@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/graph/__tests__/query.test.ts

@@ -1,180 +0,0 @@
-import { describe, expect, test } from 'bun:test'
-
-import { prepareQuery } from '../query'
-
-describe('prepareQuery', () => {
-  /** @evidence TEST-CLI-GRAPH-AUTHORS-QUERY-V6 */
-  test('authors the supported Path and exact-edge subset as canonical Query V6', () => {
-    const prepared = prepareQuery({
-      sources: ['/:notes.example.dev:class.Note'],
-      edge: '/:notes.example.dev:class.references',
-      direction: 'incoming',
-      limit: '25',
-      cursor: 'next-page',
-    })
-
-    expect(JSON.parse(JSON.stringify(prepared))).toEqual({
-      ast: {
-        format: 'astrale.graph.query',
-        version: 'v6',
-        source: {
-          kind: 'node',
-          terms: [{ kind: 'path', path: '/:notes.example.dev:class.Note' }],
-          binding: 'n0',
-        },
-        steps: [
-          {
-            op: 'expand',
-            from: 'n0',
-            via: [{ origin: 'notes.example.dev', kind: 'class', name: 'references' }],
-            direction: 'incoming',
-            bindings: { edge: 'e0', node: 'n1' },
-          },
-        ],
-        select: { kind: 'graph', binding: 'n1' },
-      },
-      page: { size: 25, after: 'next-page' },
-    })
-  })
-
-  /** @evidence TEST-CLI-GRAPH-AUTHORS-CLASS-QUERY */
-  test('authors an exact Class source without backend query text', () => {
-    const prepared = prepareQuery({
-      sources: [],
-      class: '/:issues.astrale.ai:class.Issue',
-      limit: '201',
-    })
-
-    expect(JSON.parse(JSON.stringify(prepared.ast))).toEqual({
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source: {
-        kind: 'node',
-        terms: [
-          {
-            kind: 'class',
-            class: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
-          },
-        ],
-        binding: 'n0',
-      },
-      steps: [],
-      select: { kind: 'graph', binding: 'n0' },
-    })
-    expect(prepared.page).toEqual({ size: 201 })
-  })
-
-  test('unions positional Paths and one Class source in authored order', () => {
-    const prepared = prepareQuery({
-      sources: ['@note'],
-      class: '/:issues.astrale.ai:class.Issue',
-    })
-
-    expect(JSON.parse(JSON.stringify(prepared.ast.source))).toEqual({
-      kind: 'node',
-      terms: [
-        { kind: 'path', path: '@note' },
-        {
-          kind: 'class',
-          class: { origin: 'issues.astrale.ai', kind: 'class', name: 'Issue' },
-        },
-      ],
-      binding: 'n0',
-    })
-  })
-
-  /** @evidence TEST-CLI-GRAPH-ADMITS-QUERY-V6-ORDERING */
-  test('admits one exact Property-ordered Query V6 document', () => {
-    const ast = {
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source: {
-        kind: 'node',
-        terms: [
-          {
-            kind: 'class',
-            class: { origin: 'notes.example.dev', kind: 'class', name: 'Note' },
-          },
-        ],
-        binding: 'n0',
-      },
-      steps: [],
-      select: {
-        kind: 'graph',
-        binding: 'n0',
-        order: {
-          property: 'notes.example.dev:class.Note.property.sequence',
-          direction: 'desc',
-          unranked: 'last',
-        },
-      },
-    }
-
-    const prepared = prepareQuery({ sources: [], ast, limit: '3' })
-    expect(JSON.parse(JSON.stringify(prepared.ast))).toEqual(ast)
-    expect(prepared.page).toEqual({ size: 3 })
-  })
-
-  /** @evidence TEST-CLI-GRAPH-ADMITS-QUERY-V6-PROJECTIONS */
-  test('admits exact Node and Edge projection profiles in Query V6 documents', () => {
-    const source = {
-      terms: [{ kind: 'path', path: '/:notes.example.dev:class.Note' }],
-      binding: 'n0',
-      kind: 'node',
-    } as const
-    const node = {
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source,
-      steps: [],
-      select: { kind: 'nodes', binding: 'n0', projection: { kind: 'reference' } },
-    }
-    const edge = {
-      format: 'astrale.graph.query',
-      version: 'v6',
-      source,
-      steps: [
-        {
-          op: 'expand',
-          from: 'n0',
-          via: [{ origin: 'notes.example.dev', kind: 'class', name: 'references' }],
-          direction: 'outgoing',
-          bindings: { edge: 'e0', node: 'n1' },
-        },
-      ],
-      select: {
-        kind: 'edges',
-        binding: 'e0',
-        projection: { edge: 'value', source: 'reference', target: 'value' },
-      },
-    }
-
-    expect(
-      JSON.parse(JSON.stringify(prepareQuery({ sources: [], ast: node, limit: '5' }).ast)),
-    ).toEqual(node)
-    expect(
-      JSON.parse(JSON.stringify(prepareQuery({ sources: [], ast: edge, limit: '5' }).ast)),
-    ).toEqual(edge)
-  })
-
-  /** @evidence TEST-CLI-GRAPH-REJECTS-LEGACY-QUERY */
-  test('rejects V1 queries and unsupported combinations locally', () => {
-    expect(() => prepareQuery({ sources: [], ast: { version: 1, from: ['/'] } })).toThrow()
-    expect(() =>
-      prepareQuery({ sources: ['/:notes.example.dev:class.Note'], direction: 'incident' }),
-    ).toThrow('--direction requires --edge')
-    expect(() =>
-      prepareQuery({ sources: ['/:notes.example.dev:class.Note'], limit: 'all' }),
-    ).toThrow('--limit must be a positive integer')
-    expect(() =>
-      prepareQuery({
-        sources: [],
-        ast: {},
-        class: '/:notes.example.dev:class.Note',
-      }),
-    ).toThrow('--ast/--file cannot be combined with sources, --class, --edge, or --direction')
-    expect(() => prepareQuery({ sources: [], class: '/:notes.example.dev:view.note' })).toThrow(
-      '--class must be one canonical Class Path',
-    )
-  })
-})

package/src/graph/class.ts

@@ -1,30 +0,0 @@
-import type { ClassKey as ClassKeyValue, ClassRef } from '@astrale-os/sdk/graph/class'
-
-import { ClassKey } from '@astrale-os/sdk/graph/class'
-import { Path } from '@astrale-os/sdk/graph/path'
-
-/** Admit one canonical Domain-rooted Class Path into its DSL coordinate. */
-export function classReference(input: string, label: string): ClassRef {
-  const path = Path.parse(input)
-  const step = path.ast.steps[0]
-  if (
-    path.ast.anchor.kind !== 'domain' ||
-    path.ast.steps.length !== 1 ||
-    step?.kind !== 'projection' ||
-    step.projection.kind !== 'class'
-  ) {
-    throw new TypeError(`${label} must be one canonical Class Path`)
-  }
-  return ClassKey.ref(
-    ClassKey.of({
-      origin: path.ast.anchor.origin,
-      kind: 'class',
-      name: step.projection.name,
-    }),
-  )
-}
-
-/** Admit one canonical Domain-rooted Class Path into its exact string identity. */
-export function classKey(input: string, label: string): ClassKeyValue {
-  return ClassKey.of(classReference(input, label))
-}

package/src/graph/index.ts

@@ -1,4 +0,0 @@
-export { classKey, classReference } from './class'
-export { prepareMutation } from './mutation'
-export { nodeProperty, unqualifyProperty } from './projection'
-export { prepareQuery, type PreparedQuery, type QueryCommandInput } from './query'

package/src/graph/mutation.ts

@@ -1,46 +0,0 @@
-import type { MutationAST as MutationASTValue, MutationInput } from '@astrale-os/sdk/mutation'
-
-import { MutationAST } from '@astrale-os/sdk/mutation'
-
-/** Admit the canonical document or Core's exact rich authoring input at the CLI JSON boundary. */
-export function prepareMutation(input: unknown): MutationASTValue {
-  if (isLegacyPatchData(input)) {
-    throw new TypeError(
-      'Legacy PatchData { nodes, edges } is not Mutation V3. Author { preconditions, operations } or a canonical astrale.graph.mutation/v3 document.',
-    )
-  }
-  if (hasEmptyOperations(input)) {
-    throw new TypeError('Mutation V3 requires at least one operation')
-  }
-  if (isCanonicalCandidate(input)) return MutationAST.decode(input)
-  return MutationAST.create(input as MutationInput)
-}
-
-function hasEmptyOperations(input: unknown): boolean {
-  return (
-    input !== null &&
-    typeof input === 'object' &&
-    !Array.isArray(input) &&
-    Array.isArray((input as { operations?: unknown }).operations) &&
-    (input as { operations: unknown[] }).operations.length === 0
-  )
-}
-
-function isCanonicalCandidate(input: unknown): boolean {
-  return (
-    input !== null &&
-    typeof input === 'object' &&
-    !Array.isArray(input) &&
-    (Object.hasOwn(input, 'format') || Object.hasOwn(input, 'version'))
-  )
-}
-
-function isLegacyPatchData(input: unknown): boolean {
-  return (
-    input !== null &&
-    typeof input === 'object' &&
-    !Array.isArray(input) &&
-    !Object.hasOwn(input, 'operations') &&
-    (Object.hasOwn(input, 'nodes') || Object.hasOwn(input, 'edges'))
-  )
-}

package/src/graph/projection.ts

@@ -1,21 +0,0 @@
-/** Strip a fully-qualified Property key to the leaf used by CLI presentation. */
-export function unqualifyProperty(key: string): string {
-  const property = key.lastIndexOf('.property.')
-  if (property >= 0) return key.slice(property + '.property.'.length)
-  const slash = key.lastIndexOf('/')
-  return slash >= 0 ? key.slice(slash + 1) : key
-}
-
-/** Read an exact key first, then one canonical qualified key with the requested leaf. */
-export function nodeProperty(
-  node: { readonly props: Readonly<Record<string, unknown>> } | null | undefined,
-  name: string,
-): unknown {
-  const props = node?.props
-  if (props === undefined) return undefined
-  if (Object.hasOwn(props, name)) return props[name]
-  for (const [key, value] of Object.entries(props)) {
-    if (unqualifyProperty(key) === name) return value
-  }
-  return undefined
-}

package/src/graph/query.ts

@@ -1,95 +0,0 @@
-import type {
-  NodeQueryBuilder,
-  QueryAST as QueryASTValue,
-  QueryDirection,
-  QueryNodeInput,
-} from '@astrale-os/sdk/query'
-
-import { Path } from '@astrale-os/sdk/graph/path'
-import { Query, QueryAST } from '@astrale-os/sdk/query'
-
-import { classReference } from './class'
-
-export interface QueryCommandInput {
-  readonly sources: readonly string[]
-  readonly class?: string
-  readonly ast?: unknown
-  readonly edge?: string
-  readonly direction?: QueryDirection
-  readonly limit?: string
-  readonly cursor?: string
-}
-
-export interface PreparedQuery {
-  readonly ast: QueryASTValue
-  readonly page: Readonly<{ readonly size: number; readonly after?: string }>
-}
-
-const DEFAULT_LIMIT = 100
-
-/** Admit canonical Query V6 or author the intentionally small Path/Class/one-edge subset. */
-export function prepareQuery(input: QueryCommandInput): PreparedQuery {
-  const limit = positiveInteger(input.limit, '--limit', DEFAULT_LIMIT)
-  if (input.ast !== undefined) {
-    if (
-      input.sources.length > 0 ||
-      input.class !== undefined ||
-      input.edge !== undefined ||
-      input.direction !== undefined
-    ) {
-      throw new TypeError(
-        '--ast/--file cannot be combined with sources, --class, --edge, or --direction',
-      )
-    }
-    return withPage(QueryAST.decode(input.ast), limit, input.cursor)
-  }
-
-  if (input.sources.length === 0 && input.class === undefined) {
-    throw new TypeError('query requires a Path source, --class, or a canonical Query V6 document')
-  }
-  if (input.direction !== undefined && input.edge === undefined) {
-    throw new TypeError('--direction requires --edge')
-  }
-
-  const paths = input.sources.map((source) => Path.parse(source))
-  const selectedClass =
-    input.class === undefined ? undefined : classReference(input.class, '--class')
-  const nodes = selectedClass === undefined ? paths : [...paths, selectedClass]
-  const query: NodeQueryBuilder<unknown> = Query.from({
-    nodes: nodes as [QueryNodeInput, ...QueryNodeInput[]],
-  })
-  const ast =
-    input.edge === undefined
-      ? query.select({ kind: 'graph', binding: query.node })
-      : expanded(query, input.edge, input.direction)
-  return withPage(ast, limit, input.cursor)
-}
-
-function expanded(
-  query: NodeQueryBuilder<unknown>,
-  edge: string,
-  direction: QueryDirection | undefined,
-): QueryASTValue {
-  const result = query.expand({
-    via: [classReference(edge, '--edge')],
-    direction: direction ?? 'outgoing',
-  })
-  return result.select({ kind: 'graph', binding: result.node })
-}
-
-function positiveInteger(raw: string | undefined, name: string, fallback: number): number {
-  if (raw === undefined) return fallback
-  if (!/^\d+$/.test(raw)) throw new TypeError(`${name} must be a positive integer`)
-  const value = Number.parseInt(raw, 10)
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new TypeError(`${name} must be a positive integer`)
-  }
-  return value
-}
-
-function withPage(ast: QueryASTValue, size: number, cursor: string | undefined): PreparedQuery {
-  return Object.freeze({
-    ast,
-    page: Object.freeze({ size, ...(cursor === undefined ? {} : { after: cursor }) }),
-  })
-}

package/src/graph/tsconfig.json

@@ -1,6 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": { "types": ["@types/node"] },
-  "include": ["*.ts"],
-  "exclude": ["__tests__"]
-}

package/src/identity/.history/ard/bootstrap-root-transfer.md

@@ -1,57 +0,0 @@
-# Bootstrap root transfer and child authority
-
-Status: resolved
-Impact: high
-Selection: identity-export-v1-and-authenticated-management-delegation
-
-## Context
-
-A production Host creates the manager Kernel's signing material before the CLI has any local state.
-Qualification may mount that generated secret into the operator environment, but it must not
-manufacture the CLI registry or key files. The Host producer and CLI importer previously agreed only
-through coincident TypeScript object shapes. The root-to-child journey was also distributed across
-Host, Runtime, Client, and CLI behavior, leaving room to confuse a manager-signed Management carrier
-with the effective child principal.
-
-## Decision
-
-https://schemas.astrale.ai/cli/identity-export/1 is the portable JSON Schema for the plaintext
-IdentityExport V1 envelope. CLI Identity owns and publishes that schema. Structural schema admission
-does not prove a keypair: identity import additionally proves that the private and public JWKs form
-one pair before publishing either keys or registry state.
-
-The Host secret generator emits one schema-conforming identity.json with mode 0600. The platform
-runner imports it through:
-
-    astrale identity import <identity.json> --name platform-root
-
-The imported root is the manager Kernel principal. It is never provisioned or registered as an
-application identity. The manager bookmark uses the non-reserved alias platform-manager, pins the
-manager issuer, and selects platform-root as its default identity. Manager identity is proved by the
-authenticated public Identity.whoami syscall, not local CLI status.
-
-Because this credential is issued by the target Kernel itself, CLI signing carries the imported
-subject as an already-resolved identity Grant. The external-primary `{ identity: self }` form is not
-valid for a self-issued Kernel bearer and cannot be substituted at this boundary.
-
-Child creation is the public receiver call
-/:host.astrale.ai:core.manager::createInstance. Once its Operation and Instance status report a
-ready route and issuer, the canonical child credential is minted at the manager:
-
-    astrale token -i platform-manager --for platform-root --audience <child-issuer> --raw
-
-That token is a manager-to-child Management carrier. Its outer JWT subject names the manager
-principal; child Runtime maps it to the child Kernel principal. Child calls therefore keep the token
-as --creds, and @self resolves through the child's authenticated Identity.whoami. The child bookmark
-pins the child issuer and carries no --as platform-root default.
-
-## Consequences
-
-- Bootstrap crosses one explicit file contract and one supported CLI command; no CLI state file is
-  fabricated.
-- Direct manager signing and child Management delegation remain distinct.
-- No consumer may infer the effective principal from an unverified JWT subject or cached
-  registration.
-- The portable schema is structural and versioned; cryptographic pair proof remains CLI admission.
-- A future encrypted Host-to-CLI bootstrap format requires a new explicit deployment decision. CLI's
-  interactive compact-JWE export remains an operator transfer representation, not Host output.

package/src/identity/.history/ard/domain-mediated-registration.md

@@ -1,36 +0,0 @@
-# Domain-mediated Identity registration
-
-Status: resolved
-Impact: high
-Selection: explicit-authority-owner-callable
-
-## Context
-
-`identity register` prepares an atomic graph Node and self-proven Identity designation. Submitting
-that request directly to Kernel Auth is correct only when the authenticated caller already holds
-creation authority for the chosen Class. A child Kernel management principal does not thereby own
-an installed application Domain's `Operator` Class, and production correctly denied that attempted
-authority substitution.
-
-The CLI must still own local key proof and target-bound registration state. Manufacturing CLI state,
-handing application credentials to the operator, or weakening mutation authorization would cross
-the wrong boundary.
-
-## Decision
-
-Registration retains direct Auth submission as its default. `--via <callablePath>` selects a second,
-explicit submission boundary: after constructing the exact same Provision request and fingerprint-
-bound self proof, CLI invokes the named Domain callable through the normal Host route. That callable
-owns admission and may exercise its Domain authority to submit the request to Kernel Auth.
-
-CLI treats the callable response as untrusted. It admits the prepared binding's issuer, subject, and
-optional created Node ID, then stores only the target-keyed issuer and subject. It never accepts or
-persists application authority, and it never exposes the self proof in argv or output.
-
-## Consequences
-
-- Kernel mutation non-amplification remains unchanged.
-- A Domain that offers registration must declare and authorize a Provision-shaped callable.
-- The option is explicit because choosing the authority owner is security-significant.
-- Direct registration remains useful for Classes the selected caller genuinely owns.
-- A failed callable or malformed response leaves CLI registration state unchanged.

package/src/identity/.spec/api.d.ts

@@ -1,124 +0,0 @@
-import type { ProvisionRequest } from '@astrale-os/sdk/auth'
-import type { Call } from '@astrale-os/sdk/client'
-import type { LocalBinding } from '@astrale-os/sdk/graph'
-import type { JWK } from 'jose'
-
-import type {
-  Identity,
-  IdentityMode,
-  IdentityStore,
-  IdentityStoreOptions,
-  Registration,
-} from '../../state/.spec/api.js'
-
-export type { Identity, IdentityStore, Registration } from '../../state/.spec/api.js'
-
-/** Filesystem coordinates used only by explicit identity transfer operations. */
-export interface IdentityFileOptions {
-  readonly state?: IdentityStoreOptions
-  readonly keysDir?: string
-}
-
-/** Canonical V1 key-identity transfer envelope. */
-export interface IdentityExport {
-  readonly version: 1
-  readonly subject: string
-  readonly mode: IdentityMode
-  readonly kid?: string
-  readonly issuer?: string
-  readonly privateJwk: JWK
-  readonly publicJwk: JWK
-}
-
-export interface IdentityImportOptions extends IdentityFileOptions {
-  readonly name?: string
-  readonly issuer?: string
-  readonly replace?: boolean
-}
-
-export interface IdentityRegistrationResult {
-  readonly iss: string
-  readonly sub: string
-  readonly nodeId?: string
-}
-
-export interface IdentityProvisionSubmission {
-  readonly request: ProvisionRequest
-  readonly binding: LocalBinding
-  readonly via?: string
-  readonly direct: {
-    provision(request: ProvisionRequest): Promise<unknown>
-  }
-  readonly callable: {
-    call(call: Call): Promise<unknown>
-  }
-}
-
-/** Submit one prepared request either directly or through its explicit Domain authority owner. */
-export function submitIdentityProvision(
-  input: IdentityProvisionSubmission,
-): Promise<IdentityRegistrationResult>
-
-/** Admit only the exact binding the CLI prepared; remote callables remain untrusted input. */
-export function acceptProvisionedIdentity(
-  value: unknown,
-  binding: LocalBinding,
-): IdentityRegistrationResult
-
-export function readIdentities(): Promise<IdentityStore>
-
-export function createIdentity(
-  name: string,
-  options?: {
-    readonly subject?: string
-    readonly mode?: IdentityMode
-    readonly issuer?: string
-    readonly kid?: string
-  },
-): Promise<Identity>
-
-export function deleteIdentity(name: string): Promise<void>
-export function setDefault(name: string): Promise<void>
-export function getDefault(): Promise<Identity & { readonly name: string }>
-export function getIdentity(name: string): Promise<Identity>
-
-export function upsertIdpIdentity(
-  name: string,
-  options: {
-    readonly subject: string
-    readonly idp: string
-    readonly issuer: string
-    readonly audience?: string
-    readonly claims?: Readonly<Record<string, unknown>>
-    readonly use?: boolean
-  },
-): Promise<Identity>
-
-export function setRegistration(
-  name: string,
-  instanceSlug: string,
-  registration: Registration,
-): Promise<void>
-
-export function setIdentityMode(name: string, mode: IdentityMode): Promise<void>
-
-/** Detect the retained compact-JWE representation without decoding it. */
-export function isEncryptedIdentityExport(raw: string): boolean
-
-/** Decode legacy plaintext, V1 plaintext, or compact-JWE content into one admitted V1 envelope. */
-export function decodeIdentityExport(raw: string, passphrase?: string): Promise<IdentityExport>
-
-/** Encode one admitted envelope as plaintext JSON or compact JWE. */
-export function encodeIdentityExport(envelope: IdentityExport, passphrase?: string): Promise<string>
-
-/** Read and prove one key-backed identity's transferable envelope. */
-export function exportIdentity(name: string, options?: IdentityFileOptions): Promise<IdentityExport>
-
-/** Import one admitted envelope after checking registry conflicts but before publishing registry state. */
-export function importIdentity(
-  envelope: IdentityExport,
-  options?: IdentityImportOptions,
-): Promise<Identity>
-
-/** Atomically publish one explicit private export file with mode 0600. */
-export function writeIdentityExport(path: string, content: string): Promise<void>

package/src/identity/.spec/architecture.md

@@ -1,33 +0,0 @@
-# CLI identity ownership
-
-Identity owns local identity selection and the coordination between the State registry, per-subject
-Keys, and IdP sessions. State owns durable registry decoding and locking; Keys owns JWK admission,
-pair proof, and private files. Commands own prompts and presentation, not persistence mechanics.
-
-Identity transfer accepts the retained unversioned plaintext envelope and the current V1 plaintext
-or compact-JWE representation. Admission completes before mutation. Import checks the registry under
-its file lock, persists the admitted keypair, and only then publishes the identity entry. Export
-proves the stored pair and atomically writes one mode-`0600` user-selected file.
-
-The canonical plaintext V1 structure is independently published as
-`https://schemas.astrale.ai/cli/identity-export/1`. A production Host may emit that envelope as its
-bootstrap root secret, but CLI Identity remains the format owner and cryptographically proves the
-pair on import. The governing bootstrap flow imports the root as `platform-root`, authenticates it
-directly to the `platform-manager` Kernel, and reaches a child only through a manager-minted
-child-audience Management carrier. The carrier's outer subject is not the child's effective
-principal; authenticated child `Identity.whoami` owns that projection.
-
-Identity registration always prepares one self-proven atomic Provision request. Direct registration
-submits it to Kernel Auth only when the selected caller already owns the target Class authority. An
-explicit `--via <callable>` instead sends those exact bytes through the Domain that owns an
-application Identity Class. The Domain callable owns admission and effect authority; CLI admits only
-the prepared binding from the response before persisting its target-bound `(issuer, subject)`.
-
-```mermaid
-flowchart LR
-  C[identity command] --> D[decode or encode transfer]
-  D --> I[Identity orchestration]
-  I --> S[State registry lock]
-  I --> K[Keys pair proof and files]
-  S --> F[identities.json]
-```

package/src/identity/.spec/capabilities/identity.ts

@@ -1,7 +0,0 @@
-import { defineCapability } from '@astrale-os/spec/authoring'
-
-export const CLI_IDENTITY = defineCapability({
-  id: 'CLI-IDENTITY',
-  statement:
-    'Preserves local identity selection, isolated key material, and explicit import/export journeys.',
-})