cursedbelt 2.7.0 → 3.0.0

package/dist/server/mixins/guard.mixin.js

@@ -1,506 +0,0 @@
-import { zeroize } from 'cwip/guard';
-import { AUDIT_READ, INFRA_WRITE, LOCKED_PRIVATE_MODE } from '../../core/session/claims';
-import { SITE_COPY_BAKED_ONLY } from '../../core/site/siteCopy';
-import { clearSiteCopyValue, platformAdminTenant, readSiteCopyEntries, readSiteCopyOverrides, setSiteCopyValue, } from '../drivers/siteCopy';
-import { AppError } from '../errors';
-import { clientIp, createRateLimiter } from '../middleware/rateLimit';
-import { createLoginThrottle } from '../auth/loginThrottle';
-import { refuseGatedSignup } from '../services/accountService';
-import { effectiveSignupMode } from '../../config/appConfig';
-import { guardFor, sessionTokenOf } from './security';
-import { featureOnAnyInstance, rbacEnabled } from './types';
-/** Ceiling on any password/passphrase body — the routes are not memory amplifiers. */
-const MAX_PASSWORD_BYTES = 4096;
-/** Read a request body as the raw password bytes (no string hop — 01 §3.4). */
-const readPasswordBytes = async (request, limit) => {
-    const buffer = await request.arrayBuffer();
-    if (buffer.byteLength === 0)
-        throw new AppError('Request carried no password bytes.', { code: 'PASSWORD_MISSING', status: 400, category: 'validation' });
-    if (buffer.byteLength > limit)
-        throw new AppError(`Password exceeds the ${limit}-byte ceiling.`, {
-            code: 'PASSWORD_TOO_LARGE',
-            status: 413,
-            category: 'validation',
-            context: { limit },
-        });
-    return new Uint8Array(buffer);
-};
-/**
- * Read a change-password body: a 2-byte big-endian length prefix, the current
- * password (that many bytes; 0 ⇒ omitted, an admin reset), then the new password
- * (the remainder). Both come out as owned copies; the combined source buffer is
- * zeroized so neither password lingers in it.
- */
-const readFramedPasswords = async (request, limit) => {
-    const buffer = new Uint8Array(await request.arrayBuffer());
-    if (buffer.byteLength < 2)
-        throw new AppError('Change-password body is missing its length frame.', {
-            code: 'PASSWORD_FRAME_INVALID',
-            status: 400,
-            category: 'validation',
-        });
-    if (buffer.byteLength > limit + 2)
-        throw new AppError(`Change-password body exceeds the ${limit}-byte ceiling.`, {
-            code: 'PASSWORD_TOO_LARGE',
-            status: 413,
-            category: 'validation',
-            context: { limit },
-        });
-    const currentLen = ((buffer[0] ?? 0) << 8) | (buffer[1] ?? 0);
-    if (2 + currentLen > buffer.byteLength) {
-        zeroize(buffer);
-        throw new AppError('Change-password length frame overruns the body.', {
-            code: 'PASSWORD_FRAME_INVALID',
-            status: 400,
-            category: 'validation',
-        });
-    }
-    // slice() copies, so `current`/`next` are independent buffers the service owns
-    // and zeroizes; the source `buffer` still holds both, so wipe it here.
-    const current = currentLen > 0 ? buffer.slice(2, 2 + currentLen) : undefined;
-    const next = buffer.slice(2 + currentLen);
-    zeroize(buffer);
-    if (next.byteLength === 0) {
-        if (current)
-            zeroize(current);
-        throw new AppError('Change-password body carried no new password.', {
-            code: 'PASSWORD_MISSING',
-            status: 400,
-            category: 'validation',
-        });
-    }
-    return { current, next };
-};
-/** Page ceiling for the audit read route. A trail is read from the top, not exhausted. */
-const AUDIT_PAGE_MAX = 200;
-/**
- * How long an edge/browser may serve the public copy payload without asking
- * again (D36 — "caching may help"). Five minutes bounds how stale a copy edit
- * can look to a visitor while keeping the marketing page's fetch effectively
- * free: Cloudflare sits in front of `api.` and will collapse the world's
- * traffic to one origin hit per window.
- */
-const SITE_COPY_MAX_AGE_SECONDS = 300;
-/** FNV-1a over the serialized payload — a stable, dependency-free ETag. This is
- *  cache validation, not integrity: a collision costs one stale 304 window. */
-const weakEtag = (body) => {
-    let hash = 0x811c9dc5;
-    for (let i = 0; i < body.length; i++) {
-        hash ^= body.charCodeAt(i);
-        hash = Math.imul(hash, 0x01000193);
-    }
-    return `W/"${(hash >>> 0).toString(16)}"`;
-};
-export function createGuardMixin(service, accounts, auditTrail, siteCopy) {
-    return (app, ctx) => {
-        const rbacOn = rbacEnabled(ctx);
-        const session = guardFor(ctx, rbacOn);
-        const privateModeOn = featureOnAnyInstance(ctx, 'guard', 'privateMode');
-        const secretsOn = featureOnAnyInstance(ctx, 'guard', 'secretsPanel');
-        const accountsOn = featureOnAnyInstance(ctx, 'guard', 'accounts') && accounts !== undefined;
-        // The two brute-force gates for the unauthenticated credential routes (L5).
-        // Constructed ONCE here (composeServer runs once), so their sliding-window
-        // state is per-server. Per-IP is coarse; per-account (`<email>:<ip>`) is
-        // strict and also blunts a distributed guess against one account.
-        const perIp = createRateLimiter({
-            limit: 10,
-            windowMs: 60_000,
-            message: 'Too many attempts from this address. Please try again shortly.',
-        });
-        // `threshold: 4` preserves this door's long-standing contract EXACTLY — five
-        // failures answered 401, the sixth refused 429 — across the 2026-08-02 swap from a
-        // fixed-window lockout to the shared exponential/global throttle. The shared
-        // default (5) counts one attempt more leniently, because `threshold` names the
-        // failures that incur NO delay and the delay is armed by the failure AFTER them.
-        // Consolidating a security control is not a license to loosen it by an attempt, so
-        // the number is stated here rather than inherited; `recipe.spec.ts` pins it.
-        // Everything else about the swap is strictly stronger: backoff now compounds
-        // instead of resetting, a global counter catches an attacker rotating
-        // X-Forwarded-For, and the table is bounded.
-        const throttle = createLoginThrottle({ threshold: 4 });
-        const accountKey = (c) => `${c.req.query('email') ?? ''}:${clientIp(c)}`;
-        const perAccount = async (c, next) => {
-            const key = accountKey(c);
-            const verdict = throttle.check(key);
-            if (!verdict.allowed) {
-                c.header('Retry-After', String(Math.max(1, verdict.retryAfterSeconds)));
-                throw new AppError('Too many failed attempts for this account. Please try again later.', {
-                    code: 'ACCOUNT_THROTTLED',
-                    status: 429,
-                    category: 'security',
-                });
-            }
-            try {
-                await next();
-            }
-            catch (error) {
-                // A thrown 4xx (bad password) never reaches the success branch — count it
-                // as a failure here, then let the envelope handler render it.
-                throttle.recordFailure(key);
-                throw error;
-            }
-            if (c.res.status < 400)
-                throttle.recordSuccess(key);
-            else
-                throttle.recordFailure(key);
-        };
-        app.get('/api/guard/health', (c) => c.json({ success: true, engine: 'guard' }));
-        if (privateModeOn) {
-            app.post('/api/guard/unlock', perIp, async (c) => {
-                const { token, claims } = await service.unlock(c.req.raw);
-                // The payload the client asserts onto `session:private-mode`. `claims`
-                // rides along as an ADVISORY copy — the server re-verifies `token` on
-                // every subsequent request regardless.
-                return c.json({ success: true, privateMode: { unlocked: true, token, claims } });
-            });
-            app.post('/api/guard/lock', session, async (c) => {
-                const claims = c.get('claims');
-                await service.lock({ claims });
-                ctx.guard.revoke(claims.jti); // denylisted until exp — a replayed token is dead
-                return c.json({ success: true, privateMode: LOCKED_PRIVATE_MODE });
-            });
-        }
-        if (accountsOn) {
-            const account = accounts;
-            /** The verified caller, as every authenticated account verb takes it. */
-            const scopeOf = (c) => ({ claims: c.get('claims') });
-            // Signup — public here (invite-gating is 02 §3). Body IS the password; the
-            // email (not secret) rides the query. The service defaults the role by
-            // profile (saas ⇒ OWNER of a new tenant, local ⇒ MEMBER) — the route never
-            // lets a caller name their own role.
-            //
-            // The launch gate (D33) short-circuits here before the password bytes are
-            // read, through the SAME `refuseGatedSignup` rule the service enforces
-            // authoritatively — two enforcement points, one definition of closed.
-            const signupMode = effectiveSignupMode(ctx.manifest.instances);
-            app.post('/api/guard/accounts', perIp, perAccount, async (c) => {
-                const gateError = refuseGatedSignup(signupMode, c.req.header('x-cc-invitation') !== undefined);
-                if (gateError)
-                    throw gateError;
-                const password = await readPasswordBytes(c.req.raw, MAX_PASSWORD_BYTES);
-                const view = await account.signup({
-                    email: c.req.query('email') ?? '',
-                    password,
-                    tenantTitle: c.req.query('tenantTitle') ?? undefined,
-                    // An invitation token is a BEARER SECRET, so it rides a header rather
-                    // than the query string: query strings land in access logs, proxy
-                    // logs and Referer headers, and a logged invite is a free membership
-                    // in someone else's tenant. The body is already the password (02 §3).
-                    inviteToken: c.req.header('x-cc-invitation') ?? undefined,
-                });
-                return c.json({ success: true, account: view }, 201);
-            });
-            // Login — verify the password and mint a session carrying the real
-            // membership role (Law #4: a real minted token, not a hand-forged one).
-            app.post('/api/guard/login', perIp, perAccount, async (c) => {
-                const password = await readPasswordBytes(c.req.raw, MAX_PASSWORD_BYTES);
-                const { token, claims } = await account.login({
-                    email: c.req.query('email') ?? '',
-                    password,
-                    // What this device calls itself, for the sessions panel (02 §4). It is
-                    // recorded beside the jti and never signed into the token.
-                    deviceLabel: c.req.header('x-cc-device') ?? undefined,
-                });
-                return c.json({ success: true, session: { unlocked: true, token, claims } });
-            });
-            // ── multi-device session lifecycle (02 §4) ───────────────────────────
-            //
-            // All four are authenticated and act ONLY on the calling account's own
-            // sessions: a jti is a bearer handle, so "end that session" is a verb an
-            // account may aim at itself and nowhere else.
-            app.get('/api/guard/sessions', session, async (c) => {
-                const sessions = await account.listSessions(scopeOf(c));
-                return c.json({ success: true, sessions });
-            });
-            // Re-mint before expiry so a working user is not logged out mid-task. The
-            // OLD token dies in the same call — a refresh is an exchange, not a
-            // second credential.
-            app.post('/api/guard/session/refresh', session, async (c) => {
-                const { token, claims } = await account.refreshSession(scopeOf(c));
-                return c.json({ success: true, session: { unlocked: true, token, claims } });
-            });
-            // Log out THIS device. `/api/guard/lock` is the private-mode verb (it also
-            // zeroizes key material); this one is the session verb, and it exists
-            // whether or not privateMode is configured on.
-            app.post('/api/guard/logout', session, async (c) => {
-                const claims = c.get('claims');
-                ctx.guard.revoke(claims.jti);
-                return c.json({ success: true, session: LOCKED_PRIVATE_MODE });
-            });
-            // Log out ONE other device by jti — the sessions panel's per-row action.
-            app.delete('/api/guard/sessions/:jti', session, async (c) => {
-                const ended = await account.endSession(scopeOf(c), c.req.param('jti'));
-                return c.json({ success: true, ended });
-            });
-            // Log out EVERYWHERE, including here (a "log out everywhere" that leaves
-            // the clicking device signed in is the bug the verb exists to avoid).
-            app.post('/api/guard/logout-all', session, async (c) => {
-                const result = await account.logoutEverywhere(scopeOf(c));
-                return c.json({ success: true, ...result, session: LOCKED_PRIVATE_MODE });
-            });
-            // Change/reset a password — authenticated. Self-change re-authenticates with
-            // the current password (the length-framed body); an ADMIN/OWNER may reset
-            // another account without it. Authorization is decided in the service from
-            // the verified claims.
-            app.post('/api/guard/accounts/:id/password', session, async (c) => {
-                const { current, next } = await readFramedPasswords(c.req.raw, MAX_PASSWORD_BYTES);
-                await account.changePassword({ claims: c.get('claims') }, c.req.param('id'), { current, next });
-                return c.json({ success: true });
-            });
-            // ── tenant lifecycle & RBAC administration (02 §3) ───────────────────
-            //
-            // All authenticated, none carrying a secret, so they take ordinary JSON
-            // bodies. The OWNER/ADMIN gate is NOT expressed as a `guardVerify`
-            // permission: a role is not a permission, the acting role must be re-read
-            // from the store (a token minted before a demotion still SAYS admin), and
-            // the escalation rules need the target row anyway. So the middleware
-            // authenticates and `AccountService` authorizes — one place, every verb.
-            app.get('/api/guard/tenants/:tenantId', session, async (c) => {
-                const tenant = await account.getTenant(scopeOf(c), c.req.param('tenantId'));
-                if (!tenant)
-                    throw new AppError('No such tenant.', { code: 'TENANT_NOT_FOUND', status: 404, category: 'validation' });
-                return c.json({ success: true, tenant });
-            });
-            app.patch('/api/guard/tenants/:tenantId', session, async (c) => {
-                const patch = (await c.req.json().catch(() => ({})));
-                const tenant = await account.updateTenant(scopeOf(c), c.req.param('tenantId'), patch);
-                return c.json({ success: true, tenant });
-            });
-            app.get('/api/guard/tenants/:tenantId/members', session, async (c) => {
-                const members = await account.listMembers(scopeOf(c), c.req.param('tenantId'));
-                return c.json({ success: true, members });
-            });
-            app.post('/api/guard/tenants/:tenantId/invitations', session, async (c) => {
-                const body = (await c.req.json().catch(() => ({})));
-                const invitation = await account.inviteMember(scopeOf(c), c.req.param('tenantId'), {
-                    email: body.email ?? '',
-                    role: body.role ?? 'MEMBER',
-                    ttlMinutes: body.ttlMinutes,
-                });
-                // The raw token rides the RESPONSE and nowhere else — never a log line,
-                // never a stored column (the store keeps its hash).
-                return c.json({ success: true, invitation }, 201);
-            });
-            // Accepting is a MEMBER-less act by definition (the caller has no
-            // membership in the inviting tenant yet), so it hangs off the invitation,
-            // not the tenant — but it still requires a verified session: the invite is
-            // bound to the account's email.
-            app.post('/api/guard/invitations/accept', session, async (c) => {
-                const body = (await c.req.json().catch(() => ({})));
-                const member = await account.acceptInvitation(scopeOf(c), body.token ?? '');
-                return c.json({ success: true, member }, 201);
-            });
-            app.patch('/api/guard/tenants/:tenantId/members/:userId', session, async (c) => {
-                const patch = (await c.req.json().catch(() => ({})));
-                const member = await account.updateMember(scopeOf(c), c.req.param('tenantId'), c.req.param('userId'), patch);
-                return c.json({ success: true, member });
-            });
-            app.delete('/api/guard/tenants/:tenantId/members/:userId', session, async (c) => {
-                const removed = await account.removeMember(scopeOf(c), c.req.param('tenantId'), c.req.param('userId'));
-                return c.json({ success: true, removed });
-            });
-            /* ── plan assignment (P2 — the entitlement anchor) ──────────────────────
-             *
-             * A tenant's plan decides its entitlements and ceilings, so assigning it
-             * is a PLATFORM act, never a tenant act — a tenant choosing its own plan
-             * is a customer picking their price. Same two-part gate as site copy:
-             * `infra:write` (any OWNER has it) AND membership in the store-anchored
-             * platform tenant. Mounted only when that anchor's executor is wired —
-             * without it the check cannot run, and an assignment surface that cannot
-             * verify who is the platform fails CLOSED by not existing. Billing-shaped
-             * on purpose (manual today, a Stripe webhook lands on the same service
-             * verb later), which is what lets the plan grid be exercised by testers
-             * long before payments exist.
-             */
-            if (siteCopy !== undefined) {
-                const planStore = siteCopy;
-                const planPrivileged = guardFor(ctx, rbacOn, { permission: INFRA_WRITE, onlyWhenRbac: false });
-                app.put('/api/guard/tenants/:tenantId/plan', planPrivileged, async (c) => {
-                    const claims = c.get('claims');
-                    const admin = await platformAdminTenant(planStore);
-                    if (claims.tenantId !== admin)
-                        throw new AppError('Plans are assigned from the platform tenant only.', {
-                            code: 'PLAN_PLATFORM_ONLY',
-                            status: 403,
-                            category: 'auth',
-                        });
-                    const body = (await c.req.json().catch(() => null));
-                    if (typeof body?.planId !== 'string')
-                        throw new AppError('Body must be JSON `{ "planId": "<id>" }`.', {
-                            code: 'PLAN_ID_MISSING',
-                            status: 400,
-                            category: 'validation',
-                        });
-                    const tenant = await account.setTenantPlan(scopeOf(c), c.req.param('tenantId'), body.planId);
-                    return c.json({ success: true, tenant });
-                });
-            }
-        }
-        /** Whether the presented token is still live — the client's cheap re-check. */
-        app.get('/api/guard/session', (c) => {
-            const result = ctx.guard.verify(sessionTokenOf(c));
-            if (!result.ok)
-                return c.json({ success: true, privateMode: LOCKED_PRIVATE_MODE });
-            return c.json({
-                success: true,
-                privateMode: { unlocked: true, token: sessionTokenOf(c) ?? null, claims: result.claims },
-            });
-        });
-        if (secretsOn) {
-            // Secrets management is privileged even inside GuardEngine: reading which
-            // credentials exist is reconnaissance, and rotating one is destructive.
-            const privileged = guardFor(ctx, rbacOn, { permission: 'infra:write', onlyWhenRbac: false });
-            app.get('/api/guard/secrets', privileged, async (c) => {
-                // Keys and timestamps only. An envelope on the wire is an envelope in a
-                // log, a proxy cache, and a browser devtools panel.
-                const secrets = await service.listSecrets({ claims: c.get('claims') });
-                return c.json({ success: true, secrets });
-            });
-            app.put('/api/guard/secrets/:key', privileged, async (c) => {
-                const summary = await service.putSecret({ claims: c.get('claims') }, c.req.param('key'), c.req.raw);
-                return c.json({ success: true, secret: summary });
-            });
-            app.post('/api/guard/secrets/:key/rotate', privileged, async (c) => {
-                const summary = await service.rotateSecret({ claims: c.get('claims') }, c.req.param('key'));
-                return c.json({ success: true, secret: summary });
-            });
-        }
-        // No `else` branch mounting a 404 stub: a feature-off sub-block contributes
-        // NO route, and `coreMixin`'s notFound already answers 404. Mounting a
-        // deliberately-failing handler would put a route in the surface that V7.1
-        // ("route surface = manifest") would rightly flag as undeclared.
-        /* ── the marketing copy (owner decision D36) ─────────────────────────────
-         *
-         * Mounted iff `guard.features.siteCopy` is on AND an executor was wired
-         * (the recipe defaults one under `local`; a saas host injects the control
-         * plane's — same presence rule as `auditTrail`). Three surfaces:
-         *
-         *   • **The public read is anonymous and CACHEABLE by design.** It returns
-         *     ONLY overridden copy keys — never defaults (the page baked those),
-         *     never the platform-tenant row, never anything tenant-scoped — so
-         *     there is nothing here to authorize. `Cache-Control` + a weak ETag are
-         *     what make the owner's "caching may help" answer real: the marketing
-         *     page's fetch is one conditional request against Cloudflare's edge.
-         *   • **Editing is `infra:write`-privileged AND platform-tenant-scoped.**
-         *     `infra:write` alone is any tenant OWNER — which, under saas, is every
-         *     self-served customer (each signup mints its own tenant). The stored
-         *     platform tenant (seeded at first deploy; `t_local` fallback under
-         *     local) is what keeps the product's public face out of customer hands.
-         *     The check happens in the handler, against the STORE, so a claims
-         *     token minted before a platform change is still judged by current
-         *     truth — same store-is-authority stance as the account verbs.
-         *   • **Writes carry provenance** (`user:<id>`), because every row is
-         *     somebody changing the public face of the product.
-         */
-        const siteCopyOn = featureOnAnyInstance(ctx, 'guard', 'siteCopy') && siteCopy !== undefined;
-        if (siteCopyOn) {
-            const store = siteCopy;
-            app.get('/api/guard/site-copy', async (c) => {
-                const copy = await readSiteCopyOverrides(store);
-                const body = JSON.stringify({ success: true, copy });
-                const etag = weakEtag(body);
-                c.header('Cache-Control', `public, max-age=${SITE_COPY_MAX_AGE_SECONDS}`);
-                c.header('ETag', etag);
-                if (c.req.header('if-none-match') === etag)
-                    return c.body(null, 304);
-                return c.body(body, 200, { 'content-type': 'application/json; charset=utf-8' });
-            });
-            const copyPrivileged = guardFor(ctx, rbacOn, { permission: INFRA_WRITE, onlyWhenRbac: false });
-            const requirePlatformTenant = async (claims) => {
-                const admin = await platformAdminTenant(store);
-                if (claims.tenantId !== admin)
-                    throw new AppError('Site copy is deployment-global and is edited from the platform tenant only.', {
-                        code: 'SITE_COPY_PLATFORM_ONLY',
-                        status: 403,
-                        category: 'auth',
-                    });
-            };
-            app.get('/api/guard/site-copy/admin', copyPrivileged, async (c) => {
-                await requirePlatformTenant(c.get('claims'));
-                const entries = await readSiteCopyEntries(store);
-                return c.json({ success: true, entries, bakedOnly: SITE_COPY_BAKED_ONLY });
-            });
-            app.put('/api/guard/site-copy/:key', copyPrivileged, async (c) => {
-                const claims = c.get('claims');
-                await requirePlatformTenant(claims);
-                const body = await c.req.json().catch(() => null);
-                const value = body?.value;
-                if (typeof value !== 'string')
-                    throw new AppError('Body must be JSON `{ "value": "<text>" }`.', {
-                        code: 'SITE_COPY_VALUE_MISSING',
-                        status: 400,
-                        category: 'validation',
-                    });
-                try {
-                    await setSiteCopyValue(store, { key: c.req.param('key'), value, updatedBy: `user:${claims.userId}` });
-                }
-                catch (error) {
-                    throw new AppError(error instanceof Error ? error.message : 'Invalid site-copy write.', {
-                        code: 'SITE_COPY_INVALID',
-                        status: 400,
-                        category: 'validation',
-                    });
-                }
-                return c.json({ success: true });
-            });
-            app.delete('/api/guard/site-copy/:key', copyPrivileged, async (c) => {
-                const claims = c.get('claims');
-                await requirePlatformTenant(claims);
-                try {
-                    await clearSiteCopyValue(store, c.req.param('key'));
-                }
-                catch (error) {
-                    throw new AppError(error instanceof Error ? error.message : 'Invalid site-copy key.', {
-                        code: 'SITE_COPY_INVALID',
-                        status: 400,
-                        category: 'validation',
-                    });
-                }
-                return c.json({ success: true });
-            });
-        }
-        /* ── the audit trail's read side (05 §B2, owner decision D25) ────────────
-         *
-         * Mounted iff a governance tier wired a trail. Three decisions, none of
-         * them cosmetic:
-         *
-         *   • **The tenant comes from the VERIFIED CLAIMS, never from the query.**
-         *     This is the single most sensitive read surface a product has — it is
-         *     every action every user of a tenant has taken — and a `?tenantId=`
-         *     parameter would turn one missing check into a cross-tenant disclosure
-         *     of exactly that. There is deliberately no way to ask for another
-         *     tenant's trail through this route, not even as an operator.
-         *   • **`audit:read`-privileged** (owner decision D27, Option C) — its OWN
-         *     permission rather than `infra:write`, which is what shipped first.
-         *     OWNER carries it by role and nobody else does by default; an ADMIN who
-         *     needs the change log gets an explicit per-membership grant
-         *     (`identity.setMembershipPermissions`). That keeps two different powers
-         *     separable — reading who did what is not the same as editing config and
-         *     running destructive DB operations — without deciding, for every
-         *     customer, that ADMINs may read each other's actions.
-         *   • **It reads through the SINK**, which is the same object the
-         *     interceptor writes through, so the read cannot drift onto a different
-         *     table than the write.
-         */
-        if (auditTrail) {
-            const auditPrivileged = guardFor(ctx, rbacOn, { permission: AUDIT_READ, onlyWhenRbac: false });
-            app.get('/api/guard/audit', auditPrivileged, async (c) => {
-                const claims = c.get('claims');
-                const action = c.req.query('action');
-                const targetId = c.req.query('targetId');
-                const limit = Number(c.req.query('limit'));
-                const entries = await auditTrail.read({
-                    tenantId: claims.tenantId,
-                    ...(action ? { action } : {}),
-                    ...(targetId ? { targetId } : {}),
-                    // A caller-supplied page size is clamped rather than trusted: `limit`
-                    // reaches a `LIMIT ?`, and an unbounded one is a way to page a whole
-                    // trail into one response.
-                    ...(Number.isFinite(limit) && limit > 0 ? { limit: Math.min(limit, AUDIT_PAGE_MAX) } : {}),
-                });
-                return c.json({ success: true, entries });
-            });
-        }
-    };
-}
-//# sourceMappingURL=guard.mixin.js.map

package/dist/server/mixins/guard.mixin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guard.mixin.js","sourceRoot":"","sources":["../../../src/server/mixins/guard.mixin.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,OAAO,EAAE,UAAU,EAAkC,WAAW,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACzH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAuB,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EAA+B,oBAAoB,EAAqB,WAAW,EAAE,MAAM,SAAS,CAAC;AAE5G,sFAAsF;AACtF,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAgB,EAAE,KAAa,EAAuB,EAAE;IACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,oCAAoC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9H,IAAI,MAAM,CAAC,UAAU,GAAG,KAAK;QAC3B,MAAM,IAAI,QAAQ,CAAC,wBAAwB,KAAK,gBAAgB,EAAE;YAChE,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,EAAE,KAAK,EAAE;SACnB,CAAC,CAAC;IACL,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,KAAK,EAC/B,OAAgB,EAChB,KAAa,EACwC,EAAE;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,mDAAmD,EAAE;YACtE,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,IAAI,MAAM,CAAC,UAAU,GAAG,KAAK,GAAG,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,oCAAoC,KAAK,gBAAgB,EAAE;YAC5E,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,EAAE,KAAK,EAAE;SACnB,CAAC,CAAC;IACL,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,IAAI,QAAQ,CAAC,iDAAiD,EAAE;YACpE,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IACD,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,OAAO,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,+CAA+C,EAAE;YAClE,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,YAAY;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF,0FAA0F;AAC1F,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC;+EAC+E;AAC/E,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;IACxC,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,QAAyB,EACzB,UAA2B,EAC3B,QAA4B;IAE5B,OAAO,CAAC,GAAW,EAAE,GAAiB,EAAQ,EAAE;QAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC;QAE5F,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,KAAK,GAAsB,iBAAiB,CAAC;YACjD,KAAK,EAAE,EAAE;YACT,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;QACH,6EAA6E;QAC7E,mFAAmF;QACnF,6EAA6E;QAC7E,+EAA+E;QAC/E,iFAAiF;QACjF,mFAAmF;QACnF,6EAA6E;QAC7E,6EAA6E;QAC7E,sEAAsE;QACtE,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,CAAC,CAAmC,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACtD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBACxE,MAAM,IAAI,QAAQ,CAAC,oEAAoE,EAAE;oBACvF,IAAI,EAAE,mBAAmB;oBACzB,MAAM,EAAE,GAAG;oBACX,QAAQ,EAAE,UAAU;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,8DAA8D;gBAC9D,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;;gBAC/C,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC;QAEF,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAEhF,IAAI,aAAa,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC/C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1D,uEAAuE;gBACvE,sEAAsE;gBACtE,uCAAuC;gBACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/B,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,kDAAkD;gBAChF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,QAA0B,CAAC;YAC3C,yEAAyE;YACzE,MAAM,OAAO,GAAG,CAAC,CAAY,EAA4B,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAE1F,2EAA2E;YAC3E,uEAAuE;YACvE,2EAA2E;YAC3E,qCAAqC;YACrC,EAAE;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,SAAS,CAAC,CAAC;gBAC/F,IAAI,SAAS;oBAAE,MAAM,SAAS,CAAC;gBAC/B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACxE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;oBAChC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACjC,QAAQ;oBACR,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,SAAS;oBACpD,sEAAsE;oBACtE,kEAAkE;oBAClE,qEAAqE;oBACrE,sEAAsE;oBACtE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,SAAS;iBAC1D,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;YAEH,mEAAmE;YACnE,wEAAwE;YACxE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC1D,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACxE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;oBAC5C,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;oBACjC,QAAQ;oBACR,uEAAuE;oBACvE,2DAA2D;oBAC3D,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,SAAS;iBACtD,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;YAEH,wEAAwE;YACxE,EAAE;YACF,uEAAuE;YACvE,yEAAyE;YACzE,8CAA8C;YAE9C,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;YAEH,0EAA0E;YAC1E,oEAAoE;YACpE,qBAAqB;YACrB,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC1D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;YAEH,2EAA2E;YAC3E,sEAAsE;YACtE,+CAA+C;YAC/C,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACjD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/B,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACjE,CAAC,CAAC,CAAC;YAEH,yEAAyE;YACzE,GAAG,CAAC,MAAM,CAAC,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC1D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,yEAAyE;YACzE,sEAAsE;YACtE,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACrD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,0EAA0E;YAC1E,2EAA2E;YAC3E,uBAAuB;YACvB,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACnF,MAAM,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YAEH,wEAAwE;YACxE,EAAE;YACF,wEAAwE;YACxE,mEAAmE;YACnE,0EAA0E;YAC1E,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM;oBACT,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC3G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAoE,CAAC;gBACxH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;gBACtF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,sCAAsC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACxE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA2D,CAAC;gBAC9G,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE;oBACjF,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ;oBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;gBACH,wEAAwE;gBACxE,oDAAoD;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YAEH,kEAAkE;YAClE,0EAA0E;YAC1E,2EAA2E;YAC3E,gCAAgC;YAChC,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;gBAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7E,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0D,CAAC;gBAC9G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC7G,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,8CAA8C,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC9E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACvG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH;;;;;;;;;;;;eAYG;YACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,QAA6B,CAAC;gBAChD,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/F,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;oBACvE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;oBACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;wBAC3B,MAAM,IAAI,QAAQ,CAAC,mDAAmD,EAAE;4BACtE,IAAI,EAAE,oBAAoB;4BAC1B,MAAM,EAAE,GAAG;4BACX,QAAQ,EAAE,MAAM;yBACjB,CAAC,CAAC;oBACL,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAgC,CAAC;oBACnF,IAAI,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ;wBAClC,MAAM,IAAI,QAAQ,CAAC,2CAA2C,EAAE;4BAC9D,IAAI,EAAE,iBAAiB;4BACvB,MAAM,EAAE,GAAG;4BACX,QAAQ,EAAE,YAAY;yBACvB,CAAC,CAAC;oBACL,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC3C,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;aACzF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACd,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAE7F,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACpD,wEAAwE;gBACxE,oDAAoD;gBACpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,iEAAiE;QAEjE;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC;QAC5F,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,QAA6B,CAAC;YAE5C,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC1C,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,yBAAyB,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/F,MAAM,qBAAqB,GAAG,KAAK,EAAE,MAAoB,EAAiB,EAAE;gBAC1E,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK;oBAC3B,MAAM,IAAI,QAAQ,CAAC,6EAA6E,EAAE;wBAChG,IAAI,EAAE,yBAAyB;wBAC/B,MAAM,EAAE,GAAG;wBACX,QAAQ,EAAE,MAAM;qBACjB,CAAC,CAAC;YACP,CAAC,CAAC;YAEF,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChE,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC7C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC/D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/B,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAY,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3D,MAAM,KAAK,GAAI,IAAmC,EAAE,KAAK,CAAC;gBAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAC3B,MAAM,IAAI,QAAQ,CAAC,4CAA4C,EAAE;wBAC/D,IAAI,EAAE,yBAAyB;wBAC/B,MAAM,EAAE,GAAG;wBACX,QAAQ,EAAE,YAAY;qBACvB,CAAC,CAAC;gBACL,IAAI,CAAC;oBACH,MAAM,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACxG,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE;wBACtF,IAAI,EAAE,mBAAmB;wBACzB,MAAM,EAAE,GAAG;wBACX,QAAQ,EAAE,YAAY;qBACvB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,2BAA2B,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAClE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/B,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE;wBACpF,IAAI,EAAE,mBAAmB;wBACzB,MAAM,EAAE,GAAG;wBACX,QAAQ,EAAE,YAAY;qBACvB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAE/F,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACvD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACzC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;oBACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjC,sEAAsE;oBACtE,qEAAqE;oBACrE,2BAA2B;oBAC3B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3F,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/mixins/index.d.ts

@@ -1,68 +0,0 @@
-import type { AuditTrailSink, StatementExecutor } from 'cwip/storage';
-import type { EngineId } from '../../config/appConfig';
-import type { ExecutionDriver } from '../drivers';
-import { type BillingService } from './billing.mixin';
-import { type InstanceMixinOptions } from './instance.mixin';
-import type { EngineServices } from './services';
-import { type CCHono, type MixinContext } from './types';
-export interface ComposeServerOptions {
-    ctx: MixinContext;
-    services: EngineServices;
-    /**
-     * DevStudio ONLY (J3-4). Required iff the dev engine is active AND at least one
-     * of its EXEC-backed features is effective — see {@link devNeedsExec}.
-     */
-    exec?: ExecutionDriver;
-    /** Op handlers for `/api/instance/:id/ops/:op`. */
-    instance?: InstanceMixinOptions;
-    /** Required iff `profile === 'saas'`. */
-    billing?: BillingService;
-    /**
-     * The audit trail's READ side (05 §B2, owner decision D25) — present iff a
-     * governance tier wired a trail. The guard mixin mounts `GET /api/guard/audit`
-     * only when it is: a written trail with no way to look at it is a compliance
-     * record nobody can produce, and a route over an absent sink would be a 500
-     * pretending to be a feature.
-     *
-     * A platform seam rather than an `EngineServices` entry, for the same reason
-     * `exec` and `billing` are: no engine owns it, it is injected by the host.
-     * (And a concrete reason: `EngineServices` is reachable from the CLIENT type
-     * graph, so a `cwip/storage` import there drags the whole server storage tier
-     * into a DOM-typed compile — the demo gate catches it.)
-     */
-    auditTrail?: AuditTrailSink;
-    /**
-     * The site-copy store's executor (D36) — present iff the deployment can
-     * persist marketing-copy overrides. Same platform-seam reasoning as
-     * `auditTrail` above; the guard mixin mounts `/api/guard/site-copy*` only
-     * when both this and the `siteCopy` feature are present.
-     */
-    siteCopy?: StatementExecutor;
-    /** Reuse an existing app (the generated server mounts static assets on it). */
-    app?: CCHono;
-}
-/**
- * Compose the server from the manifest. Throws at BOOT for a missing service or
- * driver rather than 500-ing on the first request that needs it — a startup
- * failure is loud, debuggable, and cannot ship to production unnoticed.
- */
-export declare function composeServer(options: ComposeServerOptions): CCHono;
-/** Build the frozen O(1) index `MixinContext.instanceIndex` requires (J3-1). */
-export declare const buildInstanceIndex: (manifest: MixinContext["manifest"]) => ReadonlyMap<string, MixinContext["instanceIndex"] extends ReadonlyMap<string, infer V> ? V : never>;
-/** The engine ids this module can compose — exported for the V7 surface probe. */
-export declare const COMPOSABLE_ENGINES: readonly EngineId[];
-export { coreMixin, buildCsp, SECURITY_HEADERS } from './core.mixin';
-export { createAssetMixin } from './asset.mixin';
-export { createKnowledgeMixin } from './knowledge.mixin';
-export { createDevMixin } from './dev.mixin';
-export { createGuardMixin } from './guard.mixin';
-export { createSystemMixin } from './system.mixin';
-export { createInstanceMixin, type InstanceMixinOptions, type OpHandler, type OpInvocation } from './instance.mixin';
-export { type BillingService, createBillingMixin, type PlanUsage, USAGE_LIMIT_EXCEEDED, } from './billing.mixin';
-export { createPlanEnforcer, declaredContentLength, type MeterCost, requireWithinPlan, } from './enforcement';
-export { ccCorsPolicy, guardFor, guardVerify, type GuardVerifyOptions, sessionTokenOf } from './security';
-export { currentRequestClaims, runWithRequestClaims } from './requestClaims';
-export { assertPublicOutboundUrl, assertResolvedPublicUrl, OUTBOUND_URL_BLOCKED, type OutboundGuardOptions, } from '../net/outboundGuard';
-export * from './services';
-export * from './types';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/mixins/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/index.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,iBAAiB,CAAC;AAI1E,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAIlF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAc,KAAK,MAAM,EAA8C,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AA6BjH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,YAAY,CAAC;IAClB,QAAQ,EAAE,cAAc,CAAC;IACzB;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,yCAAyC;IACzC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAwFnE;AAUD,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,GAC7B,UAAU,YAAY,CAAC,UAAU,CAAC,KACjC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC,SAAS,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAC7B,CAAC;AAEzE,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,EAAE,SAAS,QAAQ,EAAqD,CAAC;AAExG,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrH,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,KAAK,SAAS,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,SAAS,EACd,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAK1G,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,SAAS,CAAC"}