-            });
-            /**
-             * The doc path rides a QUERY parameter, not a wildcard path segment.
-             *
-             * A `/docs/:appId/*` route would put an attacker-controlled path directly
-             * into routing, where every layer between the socket and the handler gets
-             * an opinion about `%2e%2e%2f`. As a query value it is one opaque string
-             * the service matches against the app's DECLARED doc list — no path
-             * arithmetic decides whether the read is allowed.
-             */
-            app.get('/api/dev/docs/:appId', session, async (c) => {
-                const doc = await service.readDoc({ claims: c.get('claims') }, c.req.param('appId'), c.req.query('path') ?? '');
-                return c.json({ success: true, doc });
-            });
-        }
-        /* ------------------ pipelines (03 §1e) — the exec whitelist ------------ */
-        if (pipelinesOn) {
-            app.get('/api/dev/pipelines', session, async (c) => {
-                const pipelines = await service.pipelines({ claims: c.get('claims') });
-                return c.json({ success: true, pipelines });
-            });
-            // The run LOG, not a run trigger: starting one is `dev:run-pipeline`, an
-            // OP, so it goes through the V2 allowlist and the op-level permission
-            // check like every other state change.
-            app.get('/api/dev/pipelines/runs', session, async (c) => {
-                const runs = await service.pipelineRuns({ claims: c.get('claims') });
-                return c.json({ success: true, runs });
-            });
-        }
-        /* ------------------ screenshots (03 §1e) — a host-wired source --------- */
-        if (screenshotsOn) {
-            app.get('/api/dev/screenshots', session, async (c) => {
-                const screenshots = await service.screenshots({ claims: c.get('claims') });
-                return c.json({ success: true, screenshots });
-            });
-            app.get('/api/dev/screenshots/:name/bytes', session, async (c) => {
-                const { bytes, contentType } = await service.readScreenshot({ claims: c.get('claims') }, c.req.param('name'));
-                return c.body(bytes, 200, {
-                    'content-type': contentType,
-                    // An operator's captures are not public cacheable content, and the
-                    // route is session-gated — a shared cache must not keep a copy.
-                    'cache-control': 'private, no-store',
-                    // The name came from a listing, but it still reaches a browser as a
-                    // filename; sniffing is what turns a mislabeled capture into script.
-                    'x-content-type-options': 'nosniff',
-                });
-            });
-        }
-        /* --------------- orchestration (03 §1e) — durable job outcomes --------- */
-        if (orchestrationOn)
-            app.get('/api/dev/jobs', session, async (c) => {
-                const jobs = await service.jobs({ claims: c.get('claims') });
-                return c.json({ success: true, jobs });
-            });
-        /* ---------------- privileged: plaintext env values (J2-2) ------------- */
-        if (configEditorOn) {
-            app.get('/api/dev/config/:appId', privileged, async (c) => {
-                const config = await service.readConfig({ claims: c.get('claims') }, c.req.param('appId'));
-                return c.json({ success: true, config });
-            });
-            app.put('/api/dev/config/:appId', privileged, async (c) => {
-                const patch = (await c.req.json().catch(() => ({})));
-                await service.writeConfig({ claims: c.get('claims') }, c.req.param('appId'), patch);
-                return c.json({ success: true });
-            });
-        }
-        /* ---------------- privileged: destructive DB operations --------------- */
-        if (dbAdminOn) {
-            app.post('/api/dev/db/:domain/export', privileged, async (c) => {
-                // `VACUUM INTO` a snapshot — never a tar of a live `.db` (01 §6.1).
-                const result = await service.exportDatabase({ claims: c.get('claims') }, c.req.param('domain'));
-                return c.json({ success: true, ...result });
-            });
-        }
-    };
-}
-//# sourceMappingURL=dev.mixin.js.map

package/dist/server/mixins/dev.mixin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dev.mixin.js","sourceRoot":"","sources":["../../../src/server/mixins/dev.mixin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAqC,oBAAoB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/F,MAAM,UAAU,cAAc,CAAC,OAAmB;IAChD,OAAO,CAAC,GAAW,EAAE,GAAoB,EAAQ,EAAE;QACjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC;;;;;WAKG;QACH,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3F,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QAE1E,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAE5E,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YAEH,uEAAuE;YACvE,0EAA0E;YAC1E,oCAAoC;YACpC,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO;YACT,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QAEL,IAAI,QAAQ;YACV,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACzD,oEAAoE;gBACpE,2CAA2C;gBAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QAEL,IAAI,MAAM;YACR,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QAEL,6EAA6E;QAC7E,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YAEH;;;;;;;;eAQG;YACH,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAC/B,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EACpB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAC1B,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACjD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YAEH,yEAAyE;YACzE,sEAAsE;YACtE,uCAAuC;YACvC,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IAAI,aAAa,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC/D,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CACzD,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,KAA+B,EAAE,GAAG,EAAE;oBAClD,cAAc,EAAE,WAAW;oBAC3B,mEAAmE;oBACnE,gEAAgE;oBAChE,eAAe,EAAE,mBAAmB;oBACpC,oEAAoE;oBACpE,qEAAqE;oBACrE,wBAAwB,EAAE,SAAS;iBACpC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IAAI,eAAe;YACjB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;QAEL,4EAA4E;QAC5E,IAAI,cAAc,EAAE,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACxD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA2B,CAAC;gBAC/E,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7D,oEAAoE;gBACpE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/mixins/enforcement.d.ts

@@ -1,73 +0,0 @@
-/**
- * Billing ENFORCEMENT — the wire between the meter and the gate (11 §4).
- *
- * The billing tier landed 90% built: the meter is durable and never-dropped
- * (01 §4.1), `BillingService` evaluates a plan against it, and
- * `assertMetricWithinPlan` throws the typed `USAGE_LIMIT_EXCEEDED` (402). The
- * missing 10% — the 10% that turns metering into revenue — was that
- * `assertMetricWithinPlan` had ZERO callers: the platform metered perfectly and
- * enforced nothing, giving every feature away for free while carefully recording
- * how much it gave away.
- *
- * This module supplies the two things that were absent:
- *
- *   * {@link createPlanEnforcer} — the concrete {@link PlanEnforcer} the mixin
- *     context carries under saas, reading live usage and asserting against it.
- *   * {@link requireWithinPlan} — a composable route middleware, mirroring how
- *     `guardVerify` is composed onto a protected sub-block (03 §2.3). An engine
- *     mixin drops it onto its metered sub-blocks and the pre-check becomes
- *     declarative and visible at the mount site, rather than buried in a service
- *     body where the next metered route can forget it.
- *
- * The pre-check is the point (billingService.ts, §4): a route that only read
- * usage AFTER the work would already have spent the tokens/bytes. Enforcement
- * runs BEFORE the handler — for AI, before the gateway dispatches; for uploads,
- * before the stream is consumed — so the request that would cross the ceiling is
- * refused, not billed and then noticed.
- */
-import type { Context, MiddlewareHandler } from 'hono';
-import type { BillingService } from './billing.mixin';
-import type { CCVariables, PlanEnforcer } from './types';
-/**
- * The enforcer bound to a live {@link BillingService}. `usage` reads the
- * durable `meter_events` record — never a parallel counter — so the gate and the
- * ledger can never disagree (01 §4.1).
- */
-export declare function createPlanEnforcer(service: BillingService): PlanEnforcer;
-/**
- * How much of `metric` the pending request is about to consume. Defaults to a
- * floor of 1 — i.e. "is there ANY headroom left?" — because the exact cost of an
- * AI completion (tokens) or a chunked upload (bytes) is unknown before the work
- * runs. A route that CAN name an upper bound (a declared `Content-Length`)
- * supplies it, so an upload that would clearly overflow is refused up front
- * rather than after the last byte lands.
- */
-export type MeterCost = (c: Context<{
-    Variables: CCVariables;
-}>) => number;
-/**
- * The pre-flight limit middleware for one metered sub-block.
- *
- * MUST be composed AFTER the session middleware — it reads `tenantId` from the
- * verified claims, so a route registers `session` first, then this. Applying it
- * per sub-block (never globally) keeps both properties visible at the mount
- * site: a public/unmetered route pays nothing, and a metered route cannot forget
- * the gate.
- */
-export declare function requireWithinPlan(enforcer: PlanEnforcer, metric: string, cost?: MeterCost): MiddlewareHandler<{
-    Variables: CCVariables;
-}>;
-/** The `Content-Length` a client declared, as a cost floored at 1 (unknown ⇒ 1). */
-export declare const declaredContentLength: MeterCost;
-/**
- * The ENTITLEMENT pre-flight for one tier-gated sub-block (P2). Same
- * composition contract as {@link requireWithinPlan}: AFTER the session
- * middleware (it reads `tenantId` from verified claims), per sub-block so the
- * gate is visible at the mount site. Deployment feature config decides whether
- * the route EXISTS; this decides whether THIS tenant's plan includes it —
- * throwing the typed 402 the shell renders as the upgrade dialog.
- */
-export declare function requirePlanFeature(enforcer: PlanEnforcer, engine: string, feature: string): MiddlewareHandler<{
-    Variables: CCVariables;
-}>;
-//# sourceMappingURL=enforcement.d.ts.map

package/dist/server/mixins/enforcement.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAQ,MAAM,MAAM,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CASxE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;IAAE,SAAS,EAAE,WAAW,CAAA;CAAE,CAAC,KAAK,MAAM,CAAC;AAI3E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,SAAwB,GAC7B,iBAAiB,CAAC;IAAE,SAAS,EAAE,WAAW,CAAA;CAAE,CAAC,CAQ/C;AAED,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,EAAE,SACS,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,iBAAiB,CAAC;IAAE,SAAS,EAAE,WAAW,CAAA;CAAE,CAAC,CAM/C"}

package/dist/server/mixins/enforcement.js

@@ -1,53 +0,0 @@
-import { assertFeatureWithinPlan, assertMetricWithinPlan } from '../services/billingService';
-/**
- * The enforcer bound to a live {@link BillingService}. `usage` reads the
- * durable `meter_events` record — never a parallel counter — so the gate and the
- * ledger can never disagree (01 §4.1).
- */
-export function createPlanEnforcer(service) {
-    return {
-        async assert(tenantId, metric, cost = 1) {
-            assertMetricWithinPlan(await service.usage(tenantId), metric, cost);
-        },
-        async assertFeature(tenantId, engine, feature) {
-            assertFeatureWithinPlan(await service.plan(tenantId), engine, feature);
-        },
-    };
-}
-const AT_LEAST_ONE = () => 1;
-/**
- * The pre-flight limit middleware for one metered sub-block.
- *
- * MUST be composed AFTER the session middleware — it reads `tenantId` from the
- * verified claims, so a route registers `session` first, then this. Applying it
- * per sub-block (never globally) keeps both properties visible at the mount
- * site: a public/unmetered route pays nothing, and a metered route cannot forget
- * the gate.
- */
-export function requireWithinPlan(enforcer, metric, cost = AT_LEAST_ONE) {
-    return async (c, next) => {
-        const { tenantId } = c.get('claims');
-        // Throws the typed 402 the shell renders as the upgrade dialog (09 §5e); the
-        // handler never runs, so no metered work happens past the ceiling.
-        await enforcer.assert(tenantId, metric, cost(c));
-        await next();
-    };
-}
-/** The `Content-Length` a client declared, as a cost floored at 1 (unknown ⇒ 1). */
-export const declaredContentLength = (c) => Number(c.req.header('content-length')) || 1;
-/**
- * The ENTITLEMENT pre-flight for one tier-gated sub-block (P2). Same
- * composition contract as {@link requireWithinPlan}: AFTER the session
- * middleware (it reads `tenantId` from verified claims), per sub-block so the
- * gate is visible at the mount site. Deployment feature config decides whether
- * the route EXISTS; this decides whether THIS tenant's plan includes it —
- * throwing the typed 402 the shell renders as the upgrade dialog.
- */
-export function requirePlanFeature(enforcer, engine, feature) {
-    return async (c, next) => {
-        const { tenantId } = c.get('claims');
-        await enforcer.assertFeature(tenantId, engine, feature);
-        await next();
-    };
-}
-//# sourceMappingURL=enforcement.js.map

package/dist/server/mixins/enforcement.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../../../src/server/mixins/enforcement.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAI7F;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAI,GAAG,CAAC;YACrD,sBAAsB,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAe;YACnE,uBAAuB,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC;AAYD,MAAM,YAAY,GAAc,GAAG,EAAE,CAAC,CAAC,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAsB,EACtB,MAAc,EACd,OAAkB,YAAY;IAE9B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAU,EAAE,EAAE;QAC7B,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,6EAA6E;QAC7E,mEAAmE;QACnE,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAc,CAAC,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAsB,EACtB,MAAc,EACd,OAAe;IAEf,OAAO,KAAK,EAAE,CAAC,EAAE,IAAU,EAAE,EAAE;QAC7B,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/mixins/guard.mixin.d.ts

@@ -1,6 +0,0 @@
-import type { AuditTrailSink, StatementExecutor } from 'cwip/storage';
-import { type AccountService } from '../services/accountService';
-import type { GuardService } from './services';
-import { type CCHono, type MixinContext } from './types';
-export declare function createGuardMixin(service: GuardService, accounts?: AccountService, auditTrail?: AuditTrailSink, siteCopy?: StatementExecutor): (app: CCHono, ctx: MixinContext) => void;
-//# sourceMappingURL=guard.mixin.d.ts.map

package/dist/server/mixins/guard.mixin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"guard.mixin.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/guard.mixin.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAatE,OAAO,EAAE,KAAK,cAAc,EAAqB,MAAM,4BAA4B,CAAC;AAGpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAkB,KAAK,MAAM,EAAwB,KAAK,YAAY,EAAe,MAAM,SAAS,CAAC;AA4F5G,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,QAAQ,CAAC,EAAE,cAAc,EACzB,UAAU,CAAC,EAAE,cAAc,EAC3B,QAAQ,CAAC,EAAE,iBAAiB,IAEpB,KAAK,MAAM,EAAE,KAAK,YAAY,KAAG,IAAI,CAub9C"}