@agent-flow-board/bridge 0.0.0-stage → 0.2.0

package/dist/checks/lock.js

@@ -0,0 +1,183 @@
+// FILE LOCKS FOR THE CHECK COMMANDS: A SHORT EXCLUSIVE LOCK (THE AUDIT CHAIN) AND THE ONE-WORKER-PER-MACHINE LOCK OF `check watch`.
+// Two lessons are built in. A lock file that is created empty and written afterwards looks stale to a second process, so the file is written whole into a
+// temporary file and linked into place in one step. A stale lock that is unlinked and then created again lets two contenders in, so a stale lock is RENAMED
+// aside, what was moved is compared with the stale one that was seen, and a fresh lock that was moved by mistake is put back.
+// -- DEP-MODULES -- //
+import { randomBytes } from 'node:crypto';
+import { linkSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+// -- MODULES -- //
+import { assertName, ensureDir, locksDir } from './paths.js';
+// -- CONSTANTS -- //
+/** A lock whose content cannot be read is only treated as stale after this long (it is created whole, so this means a damaged file). */
+const UNREADABLE_GRACE_MS = 2_000;
+/** For a lock that only a dead process may lose, such as the worker lock. */
+export const NEVER_STALE_MS = Number.MAX_SAFE_INTEGER;
+// -- FUNCTIONS -- //
+/** True when a process with this id exists (it may belong to another user, which still counts as alive). */
+export function pidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    }
+}
+const lockPath = (name) => join(locksDir(), `${assertName(name, 'lock name')}.lock`);
+function parseBody(text) {
+    try {
+        const v = JSON.parse(text);
+        if (!v || typeof v !== 'object')
+            return null;
+        const b = v;
+        if (typeof b.pid !== 'number' || typeof b.at !== 'string' || typeof b.token !== 'string')
+            return null;
+        return { pid: b.pid, at: b.at, token: b.token };
+    }
+    catch {
+        return null;
+    }
+}
+function readText(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function isStale(text, file, staleMs) {
+    const body = text === null ? null : parseBody(text);
+    if (body)
+        return !pidAlive(body.pid) || Date.now() - Date.parse(body.at) > staleMs;
+    // Unreadable or damaged: given a moment, then stale
+    try {
+        return Date.now() - statSync(file).mtimeMs > UNREADABLE_GRACE_MS;
+    }
+    catch {
+        return false;
+    }
+}
+/** Creates the lock file with its whole content at once. False when somebody holds it. */
+function tryCreate(file, text) {
+    const tmp = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+    writeFileSync(tmp, text, { mode: 0o600 });
+    try {
+        linkSync(tmp, file);
+        return true;
+    }
+    catch (e) {
+        if (e.code === 'EEXIST')
+            return false;
+        throw e;
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+}
+/**
+ * Moves the lock file aside under a name of its own. Returns what was moved, or null when somebody else moved it first. When what was moved is not
+ * `expected` (somebody made a new lock between the look and the move), it is linked back.
+ */
+function moveAside(file, expected, keep) {
+    const aside = `${file}.aside.${process.pid}.${randomBytes(4).toString('hex')}`;
+    try {
+        renameSync(file, aside);
+    }
+    catch {
+        return null;
+    }
+    const moved = readText(aside);
+    if (moved !== null && moved !== expected && keep(moved)) {
+        try {
+            linkSync(aside, file);
+        }
+        catch {
+            /* A newer lock is already there: the one that was moved is dropped */
+        }
+    }
+    rmSync(aside, { force: true });
+    return moved ?? '';
+}
+/**
+ * Takes the lock `name` without waiting. Returns null when a live holder has it. A lock whose process is gone, or that is older than `staleMs`,
+ * is taken over.
+ */
+export function acquireLock(name, { staleMs }) {
+    const file = lockPath(name);
+    ensureDir(locksDir());
+    const token = randomBytes(8).toString('hex');
+    const mine = JSON.stringify({ pid: process.pid, at: new Date().toISOString(), token }) +
+        '\n';
+    for (let attempt = 0; attempt < 6; attempt++) {
+        if (tryCreate(file, mine))
+            return makeLock(file, token);
+        const held = readText(file);
+        if (held === null && !statExists(file))
+            continue; // Released between the two looks
+        if (!isStale(held, file, staleMs))
+            return null;
+        // Stale: moved aside in one step, so of two contenders only one moves it. A fresh lock that was moved by mistake goes back
+        moveAside(file, held, (moved) => !isStale(moved, file, staleMs));
+    }
+    return null;
+}
+const statExists = (file) => {
+    try {
+        statSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+function makeLock(file, token) {
+    let released = false;
+    return {
+        file,
+        release() {
+            if (released)
+                return;
+            released = true;
+            // Moved aside first, so a lock that was taken over from us in the meantime is never removed by mistake
+            const text = readText(file);
+            if (text === null || parseBody(text)?.token !== token)
+                return;
+            moveAside(file, text, () => true);
+        }
+    };
+}
+const nap = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+/** Runs `fn` while holding the lock, waiting up to `waitMs` for another holder. Throws one plain sentence when it could not get the lock. */
+export function withLockSync(name, fn, { staleMs = 15_000, waitMs = 20_000 } = {}) {
+    const until = Date.now() + waitMs;
+    let lock = acquireLock(name, { staleMs });
+    while (!lock) {
+        if (Date.now() > until)
+            throw new Error(`Another process kept the "${name}" lock for more than ${Math.round(waitMs / 1000)} seconds.`);
+        nap(15);
+        lock = acquireLock(name, { staleMs });
+    }
+    try {
+        return fn();
+    }
+    finally {
+        lock.release();
+    }
+}
+/** The process id that holds a lock, or null when nobody does. For the plain sentence of a refused second worker. */
+export function lockHolderPid(name) {
+    const text = readText(lockPath(name));
+    const body = text === null ? null : parseBody(text);
+    return body && pidAlive(body.pid) ? body.pid : null;
+}
+/**
+ * The one-worker-per-machine lock of `check watch`. Only a dead process loses it (the work inside runs for hours), so the stale age is never reached.
+ * Returns null when another worker holds it; the caller says so in one plain line.
+ */
+export function machineLock(name) {
+    return acquireLock(`machine-${name}`, { staleMs: NEVER_STALE_MS });
+}

package/dist/checks/paths.js

@@ -0,0 +1,61 @@
+// WHERE THE CHECK COMMANDS KEEP THEIR STATE: ONE FOLDER UNDER THE BRIDGE HOME, NEVER INSIDE A REPO
+// The bridge home also holds the token store (key and token files). Nothing here ever names those, and the sandboxed child of a check is
+// given read access to the scripts folder, its own run folder and the Playwright runtime only (see sandbox.ts).
+// -- DEP-MODULES -- //
+import { mkdirSync, realpathSync } from 'node:fs';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+// -- MODULES -- //
+import { configDir } from '../tokenStore.js';
+// -- CONSTANTS -- //
+/** The version of the conversation between the board and the check tool. The board refuses a tool older than its minimum. */
+export const TOOL_PROTOCOL = 2;
+/** Item references and check keys: letters, digits, dash and underscore only, so a name can never leave its folder. */
+export const NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** An organisation slug as the app writes it. */
+export const ORG_SLUG = /^[a-z0-9][a-z0-9-]{1,38}$/;
+// -- FUNCTIONS -- //
+/** The folder of all check state. AFB_BRIDGE_HOME moves it, which is how the tests get a throwaway one. */
+export const checksHome = () => join(configDir(), 'checks');
+/** Check scripts: scripts/<org>/<item>/<key>.mjs. Written by the agent, never fetched and run from the board. */
+export const scriptsDir = () => join(checksHome(), 'scripts');
+/** One folder per run, named by the run id. */
+export const runsDir = () => join(checksHome(), 'runs');
+export const locksDir = () => join(checksHome(), 'locks');
+export const auditFile = () => join(checksHome(), 'audit.log');
+export const bindingsFile = () => join(checksHome(), 'bindings.json');
+/** Private copies of repos, one per run, kept so a crashed run can be swept. */
+export const copiesDir = () => join(checksHome(), 'copies');
+export function ensureDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    return dir;
+}
+/** Refuses a name that is not a plain name (a path separator, a dot dot, an empty string). */
+export function assertName(value, what) {
+    if (!NAME.test(value))
+        throw new Error(`${what} "${value.slice(0, 40)}" is not a plain name (letters, digits, dash, underscore).`);
+    return value;
+}
+/** Joins parts below a base and proves the result stays below it. Throws when it does not. */
+export function under(base, ...parts) {
+    const full = resolve(base, ...parts);
+    const rel = relative(resolve(base), full);
+    if (rel === '' || rel.startsWith('..') || isAbsolute(rel))
+        throw new Error('That path leaves its folder.');
+    return full;
+}
+/** The path of a check script. */
+export function scriptPath(org, item, key) {
+    if (!ORG_SLUG.test(org))
+        throw new Error('The organisation is not a slug.');
+    return under(scriptsDir(), org, assertName(item, 'item reference'), `${assertName(key, 'check key')}.mjs`);
+}
+/** True when `child` is `parent` or inside it, compared by real path so a link cannot step outside. */
+export function isInside(parent, child) {
+    try {
+        const rel = relative(realpathSync(parent), realpathSync(child));
+        return (rel === '' || (!rel.startsWith('..') && !isAbsolute(rel) && !rel.split(sep).includes('..')));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/checks/preview.js

@@ -0,0 +1,350 @@
+// THE PREVIEW OF ONE RUN: A PRIVATE COPY OF THE REPO, BUILT AND SERVED FROM ITS OWN FOLDER ON A FREE PORT, WITH AN ENVIRONMENT THE TOOL BUILT (envPolicy.ts).
+// A run builds and serves from its own copy so it can never take down the preview a person is looking at, and two runs never share a folder. The copy is
+// made from the files git lists (tracked, and untracked that are not ignored), never from .git; env files are not copied, they are read from the source repo.
+// A dependency cache was left out on purpose: a fresh install per run is slower but cannot serve a stale module to a run.
+// -- DEP-MODULES -- //
+import { execFile, spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { closeSync, copyFileSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+// -- MODULES -- //
+import { buildPreviewEnv } from './envPolicy.js';
+import { FORBIDDEN_PORTS } from './guardrails.js';
+import { copiesDir, ensureDir, runsDir, under } from './paths.js';
+import { freePort, makeThrowawayDatabase } from './provision.js';
+import { killTree, removeTree } from './scope.js';
+// -- CONSTANTS -- //
+/** A file bigger than this is not copied (a build output, a dump, a video). */
+const MAX_COPY_BYTES = 5 * 1024 * 1024;
+const BUILD_TIMEOUT_MS = 10 * 60_000;
+const READY_TIMEOUT_MS = 120_000;
+/** Env files are read from the source repo by envPolicy, never copied. An example file holds no secrets and is copied. */
+const ENV_FILE = /(^|\/)\.env(\.[^/]*)?$/i;
+const ENV_EXAMPLE = /\.(example|sample|template)$/i;
+// -- FUNCTIONS -- //
+/** Runs git with an argument list and no shell. Resolves with the exit status; never throws. */
+function git(cwd, args) {
+    return new Promise((resolve) => {
+        execFile('git', args, {
+            cwd,
+            windowsHide: true,
+            encoding: 'buffer',
+            maxBuffer: 256 * 1024 * 1024,
+            timeout: 120_000
+        }, (err, stdout) => {
+            const code = err
+                ? typeof err.code === 'number'
+                    ? err.code
+                    : -1
+                : 0;
+            resolve({ status: code, stdout: stdout });
+        });
+    });
+}
+/** The tracked and the untracked-not-ignored files of a repo, as paths relative to it. Null when the folder is not a git repo. */
+async function listFiles(repo) {
+    const r = await git(repo, ['ls-files', '--cached', '--others', '--exclude-standard', '-z']);
+    if (r.status !== 0)
+        return null;
+    return [...new Set(r.stdout.toString('utf8').split('\0').filter(Boolean))];
+}
+/**
+ * Copies the listed files of `repo` into `dest`. A link anywhere in the repo's files (the file itself or a folder above it) is refused by name,
+ * because a copy that follows a link could carry files from outside the repo into the build.
+ */
+export async function makePrivateCopy(repo, dest, log = () => { }) {
+    const files = await listFiles(repo);
+    if (!files)
+        throw new Error('The project folder is not a git repository, so the tool cannot tell which files belong to it.');
+    const checkedDirs = new Set();
+    let copied = 0;
+    let skipped = 0;
+    mkdirSync(dest, { recursive: true, mode: 0o700 });
+    for (const rel of files) {
+        const parts = rel.split('/');
+        if (parts[0] === '.git' || parts.includes('..'))
+            throw new Error(`The file "${rel.slice(0, 80)}" is not a file the tool copies.`);
+        // Every folder above the file must be a real folder
+        for (let i = 1; i < parts.length; i++) {
+            const folder = parts.slice(0, i).join('/');
+            if (checkedDirs.has(folder))
+                continue;
+            let st;
+            try {
+                st = lstatSync(join(repo, folder));
+            }
+            catch {
+                break;
+            }
+            if (st.isSymbolicLink())
+                throw new Error(`"${folder.slice(0, 80)}" is a link. A check does not copy links; remove it or ignore it in git.`);
+            checkedDirs.add(folder);
+        }
+        const from = join(repo, ...parts);
+        let st;
+        try {
+            st = lstatSync(from);
+        }
+        catch {
+            continue; // Listed by git but deleted in the working tree
+        }
+        if (st.isSymbolicLink())
+            throw new Error(`"${rel.slice(0, 80)}" is a link. A check does not copy links; remove it or ignore it in git.`);
+        if (!st.isFile())
+            continue;
+        if ((ENV_FILE.test(rel) && !ENV_EXAMPLE.test(rel)) || st.size > MAX_COPY_BYTES) {
+            skipped++;
+            continue;
+        }
+        const to = under(dest, ...parts);
+        mkdirSync(dirname(to), { recursive: true, mode: 0o700 });
+        copyFileSync(from, to);
+        copied++;
+    }
+    if (skipped)
+        log(`${skipped} file(s) were not copied (env files and files over 5 MB).`);
+    return { files: copied, skipped };
+}
+/** The commit of HEAD, or null when the folder has no commit. */
+async function headCommit(repo) {
+    const r = await git(repo, ['rev-parse', 'HEAD']);
+    return r.status === 0 ? r.stdout.toString('utf8').trim() || null : null;
+}
+/** A hash over the uncommitted changes (`git diff HEAD`) and the contents of untracked files. Null when the folder is not a git repo. */
+async function hashChanges(repo) {
+    const files = await listFiles(repo);
+    if (!files)
+        return null;
+    const h = createHash('sha256');
+    const diff = await git(repo, ['diff', 'HEAD']);
+    if (diff.status === 0)
+        h.update(diff.stdout);
+    const others = await git(repo, ['ls-files', '--others', '--exclude-standard', '-z']);
+    for (const rel of others.stdout.toString('utf8').split('\0').filter(Boolean).sort()) {
+        try {
+            const full = join(repo, ...rel.split('/'));
+            if (ENV_FILE.test(rel) || !lstatSync(full).isFile())
+                continue;
+            h.update(`\0${rel}\0`);
+            h.update(readFileSync(full));
+        }
+        catch {
+            /* A file that vanished while hashing */
+        }
+    }
+    return h.digest('hex');
+}
+/**
+ * Starts a program from an argument list with no shell. On Windows the package managers are .cmd shims, which a plain spawn cannot find (ENOENT) and
+ * Node refuses to start directly; only then is the shim run through `cmd.exe /d /s /c`. The arguments came from a command that was already checked
+ * (words, flags and a port, no metacharacters), so they are not interpreted by cmd.exe. Resolves once the process exists.
+ */
+export function launch(argv, opts) {
+    const [file, ...args] = argv;
+    if (!file)
+        return Promise.reject(new Error('The command is empty.'));
+    const base = {
+        cwd: opts.cwd,
+        env: opts.env,
+        stdio: ['ignore', opts.out, opts.out],
+        windowsHide: true,
+        shell: false,
+        detached: opts.detached
+    };
+    const attempt = (f, a) => new Promise((resolve, reject) => {
+        const child = spawn(f, a, base);
+        child.once('error', reject);
+        child.once('spawn', () => {
+            child.off('error', reject);
+            resolve(child);
+        });
+    });
+    return attempt(file, args).catch((e) => {
+        if (e.code === 'ENOENT' && process.platform === 'win32' && /^(yarn|npm|pnpm|npx)$/.test(file))
+            return attempt('cmd.exe', ['/d', '/s', '/c', `${file}.cmd`, ...args]);
+        throw e;
+    });
+}
+/** Runs a command to its end and resolves with its exit code (or -1 when it timed out). The output goes to the open file `out`. */
+async function runToEnd(argv, opts) {
+    const child = await launch(argv, { ...opts, detached: false });
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            if (child.pid)
+                void killTree(child.pid).then(() => resolve(-1));
+            else
+                resolve(-1);
+        }, opts.timeoutMs);
+        child.once('exit', (code) => {
+            clearTimeout(timer);
+            resolve(code ?? -1);
+        });
+    });
+}
+const words = (command) => command.split(' ').filter(Boolean);
+/** The install command for the copy, from the lock file it holds, or null when there is no lock file (a frozen install needs one). */
+export function installCommand(dir) {
+    if (!existsSync(join(dir, 'package.json')))
+        return null;
+    if (existsSync(join(dir, 'yarn.lock')))
+        return ['yarn', 'install', '--immutable'];
+    if (existsSync(join(dir, 'pnpm-lock.yaml')))
+        return ['pnpm', 'install', '--frozen-lockfile'];
+    if (existsSync(join(dir, 'package-lock.json')))
+        return ['npm', 'ci'];
+    return null;
+}
+/** The last lines of a log file with every value of the preview environment hidden. */
+export function tailOf(file, secrets, lines = 20) {
+    let text;
+    try {
+        text = readFileSync(file, 'utf8');
+    }
+    catch {
+        return '';
+    }
+    let out = text.split(/\r?\n/).filter(Boolean).slice(-lines).join('\n');
+    for (const s of [...secrets].sort((a, b) => b.length - a.length))
+        if (s.length >= 4)
+            out = out.split(s).join('[hidden]');
+    return out;
+}
+/** Waits until GET url answers with a status below 500. Gives up after `timeoutMs`, or at once when `exited` says the process is gone. */
+export async function waitReady(url, opts) {
+    const until = Date.now() + opts.timeoutMs;
+    while (Date.now() < until) {
+        if (opts.exited())
+            return 'exited';
+        try {
+            const res = await fetch(url, { signal: AbortSignal.timeout(2_000), redirect: 'manual' });
+            await res.body?.cancel();
+            if (res.status < 500)
+                return 'ready';
+        }
+        catch {
+            /* Not listening yet */
+        }
+        await new Promise((r) => setTimeout(r, opts.intervalMs ?? 500));
+    }
+    return opts.exited() ? 'exited' : 'timeout';
+}
+/** Picks a free port on 127.0.0.1 and refuses a forbidden one. */
+export async function pickPort() {
+    const port = await freePort();
+    if (FORBIDDEN_PORTS.has(port))
+        throw new Error(`Port ${port} is not one a check may use.`);
+    return port;
+}
+export async function startPreview(cfg, opts) {
+    const { runId, scope, log } = opts;
+    // -- 1. THE MARKER COMES FIRST -- //
+    scope.start();
+    const runDir = ensureDir(under(runsDir(), runId));
+    const notes = [];
+    const secrets = [];
+    // -- 2. A PRIVATE COPY -- //
+    const copyDir = under(copiesDir(), runId);
+    scope.setInfo({ copyDir });
+    scope.add('private copy', () => removeTree(copyDir));
+    const made = await makePrivateCopy(cfg.repo, copyDir, log);
+    log(`Made a private copy of ${made.files} file(s).`);
+    // -- 3. WHAT WAS TESTED -- //
+    const commit = await headCommit(cfg.repo);
+    const diffHash = await hashChanges(cfg.repo);
+    // -- 4. A FREE PORT -- //
+    const port = await pickPort();
+    const baseUrl = `http://127.0.0.1:${port}`;
+    // -- 5. A THROWAWAY DATABASE, ONLY WHEN THE APP NEEDS ONE -- //
+    let databaseUrl;
+    let ownerUrl;
+    if (cfg.needsDatabase) {
+        const db = await makeThrowawayDatabase(runId, scope, log, { runtimeRole: cfg.runtimeRole });
+        databaseUrl = db.databaseUrl;
+        ownerUrl = db.ownerUrl;
+        secrets.push(db.databaseUrl, db.ownerUrl);
+        notes.push('A throwaway database was made for this run.');
+    }
+    // -- ENVIRONMENT -- //
+    const built = buildPreviewEnv({
+        repo: cfg.repo,
+        recipeEnv: cfg.env,
+        port,
+        baseUrl,
+        databaseUrl,
+        databaseOwnerUrl: ownerUrl
+    });
+    notes.push(...built.notes);
+    const redact = Object.values(built.env).filter((v) => v.length >= 8);
+    if (cfg.testUser)
+        secrets.push(cfg.testUser.password);
+    // -- 6. INSTALL AND BUILD -- //
+    const buildLog = openSync(join(runDir, 'build.log'), 'a');
+    try {
+        const install = installCommand(copyDir);
+        if (install) {
+            log('Installing dependencies in the private copy.');
+            const code = await runToEnd(install, {
+                cwd: copyDir,
+                env: built.env,
+                out: buildLog,
+                timeoutMs: BUILD_TIMEOUT_MS
+            });
+            if (code !== 0)
+                throw new Error(`The install failed (exit ${code}). Last lines:\n${tailOf(join(runDir, 'build.log'), redact)}`);
+        }
+        if (cfg.build) {
+            log('Building the project.');
+            const code = await runToEnd(words(cfg.build), {
+                cwd: copyDir,
+                env: built.env,
+                out: buildLog,
+                timeoutMs: BUILD_TIMEOUT_MS
+            });
+            if (code !== 0)
+                throw new Error(`The build failed (exit ${code}). Last lines:\n${tailOf(join(runDir, 'build.log'), redact)}`);
+        }
+    }
+    finally {
+        closeSync(buildLog);
+    }
+    // -- 7. START -- //
+    const startLog = openSync(join(runDir, 'preview.log'), 'a');
+    let child;
+    try {
+        child = await launch(words(cfg.start.split('{port}').join(String(port))), {
+            cwd: copyDir,
+            env: built.env,
+            out: startLog,
+            detached: process.platform !== 'win32'
+        });
+    }
+    finally {
+        closeSync(startLog);
+    }
+    let exited = false;
+    child.once('exit', () => (exited = true));
+    if (child.pid) {
+        const pid = child.pid;
+        scope.setInfo({ previewPid: pid });
+        scope.add('preview process', () => killTree(pid));
+    }
+    // -- 8. WAIT UNTIL IT ANSWERS -- //
+    const readyUrl = baseUrl + (cfg.ready ?? '/');
+    const state = await waitReady(readyUrl, { timeoutMs: READY_TIMEOUT_MS, exited: () => exited });
+    if (state !== 'ready') {
+        const why = state === 'exited'
+            ? 'The preview stopped before it answered.'
+            : 'The preview did not answer within 120 seconds.';
+        throw new Error(`${why} Last lines:\n${tailOf(join(runDir, 'preview.log'), redact)}`);
+    }
+    log('The preview answers.');
+    // -- 9. RESULT -- //
+    return {
+        baseUrl,
+        commit,
+        diffHash,
+        testUser: cfg.testUser ?? null,
+        secrets,
+        note: notes.join(' ')
+    };
+}