workspaces 0.1.0

data/lib/workspaces/config.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require 'pathname'
+require 'uri'
+require_relative 'paths'
+
+module Workspaces
+  module Config
+    extend Paths
+
+    SAFE_LOG_BYTES = 8 * 1024
+    SAFE_LOG_LINES = 100
+    DEFAULT_HOME = File.expand_path('~/.workspaces')
+    DEFAULT_SUBDOMAIN_PREFIX = 'ws-'
+    DEFAULT_FRONT_DOOR_PORT = 4747
+    BACKEND_PORT_RANGE = (30_000..30_999)
+
+    def self.front_door_port
+      Integer(ENV.fetch('WORKSPACES_PORT', DEFAULT_FRONT_DOOR_PORT))
+    end
+
+    def self.front_door_host
+      public_uri.authority
+    end
+
+    def self.bind_address
+      ENV.fetch('WORKSPACES_BIND', '127.0.0.1')
+    end
+
+    def self.public_origin
+      uri = public_uri
+      "#{uri.scheme}://#{uri.authority}"
+    end
+
+    def self.public_uri
+      value = ENV.fetch('WORKSPACES_PUBLIC_ORIGIN', "http://localhost:#{front_door_port}")
+      uri = URI.parse(value)
+      unless valid_origin?(uri)
+        raise ArgumentError,
+              'WORKSPACES_PUBLIC_ORIGIN must be an HTTP(S) origin without credentials or a path'
+      end
+
+      uri
+    rescue URI::InvalidURIError
+      raise ArgumentError, 'Invalid WORKSPACES_PUBLIC_ORIGIN'
+    end
+
+    def self.valid_origin?(uri)
+      uri.is_a?(URI::HTTP) && uri.host && ['', '/'].include?(uri.path) &&
+        [uri.userinfo, uri.query, uri.fragment].all?(&:nil?)
+    end
+
+    def self.preview_base_domain
+      domain = ENV.fetch('WORKSPACES_BASE_DOMAIN', 'localhost').downcase
+      labels = domain.split('.', -1)
+      valid = domain.length <= 253 && labels.all? do |label|
+        label.length <= 63 && label.match?(/\A[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\z/)
+      end
+      raise ArgumentError, 'Invalid WORKSPACES_BASE_DOMAIN' unless valid
+
+      domain
+    end
+
+    def self.preview_subdomain_prefix
+      prefix = ENV.fetch('WORKSPACES_SUBDOMAIN_PREFIX', DEFAULT_SUBDOMAIN_PREFIX)
+      validate_preview_subdomain_prefix!(prefix)
+      prefix
+    end
+
+    def self.preview_host(workspace_id)
+      validate_id!(workspace_id)
+      hostname = "#{preview_subdomain_prefix}#{workspace_id}.#{preview_base_domain}"
+      raise ArgumentError, 'Workspace hostname exceeds DNS label limits' if hostname.split('.').any? do |label|
+        label.length > 63
+      end
+      uri = public_uri
+      uri.port == uri.default_port ? hostname : "#{hostname}:#{uri.port}"
+    end
+
+    def self.preview_url(workspace_id)
+      "#{public_uri.scheme}://#{preview_host(workspace_id)}/"
+    end
+
+    def self.preview_workspace_id(host)
+      pattern = "#{Regexp.escape(preview_subdomain_prefix)}(?<workspace_id>[a-z0-9]+(?:-[a-z0-9]+)*)\\." \
+                "#{Regexp.escape(preview_base_domain)}"
+      match = /\A#{pattern}\z/i.match(host.to_s)
+      match && match[:workspace_id].downcase
+    end
+
+    def self.validate_id!(id)
+      return id if id.is_a?(String) && id.length <= 48 && id.match?(/\A[a-z0-9]+(?:-[a-z0-9]+)*\z/)
+
+      raise ArgumentError, 'Invalid workspace ID'
+    end
+
+    def self.dashboard_url(id)
+      "#{public_origin}/workspaces/#{validate_id!(id)}"
+    end
+
+    def self.validate_preview_subdomain_prefix!(prefix)
+      parts = prefix.to_s.split('.', -1)
+      raise ArgumentError, 'WORKSPACES_SUBDOMAIN_PREFIX must not be empty' if parts.empty? || parts.any?(&:empty?)
+
+      parts[0...-1].each do |part|
+        next if part.match?(/\A[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\z/)
+
+        raise ArgumentError, "Unsafe WORKSPACES_SUBDOMAIN_PREFIX: #{prefix.inspect}"
+      end
+
+      return prefix if parts.last.match?(/\A[a-z0-9](?:[a-z0-9-]*[a-z0-9-])?\z/)
+
+      raise ArgumentError, "Unsafe WORKSPACES_SUBDOMAIN_PREFIX: #{prefix.inspect}"
+    end
+  end
+end

data/lib/workspaces/coordinator.rb

@@ -0,0 +1,203 @@
+require 'time'
+require_relative 'registry'
+require_relative 'backend'
+require_relative 'workflow'
+require_relative 'tee_log'
+require_relative 'presentation'
+require_relative 'environment_overrides'
+
+module Workspaces
+  class Coordinator
+    ACTIVE = %w(preparing).freeze
+    attr_reader :workers, :workers_mutex
+
+    def initialize(registry: Registry.new, state: StateStore.new(Config.state_file))
+      @registry = registry
+      @state = state
+      @workers = {}
+      @workers_mutex = Mutex.new
+    end
+
+    def start(id, force: false)
+      launch(id, restart: false, force: force)
+    end
+
+    def restart(id)
+      launch(id, restart: true, force: true)
+    end
+
+    def update_environment(id, set:, remove:)
+      restart = Backend.new(id).running?
+      launch(id, restart: restart, force: true,
+                 prelaunch: lambda { |_workspace|
+                   Recipe.new
+                   EnvironmentOverrides.new(id).apply_patch(set: set, remove: remove)
+                 })
+    end
+
+    def wait(id)
+      workers_mutex.synchronize { workers[id] }&.value
+      snapshot(id)
+    end
+
+    def snapshot(id, log: 'setup', include_log: true)
+      raise ArgumentError, 'Unknown workspace log' unless %w(setup backend).include?(log)
+
+      workspace = @registry.find(id)
+      entry = @state.get(id) || {}
+      busy = locked?(id)
+      status = resolve_status(id, entry.fetch('status', 'idle'), busy)
+      data = workspace.describe.merge(snapshot_fields(id, entry, busy, status, log, include_log))
+      data.merge('presentation' => Presentation.new(data).to_h)
+    end
+
+
+    private
+
+    def resolve_status(id, status, busy)
+      return busy ? status : 'interrupted' if ACTIVE.include?(status)
+      return status if status == 'error'
+      return 'ready' if Backend.new(id).running?
+
+      status == 'ready' ? 'stopped' : status
+    end
+
+    def snapshot_fields(id, entry, busy, status, log, include_log)
+      {
+        'workspace_id' => id, 'status' => status, 'active' => busy,
+        'message' => status == entry['status'] ? entry['message'] : status.capitalize,
+        'prepare_started_at' => entry['prepare_started_at'], 'updated_at' => entry['updated_at'],
+        'completed_at' => entry['completed_at'], 'last_error' => entry['last_error'],
+        'operation' => entry['operation'], 'failed_phase' => failure_phase(entry, status),
+        'steps' => entry.fetch('steps', []),
+        'log_tail' => include_log ? log_tail(id, log) : '', 'log_source' => log, 'port' => entry['port'],
+        'environment_keys' => environment_keys(id)
+      }
+    end
+
+    def failure_phase(entry, status)
+      status == 'interrupted' ? entry['status'] : entry['failed_phase']
+    end
+
+    def launch(id, restart:, force:, prelaunch: nil)
+      workspace = @registry.find(id)
+      lock = acquire_lock(id)
+      return false unless lock
+
+      return false if backend_already_running?(id, force, lock)
+      prelaunch&.call(workspace)
+      publish_starting(id, restart)
+      spawn_worker(workspace, restart, lock)
+      true
+    rescue StandardError
+      lock&.close unless lock&.closed?
+      raise
+    end
+
+    def backend_already_running?(id, force, lock)
+      return false if force || !Backend.new(id).running?
+
+      lock.close
+      true
+    end
+
+    def acquire_lock(id)
+      Config.locks_dir.mkpath
+      # The worker owns this duplicate; closing the request's descriptor must not release its lock.
+      File.open(Config.prepare_lock_path(id), File::RDWR | File::CREAT, 0o600) do |file|
+        file.dup if file.flock(File::LOCK_EX | File::LOCK_NB)
+      end
+    end
+
+    def publish_starting(id, restart)
+      recipe = Recipe.new
+      steps = recipe.for_operation(restart: restart).map do |step|
+        { 'key' => step['id'], 'label' => step['name'], 'state' => 'pending' }
+      end
+      update(id, 'status' => 'preparing', 'message' => restart ? 'Restarting application' : 'Preparing workspace',
+                 'steps' => steps,
+                 'operation' => restart ? 'restart' : 'prepare', 'failed_phase' => nil,
+                 'prepare_started_at' => now, 'completed_at' => nil, 'last_error' => nil)
+    end
+
+    def spawn_worker(workspace, restart, lock)
+      id = workspace.id
+      workers_mutex.synchronize do
+        workers[id] = Thread.new do
+          run(workspace, restart: restart)
+        ensure
+          lock.close
+          workers_mutex.synchronize { workers.delete(id) }
+        end
+      end
+    end
+
+    def run(workspace, restart:)
+      id = workspace.id
+      File.open(Config.setup_log_path(id), 'a') do |file|
+        file.sync = true
+        log = TeeLog.new(id, file)
+        log.puts "==> #{restart ? 'restarting' : 'preparing'} workspace #{id}; branch and working files unchanged"
+        prepare_and_boot(workspace, log, restart)
+      end
+    rescue StandardError => e
+      publish_error(id, e)
+    end
+
+    def prepare_and_boot(workspace, log, restart)
+      id = workspace.id
+      port = Workflow.new(workspace, log, state: @state).run!(restart: restart)
+      update(id, 'status' => 'ready', 'message' => 'Workspace ready', 'completed_at' => now, 'port' => port)
+    end
+
+    def publish_error(id, exception)
+      detail = scrub("#{exception.class}: #{exception.message}", id: id)
+      $stdout.puts "[Workspace #{id}] ERROR: #{detail}"
+      File.open(Config.setup_log_path(id), 'a') { |file| file.puts "ERROR: #{detail}" }
+      update(id, 'status' => 'error', 'message' => 'Workspace preparation failed', 'last_error' => detail,
+                 'failed_phase' => @state.get(id)&.fetch('status', nil), 'completed_at' => now)
+    end
+
+    def locked?(id)
+      path = Config.prepare_lock_path(id)
+      return false unless path.file?
+
+      File.open(path, File::RDWR) { |lock| !lock.flock(File::LOCK_EX | File::LOCK_NB) }
+    end
+
+    def log_tail(id, log)
+      path = log == 'backend' ? Config.backend_log_path(id, create: false) : Config.setup_log_path(id, create: false)
+      return '' unless path.file?
+
+      raw = File.open(path, 'rb') do |file|
+        file.seek(-Config::SAFE_LOG_BYTES, IO::SEEK_END) if file.size > Config::SAFE_LOG_BYTES
+        file.read
+      end
+      scrub(raw, id: id).lines.last(Config::SAFE_LOG_LINES).join
+    end
+
+    def scrub(value, id:)
+      scrubbed = value.to_s
+      scrubbed = EnvironmentOverrides.new(id).scrub(scrubbed)
+      scrubbed.encode('UTF-8', invalid: :replace, undef: :replace)
+        .gsub(%r{\e\[[0-9;?]*[ -/]*[@-~]}, '')
+        .gsub(/((?:api[_-]?key|token|secret|password|authorization)[^\n:=]{0,40}[:=]\s*)[^\s"',;]+/i, '\1[FILTERED]')
+        .gsub(/(Bearer\s+)[^\s]+/i, '\1[FILTERED]')
+        .gsub(%r{(https?://[^:\s/]+:)[^@\s]+(@)}i, '\1[FILTERED]\2')
+    end
+
+    def environment_keys(id)
+      EnvironmentOverrides.new(id).keys
+    rescue EnvironmentOverrides::Invalid
+      []
+    end
+
+    def update(id, attributes)
+      @state.set(id, attributes.merge('updated_at' => now))
+    end
+
+    def now
+      Time.now.utc.iso8601
+    end
+  end
+end

data/lib/workspaces/dashboard/app.js

@@ -0,0 +1,132 @@
+(function () {
+  'use strict';
+  const root = document.getElementById('workspace');
+  if (!root) return;
+  const node = (id) => document.getElementById(id);
+  const base = '/workspaces/' + root.dataset.id;
+  const selectedLog = new URLSearchParams(window.location.search).get('log') === 'backend'
+    ? 'backend'
+    : 'setup';
+  const allowedActions = ['start', 'prepare', 'restart', 'stop'];
+  let busy = root.dataset.busy === 'true';
+  let started = Date.parse(root.dataset.started);
+  let completed = Date.parse(root.dataset.completed);
+  let actionsSignature = null;
+  function toggleBusyState(nextBusy) {
+    root.querySelectorAll('.workspace-actions button').forEach((button) => {
+      button.disabled = nextBusy;
+    });
+    if (window.WorkspaceEnvironment)
+      window.WorkspaceEnvironment.toggleBusy(nextBusy);
+  }
+
+  function renderActions(actions) {
+    const signature = JSON.stringify(actions);
+    if (signature === actionsSignature) return;
+    actionsSignature = signature;
+    node('actions').replaceChildren();
+    actions.forEach((action) => {
+      if (!allowedActions.includes(action.key)) return;
+      const form = document.createElement('form');
+      form.method = 'post';
+      form.action = base + '/' + action.key;
+      const button = document.createElement('button');
+      button.className =
+        'button ' + (action.primary ? 'button--primary' : 'button--subtle');
+      button.textContent = action.label;
+      form.append(button);
+      node('actions').append(form);
+    });
+  }
+
+  function renderStep(step) {
+    const item = document.createElement('li');
+    item.className = 'step';
+    item.dataset.stepState = step.state;
+    if (step.state === 'active') item.setAttribute('aria-current', 'step');
+    const bullet = document.createElement('span');
+    bullet.className = 'step-bullet';
+    bullet.setAttribute('aria-hidden', 'true');
+    const label = document.createElement('span');
+    label.textContent = step.label;
+    const outcome = document.createElement('span');
+    outcome.className = 'step-outcome';
+    outcome.textContent = step.state;
+    item.append(bullet, label, outcome);
+    return item;
+  }
+
+  function updateLog(data) {
+    if (data.log_source !== selectedLog) return;
+    const log = node('log');
+    const bottom = log.scrollTop + log.clientHeight >= log.scrollHeight - 18;
+    log.textContent = data.log_tail || '';
+    if (bottom) log.scrollTop = log.scrollHeight;
+    node('updated').textContent = data.updated_at || '';
+  }
+
+  function update(data) {
+    const view = data.presentation;
+    if (!view)
+      throw new Error('Restart the front door to load the updated status API.');
+    busy = view.busy;
+    toggleBusyState(busy);
+    started = Date.parse(data.prepare_started_at);
+    completed = Date.parse(data.completed_at);
+    renderStatus(view);
+    node('message').textContent = data.message || '';
+    node('progress').replaceChildren(...view.steps.map(renderStep));
+    renderActions(view.actions);
+    updateLog(data);
+  }
+
+  function renderStatus(view) {
+    node('status').textContent = view.title;
+    node('activity').hidden = !view.busy;
+    node('preview').hidden = !view.ready;
+    node('error').textContent = view.error || '';
+    node('error-panel').hidden = !view.error;
+    if (window.WorkspaceEnvironment)
+      window.WorkspaceEnvironment.updateStatus(view.busy);
+  }
+
+  async function poll() {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 10000);
+    try {
+      const response = await fetch(base + '/status?log=' + selectedLog, {
+        credentials: 'same-origin',
+        signal: controller.signal
+      });
+      if (!response.ok)
+        throw new Error('Status unavailable. Retrying automatically.');
+      update(await response.json());
+      node('connection').textContent = '';
+    } catch (error) {
+      node('connection').textContent = error.message;
+    } finally {
+      clearTimeout(timeout);
+      setTimeout(poll, busy || selectedLog === 'backend' ? 2000 : 10000);
+    }
+  }
+
+  function tick() {
+    if (Number.isFinite(started)) {
+      const end = busy ? Date.now() : completed;
+      const seconds = Math.max(0, Math.floor((end - started) / 1000));
+      if (Number.isFinite(seconds))
+        node('elapsed').textContent =
+          Math.floor(seconds / 60) + 'm ' + (seconds % 60) + 's';
+    }
+    setTimeout(tick, 1000);
+  }
+
+  root.addEventListener('submit', (event) => {
+    if (event.target.id !== 'environment-form') toggleBusyState(true);
+    node('connection').textContent = 'Submitting…';
+  });
+
+  toggleBusyState(busy);
+  tick();
+  setTimeout(poll, 1000);
+})();

data/lib/workspaces/dashboard/checkout_authentication_error.html.erb

@@ -0,0 +1,22 @@
+<main class="dashboard">
+  <header class="dashboard__header"><h1>GitHub access needs setup</h1><a href="/workspaces">All workspaces</a></header>
+  <section class="error-panel" role="alert">
+    <h2>Checkout couldn't authenticate</h2>
+    <p>The server needs Git credentials to fetch this repository. GitHub CLI access alone may not configure Git.</p>
+  </section>
+  <section class="status-panel" aria-labelledby="fix-heading">
+    <h2 id="fix-heading">Fix on the server</h2>
+    <ol>
+      <li>Open a terminal in the app container, as the user running Workspaces.</li>
+      <li>Check GitHub CLI authentication: <code>gh auth status</code>. If needed, authenticate with <code>gh auth login</code>.</li>
+      <li>Connect Git to those credentials:</li>
+    </ol>
+    <pre><code>gh auth setup-git --hostname github.com</code></pre>
+    <p>For SSH remotes, configure a key authorized for the repository instead. Persist the credential setup in the container configuration.</p>
+    <% if @retry_path %>
+      <form method="post" action="<%= escape(@retry_path) %>"><button class="button button--primary">Retry checkout</button></form>
+    <% else %>
+      <a class="button button--primary" href="/workspaces">Back to workspace creation</a>
+    <% end %>
+  </section>
+</main>

data/lib/workspaces/dashboard/environment.js

@@ -0,0 +1,120 @@
+(function () {
+  'use strict';
+  const form = document.getElementById('environment-form');
+  if (!form) return;
+  const list = form.querySelector('[data-env-add-list]');
+  const addButton = form.querySelector('[data-env-add-row]');
+  const status = document.getElementById('environment-status');
+  const namePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
+  let rowIndex = 0;
+
+  function toggleBusy(nextBusy) {
+    form
+      .querySelectorAll('fieldset, [data-env-submit], [data-env-add-row]')
+      .forEach((control) => {
+        control.disabled = nextBusy;
+      });
+  }
+
+  function updateStatus(busy) {
+    if (busy)
+      status.textContent =
+        'Workspace is busy. Environment updates are temporarily disabled.';
+  }
+
+  function syncReplace(toggle) {
+    const input = toggle
+      .closest('[data-env-existing]')
+      .querySelector('[data-replace-value]');
+    input.disabled = !toggle.checked;
+    if (!toggle.checked) input.value = '';
+  }
+
+  function labelledInput(id, label, type) {
+    const wrap = document.createElement('p');
+    const caption = document.createElement('label');
+    caption.className = 'env-input-label';
+    caption.htmlFor = id;
+    caption.textContent = label;
+    const input = document.createElement('input');
+    input.id = id;
+    input.type = type;
+    input.autocomplete = 'off';
+    wrap.append(caption, input);
+    return [wrap, input];
+  }
+
+  function addVariableRow() {
+    const row = document.createElement('li');
+    row.className = 'env-add-item';
+    row.dataset.envAddRow = String(rowIndex);
+    const [keyWrap, key] = labelledInput(
+      'env-add-key-' + rowIndex,
+      'Variable name',
+      'text'
+    );
+    key.spellcheck = false;
+    key.dataset.envNewName = 'true';
+    key.pattern = '[A-Za-z_][A-Za-z0-9_]*';
+    key.title =
+      'Use letters, numbers, and underscores; must not start with a number.';
+    const [valueWrap, value] = labelledInput(
+      'env-add-value-' + rowIndex,
+      'Value',
+      'password'
+    );
+    value.dataset.envNewValue = 'true';
+    rowIndex += 1;
+    const fields = document.createElement('div');
+    fields.className = 'env-add-grid';
+    fields.append(keyWrap, valueWrap);
+    const actions = document.createElement('div');
+    actions.className = 'env-row-actions';
+    const remove = document.createElement('button');
+    remove.type = 'button';
+    remove.className = 'button button--subtle button--icon';
+    remove.textContent = 'Remove';
+    remove.setAttribute('aria-label', 'Remove variable row');
+    remove.addEventListener('click', () => row.remove());
+    actions.append(remove);
+    row.append(fields, actions);
+    list.append(row);
+    key.focus();
+  }
+
+  function appendSetValue(row) {
+    const key = row.querySelector('[data-env-new-name]').value.trim();
+    const value = row.querySelector('[data-env-new-value]');
+    if (key && namePattern.test(key)) {
+      const hidden = document.createElement('input');
+      hidden.type = 'hidden';
+      hidden.dataset.generatedSet = 'true';
+      hidden.name = 'set[' + key + ']';
+      hidden.value = value.value;
+      form.append(hidden);
+    }
+  }
+
+  function prepareSubmit() {
+    form.querySelectorAll('[data-env-existing]').forEach((row) => {
+      const toggle = row.querySelector('[data-replace-toggle]');
+      if (!toggle.checked) row.querySelector('[data-replace-value]').value = '';
+    });
+    form
+      .querySelectorAll('[data-generated-set]')
+      .forEach((input) => input.remove());
+    form.querySelectorAll('li[data-env-add-row]').forEach(appendSetValue);
+  }
+
+  form.querySelectorAll('[data-replace-toggle]').forEach((toggle) => {
+    toggle.addEventListener('change', () => syncReplace(toggle));
+    syncReplace(toggle);
+  });
+  addButton.addEventListener('click', addVariableRow);
+  form.addEventListener('submit', () => {
+    prepareSubmit();
+    status.textContent = 'Submitting environment overrides…';
+  });
+  window.WorkspaceEnvironment = { toggleBusy, updateStatus };
+  toggleBusy(document.getElementById('workspace').dataset.busy === 'true');
+})();

data/lib/workspaces/dashboard/pull_request.html.erb

@@ -0,0 +1,37 @@
+<main class="dashboard">
+  <header class="dashboard__header">
+    <div><p class="eyebrow">PR preview</p><h1>PR #<%= escape(@number) %></h1></div>
+    <a href="/workspaces" class="button button--subtle">All workspaces</a>
+  </header>
+  <% unless @workspaces.empty? %>
+    <section class="status-panel" aria-labelledby="existing-heading">
+      <h2 id="existing-heading"><%= @workspaces.one? ? 'Continue in your workspace' : 'Choose a workspace' %></h2>
+      <p>Open an existing workspace to view its status, run it, or continue working.</p>
+      <% @workspaces.each do |workspace| %>
+        <article>
+          <h3><%= escape(workspace.fetch('id')) %></h3>
+          <p><%= escape(workspace['branch']) %></p>
+          <a href="/workspaces/<%= escape(workspace.fetch('id')) %>" class="button button--primary" aria-label="Open workspace <%= escape(workspace.fetch('id')) %>">Open workspace</a>
+        </article>
+      <% end %>
+    </section>
+  <% end %>
+  <% if @workspaces.empty? %>
+    <section class="status-panel" aria-labelledby="create-heading">
+      <h2 id="create-heading">Preview this pull request</h2>
+      <p>No workspaces yet for this PR.</p>
+  <% else %>
+    <details class="status-panel">
+      <summary>Create another workspace</summary>
+  <% end %>
+    <p>Create a fresh workspace from the PR's current head and start its server. Existing workspaces and edits stay untouched.</p>
+    <form method="post" action="/pr/<%= escape(@number) %>">
+      <button class="button <%= @workspaces.empty? ? 'button--primary' : 'button--subtle' %>">Create and start workspace</button>
+    </form>
+    <p class="muted">Creation fetches the PR. Repository setup steps continue on the workspace dashboard.</p>
+  <% if @workspaces.empty? %>
+    </section>
+  <% else %>
+    </details>
+  <% end %>
+</main>