cursedbelt 2.8.0 → 3.0.0

package/dist/server/runtime/governance.js

@@ -1,168 +0,0 @@
-/**
- * The GOVERNANCE TIER — the near side of `CCHookInterceptor`, once (owner
- * directive; 05 §B2's product consumer).
- *
- * `CCHookInterceptor` shipped proven and unregistered, which the report at the
- * time called correct-but-unused: inventing a hook with no product need would
- * have been a fresh orphan seam, the exact anti-pattern this arc exists to stop.
- * The owner has since named two needs — **an audit trail** ("prove what changed
- * and when") and **a quota gate** ("ensure a tier allowance is not exceeded") —
- * so this is the one place they are constructed, wired to the request-scoped
- * actor, and handed to `bootEngineApp` as a pipeline.
- *
- * ## Why ONE builder rather than two host options
- *
- * `createInterceptorPipeline` requires `onAfterError` — deliberately, because
- * post-commit an observer failure can only rethrow (telling a client its write
- * failed when it did not) or swallow (losing an audit record silently), and
- * neither should be picked by accident. That decision belongs to the deployment
- * ONCE, not once per interceptor. A single builder also means the two hooks
- * share one pipeline, which is what the storage provider takes, and what
- * `resolveBootManifest({ interceptors })` folds into the V4 `eventbus-cycle`
- * audit so a cyclic pair is a boot failure rather than a runaway transaction.
- *
- * ## The actor bridge, and why it lives HERE
- *
- * `cwip`'s audit interceptor takes an injected `actor` because the storage tier
- * has no idea what a user is. cursedbelt does: {@link currentRequestClaims} is
- * the verified in-flight session, already the near side `guardDeps.currentClaims`
- * uses. So the default actor is that, and outside a request — a job handler, a
- * migration, the vault reaper — it resolves to `SYSTEM_ACTOR`, which is a fact
- * rather than a gap.
- *
- * ## Ordering is not arbitrary
- *
- * The quota gate is registered FIRST. `runBefore` walks registrations in order
- * and the first throw wins, so a refused write must be refused before anything
- * else has a chance to act on it. (Today the audit trail has no `before`, so the
- * order is not yet load-bearing — it is fixed now so that adding one later
- * cannot silently reverse it.)
- */
-import { createAuditTrailInterceptor, createInterceptorPipeline, createQuotaInterceptor, createStatementAuditTrailStore, } from 'cwip/storage';
-import { currentRequestClaims } from '../mixins/requestClaims';
-/**
- * Build the governance pipeline.
- *
- * Returns an EMPTY pipeline when neither tier is configured, rather than
- * `undefined`. A host that wired nothing still gets something it can pass
- * unconditionally, and an empty pipeline costs one array check per op — which
- * matters, because the alternative is every call site growing a conditional and
- * one of them getting it wrong.
- */
-export const createGovernanceTier = (options) => {
-    const registered = [];
-    // Quota FIRST — see the header. A refused write must be refused before
-    // anything else acts on it.
-    if (options.quota)
-        registered.push(createQuotaInterceptor(options.quota));
-    let auditTrail;
-    if (options.auditTrail) {
-        auditTrail = options.auditTrail.sink ?? sinkFor(options.auditTrail);
-        registered.push(createAuditTrailInterceptor({
-            sink: auditTrail,
-            // The bridge. `cwip` cannot do this — it has no concept of a session.
-            // `userId`, not the jti: an audit trail answers "who", and a session id
-            // is a different question whose answer changes every login.
-            actor: options.auditTrail.actor ?? (() => currentRequestClaims()?.userId),
-            ...(options.auditTrail.when ? { when: options.auditTrail.when } : {}),
-            ...(options.auditTrail.targetOf ? { targetOf: options.auditTrail.targetOf } : {}),
-            ...(options.auditTrail.targetAction ? { targetAction: options.auditTrail.targetAction } : {}),
-        }));
-    }
-    registered.push(...(options.extra ?? []));
-    return {
-        interceptors: createInterceptorPipeline({ onAfterError: options.onAfterError }, registered),
-        ...(auditTrail ? { auditTrail } : {}),
-        registered,
-    };
-};
-const sinkFor = (options) => {
-    if (!options.executor)
-        throw new Error('An audit trail needs either a `sink` or an `executor` to build one over. Pass `createLocalHostServices().governanceExecutor` (local) or `createSaasHostServices().auditExecutor` (saas) — never an executor over the storage provider the pipeline is attached to.');
-    return createStatementAuditTrailStore(options.executor);
-};
-/**
- * The quota tier over a `BillingService`-shaped plan resolver — the wiring a
- * saas deployment already has the pieces for.
- *
- * Splitting this out rather than folding it into {@link createGovernanceTier}
- * keeps `cwip`'s gate free of any plan concept: the gate knows ceilings and
- * usage, and this is the ONE place a `PlanDefinition` becomes a ceiling. A
- * deployment whose tiers come from somewhere else (a feature-flag service, a
- * contract table) supplies `limits` directly and never touches this.
- */
-export const quotaTierFromPlans = (input) => ({
-    quotaFor: input.quotaFor,
-    limits: async (tenantId) => (await input.plans(tenantId)).limits,
-    usage: input.usage,
-    ...(input.onDenied ? { onDenied: input.onDenied } : {}),
-    ...(input.usageTtlMs === undefined ? {} : { usageTtlMs: input.usageTtlMs }),
-    ...(input.planTtlMs === undefined ? {} : { planTtlMs: input.planTtlMs }),
-    ...(input.unscoped ? { unscoped: input.unscoped } : {}),
-});
-/**
- * A writes-only audit predicate — the narrowing most deployments want.
- *
- * It exists because of a fact that is easy to get wrong and was:
- * **`DomainHandle.exec` carries READS as well as writes.** An audit trail
- * registered on `*` therefore records every `getRecord` the CDC search bridge
- * issues while indexing, which is one row per indexed document. That default is
- * the right one — an audit trail that misses a change is worthless, and access
- * auditing is a real requirement in its own right — but it is not free, so this
- * is the opt-in.
- *
- * It matches on the ACTION VERB, and that is the honest limitation: it is a
- * convention over repository naming, not a fact the runtime knows. A repository
- * whose mutating op is called `knowledge.applyPatch` is not matched, and there
- * is no signal available that would catch it — the CDC emit that proves a write
- * happens inside the op and is never reported to the pipeline. So a deployment
- * that adopts this is trading completeness for volume, deliberately, and one
- * that cannot make that trade keeps the total default. `extraVerbs` widens it
- * without a fork.
- */
-export const mutationsOnly = (extraVerbs = []) => {
-    const verbs = [
-        'create',
-        'insert',
-        'add',
-        'update',
-        'patch',
-        'set',
-        'upsert',
-        'delete',
-        'remove',
-        'archive',
-        'restore',
-        'rename',
-        'move',
-        'apply',
-        ...extraVerbs,
-    ];
-    // `[A-Z_]` after the verb so `recreateIndex` does not match `create` and
-    // `deleted_at` style names still do — the verb has to START a word.
-    const pattern = new RegExp(`\\.(?:${verbs.join('|')})(?:[A-Z_]|$)`);
-    return (event) => pattern.test(event.action);
-};
-/**
- * The conventional `quotaFor`: a `<domain>.create*` op draws one unit of
- * `rows.<domain>`.
- *
- * Offered as a NAMED default rather than as the gate's built-in behavior,
- * because it is a convention and conventions are wrong sometimes — an upsert is
- * named `create` in some repositories and consumes nothing when it updates, and
- * a gate that guessed would be wrong SILENTLY in the direction of not enforcing.
- * A host that adopts this is choosing it; a host that needs precision writes six
- * lines instead.
- */
-export const rowsPerDomainQuota = (limitsByDomain = {}) => (event) => {
-    if (!/\.(create|insert|add)[A-Z]/.test(event.action))
-        return null;
-    const metric = `rows.${event.domain}`;
-    // A domain the caller did not name is not gated. Returning a draw for it
-    // would rely on "absent limit ⇒ unlimited" to be harmless, which is true
-    // today and is the kind of thing that stops being true.
-    if (Object.keys(limitsByDomain).length > 0 && !(metric in limitsByDomain))
-        return null;
-    return { metric };
-};
-//# sourceMappingURL=governance.js.map

package/dist/server/runtime/governance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../../src/server/runtime/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,sBAAsB,EACtB,8BAA8B,GAQ/B,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAmE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAA8B,EAAkB,EAAE;IACrF,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,uEAAuE;IACvE,4BAA4B;IAC5B,IAAI,OAAO,CAAC,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1E,IAAI,UAAsC,CAAC;IAC3C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACpE,UAAU,CAAC,IAAI,CACb,2BAA2B,CAAC;YAC1B,IAAI,EAAE,UAAU;YAChB,sEAAsE;YACtE,wEAAwE;YACxE,4DAA4D;YAC5D,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC,CACH,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1C,OAAO;QACL,YAAY,EAAE,yBAAyB,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC;QAC3F,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,UAAU;KACX,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,OAA8B,EAAkB,EAAE;IACjE,IAAI,CAAC,OAAO,CAAC,QAAQ;QACnB,MAAM,IAAI,KAAK,CACb,oQAAoQ,CACrQ,CAAC;IACJ,OAAO,8BAA8B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAWlC,EAAoB,EAAE,CAAC,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;IAChE,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IAC3E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACxE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACxD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAgC,EAAE,EAAE,EAAE;IAClE,MAAM,KAAK,GAAG;QACZ,QAAQ;QACR,QAAQ;QACR,KAAK;QACL,QAAQ;QACR,OAAO;QACP,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,SAAS;QACT,QAAQ;QACR,MAAM;QACN,OAAO;QACP,GAAG,UAAU;KACd,CAAC;IACF,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpE,OAAO,CAAC,KAAuB,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,CAAC,iBAAoD,EAAE,EAAE,EAAE,CAC3D,CAAC,KAAuB,EAAoB,EAAE;IAC5C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;IACtC,yEAAyE;IACzE,yEAAyE;IACzE,wDAAwD;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACvF,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/server/runtime/hostCapabilities.d.ts

@@ -1,60 +0,0 @@
-/**
- * The boot moment's capability source (02 §4) — the live machine probe.
- *
- * The pipeline's four moments differ in exactly two things: where capabilities
- * come from, and what the caller does with the result. Export reads the config's
- * declared `deployTarget.capabilities` (never the build host — a laptop with
- * ffmpeg must not silently bless a container without it). CI pins them per
- * fixture. **Boot asks the machine it is actually running on**, which is this
- * file, and which did not exist: `bootEngineApp` had no way to answer
- * "is ffmpeg here?" so a capability-dependent feature could only be trusted as
- * far as the export-time declaration.
- *
- * Two rules shape the implementation:
- *
- *   * **A probe may not have side effects.** It looks for binaries on PATH and
- *     asks the runtime about itself. It does not dial the network, spawn a
- *     transcode, or write a file — a boot probe that reaches out is a boot that
- *     hangs when the network is down.
- *   * **What the machine cannot know, the HOST declares.** `aiProvider` is not a
- *     property of the machine; it is whether a driver was wired (03 §1). It is an
- *     input here, not a guess, so the probe and `buildDrivers`' boot gate can
- *     never disagree about whether AI is available.
- *
- * Every key below is a capability some engine's `capabilityDeps` actually names
- * (`verify/engines.ts`); an unnamed key would be dead weight the V2 stage never
- * reads.
- */
-import type { CapabilityProfile } from '../../verify/types';
-/** Every capability key the engine catalog's `capabilityDeps` can reference. */
-export declare const HOST_CAPABILITY_KEYS: readonly ["ffmpeg", "wasm", "ocrRuntime", "aiProvider", "diskIndex", "network", "shell", "git"];
-export type HostCapabilityKey = (typeof HOST_CAPABILITY_KEYS)[number];
-export interface ProbeHostCapabilitiesOptions {
-    /**
-     * Whether a `CognitiveDriver` is wired for this boot. NOT machine-detectable —
-     * the host that builds the driver map is the only thing that knows, and
-     * guessing here would let the probe disagree with `buildDrivers`' boot gate.
-     */
-    readonly hasAiDriver?: boolean;
-    /**
-     * Outbound network reachability. Declared, never dialed: a boot probe that
-     * makes an HTTP request hangs the app on an offline machine. Default `true`.
-     */
-    readonly network?: boolean;
-    /**
-     * Whether this host permits spawning child processes (the `shell` capability
-     * the DevStudio features depend on). Default: true iff an `ExecutionDriver`
-     * would be wired — the caller passes `exec !== undefined`.
-     */
-    readonly shell?: boolean;
-    /** Executable lookup seam. Default: PATH scan. Injected by tests. */
-    readonly hasExecutable?: (name: string) => boolean;
-    /** Explicit overrides folded in last (a host that knows better than the probe). */
-    readonly overrides?: CapabilityProfile;
-}
-/**
- * Probe the machine this process is running on. Pure with respect to the world:
- * PATH lookups and a `WebAssembly` presence check, nothing more.
- */
-export declare function probeHostCapabilities(options?: ProbeHostCapabilitiesOptions): CapabilityProfile;
-//# sourceMappingURL=hostCapabilities.d.ts.map

package/dist/server/runtime/hostCapabilities.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hostCapabilities.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/hostCapabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,iGAAkG,CAAC;AACpI,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,mFAAmF;IACnF,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;CACxC;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,4BAAiC,GAAG,iBAAiB,CA8BnG"}

package/dist/server/runtime/hostCapabilities.js

@@ -1,45 +0,0 @@
-/** Every capability key the engine catalog's `capabilityDeps` can reference. */
-export const HOST_CAPABILITY_KEYS = ['ffmpeg', 'wasm', 'ocrRuntime', 'aiProvider', 'diskIndex', 'network', 'shell', 'git'];
-/**
- * PATH lookup without spawning anything. `Bun.which` resolves against the
- * process PATH and returns null when absent; spawning `which` per capability
- * would cost three processes on every boot to learn the same thing.
- */
-const defaultHasExecutable = (name) => Bun.which(name) !== null;
-/**
- * Probe the machine this process is running on. Pure with respect to the world:
- * PATH lookups and a `WebAssembly` presence check, nothing more.
- */
-export function probeHostCapabilities(options = {}) {
-    const lookup = options.hasExecutable ?? defaultHasExecutable;
-    /**
-     * A probe may never take down a boot. A sandbox that denies PATH inspection —
-     * or an injected seam that throws — answers "capability absent", which
-     * degrades the affected feature with a V2 diagnostic instead of turning a
-     * hardened container into a crash loop.
-     */
-    const hasExecutable = (name) => {
-        try {
-            return lookup(name);
-        }
-        catch {
-            return false;
-        }
-    };
-    const probed = {
-        ffmpeg: hasExecutable('ffmpeg'),
-        // The editor/image-studio tiers run wasm in the BROWSER, but the manifest is
-        // compiled server-side; a runtime with no WebAssembly cannot serve or build
-        // those tiers meaningfully, so the server's own support is the honest signal.
-        wasm: typeof WebAssembly !== 'undefined',
-        ocrRuntime: hasExecutable('tesseract'),
-        aiProvider: options.hasAiDriver === true,
-        // Local disk indexing needs a filesystem, which every supported host has.
-        diskIndex: true,
-        network: options.network ?? true,
-        shell: options.shell ?? true,
-        git: hasExecutable('git'),
-    };
-    return Object.freeze({ ...probed, ...(options.overrides ?? {}) });
-}
-//# sourceMappingURL=hostCapabilities.js.map

package/dist/server/runtime/hostCapabilities.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hostCapabilities.js","sourceRoot":"","sources":["../../../src/server/runtime/hostCapabilities.ts"],"names":[],"mappings":"AA6BA,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAU,CAAC;AA2BpI;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAwC,EAAE;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,oBAAoB,CAAC;IAC7D;;;;;OAKG;IACH,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE;QAC9C,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAuC;QACjD,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;QAC/B,6EAA6E;QAC7E,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,EAAE,OAAO,WAAW,KAAK,WAAW;QACxC,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI;QACxC,0EAA0E;QAC1E,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;QAChC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC;KAC1B,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/dist/server/runtime/index.d.ts

@@ -1,14 +0,0 @@
-export { type CcRuntime, type CcRuntimeOptions, createCcRuntime } from './createCcRuntime';
-export { type CcServer, serveCcApp, type ServeCcAppOptions } from './serveCcApp';
-export { renderBootErrorPage, resolveBootManifest, type ResolveBootManifestOptions, type ResolvedBootManifest, } from './bootManifest';
-export { HOST_CAPABILITY_KEYS, type HostCapabilityKey, probeHostCapabilities, type ProbeHostCapabilitiesOptions, } from './hostCapabilities';
-export { createLocalDevServices, type CreateLocalDevServicesOptions, createLocalGuardServices, type CreateLocalGuardServicesOptions, createLocalHostServices, type CreateLocalHostServicesOptions, HOST_KEY_BYTES, type LocalDevServices, type LocalGuardServices, loadOrMintKeyFile, loadOrMintSessionKey, type LocalHostServices, resolveAppDataRoot, type ResolveAppDataRootOptions, } from './localHost';
-export { mountStaticAssets, type MountStaticAssetsOptions, resolveStaticFile } from './staticAssets';
-export { assertJobKindsHandled, type AssertJobKindsHandledOptions, type BootedEngineApp, bootEngineApp, type BootEngineAppOptions, buildDrivers, type BuildDriversOptions, type BuiltDrivers, buildEngineServices, type BuildEngineServicesOptions, buildJobHandlers, type BuildJobHandlersOptions, type BuiltJobHandlers, type DevServiceDeps, enqueueableKindsFor, type EngineAppHost, type GuardServiceDeps, manifestNeedsAi, openDomainHandles, type OpenDomainHandlesOptions, type OpenedDomainHandles, resolveManagedDomains, resolveSearchTier, type SearchTierDeps, type SearchTierFactory, } from './recipe';
-export * from '../guard';
-export * from '../services';
-export { currentRequestClaims, runWithRequestClaims } from '../mixins/requestClaims';
-export { createGovernanceTier, mutationsOnly, quotaTierFromPlans, rowsPerDomainQuota, type AuditTrailTierOptions, type GovernanceTier, type GovernanceTierOptions, type QuotaTierOptions, } from './governance';
-export { AUDIT_RETAIN_DAYS, RETENTION_MAX_PASSES, RETENTION_PAGE_LIMIT, runRetentionJob, type AuditRetentionOptions, type MeterRetentionOptions, type RetentionJobOptions, type RetentionJobResult, } from './retentionJob';
-export { assertSaasHostWiring, createSaasHostServices, reportSaasHostWiring, type AssertSaasHostWiringInput, type SaasHostOptions, type SaasHostServices, type SaasSearchOptions, type SaasWiringReport, } from './saasHost';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/runtime/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,gBAAgB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjF,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,wBAAwB,EACxB,KAAK,+BAA+B,EACpC,uBAAuB,EACvB,KAAK,8BAA8B,EACnC,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,KAAK,yBAAyB,GAC/B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAErG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,EACjC,KAAK,eAAe,EACpB,aAAa,EACb,KAAK,oBAAoB,EACzB,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,eAAe,EACf,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,qBAAqB,EAKrB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAClB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAM5B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAKrF,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AAKtB,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC"}

package/dist/server/runtime/index.js

@@ -1,37 +0,0 @@
-// The production runtime (Phase 2): the non-harness path from an
-// EffectiveManifest to a serving `Bun.serve` app.
-export { createCcRuntime } from './createCcRuntime';
-export { serveCcApp } from './serveCcApp';
-// The BOOT moment of the pipeline (02 §4): live probe, last-good on failure.
-export { renderBootErrorPage, resolveBootManifest, } from './bootManifest';
-export { HOST_CAPABILITY_KEYS, probeHostCapabilities, } from './hostCapabilities';
-// The LOCAL profile's host plumbing: data root, key custody, telemetry (02 §1),
-// and the GuardEngine identity tier that makes a generated app loginable (02 §2).
-export { createLocalDevServices, createLocalGuardServices, createLocalHostServices, HOST_KEY_BYTES, loadOrMintKeyFile, loadOrMintSessionKey, resolveAppDataRoot, } from './localHost';
-// The static tier — mounted on the runtime's app so its CSP cannot drift (02 §1.3).
-export { mountStaticAssets, resolveStaticFile } from './staticAssets';
-// The ONE wiring point (02 §2): the recipe the generated app + saas worker call.
-export { assertJobKindsHandled, bootEngineApp, buildDrivers, buildEngineServices, buildJobHandlers, enqueueableKindsFor, manifestNeedsAi, openDomainHandles, resolveManagedDomains, 
-// The saas search tier's seam (04 §3). The generated `worker.ts` builds its own
-// handler map, so it resolves the tier through the SAME helper the recipe does
-// — a worker that resolved it differently leases a `reindex` off the shared
-// queue and runs the loud placeholder against it.
-resolveSearchTier, } from './recipe';
-export * from '../guard';
-export * from '../services';
-// The request-scoped claims channel — what a saas `host.ts` passes as
-// `guardDeps.currentClaims`. Re-exported here because a generated `host.ts`
-// imports its whole world from `cursedbelt/server/runtime`, and a host seam
-// reachable only from a deeper path is a seam hosts do not find.
-export { currentRequestClaims, runWithRequestClaims } from '../mixins/requestClaims';
-// The GOVERNANCE tier (05 §B2's product consumers, owner-directed): the audit
-// trail and the quota gate, constructed once, wired to the request-scoped actor,
-// and handed to `bootEngineApp({ interceptors })`.
-export { createGovernanceTier, mutationsOnly, quotaTierFromPlans, rowsPerDomainQuota, } from './governance';
-// The maintenance pass a saas DEPLOYMENT schedules (01 §4) — an ENTRYPOINT, not
-// a timer, because N nodes each sweeping one shared table is N times the work
-// for one outcome. The per-node janitor stays correct under `local`.
-export { AUDIT_RETAIN_DAYS, RETENTION_MAX_PASSES, RETENTION_PAGE_LIMIT, runRetentionJob, } from './retentionJob';
-// The saas profile's host plumbing (04 §1) — the analog of `localHost`.
-export { assertSaasHostWiring, createSaasHostServices, reportSaasHostWiring, } from './saasHost';
-//# sourceMappingURL=index.js.map

package/dist/server/runtime/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/runtime/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,kDAAkD;AAClD,OAAO,EAAyC,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAiB,UAAU,EAA0B,MAAM,cAAc,CAAC;AACjF,6EAA6E;AAC7E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAGpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EAEpB,qBAAqB,GAEtB,MAAM,oBAAoB,CAAC;AAC5B,gFAAgF;AAChF,kFAAkF;AAClF,OAAO,EACL,sBAAsB,EAEtB,wBAAwB,EAExB,uBAAuB,EAEvB,cAAc,EAGd,iBAAiB,EACjB,oBAAoB,EAEpB,kBAAkB,GAEnB,MAAM,aAAa,CAAC;AACrB,oFAAoF;AACpF,OAAO,EAAE,iBAAiB,EAAiC,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrG,iFAAiF;AACjF,OAAO,EACL,qBAAqB,EAGrB,aAAa,EAEb,YAAY,EAGZ,mBAAmB,EAEnB,gBAAgB,EAIhB,mBAAmB,EAGnB,eAAe,EACf,iBAAiB,EAGjB,qBAAqB;AACrB,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,kDAAkD;AAClD,iBAAiB,GAGlB,MAAM,UAAU,CAAC;AAClB,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAE5B,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,iEAAiE;AACjE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAErF,8EAA8E;AAC9E,iFAAiF;AACjF,mDAAmD;AACnD,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,cAAc,CAAC;AAEtB,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAKhB,MAAM,gBAAgB,CAAC;AAExB,wEAAwE;AACxE,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GAMrB,MAAM,YAAY,CAAC"}

package/dist/server/runtime/localHost.d.ts

@@ -1,271 +0,0 @@
-/**
- * The LOCAL profile's host plumbing (02 §1) — everything `bootEngineApp`
- * deliberately does not construct.
- *
- * The recipe refuses to invent paths, keys or a telemetry database, and that
- * refusal is a law (handle injection, 01 §1.1.3): a library that opens its own
- * files puts the storage layout back inside the library, where a generated app
- * can never change it. But the work still has to happen somewhere, and "somewhere"
- * must not be N copies of the same twenty lines pasted into N generated
- * `server.ts` files — that is precisely the divergence the recipe exists to end.
- *
- * So this is the local host, once, as a tested unit. It owns four things a
- * machine-level host owns and a library must not:
- *
- *   1. **Where the app's data lives** — `<app-data-home>/instances/<appId>`, where
- *      the home is CONFIGURATION ({@link resolveAppDataHome}): an explicit
- *      argument, else `$APP_DATA_HOME`, else the OS convention. Never a bespoke
- *      `~/.<app>` directory, and never a folder named after one machine's owner.
- *   2. **Key custody.** The object-store URL signing key and the telemetry row
- *      integrity key are minted once, persisted `0600`, and read back **as bytes**
- *      — never as a string (V6 `key-material-as-string`; a hex string of a key
- *      lands in GC-managed RAM with no way to zeroize it).
- *   3. **The telemetry tier**, opened and migrated, with the row signer
- *      `meter_events.row_signature` is NOT NULL for.
- *   4. **The GuardEngine's identity tier** ({@link createLocalGuardServices}) —
- *      the app's own registry file, the argon2id binding, and the
- *      manager/secrets/identity trio `bootEngineApp({ guardDeps })` needs. Split
- *      out rather than folded in, so an app with no guard engine opens no
- *      registry file and loads no native KDF.
- *   5. **The DevStudio's registry handle** ({@link createLocalDevServices}) —
- *      same split, same reason.
- *
- * A SaaS host wires its own equivalents (pooled Postgres, S3, a shared telemetry
- * database); nothing here is reachable from that path.
- */
-import { Database } from 'bun:sqlite';
-import { type StatementExecutor } from 'cwip/storage';
-import { type SessionSigner } from '../guard/sessionSigner';
-import type { ScreenshotSource } from '../services';
-import type { DevServiceDeps, GuardServiceDeps } from './recipe';
-import { type TelemetryDatabase, type TelemetryWriter } from 'cwip/telemetry';
-/** Bytes in a minted key file. Matches cwip's `CC_KEY_BYTES`. */
-export declare const HOST_KEY_BYTES = 32;
-export interface ResolveAppDataRootOptions {
-    readonly appId: string;
-    /** Explicit override (a `--data-root` flag, `CC_DATA_ROOT`). Wins outright. */
-    readonly override?: string;
-    /** Environment to read `APP_DATA_HOME` from. Injected by tests. */
-    readonly env?: Record<string, string | undefined>;
-}
-/**
- * `<app-data-home>/instances/<appId>` — the app's data root.
- *
- * A HOST function, not a library one: `openDomainHandles` still refuses to derive
- * a path, and this is the thing that hands it one. The home underneath it is
- * {@link resolveAppDataHome} — configuration, then the OS convention, and nothing
- * else. A published package may not go looking for a directory it invented in
- * somebody's home.
- */
-export declare function resolveAppDataRoot(options: ResolveAppDataRootOptions): string;
-/**
- * Read a persisted key file, minting it on first boot. Bytes in, bytes out —
- * the material is never rendered as a string, and the file is `0600` from the
- * moment it exists (written to a temp name and chmod'd before the rename would be
- * stricter still; `writeFileSync` with `mode` is applied at create time, which
- * closes the window for a file this process creates).
- */
-export declare function loadOrMintKeyFile(file: string, byteLength?: number): Uint8Array;
-/**
- * The app's session-signing key, minted once and persisted `0600` as a PKCS8 PEM.
- *
- * `createSessionSigner()` with no key generates an EPHEMERAL Ed25519 pair, which
- * is correct only for a single-process dev server: every restart invalidates
- * every live session (a deploy silently logs every user out) and a second
- * process — the saas worker, a companion — cannot verify a token the server
- * minted. Persisting the key is what makes both work, so the local host does it
- * rather than leaving each generated app to rediscover the problem.
- */
-export declare function loadOrMintSessionKey(file: string): string;
-export interface CreateLocalHostServicesOptions {
-    readonly appId: string;
-    /** The app data root (see {@link resolveAppDataRoot}). Created if absent. */
-    readonly root: string;
-    /** Override the machine-tier telemetry home (tests, sandboxed runs). */
-    readonly appManagedHome?: string;
-    /** Session lifetime. Feed it `guard.features.sessionTtlMinutes × 60`. Default 1h. */
-    readonly sessionTtlSeconds?: number;
-}
-export interface LocalHostServices {
-    readonly root: string;
-    readonly telemetry: TelemetryWriter;
-    /**
-     * The opened telemetry tier — the WRITER's own handle, exposed because
-     * `meter_events` is also the only source of truth for USAGE (01 §4.1), and
-     * `createBillingService` reads it. Without this a host that needs billing (the
-     * saas profile composes it unconditionally) had to open a SECOND connection to
-     * the same file, which is two handles racing one WAL for a read the writer's
-     * own connection could serve.
-     */
-    readonly telemetryDb: TelemetryDatabase;
-    /** Where `createFsObjectStore` keeps bytes. */
-    readonly objectStoreRoot: string;
-    /** The HMAC key behind local signed object URLs — persisted, never regenerated per boot. */
-    readonly objectStoreSigningKey: Uint8Array;
-    /** The jobs queue handle the local broker runs on. */
-    readonly jobsDb: Database;
-    /**
-     * `governance.db` — the audit trail's own file, and an executor over it.
-     *
-     * Its OWN file on purpose. `createGovernanceTier`'s audit sink must not reach
-     * the storage provider the interceptor is attached to: a sink that writes back
-     * into an intercepted domain deadlocks on that domain's op mutex, permanently
-     * (see `cwip`'s `auditTrail.ts`). A separate handle makes that structurally
-     * impossible rather than a rule somebody has to remember, and it also means an
-     * audit trail survives a `rm` of a domain file — which is exactly the sequence
-     * of events an audit trail exists to describe.
-     */
-    readonly governanceDb: Database;
-    readonly governanceExecutor: StatementExecutor;
-    /**
-     * The session signer, over a PERSISTED key: sessions survive a restart and a
-     * second process can verify what this one minted.
-     */
-    readonly signer: SessionSigner;
-    /** Flush telemetry, close the handles this created. */
-    close(): Promise<void>;
-}
-/**
- * Build the local host's services. Idempotent across boots: the keys persist, so
- * a signed media URL minted before a restart still verifies after it (regenerating
- * the signing key per boot silently 404s every `<img>` on the page after a deploy).
- */
-export declare function createLocalHostServices(options: CreateLocalHostServicesOptions): LocalHostServices;
-export interface CreateLocalGuardServicesOptions {
-    /** The app data root (see {@link resolveAppDataRoot}). Created if absent. */
-    readonly root: string;
-    /**
-     * Arm the process-wide argon2id seam. Default: {@link registerNodeRsArgon2id}
-     * (the optional `@node-rs/argon2` peer). A host with a different binding —
-     * libsodium, a Worker-backed one — passes its own registration here; a test
-     * passes a deterministic stub. There is deliberately no "no KDF" path: the
-     * `assertArgon2idReady()` below turns a forgotten binding into a boot failure
-     * rather than a 500 on the first user's login.
-     */
-    readonly registerKdf?: () => void | Promise<void>;
-    /** Open the registry file. Injected by tests (`:memory:`). */
-    readonly openDatabase?: (file: string) => Database;
-}
-export interface LocalGuardServices {
-    /** The app's registry file — `<root>/registry.db`. */
-    readonly registryFile: string;
-    /**
-     * The opened handle. Exposed because the DEV engine wants the same one
-     * (`devDeps.registry`): two handles on one sqlite file is two write locks
-     * contending, and the second one's pragma assertion fighting the first.
-     */
-    readonly registryDb: Database;
-    /** Exactly what `bootEngineApp({ guardDeps })` takes. */
-    readonly deps: GuardServiceDeps;
-    /** Dispose the txn-lifetime guard, close the handle, zeroize the integrity key. */
-    close(): void;
-}
-/**
- * The GuardEngine half of the local host (02 §2-tail) — the seam that makes a
- * generated app genuinely loginable.
- *
- * `AccountService`, the auth routes and the wired limiter all landed in 02 §1/§2,
- * but no SHIPPING host ever constructed `guardDeps`, so a real generated app
- * still answered 404 on `/api/guard/login`: the whole tier was reachable only
- * from `recipe.spec.ts`. This function is what a `server.ts` calls, and it owns
- * the four things a library must not decide:
- *
- *   1. **Which file the identity lives in.** `<root>/registry.db` — the app's
- *      OWN registry, never the machine-wide `cc-registry.db`. The station is the
- *      sole DDL owner of that shared file (V6 `client-ddl-on-shared-db`), and
- *      two generated apps sharing one account table is a tenancy decision no
- *      generator gets to make silently. Same schema, same station-authored
- *      migration chain, per-app file.
- *   2. **Row integrity.** The identity and secrets tables are HMAC-signed with
- *      the SAME persisted machine key the telemetry tier signs with — one key
- *      file per data root, minted `0600` on first boot.
- *   3. **The envelope salt**, persisted beside the registry. Minting it per boot
- *      would change every new envelope's `kdf` block and orphan yesterday's
- *      secrets behind a reseal.
- *   4. **The KDF.** cwip ships no argon2id; the binding is registered here, once,
- *      and `assertArgon2idReady()` proves it took before a single route mounts.
- *
- * Async solely because the argon2id binding is an optional native module loaded
- * with a dynamic `import()` — the generated `server.ts` is already a top-level
- * `await` module.
- */
-export declare function createLocalGuardServices(options: CreateLocalGuardServicesOptions): Promise<LocalGuardServices>;
-export interface CreateLocalDevServicesOptions {
-    /** The app data root (see {@link resolveAppDataRoot}). Created if absent. */
-    readonly root: string;
-    /**
-     * Reuse an already-open registry handle — pass
-     * {@link LocalGuardServices.registryDb} whenever the guard engine is also
-     * active. Two handles on one SQLite file is two write locks contending and a
-     * second txn-lifetime guard fighting the first.
-     */
-    readonly registryDb?: Database;
-    /** Open the registry file. Injected by tests (`:memory:`). */
-    readonly openDatabase?: (file: string) => Database;
-    /**
-     * Where the `screenshots` surface (03 §1e) reads captures from. Defaults to
-     * `<root>/screenshots` — the app's OWN data root, on the same reasoning as the
-     * registry file above: a generated app reaching into a machine-wide capture
-     * directory is not a decision a generator gets to make.
-     */
-    readonly screenshotRoot?: string;
-}
-export interface LocalDevServices {
-    readonly registryFile: string;
-    readonly registryDb: Database;
-    /** Where {@link LocalDevServices.deps}'s screenshot source reads from. */
-    readonly screenshotRoot: string;
-    /** Exactly what `bootEngineApp({ devDeps })` takes. */
-    readonly deps: DevServiceDeps;
-    close(): void;
-}
-/**
- * The local `ScreenshotSource` — a flat directory of captures.
- *
- * Three properties make it safe to hand a URL segment to, and all three come
- * from the same decision: the LISTING is the authority, not the caller's string.
- *
- *   * Only files whose extension is in {@link SCREENSHOT_TYPES} are published,
- *     so the source can never serve an `.env` that happens to be in the folder.
- *   * The list is FLAT — sub-directories are not descended and a name containing
- *     a separator is never produced, so no listed name can traverse.
- *   * `read` re-checks the name against the same rules before it opens anything;
- *     `DevService.readScreenshot` also matches the name against the live listing
- *     first. Two independent checks, because this is the one dev route that
- *     turns a caller-supplied segment into a file handle.
- *
- * A missing directory is an EMPTY listing, not a boot failure: an operator who
- * turned the feature on before their first capture should see "no screenshots
- * yet", and the directory appears the moment something writes one.
- */
-export declare function createLocalScreenshotSource(root: string): ScreenshotSource;
-/**
- * The DevStudio half of the local host (03 §2c) — the seam whose absence made
- * the `dev` engine **unbootable in a generated app**.
- *
- * `DevService`, `dev.mixin.ts` and the five DevStudio views all landed arcs ago,
- * and `buildEngineServices` has always thrown `DEV_DEPS_MISSING` when the engine
- * is active with no `devDeps` — but no shipping host ever constructed them, and
- * the generated `server.ts` emitted nothing for dev. Every app whose config
- * activated the engine died at boot with a 500 before serving a byte. The
- * migrator found it on the first real app, because `plugin-app-info` maps to
- * `dev.appRegistry` and the then-live local-gallery app mounted it.
- *
- * What it decides — the two things a library must not:
- *
- *   1. **Which registry the app board reads.** `<root>/registry.db`, the app's
- *      OWN file, for exactly the reason the guard tier uses it: the station is
- *      the sole DDL owner of the machine-wide `cc-registry.db` (V6
- *      `client-ddl-on-shared-db`), and a generated app silently attaching to the
- *      machine fleet database is a decision no generator gets to make. A host
- *      that genuinely wants the machine board passes that handle in.
- *   2. **That it is ONE handle.** With the guard engine active the caller passes
- *      `guard.registryDb` and this opens nothing — same file, same chain, one
- *      lock.
- *
- * `snapshotRoot`/`snapshot` are deliberately NOT set here: the recipe defaults
- * them from the domain handles it opens, which is the only place those handles
- * exist (see {@link DevServiceDeps.snapshot}).
- */
-export declare function createLocalDevServices(options: CreateLocalDevServicesOptions): LocalDevServices;
-//# sourceMappingURL=localHost.d.ts.map

package/dist/server/runtime/localHost.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"localHost.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/localHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAkBtC,OAAO,EAAwB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAGxB,iEAAiE;AACjE,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAI7E;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAuB,GAAG,UAAU,CAe/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,qFAAqF;IACrF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,+CAA+C;IAC/C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,qBAAqB,EAAE,UAAU,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,uDAAuD;IACvD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,GAAG,iBAAiB,CAiDlG;AAID,MAAM,WAAW,+BAA+B;IAC9C,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC;CACpD;AAED,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,mFAAmF;IACnF,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0CpH;AAID,MAAM,WAAW,6BAA6B;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,KAAK,IAAI,IAAI,CAAC;CACf;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CA4C1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,gBAAgB,CA4C/F"}