cursedbelt 2.8.0 → 3.0.0

package/dist/server/runtime/bootManifest.d.ts

@@ -1,61 +0,0 @@
-import type { CCHookInterceptor } from 'cwip/storage';
-import type { CapabilityProfile, CodeContractDeclarations, ConfigProvenance, Diagnostic, EffectiveManifest, SourceDecl, StorageContract } from '../../verify/types';
-import { type ProbeHostCapabilitiesOptions } from './hostCapabilities';
-export interface ResolveBootManifestOptions {
-    /** The live `app-config.json`, parsed. The pipeline owns the parse (V0). */
-    readonly config: unknown;
-    /**
-     * The frozen `manifest.gen.json` (already re-hydrated by `readFrozenManifest`).
-     * Absent ⇒ a failed verification is fatal, because there is nothing to serve.
-     */
-    readonly lastGood?: EffectiveManifest | null;
-    /** Live machine probe. Default: {@link probeHostCapabilities}. */
-    readonly capabilities?: CapabilityProfile;
-    /** Forwarded to the probe when `capabilities` is not supplied. */
-    readonly probe?: ProbeHostCapabilitiesOptions;
-    readonly sources?: readonly SourceDecl[];
-    readonly storage?: StorageContract;
-    readonly code?: CodeContractDeclarations;
-    /**
-     * Registered interceptors (05 §B2), folded into `code.eventHandlers` for the
-     * V4 cycle audit.
-     *
-     * Passing the SAME registry the storage provider got is what makes a cyclic
-     * pair of hooks a boot failure instead of a runaway mutation loop discovered
-     * in production. It is an option here rather than a caller-side spread on
-     * purpose: the two edge sources have to land in ONE array, and a walk over
-     * either list alone cannot see the most likely real cycle there is — engine
-     * subscriber → interceptor → engine subscriber.
-     */
-    readonly interceptors?: readonly CCHookInterceptor[];
-    readonly provenance?: ConfigProvenance;
-}
-export interface ResolvedBootManifest {
-    /** The manifest to actually serve — live on success, last-good on failure. */
-    readonly manifest: EffectiveManifest;
-    /** True ⇒ the live config did NOT verify and the frozen bundle is being served. */
-    readonly servedLastGood: boolean;
-    readonly diagnostics: readonly Diagnostic[];
-    /** Whether the LIVE config verified clean (false while degraded). */
-    readonly ok: boolean;
-    /** The capability profile the verification actually ran against. */
-    readonly capabilities: CapabilityProfile;
-}
-/**
- * Verify the live config against this machine and decide what to serve.
- * Never throws for a config-level problem when a last-good bundle exists — that
- * is the whole point of the boot disposition.
- */
-export declare function resolveBootManifest(options: ResolveBootManifestOptions): Promise<ResolvedBootManifest>;
-/**
- * The page the HTML route serves while the app is degraded. It renders the
- * diagnostics rather than a generic apology: the operator reading it is the
- * person who just broke the config, and the corpus diagnostic code is the exact
- * string they can search for.
- *
- * No inline `<script>` — the pinned CSP forbids it (`script-src 'self'`), and an
- * error page that itself violates the policy would render blank in the browser
- * it is meant to inform.
- */
-export declare function renderBootErrorPage(resolved: Pick<ResolvedBootManifest, 'manifest' | 'diagnostics'>): string;
-//# sourceMappingURL=bootManifest.d.ts.map

package/dist/server/runtime/bootManifest.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootManifest.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/bootManifest.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,KAAK,EACV,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,eAAe,EAChB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAyB,KAAK,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAE9F,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC7C,kEAAkE;IAClE,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,4BAA4B,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,wBAAwB,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACxC;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,mFAAmF;IACnF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+B5G;AAKD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,aAAa,CAAC,GAAG,MAAM,CA0C5G"}

package/dist/server/runtime/bootManifest.js

@@ -1,109 +0,0 @@
-/**
- * The BOOT moment of the pipeline (02 §4) — the third of four callers.
- *
- * The pipeline had two real callers (tests and the CI corpus CLI) and two
- * specified ones. This is the boot caller, and its disposition is the one that
- * differs most from the others: **export blocks, CI gates, boot degrades.**
- *
- * The reasoning is operational rather than aesthetic. A running app re-verifies
- * its config against the machine it actually booted on, because a host loses
- * capabilities between builds — the container without ffmpeg, the laptop whose
- * `git` moved. If that re-verification fails, the least-bad outcome is NOT to
- * exit: an app that dies on a config edit takes a working product offline over a
- * typo. It keeps serving the **last-good frozen manifest** the export wrote and
- * makes the failure impossible to miss on the HTML route (V7.6
- * `last-good-not-served`; the error page is `renderBootErrorPage`).
- *
- * There is exactly one case where boot is fatal: a failed verification with NO
- * last-good bundle to fall back to. There is nothing to serve, and inventing a
- * manifest would fabricate a surface nobody declared.
- */
-import { AppError } from '../errors';
-import { verifyAppConfig } from '../../verify/pipeline';
-import { withInterceptorEdges } from '../../verify/interceptorGraph';
-import { errorsOf } from '../../verify/types';
-import { probeHostCapabilities } from './hostCapabilities';
-/**
- * Verify the live config against this machine and decide what to serve.
- * Never throws for a config-level problem when a last-good bundle exists — that
- * is the whole point of the boot disposition.
- */
-export async function resolveBootManifest(options) {
-    const capabilities = options.capabilities ?? probeHostCapabilities(options.probe);
-    const result = await verifyAppConfig({
-        config: options.config,
-        moment: 'boot',
-        capabilities,
-        sources: options.sources,
-        storage: options.storage,
-        code: options.interceptors && options.interceptors.length > 0
-            ? { ...options.code, eventHandlers: withInterceptorEdges(options.code?.eventHandlers, options.interceptors) }
-            : options.code,
-        provenance: options.provenance,
-    });
-    if (result.ok && result.manifest)
-        return { manifest: result.manifest, servedLastGood: false, diagnostics: result.diagnostics, ok: true, capabilities };
-    const lastGood = options.lastGood ?? null;
-    if (!lastGood)
-        throw new AppError(`The app config failed verification at boot and there is no last-good manifest to fall back to (${errorsOf(result.diagnostics).length} error(s)). Fix the config, or regenerate the app so a frozen manifest.gen.json exists.`, {
-            code: 'BOOT_CONFIG_UNSERVABLE',
-            status: 500,
-            isOperational: false,
-            context: { codes: errorsOf(result.diagnostics).map((d) => d.code) },
-        });
-    return { manifest: lastGood, servedLastGood: true, diagnostics: result.diagnostics, ok: false, capabilities };
-}
-const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[ch]);
-/**
- * The page the HTML route serves while the app is degraded. It renders the
- * diagnostics rather than a generic apology: the operator reading it is the
- * person who just broke the config, and the corpus diagnostic code is the exact
- * string they can search for.
- *
- * No inline `<script>` — the pinned CSP forbids it (`script-src 'self'`), and an
- * error page that itself violates the policy would render blank in the browser
- * it is meant to inform.
- */
-export function renderBootErrorPage(resolved) {
-    const errors = errorsOf(resolved.diagnostics);
-    const rows = errors
-        .map((d) => {
-        const where = [d.instanceId, d.port, d.path].filter(Boolean).join(' ');
-        return [
-            '<li>',
-            `<code>${escapeHtml(d.code)}</code>${where ? ` <span class="where">${escapeHtml(where)}</span>` : ''}`,
-            `<p>${escapeHtml(d.message)}</p>`,
-            d.fix ? `<p class="fix">fix: ${escapeHtml(d.fix)}</p>` : '',
-            '</li>',
-        ].join('');
-    })
-        .join('\n');
-    return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>${escapeHtml(resolved.manifest.title)} — config error</title>
-<style>
-  body { font: 14px/1.5 ui-monospace, SFMono-Regular, Menlo, monospace; margin: 0; padding: 2rem; background: #12121a; color: #e8e8f0; }
-  h1 { font-size: 1.1rem; margin: 0 0 .25rem; }
-  .sub { color: #9a9ab0; margin: 0 0 1.5rem; }
-  ul { list-style: none; padding: 0; margin: 0; }
-  li { border-left: 3px solid #e0576b; background: #1b1b26; padding: .75rem 1rem; margin-bottom: .75rem; }
-  code { color: #e0576b; font-weight: 600; }
-  .where { color: #9a9ab0; }
-  p { margin: .35rem 0 0; }
-  .fix { color: #6fd3a0; }
-</style>
-</head>
-<body>
-<h1>${escapeHtml(resolved.manifest.title)} is serving its last-good bundle</h1>
-<p class="sub">The live <code>app-config.json</code> failed verification, so the previously exported manifest (<code>${escapeHtml(resolved.manifest.bundleKey)}</code>) is still being served. The API is up; this page replaces the app until the config verifies.</p>
-<ul>
-${rows}
-</ul>
-</body>
-</html>
-`;
-}
-//# sourceMappingURL=bootManifest.js.map

package/dist/server/runtime/bootManifest.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootManifest.js","sourceRoot":"","sources":["../../../src/server/runtime/bootManifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAUrE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAqC,MAAM,oBAAoB,CAAC;AA4C9F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAmC;IAC3E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,MAAM;QACd,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EACF,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE;YAC7G,CAAC,CAAC,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ;QAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAEvH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC1C,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,QAAQ,CAChB,kGAAkG,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,yFAAyF,EAC9N;YACE,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;SACpE,CACF,CAAC;IAEJ,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAW,CAAC,CAAC;AAE7H;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgE;IAClG,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvE,OAAO;YACL,MAAM;YACN,SAAS,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,wBAAwB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YACtG,MAAM,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YACjC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,uBAAuB,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC3D,OAAO;SACR,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;SAKA,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;;;;;;;;;;;;;;MActC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;uHAC8E,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;;EAE5J,IAAI;;;;CAIL,CAAC;AACF,CAAC"}

package/dist/server/runtime/createCcRuntime.d.ts

@@ -1,91 +0,0 @@
-import type { DomainName } from 'cwip/domains';
-import type { SearchProvider } from 'cwip/search-provider';
-import type { AuditTrailSink, StatementExecutor, StorageProvider } from 'cwip/storage';
-import type { TelemetryWriter } from 'cwip/telemetry';
-import type { CognitiveGateway, ExecutionDriver, JobBroker } from '../drivers';
-import type { BillingService } from '../mixins/billing.mixin';
-import type { EngineServices } from '../mixins/services';
-import type { CCHono, GuardVerifier, MixinContext } from '../mixins/types';
-import { type EngineOpsOptions } from '../ops';
-import { type ServerPushHub } from '../stream';
-import type { EffectiveManifest } from '../../verify/types';
-export interface CcRuntimeOptions {
-    /** The V2 output. The route table derives from this and nothing else. */
-    manifest: EffectiveManifest;
-    /** Built by the host over ITS injected handles (01 §1.1.3). */
-    storage: StorageProvider;
-    /** Per-request token verification — `createSessionSigner()` in production. */
-    guard: GuardVerifier;
-    gateway: CognitiveGateway;
-    broker: JobBroker;
-    telemetry: TelemetryWriter;
-    services: EngineServices;
-    /** Origins `ccCorsPolicy` admits. Wildcards are banned (03 §2.3). */
-    allowedOrigins: readonly string[];
-    /** Required iff `engines[]` contains `dev` (J3-4). */
-    exec?: ExecutionDriver;
-    /** Required iff `profile === 'saas'`. */
-    billing?: BillingService;
-    /**
-     * The audit trail's READ side (D25) — `createGovernanceTier(…).auditTrail`.
-     * Present ⇒ the guard mixin mounts `GET /api/guard/audit`.
-     */
-    auditTrail?: AuditTrailSink;
-    /**
-     * The site-copy store's executor (D36). Present + `guard.features.siteCopy`
-     * on ⇒ the guard mixin mounts `/api/guard/site-copy*`.
-     */
-    siteCopy?: StatementExecutor;
-    /** Domains to tap for CDC push. Defaults to those the active engines own. */
-    cdcDomains?: readonly DomainName[];
-    /**
-     * The ranked-retrieval tier (08 §2). Present ⇒ the runtime taps CDC into it,
-     * so knowledge writes update `search_docs` with no component involvement
-     * (01 §2.6).
-     *
-     * This is the WRITE side. The same provider must also be passed to
-     * `createKnowledgeService` for the read side — the service queries it, the
-     * runtime fills it, and wiring only one of the two is the misconfiguration
-     * this comment exists to name.
-     */
-    search?: SearchProvider;
-    /** Reported for every row the search index could not follow. */
-    onSearchIndexError?: (error: unknown, record: {
-        table: string;
-        rowId: string;
-    }) => void;
-    /** Extra/overriding op handlers, merged over the generated table. */
-    ops?: Partial<Pick<EngineOpsOptions, 'commands' | 'utilities' | 'outboundGuard'>> & {
-        handlers?: Readonly<Record<string, import('../mixins/instance.mixin').OpHandler>>;
-    };
-    /** Reuse an existing app (the generated server mounts static assets on it). */
-    app?: CCHono;
-    /**
-     * Reuse an existing push hub instead of constructing one. `bootEngineApp`
-     * passes the SAME hub it handed the deploy job handler, so a long job's
-     * progress frames fan out on the very channel the `/stream` routes serve —
-     * a second hub would publish into a void nothing is subscribed to.
-     */
-    push?: ServerPushHub;
-    /**
-     * Skip the argon2id boot gate. For a host that genuinely has no GuardEngine
-     * surface (a headless worker composing only `knowledge`). Setting it with an
-     * active `guard` engine re-opens exactly the failure the gate exists to catch.
-     */
-    skipKdfReadinessGate?: boolean;
-    /**
-     * How often to replay spilled meter events (08 §5). `0` disables the timer —
-     * for a test, or a host that drives `drainSpill()` from its own scheduler.
-     */
-    meterSpillDrainIntervalMs?: number;
-}
-export interface CcRuntime {
-    app: CCHono;
-    ctx: MixinContext;
-    /** The live fan-out behind the `/stream` routes. */
-    push: ServerPushHub;
-    /** Detach CDC taps and close the push hub. Does NOT close injected handles. */
-    stop(): Promise<void>;
-}
-export declare function createCcRuntime(options: CcRuntimeOptions): CcRuntime;
-//# sourceMappingURL=createCcRuntime.d.ts.map

package/dist/server/runtime/createCcRuntime.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"createCcRuntime.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/createCcRuntime.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,EAA2D,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AACxG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,eAAe,CAAC;IACzB,8EAA8E;IAC9E,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,qEAAqE;IACrE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sDAAsD;IACtD,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,yCAAyC;IACzC,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,6EAA6E;IAC7E,UAAU,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACnC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACxF,qEAAqE;IACrE,GAAG,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC,GAAG;QAClF,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC,CAAC,CAAC;KACnF,CAAC;IACF,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,YAAY,CAAC;IAClB,oDAAoD;IACpD,IAAI,EAAE,aAAa,CAAC;IACpB,+EAA+E;IAC/E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAKD,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAwHpE"}

package/dist/server/runtime/createCcRuntime.js

@@ -1,143 +0,0 @@
-/**
- * The production entrypoint (03 §2.1) — the non-harness caller of
- * `composeServer` that the audit found missing.
- *
- * Before this, `composeServer` was called from exactly one place: the verify
- * harness. Everything it orbits — the mixins, the guards, the CSP, the instance
- * index, the drivers — was proven at the contract level and nowhere else,
- * because no code path bound real repositories to the mixins and served a
- * request. This is that path.
- *
- * What it will NOT do is open a database. Handle injection (01 §1.1.3) is a law:
- * hosts open the files (paths declared in the generated app's `package.json` →
- * `cursed.app.storage`) and inject them. A runtime that opened its own would put
- * the storage layout back inside the library, where a generated app could never
- * change it.
- *
- * Boot is deliberately loud. Every check below is a startup failure rather than
- * a 500 on the first request that happens to need the missing piece:
- *
- *   * an active `guard` engine with no argon2id binding registered
- *     (`assertArgon2idReady` — the gate that converts a first-user 500 into a
- *     boot failure, §1.2);
- *   * a missing engine service or `ExecutionDriver` (`composeServer` throws);
- *   * a saas profile with no `BillingService`.
- */
-import { assertArgon2idReady } from 'cwip/guard';
-import { AppError } from '../errors';
-import { buildInstanceIndex, composeServer } from '../mixins';
-import { createEngineOpHandlers } from '../ops';
-import { bridgeCdcToPush, bridgeCdcToSearch, createServerPushHub } from '../stream';
-/** Default meter-spill replay cadence (08 §5). Jittered ±20% at schedule time. */
-const DEFAULT_SPILL_DRAIN_MS = 30_000;
-export function createCcRuntime(options) {
-    const { manifest } = options;
-    // The boot gate. A misconfigured GuardEngine dies HERE, at startup, instead of
-    // looking healthy until the first user tries to unlock in production (§1.2).
-    if (manifest.engines.includes('guard') && options.skipKdfReadinessGate !== true)
-        assertArgon2idReady();
-    if (manifest.profile === 'saas' && !options.billing)
-        throw new AppError('The saas profile composes the billing mixin, but no BillingService was provided.', {
-            code: 'MIXIN_DEPENDENCY_MISSING',
-            status: 500,
-            context: { profile: manifest.profile },
-        });
-    const push = options.push ?? createServerPushHub();
-    const ctx = {
-        manifest,
-        // Frozen once (J3-1). Building it per request was an O(N) scan that also
-        // tempted `instances[0]` shortcuts — the first-instance-wins bug C28 pinned.
-        instanceIndex: buildInstanceIndex(manifest),
-        storage: options.storage,
-        guard: options.guard,
-        gateway: options.gateway,
-        broker: options.broker,
-        telemetry: options.telemetry,
-        allowedOrigins: options.allowedOrigins,
-        push,
-    };
-    // CDC → per-instance streams. Without this the client's dirty ledger only ever
-    // reflects changes the same tab made (03 §6.2).
-    const detachCdc = bridgeCdcToPush({
-        storage: options.storage,
-        hub: push,
-        manifest,
-        domains: options.cdcDomains,
-    });
-    // CDC → the search index (08 §2b). Same stream, second consumer: the index
-    // follows every writer, not only the ones that remembered to call `index()`.
-    const detachSearch = options.search !== undefined
-        ? bridgeCdcToSearch({
-            storage: options.storage,
-            search: options.search,
-            onError: options.onSearchIndexError,
-        })
-        : undefined;
-    const handlers = {
-        ...createEngineOpHandlers({
-            services: options.services,
-            broker: options.broker,
-            exec: options.exec,
-            push,
-            commands: options.ops?.commands,
-            utilities: options.ops?.utilities,
-            outboundGuard: options.ops?.outboundGuard,
-        }),
-        // Host overrides last: a generated app may add an op the framework table
-        // knows nothing about, or replace one with its own implementation.
-        ...(options.ops?.handlers ?? {}),
-    };
-    const app = composeServer({
-        app: options.app,
-        ctx,
-        services: options.services,
-        exec: options.exec,
-        instance: { handlers },
-        billing: options.billing,
-        auditTrail: options.auditTrail,
-        siteCopy: options.siteCopy,
-    });
-    // Spilled meter events are DURABLE but not yet BILLABLE: they sit in the
-    // journal until something replays them into `meter_events`, and until then
-    // `BillingService.usage` under-reports — which also means the 11 §4 plan gate
-    // compares against a number that is quietly too low. `drainSpill` existed with
-    // nothing scheduling it (08 §5); this is the scheduler.
-    //
-    // Jittered, so a fleet that restarts together does not converge on one instant
-    // and stampede the telemetry database's write lock.
-    const drainIntervalMs = options.meterSpillDrainIntervalMs ?? DEFAULT_SPILL_DRAIN_MS;
-    const spillTimer = drainIntervalMs > 0
-        ? setInterval(() => {
-            try {
-                // Cheap guard first: the common case is an empty journal, and
-                // `hasPendingSpill` avoids opening it at all.
-                if (!options.telemetry.hasPendingSpill?.())
-                    return;
-                options.telemetry.drainSpill();
-            }
-            catch {
-                // A drain failure is not fatal — the journal is the durable
-                // record and the next tick retries. Throwing here would take down
-                // a healthy server over a transient database lock.
-            }
-        }, drainIntervalMs + Math.floor(Math.random() * drainIntervalMs * 0.2))
-        : null;
-    // Never hold the process open on this timer alone.
-    spillTimer?.unref?.();
-    return {
-        app,
-        ctx,
-        push,
-        async stop() {
-            if (spillTimer)
-                clearInterval(spillTimer);
-            detachCdc();
-            detachSearch?.();
-            // Subscribers get a `close` frame, so a browser reconnects on its jittered
-            // schedule rather than hanging on a socket the server already abandoned.
-            push.close();
-            await options.storage.close();
-        },
-    };
-}
-//# sourceMappingURL=createCcRuntime.js.map

package/dist/server/runtime/createCcRuntime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"createCcRuntime.js","sourceRoot":"","sources":["../../../src/server/runtime/createCcRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAMjD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG9D,OAAO,EAAE,sBAAsB,EAAyB,MAAM,QAAQ,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAsB,MAAM,WAAW,CAAC;AAgFxG,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE7B,+EAA+E;IAC/E,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,oBAAoB,KAAK,IAAI;QAAE,mBAAmB,EAAE,CAAC;IAEvG,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO;QACjD,MAAM,IAAI,QAAQ,CAAC,kFAAkF,EAAE;YACrG,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;SACvC,CAAC,CAAC;IAEL,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;IAEnD,MAAM,GAAG,GAAiB;QACxB,QAAQ;QACR,yEAAyE;QACzE,6EAA6E;QAC7E,aAAa,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI;KACL,CAAC;IAEF,+EAA+E;IAC/E,gDAAgD;IAChD,MAAM,SAAS,GAAG,eAAe,CAAC;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,IAAI;QACT,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,UAAU;KAC5B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,YAAY,GAChB,OAAO,CAAC,MAAM,KAAK,SAAS;QAC1B,CAAC,CAAC,iBAAiB,CAAC;YAChB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,kBAAkB;SACpC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,QAAQ,GAAG;QACf,GAAG,sBAAsB,CAAC;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI;YACJ,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ;YAC/B,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS;YACjC,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa;SAC1C,CAAC;QACF,yEAAyE;QACzE,mEAAmE;QACnE,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;KACjC,CAAC;IAEF,MAAM,GAAG,GAAG,aAAa,CAAC;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG;QACH,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,EAAE,QAAQ,EAAE;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,wDAAwD;IACxD,EAAE;IACF,+EAA+E;IAC/E,oDAAoD;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB,IAAI,sBAAsB,CAAC;IACpF,MAAM,UAAU,GACd,eAAe,GAAG,CAAC;QACjB,CAAC,CAAC,WAAW,CACT,GAAG,EAAE;YACH,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,8CAA8C;gBAC9C,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE;oBAAE,OAAO;gBACnD,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;gBAC5D,kEAAkE;gBAClE,mDAAmD;YACrD,CAAC;QACH,CAAC,EACD,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,eAAe,GAAG,GAAG,CAAC,CACpE;QACH,CAAC,CAAC,IAAI,CAAC;IACX,mDAAmD;IACnD,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;IAEtB,OAAO;QACL,GAAG;QACH,GAAG;QACH,IAAI;QACJ,KAAK,CAAC,IAAI;YACR,IAAI,UAAU;gBAAE,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1C,SAAS,EAAE,CAAC;YACZ,YAAY,EAAE,EAAE,CAAC;YACjB,2EAA2E;YAC3E,yEAAyE;YACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/runtime/governance.d.ts

@@ -1,173 +0,0 @@
-/**
- * The GOVERNANCE TIER — the near side of `CCHookInterceptor`, once (owner
- * directive; 05 §B2's product consumer).
- *
- * `CCHookInterceptor` shipped proven and unregistered, which the report at the
- * time called correct-but-unused: inventing a hook with no product need would
- * have been a fresh orphan seam, the exact anti-pattern this arc exists to stop.
- * The owner has since named two needs — **an audit trail** ("prove what changed
- * and when") and **a quota gate** ("ensure a tier allowance is not exceeded") —
- * so this is the one place they are constructed, wired to the request-scoped
- * actor, and handed to `bootEngineApp` as a pipeline.
- *
- * ## Why ONE builder rather than two host options
- *
- * `createInterceptorPipeline` requires `onAfterError` — deliberately, because
- * post-commit an observer failure can only rethrow (telling a client its write
- * failed when it did not) or swallow (losing an audit record silently), and
- * neither should be picked by accident. That decision belongs to the deployment
- * ONCE, not once per interceptor. A single builder also means the two hooks
- * share one pipeline, which is what the storage provider takes, and what
- * `resolveBootManifest({ interceptors })` folds into the V4 `eventbus-cycle`
- * audit so a cyclic pair is a boot failure rather than a runaway transaction.
- *
- * ## The actor bridge, and why it lives HERE
- *
- * `cwip`'s audit interceptor takes an injected `actor` because the storage tier
- * has no idea what a user is. cursedbelt does: {@link currentRequestClaims} is
- * the verified in-flight session, already the near side `guardDeps.currentClaims`
- * uses. So the default actor is that, and outside a request — a job handler, a
- * migration, the vault reaper — it resolves to `SYSTEM_ACTOR`, which is a fact
- * rather than a gap.
- *
- * ## Ordering is not arbitrary
- *
- * The quota gate is registered FIRST. `runBefore` walks registrations in order
- * and the first throw wins, so a refused write must be refused before anything
- * else has a chance to act on it. (Today the audit trail has no `before`, so the
- * order is not yet load-bearing — it is fixed now so that adding one later
- * cannot silently reverse it.)
- */
-import { type AuditTrailSink, type CCHookInterceptor, type InterceptorPipeline, type InterceptorResultEvent, type QuotaDenial, type QuotaDraw, type StatementExecutor } from 'cwip/storage';
-import type { InterceptorEvent } from 'cwip/storage';
-export interface AuditTrailTierOptions {
-    /**
-     * Where audit rows go. It MUST NOT be an executor over the storage provider
-     * this pipeline is attached to — see `cwip`'s `auditTrail.ts` header: a
-     * same-domain sink deadlocks on that domain's op mutex, permanently.
-     * `createLocalHostServices().governanceExecutor` and
-     * `createSaasHostServices().auditExecutor` are both independent of it.
-     */
-    executor?: StatementExecutor;
-    /** Substitute a sink entirely (an external SIEM, a log shipper). Wins over `executor`. */
-    sink?: AuditTrailSink;
-    /** Override the actor resolution. Defaults to the verified request claims. */
-    actor?(event: InterceptorEvent): string | null | undefined;
-    /** Override target-row extraction. */
-    targetOf?(event: InterceptorResultEvent): string | undefined;
-    /** Which actions to audit. Default `*` — see `auditTrail.ts` on why total. */
-    targetAction?: string;
-    /**
-     * Narrow what is recorded. Default: everything `targetAction` matched,
-     * **reads included** — `DomainHandle.exec` is an OP choke point, not a
-     * mutation one, and the interceptor event carries no "this changed something"
-     * signal. Pass {@link mutationsOnly} for a writes-only trail.
-     */
-    when?(event: InterceptorResultEvent): boolean;
-}
-export interface QuotaTierOptions {
-    /** Which quota an op draws on. Host-declared; it cannot be inferred from an op name. */
-    quotaFor(event: InterceptorEvent): QuotaDraw | null;
-    /** The tenant's TIER ceilings. */
-    limits(tenantId: string): Promise<Readonly<Record<string, number>>>;
-    /** Authoritative current usage. */
-    usage(tenantId: string, metric: string): Promise<number>;
-    usageTtlMs?: number;
-    planTtlMs?: number;
-    onDenied?(denial: QuotaDenial): void;
-    unscoped?: 'allow' | 'deny';
-    targetAction?: string;
-}
-export interface GovernanceTierOptions {
-    /**
-     * Where a post-commit observer failure goes. REQUIRED — the same law
-     * `createInterceptorPipeline` states, passed straight through rather than
-     * defaulted here, because defaulting it in a convenience wrapper is exactly
-     * how a required decision stops being made.
-     */
-    onAfterError(error: Error, event: InterceptorResultEvent): void;
-    /** Omit ⇒ no audit trail. */
-    auditTrail?: AuditTrailTierOptions;
-    /** Omit ⇒ no quota gate. */
-    quota?: QuotaTierOptions;
-    /** Extra hooks a deployment wrote itself. Registered after the two built-ins. */
-    extra?: readonly CCHookInterceptor[];
-}
-export interface GovernanceTier {
-    /** Pass to `bootEngineApp({ interceptors })` AND to `resolveBootManifest({ interceptors })`. */
-    readonly interceptors: InterceptorPipeline;
-    /** The audit sink, for the read surface. Absent iff no audit trail was configured. */
-    readonly auditTrail?: AuditTrailSink;
-    /** Every registered hook — what `resolveBootManifest` needs for the cycle audit. */
-    readonly registered: readonly CCHookInterceptor[];
-}
-/**
- * Build the governance pipeline.
- *
- * Returns an EMPTY pipeline when neither tier is configured, rather than
- * `undefined`. A host that wired nothing still gets something it can pass
- * unconditionally, and an empty pipeline costs one array check per op — which
- * matters, because the alternative is every call site growing a conditional and
- * one of them getting it wrong.
- */
-export declare const createGovernanceTier: (options: GovernanceTierOptions) => GovernanceTier;
-/**
- * The quota tier over a `BillingService`-shaped plan resolver — the wiring a
- * saas deployment already has the pieces for.
- *
- * Splitting this out rather than folding it into {@link createGovernanceTier}
- * keeps `cwip`'s gate free of any plan concept: the gate knows ceilings and
- * usage, and this is the ONE place a `PlanDefinition` becomes a ceiling. A
- * deployment whose tiers come from somewhere else (a feature-flag service, a
- * contract table) supplies `limits` directly and never touches this.
- */
-export declare const quotaTierFromPlans: (input: {
-    /** Which plan a tenant is on — the same resolver `server.ts` builds billing from. */
-    plans(tenantId: string): Promise<{
-        limits: Readonly<Record<string, number>>;
-    }> | {
-        limits: Readonly<Record<string, number>>;
-    };
-    /** Authoritative usage per (tenant, metric). */
-    usage(tenantId: string, metric: string): Promise<number>;
-    /** Which ops draw on which ceiling. */
-    quotaFor(event: InterceptorEvent): QuotaDraw | null;
-    onDenied?(denial: QuotaDenial): void;
-    usageTtlMs?: number;
-    planTtlMs?: number;
-    unscoped?: "allow" | "deny";
-}) => QuotaTierOptions;
-/**
- * A writes-only audit predicate — the narrowing most deployments want.
- *
- * It exists because of a fact that is easy to get wrong and was:
- * **`DomainHandle.exec` carries READS as well as writes.** An audit trail
- * registered on `*` therefore records every `getRecord` the CDC search bridge
- * issues while indexing, which is one row per indexed document. That default is
- * the right one — an audit trail that misses a change is worthless, and access
- * auditing is a real requirement in its own right — but it is not free, so this
- * is the opt-in.
- *
- * It matches on the ACTION VERB, and that is the honest limitation: it is a
- * convention over repository naming, not a fact the runtime knows. A repository
- * whose mutating op is called `knowledge.applyPatch` is not matched, and there
- * is no signal available that would catch it — the CDC emit that proves a write
- * happens inside the op and is never reported to the pipeline. So a deployment
- * that adopts this is trading completeness for volume, deliberately, and one
- * that cannot make that trade keeps the total default. `extraVerbs` widens it
- * without a fork.
- */
-export declare const mutationsOnly: (extraVerbs?: readonly string[]) => (event: InterceptorEvent) => boolean;
-/**
- * The conventional `quotaFor`: a `<domain>.create*` op draws one unit of
- * `rows.<domain>`.
- *
- * Offered as a NAMED default rather than as the gate's built-in behavior,
- * because it is a convention and conventions are wrong sometimes — an upsert is
- * named `create` in some repositories and consumes nothing when it updates, and
- * a gate that guessed would be wrong SILENTLY in the direction of not enforcing.
- * A host that adopts this is choosing it; a host that needs precision writes six
- * lines instead.
- */
-export declare const rowsPerDomainQuota: (limitsByDomain?: Readonly<Record<string, unknown>>) => (event: InterceptorEvent) => QuotaDraw | null;
-//# sourceMappingURL=governance.d.ts.map

package/dist/server/runtime/governance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,0FAA0F;IAC1F,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,8EAA8E;IAC9E,KAAK,CAAC,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3D,sCAAsC;IACtC,QAAQ,CAAC,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7D,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC;CAC/C;AAED,MAAM,WAAW,gBAAgB;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAAC;IACpD,kCAAkC;IAClC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACpE,mCAAmC;IACnC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAChE,6BAA6B;IAC7B,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,4BAA4B;IAC5B,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,iFAAiF;IACjF,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,qBAAqB,KAAG,cA+BrE,CAAC;AAUF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO;IACxC,qFAAqF;IACrF,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAC,GAAG;QAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAC;IAC9H,gDAAgD;IAChD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,CAAC;IACpD,QAAQ,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B,KAAG,gBAQF,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa,GAAI,aAAY,SAAS,MAAM,EAAO,MAqBtD,OAAO,gBAAgB,KAAG,OACnC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAC5B,iBAAgB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,MACtD,OAAO,gBAAgB,KAAG,SAAS,GAAG,IAQtC,CAAC"}