okengine 0.3.6 → 0.5.0

package/src/drivers/meilisearch.ts

@@ -0,0 +1,208 @@
+/**
+ * `meilisearch` index driver — full-text search over the Meilisearch HTTP API.
+ *
+ * Product-as-protocol id (same pattern as `openbao` / `pgvector`); the image
+ * pin lives in `images["store.index"]` (e.g. `getmeili/meilisearch`). This is
+ * a genuinely different capability from the vector ANN drivers — typo-tolerant
+ * / faceted full-text relevance, not cosine similarity.
+ *
+ * Fail-loud: a configured Meilisearch that is unreachable, unhealthy, or
+ * rejects a call throws {@link MeilisearchUnavailableError} — never silently
+ * falls back to memory. Writes wait for their task to succeed (Meilisearch is
+ * asynchronous), so an `upsert`/`delete` only resolves once the server has
+ * actually indexed it.
+ */
+
+import type {
+  IndexHit,
+  IndexOpenOptions,
+  TextIndexDriver,
+  TextIndexSearchOptions,
+  TextIndexSearchResult,
+  TextIndexStore,
+} from "./types.ts";
+
+/** Error thrown when the remote Meilisearch is unreachable / unhealthy / errors. */
+export class MeilisearchUnavailableError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "MeilisearchUnavailableError";
+  }
+}
+
+/** Minimal response shape of a Meilisearch summarized / finished task. */
+interface MeiliTask {
+  readonly taskUid: number;
+  readonly status: "enqueued" | "processing" | "succeeded" | "failed" | "canceled";
+  readonly error?: { readonly message?: string } | null;
+}
+
+/** Search response hit shape we consume. */
+interface MeiliSearchResponse {
+  readonly hits?: ReadonlyArray<Record<string, unknown> & { readonly _rankingScore?: number }>;
+  readonly facetDistribution?: Record<string, Record<string, number>>;
+}
+
+/** Options for opening a Meilisearch-backed text index. */
+export interface MeilisearchIndexOptions extends IndexOpenOptions {
+  /** Max ms to wait for an indexing task to finish (default 5000). */
+  readonly taskTimeoutMs?: number;
+}
+
+/**
+ * Open a full-text index.
+ *
+ * Ensures the index exists, health-checks the server, and returns a handle
+ * whose writes are confirmed (task-waited) and whose search maps
+ * `_rankingScore` into `IndexHit.score` as relevance.
+ *
+ * @param options - name / url / apiKey / injected fetch
+ */
+export async function openMeilisearchIndex(
+  options: MeilisearchIndexOptions,
+): Promise<TextIndexStore> {
+  const url = options.url?.replace(/\/$/, "");
+  if (!url) {
+    throw new MeilisearchUnavailableError(
+      "meilisearch index: needs an HTTP URL (OKE_STORE_INDEX_URL) — no silent memory fallback",
+    );
+  }
+  const apiKey = options.apiKey;
+  const fetchFn = options.fetch ?? globalThis.fetch;
+  const taskTimeoutMs = options.taskTimeoutMs ?? 5_000;
+  const uid = encodeURIComponent(options.name);
+
+  const headers: Record<string, string> = { "content-type": "application/json" };
+  if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
+
+  async function request(path: string, init?: RequestInit): Promise<Response> {
+    let res: Response;
+    try {
+      res = await fetchFn(`${url}${path}`, {
+        ...init,
+        headers: { ...headers, ...(init?.headers ?? {}) },
+      });
+    } catch (err) {
+      throw new MeilisearchUnavailableError(
+        `meilisearch index: unreachable at ${url} — ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+    return res;
+  }
+
+  async function requestOk(path: string, init?: RequestInit): Promise<Response> {
+    const res = await request(path, init);
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new MeilisearchUnavailableError(
+        `meilisearch index: ${init?.method ?? "GET"} ${path} failed (${res.status})${detail ? ` — ${detail.slice(0, 200)}` : ""}`,
+      );
+    }
+    return res;
+  }
+
+  async function enqueue(path: string, init: RequestInit): Promise<MeiliTask> {
+    const res = await requestOk(path, init);
+    return (await res.json()) as MeiliTask;
+  }
+
+  async function waitForTask(taskUid: number): Promise<void> {
+    const deadline = Date.now() + taskTimeoutMs;
+    // Poll the task until it leaves the queue; treat a failed/canceled task as
+    // a loud error rather than an optimistic write.
+    for (;;) {
+      const res = await requestOk(`/tasks/${taskUid}`);
+      const task = (await res.json()) as MeiliTask;
+      if (task.status === "succeeded") return;
+      if (task.status === "failed" || task.status === "canceled") {
+        throw new MeilisearchUnavailableError(
+          `meilisearch index: task ${taskUid} ${task.status}${task.error?.message ? ` — ${task.error.message}` : ""}`,
+        );
+      }
+      if (Date.now() > deadline) {
+        throw new MeilisearchUnavailableError(
+          `meilisearch index: task ${taskUid} did not finish within ${taskTimeoutMs}ms`,
+        );
+      }
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+  }
+
+  // Fail loud up front: server must be healthy and the index must exist
+  // (created if absent) before we hand back a usable handle.
+  await requestOk("/health");
+  const created = await enqueue("/indexes", {
+    method: "POST",
+    body: JSON.stringify({ uid: options.name, primaryKey: "id" }),
+  });
+  await waitForTask(created.taskUid);
+
+  const scoreOf = (hit: { readonly _rankingScore?: unknown }): number =>
+    typeof hit._rankingScore === "number" ? hit._rankingScore : 0;
+
+  return {
+    driverId: "meilisearch",
+    async upsert(id, document) {
+      const body = [{ ...document, id }];
+      const task = await enqueue(`/indexes/${uid}/documents`, {
+        method: "POST",
+        body: JSON.stringify(body),
+      });
+      await waitForTask(task.taskUid);
+    },
+    async search(q, opts?: TextIndexSearchOptions): Promise<TextIndexSearchResult> {
+      const payload: Record<string, unknown> = {
+        q,
+        limit: opts?.topK ?? 10,
+        showRankingScore: true,
+      };
+      if (opts?.filter !== undefined) payload.filter = opts.filter;
+      if (opts?.facets !== undefined) payload.facets = opts.facets;
+      const res = await requestOk(`/indexes/${uid}/search`, {
+        method: "POST",
+        body: JSON.stringify(payload),
+      });
+      const body = (await res.json()) as MeiliSearchResponse;
+      const hits: IndexHit[] = (body.hits ?? []).map((hit) => {
+        const { _rankingScore, ...rest } = hit;
+        void _rankingScore;
+        const meta = Object.fromEntries(Object.entries(rest).filter(([key]) => key !== "id"));
+        return {
+          id: String(rest.id ?? ""),
+          score: scoreOf(hit),
+          ...(Object.keys(meta).length > 0 ? { meta } : {}),
+        };
+      });
+      return {
+        hits,
+        ...(body.facetDistribution !== undefined
+          ? { facetDistribution: body.facetDistribution }
+          : {}),
+      };
+    },
+    async delete(id) {
+      const res = await request(`/indexes/${uid}/documents/${encodeURIComponent(id)}`, {
+        method: "DELETE",
+      });
+      if (res.status === 404) return false;
+      if (!res.ok) {
+        throw new MeilisearchUnavailableError(
+          `meilisearch index: delete ${id} failed (${res.status})`,
+        );
+      }
+      const task = (await res.json()) as MeiliTask;
+      await waitForTask(task.taskUid);
+      return true;
+    },
+    async close() {
+      // Stateless HTTP client — nothing to release.
+    },
+  };
+}
+
+/** Protocol-named Meilisearch driver. */
+export const meilisearchDriver: TextIndexDriver = {
+  id: "meilisearch",
+  facet: "index",
+  open: openMeilisearchIndex,
+};

package/src/drivers/memory.ts

@@ -7,10 +7,10 @@ import type {
   FilesBucket,
   FilesDriver,
   FilesOpenOptions,
-  IndexDriver,
   IndexHit,
   IndexOpenOptions,
-  IndexStore,
+  VectorIndexDriver,
+  VectorIndexStore,
   KvDriver,
   KvNamespace,
   KvOpenOptions,
@@ -638,10 +638,10 @@ function cosine(a: readonly number[], b: readonly number[]): number {
 }
 
 /** Memory index driver. */
-export const memoryIndexDriver: IndexDriver = {
+export const memoryIndexDriver: VectorIndexDriver = {
   id: "memory",
   facet: "index",
-  async open(options: IndexOpenOptions): Promise<IndexStore> {
+  async open(options: IndexOpenOptions): Promise<VectorIndexStore> {
     const docs = new Map<string, { vector: number[]; meta?: Record<string, unknown> }>();
     return {
       driverId: "memory",

package/src/drivers/pgvector.ts

@@ -14,11 +14,11 @@
 import { cosineDistance } from "drizzle-orm";
 import { PgDialect, index as pgIndex, pgTable, text, vector } from "drizzle-orm/pg-core";
 import type {
-  IndexDriver,
   IndexHit,
   IndexOpenOptions,
-  IndexStore,
   SqlConnection,
+  VectorIndexDriver,
+  VectorIndexStore,
 } from "./types.ts";
 
 /**
@@ -26,7 +26,7 @@ import type {
  *
  * @param options - Name / dims / SQL connection
  */
-export async function openPgvectorIndex(options: IndexOpenOptions): Promise<IndexStore> {
+export async function openPgvectorIndex(options: IndexOpenOptions): Promise<VectorIndexStore> {
   if (options.sql) {
     return openPgvectorSql(options.name, options.dims, options.sql);
   }
@@ -40,7 +40,7 @@ async function openPgvectorSql(
   name: string,
   dims: number,
   sql: SqlConnection,
-): Promise<IndexStore> {
+): Promise<VectorIndexStore> {
   if (sql.driverId !== "postgres" && sql.driverId !== "pglite") {
     throw new Error(
       `pgvector index: needs a postgres/pglite SQL connection, got "${sql.driverId}" — ` +
@@ -111,7 +111,7 @@ async function openPgvectorSql(
   };
 }
 
-function openPgvectorMemory(dims: number): IndexStore {
+function openPgvectorMemory(dims: number): VectorIndexStore {
   const docs = new Map<string, { vector: number[]; meta?: Record<string, unknown> }>();
   return {
     driverId: "pgvector",
@@ -154,7 +154,7 @@ function cosine(a: readonly number[], b: readonly number[]): number {
 }
 
 /** Protocol-named pgvector driver. */
-export const pgvectorDriver: IndexDriver = {
+export const pgvectorDriver: VectorIndexDriver = {
   id: "pgvector",
   facet: "index",
   open: openPgvectorIndex,

package/src/drivers/types.ts

@@ -17,7 +17,8 @@ export type StoreDriverId =
   | "redis"
   | "fs"
   | "s3"
-  | "pgvector";
+  | "pgvector"
+  | "meilisearch";
 
 /** Facets a driver may serve. */
 export type DriverFacet = StoreFacet;
@@ -248,15 +249,19 @@ export interface FilesDriver {
   open(options: FilesOpenOptions): Promise<FilesBucket>;
 }
 
-/** Vector index hit. */
+/** Index hit — score meaning depends on the driver. */
 export interface IndexHit {
   readonly id: string;
+  /**
+   * Vector drivers: cosine similarity (higher = more similar).
+   * Full-text (`meilisearch`): relevance score (`_rankingScore`, higher = more relevant).
+   */
   readonly score: number;
   readonly meta?: Record<string, unknown>;
 }
 
-/** Vector index handle. */
-export interface IndexStore {
+/** Vector (ANN) index handle. */
+export interface VectorIndexStore {
   readonly driverId: "memory" | "pgvector" | "libsql";
   /**
    * Upsert a vector.
@@ -272,7 +277,7 @@ export interface IndexStore {
    * @param vector - Query embedding
    * @param topK - Max hits
    */
-  search(vector: readonly number[], topK?: number): Promise<IndexHit[]>;
+  search(vector: readonly number[], topK?: number): Promise<readonly IndexHit[]>;
   /**
    * Delete a vector.
    *
@@ -283,28 +288,104 @@ export interface IndexStore {
   close(): Promise<void>;
 }
 
+/** Full-text search options (meilisearch). */
+export interface TextIndexSearchOptions {
+  /** Max hits (Meilisearch `limit`). */
+  readonly topK?: number;
+  /** Filter expression (attribute must be filterable). */
+  readonly filter?: string | string[];
+  /** Facet attributes to aggregate. */
+  readonly facets?: string[];
+}
+
+/** Full-text search result (meilisearch). */
+export interface TextIndexSearchResult {
+  readonly hits: readonly IndexHit[];
+  /** Facet counts per attribute, when `facets` was requested. */
+  readonly facetDistribution?: Record<string, Record<string, number>>;
+}
+
+/** Full-text index handle. */
+export interface TextIndexStore {
+  readonly driverId: "meilisearch";
+  /**
+   * Upsert a document.
+   *
+   * @param id - Document id
+   * @param document - Field map (must include the id field)
+   */
+  upsert(id: string, document: Record<string, unknown>): Promise<void>;
+  /**
+   * Full-text search.
+   *
+   * @param q - Query text (typo tolerant)
+   * @param opts - topK / filter / facets
+   */
+  search(q: string, opts?: TextIndexSearchOptions): Promise<TextIndexSearchResult>;
+  /**
+   * Delete a document.
+   *
+   * @param id - Document id
+   */
+  delete(id: string): Promise<boolean>;
+  /** Close / release. */
+  close(): Promise<void>;
+}
+
+/** Index handle — discriminated by `driverId`. */
+export type IndexStore = VectorIndexStore | TextIndexStore;
+
 /** Options when opening an index. */
 export interface IndexOpenOptions {
   /** Index name. */
   readonly name: string;
-  /** Vector dimensions. */
+  /** Vector dimensions (vector drivers only). */
   readonly dims: number;
-  /** SQL URL when the index driver shares the sql facet's engine. */
+  /**
+   * Vector: SQL URL when the driver shares the sql facet's engine.
+   * Meilisearch: base HTTP URL.
+   */
   readonly url?: string;
-  /** Injected SQL connection — shared with `store.sql` at boot. */
+  /** Injected SQL connection — shared with `store.sql` at boot (vector only). */
   readonly sql?: SqlConnection;
+  /** Meilisearch API / master key. */
+  readonly apiKey?: string;
+  /** Injected fetch (tests). */
+  readonly fetch?: typeof fetch;
 }
 
-/** Index driver factory. */
-export interface IndexDriver {
+/** Vector index driver factory. */
+export interface VectorIndexDriver {
   readonly id: "memory" | "pgvector" | "libsql";
   readonly facet: "index";
   /**
-   * Open an index.
+   * Open a vector index.
    *
    * @param options - Name / dims / SQL
    */
-  open(options: IndexOpenOptions): Promise<IndexStore>;
+  open(options: IndexOpenOptions): Promise<VectorIndexStore>;
+}
+
+/** Full-text index driver factory. */
+export interface TextIndexDriver {
+  readonly id: "meilisearch";
+  readonly facet: "index";
+  /**
+   * Open a full-text index.
+   *
+   * @param options - Name / HTTP URL / apiKey
+   */
+  open(options: IndexOpenOptions): Promise<TextIndexStore>;
+}
+
+/** Index driver factory — discriminated by `id`. */
+export type IndexDriver = VectorIndexDriver | TextIndexDriver;
+
+/** True when the index driver shares the sql facet's engine (never memory). */
+export function indexDriverNeedsSql(
+  driver: IndexDriver,
+): driver is VectorIndexDriver & { id: "pgvector" | "libsql" } {
+  return driver.id === "pgvector" || driver.id === "libsql";
 }
 
 /** Union of all store drivers. */

package/src/drivers/vault-driver-removal.test.ts

@@ -12,6 +12,8 @@ const ROOT = join(import.meta.dir, "../..");
 
 /** Forbidden driver id, split so this file does not match itself. */
 const FORBIDDEN_DRIVER = ["so", "ps"].join("");
+/** Forbidden vault driver id, split so this file does not match itself. */
+const FORBIDDEN_SECRETS_SAAS = ["infi", "sical"].join("");
 /** Forbidden optional peer, split so this file does not match itself. */
 const FORBIDDEN_AGE = ["age", "-", "encryption"].join("");
 
@@ -49,6 +51,10 @@ describe("removed vault driver gate", () => {
     assertZeroGitGrep(FORBIDDEN_DRIVER);
   });
 
+  test("tracked tree has zero matches for the removed secrets-saas driver id", () => {
+    assertZeroGitGrep(FORBIDDEN_SECRETS_SAAS, ["changelog.md:"]);
+  });
+
   test("tracked tree has zero matches for the removed age peer outside lockfiles", () => {
     assertZeroGitGrep(FORBIDDEN_AGE, LOCKFILE_PREFIXES);
   });

package/src/drivers/vault-types.ts

@@ -1,12 +1,12 @@
 /**
  * Protocol-named vault driver contracts.
  *
- * Driver ids: `env` · `openbao` · `infisical` · `managed` · `memory`.
- * Never vendor names (`neon`, `infisical-cloud`, …) — vendor choice lives in `images`.
+ * Driver ids: `env` · `openbao` · `managed` · `memory`.
+ * Never vendor names (`neon`, …) — vendor choice lives in `images`.
  */
 
 /** Protocol ids for vault drivers. */
-export type VaultDriverId = "env" | "openbao" | "infisical" | "managed" | "memory";
+export type VaultDriverId = "env" | "openbao" | "managed" | "memory";
 
 /** Options when opening a vault backend. */
 export interface VaultOpenOptions {
@@ -16,7 +16,7 @@ export interface VaultOpenOptions {
   readonly envPrefix?: string;
   /** Injected env map for tests (defaults to `process.env`). */
   readonly env?: Readonly<Record<string, string | undefined>>;
-  /** OpenBao / Infisical / managed base URL. */
+  /** OpenBao / managed base URL. */
   readonly url?: string;
   /** Token / API key for remote vaults. */
   readonly token?: string;

package/src/elements/ai/runtime.ts

@@ -485,6 +485,12 @@ export function createAiRuntime(options: CreateAiRuntimeOptions = {}): AiRuntime
       if (!index) {
         throw new Error(`ai: index "${decl.into}" not registered`);
       }
+      if (index.driverId === "meilisearch") {
+        throw new Error(
+          `ai: embed into "${decl.into}" needs a vector index (memory/pgvector/libsql) — ` +
+            `"${index.driverId}" is full-text; embeddings don't apply`,
+        );
+      }
       const modelName = decl.model ?? [...models.keys()][0] ?? "mock";
       const client = await clientFor(modelName);
       if (!client.embed) {

package/src/elements/ai.test.ts

@@ -263,6 +263,28 @@ describe("embeddings into store.index", () => {
     const hits = await index.search((await client.embed!({ input: "hello world" })).vectors[0]!, 1);
     expect(hits[0]?.id).toBe("doc-1");
   });
+
+  test("embed into a meilisearch (full-text) index fails loud", async () => {
+    const smart = ai.model("smart", { provider: "mock" });
+    const embed = ai.embed("docs", { model: smart, into: "kb" });
+    const client = await mockAiDriver.open({ model: "mock" });
+    const textIndex = {
+      driverId: "meilisearch" as const,
+      upsert: async () => {},
+      search: async () => ({ hits: [] }),
+      delete: async () => true,
+      close: async () => {},
+    };
+    const runtime = createAiRuntime({
+      models: [smart],
+      embeds: [embed],
+      clients: { smart: client },
+      indexes: { kb: textIndex as never },
+    });
+    await expect(runtime.embed("docs", "doc-1", "hello world")).rejects.toThrow(
+      /needs a vector index/,
+    );
+  });
 });
 
 describe("model fallback chain", () => {

package/src/elements/gate/boot.ts

@@ -0,0 +1,136 @@
+/**
+ * Gate boot audit — every HTTP trigger must declare auth posture.
+ *
+ * Fail loud: missing gate and missing {@link gate.public} → {@link GateBootError}.
+ * `unguardedHttp: "allow"` is honoured **only** when `env === "test"` — never a
+ * production-wide bypass. Migrate real apps with per-trigger `gate.public`.
+ */
+
+import { GATE_PUBLIC_NAME } from "./declare.ts";
+
+/** One HTTP flow missing declared auth posture. */
+export interface GatePostureGap {
+  /** Flow id (`unit.name` or flow name). */
+  readonly flowId: string;
+  /** HTTP method. */
+  readonly method: string;
+  /** HTTP path template. */
+  readonly path: string;
+}
+
+/**
+ * Thrown when HTTP triggers omit both a gate chain and {@link gate.public}.
+ * Lists every gap (Vault-style — fail once with the full set).
+ */
+export class GateBootError extends Error {
+  readonly gaps: readonly GatePostureGap[];
+
+  constructor(gaps: readonly GatePostureGap[]) {
+    const lines = gaps.map((g) => `  - ${g.flowId} ${g.method} ${g.path}`);
+    super(
+      `gate boot failed — ${gaps.length} HTTP trigger(s) missing auth posture (attach a gate or gate.public):\n${lines.join("\n")}`,
+    );
+    this.name = "GateBootError";
+    this.gaps = gaps;
+  }
+}
+
+/** Minimal HTTP trigger shape for posture audit. */
+export interface HttpTriggerPosture {
+  readonly kind: "http";
+  readonly method: string;
+  readonly path: string;
+  readonly gates: readonly (string | { readonly name: string })[];
+}
+
+/** Binding shape consumed by the audit. */
+export interface BindingPosture {
+  readonly trigger: { readonly kind: string } & Omit<Partial<HttpTriggerPosture>, "kind">;
+  readonly flow: { readonly name: string };
+}
+
+/** Options for {@link assertHttpGatePosture}. */
+export interface AssertHttpGatePostureOptions {
+  /**
+   * `"allow"` skips the audit **only** when {@link env} is `"test"`.
+   * Outside test, `"allow"` has no effect — enforcement still runs.
+   */
+  readonly unguardedHttp?: "deny" | "allow";
+  /**
+   * Boot environment. Hard-coded gate: `"allow"` is ignored unless this is
+   * `"test"` (not developer-overridable beyond the env value itself).
+   */
+  readonly env?: string;
+}
+
+/**
+ * Whether a gate ref is the public sentinel.
+ *
+ * @param ref - Gate name or named handle
+ */
+export function isPublicGateRef(ref: string | { readonly name: string }): boolean {
+  return (typeof ref === "string" ? ref : ref.name) === GATE_PUBLIC_NAME;
+}
+
+/**
+ * Whether an HTTP trigger has declared auth posture (any gate or public).
+ *
+ * @param gates - Trigger gate chain
+ */
+export function hasHttpGatePosture(
+  gates: readonly (string | { readonly name: string })[],
+): boolean {
+  return gates.length > 0;
+}
+
+/**
+ * Collect HTTP triggers with neither a gate nor {@link gate.public}.
+ *
+ * @param bindings - Adopted / registered bindings
+ */
+export function collectUnguardedHttpGaps(bindings: readonly BindingPosture[]): GatePostureGap[] {
+  const gaps: GatePostureGap[] = [];
+  for (const b of bindings) {
+    if (b.trigger.kind !== "http") continue;
+    const t = b.trigger as HttpTriggerPosture;
+    if (hasHttpGatePosture(t.gates)) continue;
+    gaps.push({
+      flowId: b.flow.name,
+      method: t.method,
+      path: t.path,
+    });
+  }
+  return gaps;
+}
+
+/**
+ * Whether `unguardedHttp: "allow"` may skip the audit for this boot.
+ * Hard-coded: only `env === "test"`.
+ *
+ * @param unguardedHttp - Requested opt-out
+ * @param env - Boot environment
+ */
+export function unguardedHttpAllowActive(
+  unguardedHttp: "deny" | "allow" | undefined,
+  env: string | undefined,
+): boolean {
+  return unguardedHttp === "allow" && env === "test";
+}
+
+/**
+ * Assert every HTTP trigger declares auth posture. Throws {@link GateBootError}.
+ *
+ * @param bindings - Adopted / registered bindings
+ * @param options - Opt-out + env (allow only in test)
+ */
+export function assertHttpGatePosture(
+  bindings: readonly BindingPosture[],
+  options: AssertHttpGatePostureOptions | "deny" | "allow" = "deny",
+): void {
+  // Back-compat: second arg was previously just `"deny" | "allow"`.
+  const opts: AssertHttpGatePostureOptions =
+    typeof options === "string" ? { unguardedHttp: options } : options;
+  if (unguardedHttpAllowActive(opts.unguardedHttp, opts.env)) return;
+  const gaps = collectUnguardedHttpGaps(bindings);
+  if (gaps.length > 0) throw new GateBootError(gaps);
+}