@by-association-only/harness-app 0.0.0-stage → 0.1.0

package/dist/harness.mjs

@@ -0,0 +1,1382 @@
+import { i as switchPath, t as branchCookie } from "./branch-XrPxkmYQ.mjs";
+import { existsSync, globSync, readFileSync } from "node:fs";
+import path from "node:path";
+import * as Schema from "effect/Schema";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import { Argument, Command, Flag } from "effect/cli";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import * as Stream from "effect/Stream";
+import { branchStage, isBranchName, stageHost } from "@by-association-only/harness-unisian/stages";
+import * as Config from "effect/Config";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import { TomlDate, parse, stringify } from "smol-toml";
+import * as Predicate from "effect/Predicate";
+import * as DateTime from "effect/DateTime";
+import * as Option from "effect/Option";
+import { DoctorFlags, VerifyFailed, argument, attempt, checkedArgument, command, flowStep, openedPage, optionalFlag, toggle, writeEvidence } from "@by-association-only/harness/verify";
+import { FetchHttpClient, HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
+import * as Clock from "effect/Clock";
+import * as Redacted from "effect/Redacted";
+import { Kind, parse as parse$1 } from "graphql";
+//#region src/blocks.ts
+const agents$1 = (slot, id, lines) => ({
+	file: "AGENTS.md",
+	id,
+	slot,
+	text: lines.join("\n")
+});
+const lore = (page, slot, id, lines) => ({
+	file: `docs/lore/${page}.md`,
+	id,
+	slot,
+	text: lines.join("\n")
+});
+const baseBlocks = [
+	agents$1("hard-to-reverse", "hard-to-reverse", ["- A second Shopify app config, such as `shopify.app.<name>.toml`, which is per-store infrastructure."]),
+	agents$1("commands", "commands", [
+		"| Command                             | What it does                                                                                                                                                                                                                |",
+		"| ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |",
+		"| `pnpm exec shopify-graphql-codegen` | Regenerates the Admin operation and Events subscription types and the metaobject and metafield Schemas in `src/graphql/`; `--update-schema` refreshes the Admin schema ([lore](docs/lore/codegen-checks-every-template.md)) |",
+		"| `pnpm exec harness app dev`         | Runs `shopify app dev` on the `local-<user>` stage, holding the dev store's slot, and gives the slot back when it fails or stops; `harness unisian dev` runs the Alchemy half ([lore](docs/lore/branch-router.md))          |",
+		"| `pnpm exec harness app stage`       | Deploys the branch as `w-<branch>` behind the router host in `shopify.app.toml`, then prints the `/__branch/<stage>` path to open in the Admin                                                                              |"
+	]),
+	agents$1("architecture", "architecture", [
+		"- `src/features/shell/` is the Admin frame: the nav, the surfaces list, the error page and the browser error report. The surfaces list is typed from the route tree's `fullPaths`, so tsc fails when a route and the list disagree. `src/server/` also holds the webhook and Events routers and the `ShopSessions` Durable Object, which declares `@unisian/shopify-auth`'s class with the app's config; the Worker entry exports it and `alchemy.run.ts` binds it, since Cloudflare needs both.",
+		"- `src/routes/app.tsx` is the shell every Admin page sits in. Its head loads App Bridge first, then the Polaris extensions, then Polaris 2.0 RC; the script URL and the `@shopify/polaris-types` pin change together ([lore](docs/lore/polaris-2-rc.md)). `appNav` in `src/features/shell/nav.ts` is the one nav list: the shell renders it in `ui-nav-menu` and preloads it when the browser goes idle, so a page joins the nav with one entry ([lore](docs/lore/one-nav-list.md)).",
+		"- An `/app` page that fails gets `AppErrorPage`, the router's default, and an `/app` path no route serves gets `NotFoundPage`. A failure a merchant should read carries a `merchantMessage` field, which the error page shows. Errors thrown in the browser are reported to the server, so every error page has a reference, and a production build shows none of the failure's text (`test/production-bundle.test.ts`) ([lore](docs/lore/shell-errors.md)).",
+		"- A form is `useAppForm(useCommandForm({ contract, command, defaultValues }))`, with `useAppForm` and the Polaris fields from `@unisian/shopify-app-ui/react`. A file field opens Shopify's `pick:shopify/File` intent, so merchant uploads land in Shopify Files ([lore](docs/lore/forms-on-the-contract.md), [files](docs/lore/files-through-intents.md)).",
+		"- A feature worker is a Worker every app shares. unisian-next is the only repo that writes one, and an app binds it by name."
+	]),
+	agents$1("project-law", "project-law", [
+		"- Admin API calls go through `ShopifyAdmin` from `@unisian/shopify-auth`, and every other request through `HttpClient`. Never write an `/admin/api/` URL; lint enforces this (`app/admin-api-url`) ([lore](docs/lore/one-request-path.md)).",
+		"- The caller's identity is the shop (`CurrentShop`), provided by the entry point that proved it. ID-token auth runs on the admin app only: admin pages go under `/app`, and server functions are the admin app's calls only. One request middleware (`adminAuth`) authenticates both by path, and the global function middleware reads the shop it found. The app proxy, webhooks, Events and public URLs are server routes that prove themselves (HMAC, a signed query) or need nothing ([lore](docs/lore/who-is-calling.md)).",
+		"- A webhook or Events delivery verifies, decodes Shopify's payload, then calls a capability or service inline. A bad HMAC gets 401 and any other failure 500, so Shopify's retry is the queue. Work that can't finish inside Shopify's five seconds starts a Workflow. A handler re-reads current state, tolerates duplicate, late and out-of-order deliveries, and reaches an outside effect, such as an email, only through `once(key, effect)` ([lore](docs/lore/webhooks-are-ingress.md)).",
+		"- The app subscribes the webhook topics its own code handles: `app/uninstalled` and `shop/redact` always, `shop/update` and `locales/*` with code that reads the shop's app info, and `customers/data_request` and `customers/redact` only when the app keeps customer data, with handlers that answer them ([lore](docs/lore/webhooks-are-ingress.md)).",
+		"- A save splits by what the merchant has to see before \"Saved\" ([lore](docs/lore/saves-and-events.md)):",
+		"  - The command does the checks, the write, dependent writes and their rollback, and anything only the request knows (who acted, the value before).",
+		"  - Work derived from Shopify's state reacts to Events at `/events`, whoever made the change, and has a periodic sweep. `shopify-graphql-codegen` types each `[[events.subscription]]` from its `query`, and `eventDispatcher` takes one handler per handle, so a missing or extra handle fails tsc.",
+		"  - Slow work the merchant waits on starts a Workflow from the command.",
+		"  - Topics Events lacks (the shop, locales, `app/uninstalled`, compliance) stay on webhooks.",
+		"- Every metaobject type is app-owned: `$app:<type>`, declared in `shopify.app.toml`. `access.admin` is `merchant_read_write` unless a merchant's edit would do damage no handler can repair afterwards, such as a points balance or a code that must stay unique; then it's `merchant_read`, and the app's own UI makes the edits ([lore](docs/lore/saves-and-events.md)).",
+		"- Every `#graphql` template is one named operation with no interpolation. `pnpm check` runs `shopify-graphql-codegen --check`, which fails a template the registry doesn't match and a hand edit to a generated file ([lore](docs/lore/codegen-checks-every-template.md)).",
+		"- An app declares a write scope alone, never its read scope beside it: Shopify grants read with write."
+	]),
+	agents$1("deploys", "deploys", [
+		"- On every push to `{{defaultBranch}}`, once the `live` Worker deploys, CI releases the live app with `shopify app deploy --config live --allow-updates`, so merging is the go-ahead for the release too. A failed Worker deploy stops the release ([lore](docs/lore/one-live-stage.md)).",
+		"- Releasing the dev app, and any release with `--allow-deletes`, asks {{maintainer}} at the time: deleting app configuration or an extension deletes its data on stores. {{maintainer}} merges a PR whose release needs `--allow-deletes`.",
+		"- Take the dev store's slot without asking when your branch changes app config (scopes, webhooks, Events, the app proxy, extensions). `pnpm exec harness app slot take` refuses while another checkout holds it: find that checkout's agent with `herdr agent list`, ask whether it can give the slot back, and wait if it's still proving. Give the slot back with `pnpm exec harness app slot give` as soon as your proof is in ([lore](docs/lore/branch-router.md))."
+	]),
+	lore("who-is-calling", "entry-points", "who-is-calling", [
+		"## In a Shopify app",
+		"",
+		"The identity service is `CurrentShop` (`@unisian/shopify-auth`), and it holds only which shop (`{ shop }`), because every entry point can prove that (Dan Gamble, 2026-09-28). On the storefront, the customer comes from the Shopify-signed app proxy's `logged_in_customer_id`, never from the body.",
+		"",
+		"| Entry point                    | Proves                                 | Provides                                                                          |",
+		"| ------------------------------ | -------------------------------------- | --------------------------------------------------------------------------------- |",
+		"| Admin page load (under `/app`) | staff session token (`id_token` query) | nothing directly; its loaders' server functions reuse the check, once per request |",
+		"| Admin server function          | staff session token                    | `CurrentShop`, `ShopifyAdmin`                                                     |",
+		"| App proxy route                | Shopify-signed proxy query             | `CurrentShop`, `ShopifyAdmin`, `CurrentCustomer` (not built yet)                  |",
+		"| Webhook or Events delivery     | HMAC                                   | `CurrentShop`, `ShopifyAdmin.layerForShop`                                        |",
+		"| Queue or Workflow step         | its own enqueued payload               | `CurrentShop`, `ShopifyAdmin.layerForShop`                                        |",
+		"",
+		"A capability that requires `CurrentCustomer` can't be exposed as an admin server function, because nothing there provides it, so `tsc` fails.",
+		"",
+		"The offline session and the request's ID token stay with the API clients. The admin entry point passes them to `ShopifyAdmin.layer`, which re-exchanges the ID token after a 401; everywhere else `ShopifyAdmin.layerForShop` loads the stored session by the shop's domain. So the access token never reaches a capability, and a capability that only needs the shop runs from a page and a webhook alike. abask confirms the split: its session reads either use only the shop (about 20 of them) or build an Admin or Storefront API client. A Storefront API client follows `ShopifyAdmin`'s pattern and holds the session itself.",
+		"",
+		"## ID-token auth on the admin app only",
+		"",
+		"Only the admin app proves itself with an ID token, so only the admin app runs ID-token auth (Dan Gamble, 2026-09-28). One request middleware, `adminAuth` (`src/server/middleware.ts`), authenticates a request whose path is `/app`, under `/app/`, or under Start's server-function base, and puts the shop in context. `adminCalls`, the global function middleware, reads the shop from there. A loader's server-function call during SSR reads the page's own result, so an `/app` load verifies once. Server functions are the admin app's calls only; storefront and proxy work are server routes. Everything else proves itself its own way or not at all: the app proxy by its signed query, webhooks and Events by HMAC, `/auth/bounce` and `/` by needing nothing.",
+		"",
+		"An earlier request middleware authenticated every request that wasn't the bounce or a webhook. So a path nothing served, such as `/favicon.ico` or the Admin's `/extensions` socket, got the 400 or the bounce and logged a token failure. `adminAuth` checks the path first, so those paths keep the router's 404. Its context types `shopify` as possibly undefined, and `adminCalls` narrows it: a server function a loader calls outside `/app` fails there rather than in `serve`. `test/request-handler.test.ts` builds the app and checks both halves.",
+		"",
+		"## Who may frame the app",
+		"",
+		"The `frame-ancestors` header, which `adminAuth` sets on every HTML response, names a shop only when the ID token proved it. Every other HTML response, the `/auth/bounce` page and error pages included, lets only Shopify's Admin hosts frame it, whatever `shop` the query names. Shopify's `addDocumentResponseHeaders` and Unisian's `addShopifyHeaders` take the shop from the sanitised query parameter instead, and send no header without one (Dan Gamble, 2026-10-03; [iframe protection](https://shopify.dev/docs/apps/build/security/set-up-iframe-protection))."
+	]),
+	lore("forms-on-the-contract", "form-kit", "forms-on-the-contract", [
+		"## The Polaris form kit",
+		"",
+		"Unisian's kit was TanStack Form with TanStack Query, and client apps build on it: `abask-pstack-bootstrap` adds its own fields through the kit's `extendForm`. The kit keeps that shape. `@unisian/shopify-app-ui` holds `useAppForm`, `extendForm`, the `SaveBar` on App Bridge's save bar, `ErrorBanner`, `HexColour`, `Picker`, and a field for every Polaris input: TextField, TextArea, EmailField, UrlField, PasswordField, SearchField, MoneyField, NumberField, DateField, DatePicker, ColorField, Checkbox, Switch, Select, ChoiceList, ColorPicker, and FilePicker, which opens the `pick:shopify/File` intent in place of `s-drop-zone` ([files through the intent](./files-through-intents.md)). BooleanSelect holds yes, no or unset, and EnumSwitch maps checked and unchecked to two values a schema names, such as `VISIBLE` and `HIDDEN`. `s-number` only displays a number, so it isn't a field. A form is `useAppForm(useCommandForm({ contract, command, defaultValues }))`, and an app adds its own fields through `extendForm` in `src/`.",
+		"",
+		"`Picker`, and the ColorPicker and FilePicker built on it, take a `marker` beside the label and `actions` in place of Reset and Clear, so a field that overrides a shared default can offer Reset to default. Every field passes the Polaris element's own props through, and each event the kit handles takes an `(event, field)` override. Select and ChoiceList set `selected` on each `s-option` and `s-choice`: setting `value` on `s-select` or `values` on `s-choice-list` didn't stick on the Polaris RC, and after a reload a saved value showed the first option or nothing ticked (2026-10-02, in the Admin).",
+		"",
+		"- Data a form can show after it renders, such as a picked file's thumbnail, the loader starts with `void queryClient.query(...).catch(() => null)` and doesn't await, and the field reads it with `useSuspenseQuery` inside a `Suspense` boundary. The server sends the spinner, then streams the image into the boundary in the same response. Awaiting it would hold back a form with many files; reading it with `useQuery` instead rendered the image on the client where the server had sent the spinner, a hydration error. Under `shopify app dev` the Cloudflare quick tunnel holds the whole response until its last chunk, so the page shows only once the slowest file arrives.",
+		"- Discard on the save bar resets to the form's `defaultValues` without a server call.",
+		"- On a `CapabilityFailureError`, `showOnForm` puts each issue whose path names a field on that field, and shows the `merchantMessage`, path-less issues and issues for fields the form doesn't have in `ErrorBanner`.",
+		"- A capability that runs a mutation turns Shopify's `userErrors` into `fieldIssues`, mapping Shopify's field paths onto the form's."
+	]),
+	lore("one-live-stage", "releases", "one-live-stage", [
+		"## Releasing the Shopify app",
+		"",
+		"- Merging is the go-ahead, for the Worker and the app. After the `live` Worker deploys, the same job releases the live app: `shopify app deploy --config live --allow-updates`, with the commit as `--source-control-url` (Dan Gamble, 2026-09-30). The Worker goes first so Shopify is never pointed at code that can't serve a new webhook topic or scope yet, and a failed Worker deploy stops the release. `shopify.app.toml` is never on the list of paths that never deploy, because `alchemy.run.ts` reads the API version from it.",
+		"- CI never passes `--allow-deletes`. Shopify warns that deleting app configuration or extensions \"also deletes related data on stores\", so a merge that removes one fails the release and a person runs it by hand, after asking.",
+		"- The Shopify CLI is pinned as a dev dependency (`@shopify/cli`), so CI and local dev run the same version. It authenticates with an App Automation Token made for the live app in the Dev Dashboard (`SHOPIFY_APP_AUTOMATION_TOKEN` in the `live` environment). That token expires after at most 6 months, and the Dashboard's rotate flow keeps old and new valid until the old one is revoked. CI also holds `SHOPIFY_API_SECRET`.",
+		"- The live app is its own Shopify app, in `shopify.app.live.toml`, created with `shopify app config link --file-name live`. Local `shopify app dev` keeps the dev app in `shopify.app.toml`, so the two never compete for one app's URL. The two apps have no reason to differ in scopes, webhooks, metaobjects or anything else they declare, so `test/app-configs.test.ts` parses both files whole and fails on any difference outside `client_id`, `name`, `application_url`, `auth.redirect_urls` and `build.automatically_update_urls_on_dev`. It also fails if the live app shares the dev app's client ID or lets a dev session repoint its URLs.",
+		"- The live app's config is the source of its identity and URL. On the `live` stage, `alchemy.run.ts` reads `client_id` and `application_url` from `shopify.app.live.toml`: `client_id` becomes `SHOPIFY_API_KEY`, and `application_url`'s hostname becomes the Worker's custom domain. Every other stage reads both from `shopify.app.toml`, and a stage named like a branch gets the host the branch router sends it ([branch router](./branch-router.md)). The hostname's zone sits in the same Cloudflare account as the Workers, and CI's Cloudflare token needs Zone Read on it, since Alchemy looks the zone up by name. A fixed URL means the first deploy is the only one: before it, the Worker's `workers.dev` name would have held a random instance ID.",
+		"",
+		"Rejected, from Unisian's `ops.md` (Dan Gamble, 2026-10-14, [harness#13](https://github.com/baoagency/harness/issues/13)):",
+		"",
+		"- A manual production deploy. Merging is the go-ahead.",
+		"- A production stage only. Every app has `live`, `main`, `pr-<n>` and `w-<branch>`.",
+		"- No unit-test gate. A change is ready when `pnpm check` and `pnpm test` pass."
+	])
+];
+const featureWorkerBlocks = [
+	agents$1("architecture", "feature-workers-architecture", ["- The app binds each feature worker with `bindService` in `alchemy.run.ts` and lists it in `boundServices` (`src/features/shell/services.ts`), whose `binding` is typed from the app's env, so an entry with no binding fails tsc. A merchant request under the worker's route prefix passes the app's own ID-token auth, then the app's proxy forwards it with the shop's access token and the `X-Unisian-*` headers from `@unisian/service-contract`. A feature worker never gets the refresh token or the API secret ([lore](docs/lore/cloudflare-bindings.md))."]),
+	agents$1("project-law", "feature-workers-project-law", ["- Every scope a `boundServices` entry names is in both app configs, where a write scope counts as its read scope; `test/service-scopes.test.ts` fails on a missing one.", "- Only a feature worker whose entry sets `targetShops: true` gets the app's other shops and may act on one, and only in an app installed on its own client's stores ([lore](docs/lore/cloudflare-bindings.md))."]),
+	lore("cloudflare-bindings", "service-bindings", "feature-workers", [
+		"## Feature workers",
+		"",
+		"A feature worker is a Worker BAO shares across apps: unisian-next writes it in `services/<name>/` and deploys it once, and an app binds it by name. Feature workers are always central and shared, so unisian-next is the only repo that writes one (Dan Gamble, 2026-10-14, [harness#13](https://github.com/baoagency/harness/issues/13)). An app handed over to its client binds a deployment unisian-next makes once in the client's Cloudflare account, since a binding can't cross accounts ([one deployment per client](./one-deployment-per-client.md)).",
+		"",
+		"Unisian's feature workers took the app's offline token and its API secret in headers. Here a feature worker gets neither (Dan Gamble, 2026-10-03). A request carries the app's current access token, which lives an hour. For anything the worker keeps, or that outlives the request, such as a Workflow's tokens, it mints a delegate with `createDelegateToken` (`@unisian/shopify-auth`), carrying only the scopes it needs. The app's `ShopSessions` stays the only holder of the refresh token.",
+		"",
+		"### Binding one",
+		"",
+		"- The app binds a worker with `bindService` (`alchemy.run.ts`) and lists it in `boundServices` (`src/features/shell/services.ts`), whose `binding` is typed from the app's env: a manifest entry with no binding fails tsc. Every scope an entry names must appear in both app configs, and `test/service-scopes.test.ts` fails otherwise. A write scope counts as its read scope, since Shopify grants read with write.",
+		"- A merchant request under a worker's route prefix goes through the app's own ID-token auth, then the proxy forwards it with the shop's access token and the `X-Unisian-*` headers. The proxy refreshes a token with under 5 minutes left before it forwards it, and drops anything the browser sent under that prefix, and the browser's `authorization` and `cookie`. The header contract only ever grows, so every header added after the first five is optional: a worker deploys before the app at each stage, and an older app sends none of them.",
+		"- A request under a worker's asset prefix skips auth, since a page's `<script src>` and stylesheet loads carry no ID token. The proxy forwards a `GET` or `HEAD` without the browser's credentials or any `X-Unisian-*` header, and answers any other method with 405.",
+		"- `X-Unisian-Nav` carries the app's `appNav` and then every bound worker's entry, as JSON. A worker's page renders it as plain links inside its own `ui-nav-menu`, so the Admin's nav stays the same on every page ([one nav list](./one-nav-list.md)).",
+		"- A worker that works across the merchant's stores sets `targetShops: true` in its entry. Only such a worker gets `X-Unisian-Shops`, the shops with the app installed, and only such a worker may ask for a target shop with `X-Unisian-Target-Shop`. The proxy checks that the app holds a session for the target and that its scopes cover the worker's, then sends the target and its access token as `X-Unisian-Target-Shop` and `X-Unisian-Target-Access-Token`. A target's session holds the scopes Shopify returned at the app's last token exchange or refresh, which can lack one the worker needs. A token with write scopes on another store is the reason for the opt-in. The proxy answers 403 with a merchant message, and never calls the worker, when the target has no session, when its scopes fall short of the worker's, or when the worker hasn't opted in (Dan Gamble, 2026-10-05). Any store the app holds a session for may be a target, so this rests on a client app being installed only on its own client's stores: an app installed on unrelated merchants' stores must not bind a worker with `targetShops`.",
+		"- The shops list leaves out a store whose app was uninstalled: `app/uninstalled` marks its row, and the store's next Admin load clears the mark and fetches the app info again.",
+		"- A worker that runs a long job answers with `X-Unisian-Token-Needed: 1`. The shop's `ShopSessions` then sets an alarm that renews the offline token and pushes a fresh delegate to the worker's `POST /__unisian/token` until every worker answers `needed: false`, and a request that had a target does the same for the target's `ShopSessions`. The first push goes out at once; later ones run every 50 minutes on `live` and every 2 minutes on other stages, since a delegate can't outlive its parent, which lives an hour. A worker already waiting leaves the alarm where it is, so a page that polls can't force a renewal per request. `needed` comes from the Workflow instance's real status, never from a flag the job sets when it ends: a job that crashes before clearing its flag keeps the app pushing tokens.",
+		"",
+		"### Which stage an app stage binds",
+		"",
+		"The live app binds the workers at `live`; `main`, `pr-<n>` and `w-<branch>` bind them at `main` (Dan Gamble, 2026-10-04). Alchemy's beta binds every service under `alchemy dev` through the local dev registry, so a local dev stage can't reach a worker deployed at `main`.",
+		"",
+		"### Rejected",
+		"",
+		"- The app's offline token, API secret, app URL and scopes in headers, as Unisian did. A worker that holds the refresh token or the secret can act as the app forever.",
+		"- A token only on merchant requests. A Workflow outlives the request, so long jobs need pushes.",
+		"- A delegate minted per proxied request. It cost about 250 ms a request, and a request that keeps nothing gains little from a narrower token.",
+		"- The worker pulling tokens from the app, which needs a binding from each worker back to every app that uses it.",
+		"- Every app stage binding `live`. A preview's requests would reach the live workers.",
+		"- A worker stage per app stage. Every `pr-<n>` and `w-<branch>` would deploy a copy of every worker it doesn't change."
+	])
+];
+const extensionBlocks = [agents$1("architecture", "extensions-architecture", ["- An extension lives in `apps/<app>/extensions/<name>/` with its `shopify.extension.toml`, and ships in its app's release. A Shopify Function is Rust: its folder holds a `Cargo.toml`, and `pnpm check` fails one without. Logic two Functions share is a crate published to crates.io, never a copy or a git dependency."]), agents$1("project-law", "extensions-project-law", ["- A Function runs inside checkout, and Shopify says to \"choose Rust to stay within the Shopify Functions instruction count requirements\"; the limit fails at the buyer, not in CI. `pnpm check` runs `cargo fmt --check` and `cargo clippy --all-targets --locked -- -D warnings` on every crate (`harness app rust check`).", "- Each Function's `tests/` folder holds one test file, which calls `testFunctionFixtures({ instructionBudget, testsDir: import.meta.dirname })` from `@by-association-only/harness-app/function-tests`, with the budget a named constant. It builds the Function, runs every fixture in `tests/fixtures/`, and fails one whose output differs from the fixture's or that runs more instructions than the budget. Shopify stops a Function at 11 million instructions for a cart of up to 200 lines, so the budget sits below that, and one fixture is the largest input the client will realistically send."])];
+//#endregion
+//#region src/unisian-docs.ts
+const agents = (slot, id, lines) => ({
+	file: "AGENTS.md",
+	id,
+	slot,
+	text: lines.join("\n")
+});
+const unisianDocBlocks = [
+	agents("what-this-repo-is", "manifesto", ["- Why BAO builds apps the way this file says: [the manifesto](docs/manifesto.md), seven tenets in Dan Gamble's words. It comes from `@by-association-only/harness-app`, so `harness rulebook --check` fails on a local edit, and a change to it goes to Dan Gamble."]),
+	agents("architecture", "one-deployment-per-client", ["- A deployment serves one client's stores, on every stage, and code may trust that every shop the app holds a session for belongs to the client. A second client gets an app and a deployment of its own. An app handed over to its client deploys to the client's own Cloudflare account ([lore](docs/lore/one-deployment-per-client.md))."]),
+	agents("project-law", "where-data-lives", ["- Where data lives turns on one question: does a Shopify surface (the theme, a Function, the Admin, the merchant, another app) read it? Yes puts it in Shopify, as a metafield, a metaobject or a file; no puts it in D1. Data a surface reads that also needs fast app queries sits in D1, with a metaobject copy the command writes in the same operation: a named exception, never a default ([lore](docs/lore/saves-and-events.md))."]),
+	agents("project-law", "extension-choice", [
+		"- Before an app gains an extension:",
+		"  - A Shopify Function goes in only where Shopify's own features can't express the behaviour without a clumsy merchant workflow. The app then builds the screen that configures it, so weigh that screen into the choice.",
+		"  - Behaviour, such as hiding, blocking or changing what the buyer gets, is a Function. A checkout UI extension goes in only for content or input that Shopify's checkout doesn't offer, such as a gift message, a free-shipping threshold, or the words that explain what a Function changed, and beside a Function only when the Function's own message can't explain what happened.",
+		"  - Checkout's components are fewer than the Admin's Polaris set. A design they can't draw well doesn't belong in checkout.",
+		"  - One app holds every Function. A second app needs a reason: a Function at its instruction budget that has to take a new behaviour, a domain unrelated to the app's, or a team or merchant that needs the code kept apart. A different scope or a different feature isn't one."
+	]),
+	agents("project-law", "theme-content", [
+		`- App content reaches the storefront through a theme app extension when the client's theme takes app blocks: the starter theme, or any Online Store 2.0 theme whose sections take them. Otherwise the theme team edits the theme by hand. What this repo is says which kind this client's theme is ([harness#13](https://github.com/baoagency/harness/issues/13#issuecomment-6167943534)).`,
+		"  - An extension ships the theme's read path in the same release as the data it reads, since merging releases the live app at once.",
+		"  - With hand edits, an app change that breaks the theme's read path waits until the theme change can go live with it."
+	])
+];
+const unisianDocFeatureWorkerBlocks = [agents("architecture", "feature-workers-handed-over", ["- A service binding reaches only a Worker on the app's own Cloudflare account, so an app handed over to its client can't bind the feature workers BAO deploys. unisian-next deploys each feature worker the app binds once, into the client's account, and the app binds that deployment. The app never copies a feature worker's code ([lore](docs/lore/one-deployment-per-client.md))."])];
+const unisianDocExtensionBlocks = [agents("project-law", "function-judgement", [
+	"- One Function per behaviour. Two behaviours share a Function only when the merchant sees them as one idea, and merging them asks the merchant first.",
+	"- Anything the merchant might change lives in an `$app:` metaobject the Function reads through its input query, never in the Function's code. The input query asks only for the fields the Function uses, since every field costs instructions.",
+	"- Fixtures cover each shape of input the Function handles."
+]), agents("project-law", "checkout-ui", ["- One checkout UI extension per concern, and no branching on its target inside it.", "- A target draws differently by cart state, so prove each extension on the dev store's checkout with carts of different shapes, such as a high-value cart and one shipping abroad."])];
+//#endregion
+//#region src/codegen/check.ts
+const codegenPackage = "@unisian/shopify-graphql-codegen";
+const codegenBin = "shopify-graphql-codegen";
+var CodegenCheckFailed = class extends Schema.TaggedError()("CodegenCheckFailed", { reason: Schema.String }) {
+	get message() {
+		return this.reason;
+	}
+};
+const Manifest = Schema.fromJsonString(Schema.Struct({
+	dependencies: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+	devDependencies: Schema.optional(Schema.Record(Schema.String, Schema.String))
+}));
+const decodeManifest = Schema.decodeUnknownSync(Manifest);
+const listsCodegen = (repo, file) => {
+	const { dependencies = {}, devDependencies = {} } = decodeManifest(readFileSync(path.join(repo, file), "utf-8"));
+	return Object.hasOwn(dependencies, codegenPackage) || Object.hasOwn(devDependencies, codegenPackage);
+};
+const appsWithCodegen = (repo) => globSync(["package.json", "apps/*/package.json"], { cwd: repo }).filter((file) => listsCodegen(repo, file)).map((file) => path.dirname(file)).toSorted();
+const checkApp = Effect.fn("checkApp")(function* checkApp(repo, app) {
+	if ((yield* (yield* ChildProcessSpawner.ChildProcessSpawner).exitCode(ChildProcess.make("pnpm", [
+		"exec",
+		codegenBin,
+		"--check"
+	], {
+		cwd: path.join(repo, app),
+		extendEnv: true,
+		stderr: "inherit",
+		stdin: "ignore",
+		stdout: "inherit"
+	})).pipe(Effect.mapError((error) => new CodegenCheckFailed({ reason: `Can't run ${codegenBin} in ${app} (${error.message}).` })))) !== 0) return yield* new CodegenCheckFailed({ reason: `${codegenBin} --check failed in ${app}: the generated types don't match its #graphql templates and shopify.app.toml. Run ${codegenBin} there and commit what it writes.` });
+});
+const codegenCheckCommand = Command.make("codegen-check", {}, () => Effect.gen(function* codegenCheck() {
+	const repo = process.cwd();
+	const apps = appsWithCodegen(repo);
+	if (apps.length === 0) {
+		yield* Console.log(`No app depends on ${codegenPackage}, so there's nothing to check.`);
+		return;
+	}
+	for (const app of apps) yield* checkApp(repo, app);
+	yield* Console.log(`${codegenBin} --check passed in ${apps.join(", ")}.`);
+})).pipe(Command.withDescription(`Run \`${codegenBin} --check\` in each app (the root, or apps/<name>/) whose package.json lists ${codegenPackage}, so every #graphql template's types stay current. A repo without it passes.`));
+//#endregion
+//#region src/failed.ts
+var CommandFailed = class extends Schema.TaggedError()("CommandFailed", { reason: Schema.String }) {
+	get message() {
+		return this.reason;
+	}
+};
+//#endregion
+//#region src/run.ts
+const cannotRun = (command) => (error) => new CommandFailed({ reason: `Can't run ${command} (${error.message}). Run this through pnpm, which puts the repo's own ${command} on PATH.` });
+const output = Effect.fn("output")(function* output(command, args, { cwd, env = {} } = {}) {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const [stdout, stderr, status] = yield* Effect.scoped(Effect.gen(function* collect() {
+		const handle = yield* spawner.spawn(ChildProcess.make(command, args, {
+			cwd,
+			env: { ...env },
+			extendEnv: true
+		}));
+		return yield* Effect.all([
+			Stream.mkString(Stream.decodeText(handle.stdout)),
+			Stream.mkString(Stream.decodeText(handle.stderr)),
+			handle.exitCode
+		], { concurrency: "unbounded" });
+	})).pipe(Effect.mapError(cannotRun(command)));
+	if (status !== 0) return yield* new CommandFailed({ reason: `${[command, ...args].join(" ")} exited ${status}: ${stderr.trim()}` });
+	return stdout.trim();
+});
+const runInherited = Effect.fn("runInherited")(function* runInherited(command, args, { cwd, env = {} } = {}) {
+	return yield* (yield* ChildProcessSpawner.ChildProcessSpawner).exitCode(ChildProcess.make(command, args, {
+		cwd,
+		detached: false,
+		env: { ...env },
+		extendEnv: true,
+		stderr: "inherit",
+		stdin: "inherit",
+		stdout: "inherit"
+	})).pipe(Effect.mapError(cannotRun(command)));
+});
+//#endregion
+//#region src/checkout.ts
+const git = (checkout, args) => output("git", [
+	"-C",
+	checkout,
+	...args
+]);
+const checkoutAt = Effect.fn("checkoutAt")(function* checkoutAt(directory) {
+	const [root = "", commonDirectory = "", branch = ""] = (yield* git(directory, [
+		"rev-parse",
+		"--path-format=absolute",
+		"--show-toplevel",
+		"--git-common-dir",
+		"--abbrev-ref",
+		"HEAD"
+	]).pipe(Effect.mapError(() => new CommandFailed({ reason: `${directory} isn't inside a git checkout.` })))).split("\n");
+	return {
+		branch,
+		commonDirectory,
+		root
+	};
+});
+const currentCheckout = Effect.suspend(() => checkoutAt(globalThis.process.cwd()));
+//#endregion
+//#region src/env/check.ts
+const envIgnored = Effect.fn("envIgnored")(function* envIgnored(root) {
+	const status = yield* runInherited("git", [
+		"-C",
+		root,
+		"check-ignore",
+		"--quiet",
+		".env"
+	]);
+	if (status === 1) return yield* new CommandFailed({ reason: `git doesn't ignore ${root}/.env, so the app's secret could be committed. Add .env to .gitignore, then run harness app pull-env.` });
+	if (status !== 0) return yield* new CommandFailed({ reason: `git check-ignore .env exited ${status}.` });
+});
+const envCheckCommand = Command.make("env-check", {}, Effect.fn("envCheck")(function* envCheck() {
+	const tracked = yield* git(process.cwd(), [
+		"ls-files",
+		"--full-name",
+		"--",
+		":(top,glob)**/.env"
+	]);
+	if (tracked !== "") return yield* new CommandFailed({ reason: `git tracks ${tracked.split("\n").join(", ")}, which holds the app's secret. Run git rm --cached on it, and add .env to .gitignore.` });
+	yield* Console.log("git tracks no .env.");
+})).pipe(Command.withDescription("Fail when git tracks a .env anywhere in the repo, since it holds the app's secret. pnpm check runs it"));
+//#endregion
+//#region src/app-config.ts
+const appConfigFile = "shopify.app.toml";
+const AppConfig = Schema.Struct({
+	application_url: Schema.String,
+	build: Schema.optional(Schema.Struct({ dev_store_url: Schema.optional(Schema.String) }))
+});
+const decodeAppConfig = Effect.fn("decodeAppConfig")(function* decodeAppConfig(source, file) {
+	const toml = yield* Effect.try({
+		catch: (error) => new CommandFailed({ reason: `${file} isn't TOML: ${error instanceof Error ? error.message : String(error)}` }),
+		try: () => parse(source)
+	});
+	const config = yield* Schema.decodeUnknownEffect(AppConfig)(toml).pipe(Effect.mapError((error) => new CommandFailed({ reason: `${file} needs an application_url: ${error.message}` })));
+	const routerHost = yield* Effect.try({
+		catch: () => new CommandFailed({ reason: `${file}'s application_url, ${config.application_url}, isn't a URL.` }),
+		try: () => new URL(config.application_url).hostname
+	});
+	return {
+		devStore: config.build?.dev_store_url,
+		routerHost
+	};
+});
+const readAppConfig$1 = Effect.fn("readAppConfig")(function* readAppConfig(checkout, file = appConfigFile) {
+	const fs = yield* FileSystem.FileSystem;
+	const location = (yield* Path.Path).join(checkout, file);
+	const source = yield* fs.readFileString(location).pipe(Effect.mapError(() => new CommandFailed({ reason: `${location} can't be read. Run this in a Shopify app.` })));
+	return yield* decodeAppConfig(source, location);
+});
+//#endregion
+//#region src/slot/config.ts
+const slotConfigName = "slot";
+const slotConfigFile = `shopify.app.${slotConfigName}.toml`;
+const noWebDirectory = ".shopify/slot-no-web";
+const isTable = (value) => Predicate.isObject(value) && !Array.isArray(value) && !(value instanceof TomlDate);
+const onStage = (url, hosts) => {
+	if (!Predicate.isString(url)) return url;
+	if (url.startsWith("/")) return `https://${hosts.toHost}${url}`;
+	return url.startsWith(`https://${hosts.routerHost}/`) ? url.replace(`//${hosts.routerHost}/`, `//${hosts.toHost}/`) : url;
+};
+const withUrl = (table, key, hosts) => {
+	const url = onStage(table[key], hosts);
+	return url === void 0 ? table : {
+		...table,
+		[key]: url
+	};
+};
+const withSubscriptionUris = (section, key, hosts) => {
+	const subscriptions = section[key];
+	return Array.isArray(subscriptions) ? {
+		...section,
+		[key]: subscriptions.map((subscription) => isTable(subscription) ? withUrl(subscription, "uri", hosts) : subscription)
+	} : section;
+};
+const slotConfig = (source, hosts, webDirectories) => {
+	const config = parse(source);
+	const { app_proxy: appProxy, build, events, webhooks } = config;
+	if (isTable(webhooks)) config.webhooks = withSubscriptionUris(webhooks, "subscriptions", hosts);
+	if (isTable(events)) config.events = withSubscriptionUris(events, "subscription", hosts);
+	if (isTable(appProxy)) config.app_proxy = withUrl(appProxy, "url", hosts);
+	config.build = isTable(build) ? {
+		...build,
+		automatically_update_urls_on_dev: false
+	} : { automatically_update_urls_on_dev: false };
+	if (webDirectories !== void 0) config.web_directories = [...webDirectories];
+	return stringify(config);
+};
+const writeSlotConfig = Effect.fn("writeSlotConfig")(function* writeSlotConfig({ checkout, routerHost, source, stage, webDirectories }) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const toHost = stageHost(routerHost, stage);
+	if (toHost === void 0) return yield* new CommandFailed({ reason: `${stage} isn't a stage name that fits a host under ${routerHost}.` });
+	const text = yield* Effect.try({
+		catch: (error) => new CommandFailed({ reason: `The app config for ${stage} isn't TOML: ${error instanceof Error ? error.message : String(error)}` }),
+		try: () => slotConfig(source, {
+			routerHost,
+			toHost
+		}, webDirectories)
+	});
+	yield* fs.writeFileString(path.join(checkout, slotConfigFile), text).pipe(Effect.mapError((error) => new CommandFailed({ reason: error.message })));
+});
+//#endregion
+//#region src/slot/holder.ts
+const SlotHolder = Schema.Struct({
+	checkout: Schema.String,
+	pid: Schema.NullOr(Schema.Finite),
+	since: Schema.String,
+	stage: Schema.String
+});
+const HolderFile = Schema.fromJsonString(SlotHolder);
+const lockFileIn = (commonDirectory) => Path.Path.use((path) => Effect.succeed(path.join(commonDirectory, "harness-app-store-slot.json")));
+const unusable = (file) => (error) => new CommandFailed({ reason: `Can't use the store slot's lock in ${file}: ${error.message}` });
+const readHolder = Effect.fn("readHolder")(function* readHolder(lockFile) {
+	const fs = yield* FileSystem.FileSystem;
+	if (!(yield* fs.exists(lockFile).pipe(Effect.mapError(unusable(lockFile))))) return;
+	return yield* fs.readFileString(lockFile).pipe(Effect.flatMap(Schema.decodeUnknownEffect(HolderFile)), Effect.mapError(unusable(lockFile)));
+});
+const isAlive = (pid) => Effect.sync(() => {
+	try {
+		globalThis.process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+});
+const isStale = Effect.fn("isStale")(function* isStale(holder) {
+	return !(yield* (yield* FileSystem.FileSystem).exists(holder.checkout).pipe(Effect.orElseSucceed(() => false))) || holder.pid !== null && !(yield* isAlive(holder.pid));
+});
+const holds = Effect.fn("holds")(function* holds(holder, checkout) {
+	return holder !== void 0 && holder.checkout === checkout && !(yield* isStale(holder));
+});
+const heldElsewhere = Effect.fn("heldElsewhere")(function* heldElsewhere(holder, checkout) {
+	return holder !== void 0 && holder.checkout !== checkout && !(yield* isStale(holder));
+});
+const writeHolder = Effect.fn("writeHolder")(function* writeHolder(lockFile, holder) {
+	const fs = yield* FileSystem.FileSystem;
+	yield* Schema.encodeEffect(HolderFile)(holder).pipe(Effect.flatMap((text) => fs.writeFileString(lockFile, `${text}\n`)), Effect.mapError(unusable(lockFile)));
+});
+const giveSlot = Effect.fn("giveSlot")(function* giveSlot(lockFile) {
+	yield* (yield* FileSystem.FileSystem).remove(lockFile, { force: true }).pipe(Effect.mapError(unusable(lockFile)));
+});
+const takeSlot = Effect.fn("takeSlot")(function* takeSlot(lockFile, taking) {
+	const current = yield* readHolder(lockFile);
+	if (current !== void 0 && (yield* heldElsewhere(current, taking.checkout))) return yield* new CommandFailed({ reason: `${current.stage} holds the store's slot (${current.checkout}). Wait for harness app slot give there.` });
+	yield* writeHolder(lockFile, {
+		...taking,
+		since: DateTime.formatIso(yield* DateTime.now)
+	});
+	return current;
+});
+const restoreSlot = (lockFile, before) => before === void 0 ? giveSlot(lockFile) : writeHolder(lockFile, before);
+//#endregion
+//#region src/slot/push.ts
+const ready = "Ready, watching for changes in your app";
+const pushTimeout = "5 minutes";
+const pushPort = 3461;
+const pushPreview = Effect.fn("pushPreview")(function* pushPreview(checkout, routerHost, store) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	yield* fs.makeDirectory(path.join(checkout, noWebDirectory), { recursive: true }).pipe(Effect.mapError((error) => new CommandFailed({ reason: error.message })));
+	const command = ChildProcess.make("shopify", [
+		"app",
+		"dev",
+		"--config",
+		slotConfigName,
+		"--no-update",
+		"--tunnel-url",
+		`https://${routerHost}:${pushPort}`,
+		...store === void 0 ? [] : ["--store", store]
+	], {
+		cwd: checkout,
+		env: { SHOPIFY_CLI_DISABLE_GRAPHIQL: "1" },
+		extendEnv: true,
+		stderr: "inherit",
+		stdin: "ignore"
+	});
+	if (!(yield* Effect.scoped(spawner.spawn(command).pipe(Effect.flatMap((handle) => Stream.decodeText(handle.stdout).pipe(Stream.tap((text) => Effect.sync(() => globalThis.process.stdout.write(text))), Stream.scan(() => "", (seen, text) => `${seen}${text}`), Stream.takeUntil((seen) => seen.includes(ready)), Stream.runLast)))).pipe(Effect.map(Option.exists((seen) => seen.includes(ready))), Effect.mapError((error) => new CommandFailed({ reason: `Can't run shopify (${error.message}). Run this through pnpm, which puts the repo's own shopify on PATH.` })), Effect.timeoutOrElse({
+		duration: pushTimeout,
+		orElse: () => Effect.fail(new CommandFailed({ reason: `shopify app dev didn't report "${ready}" within ${pushTimeout}.` }))
+	})))) return yield* new CommandFailed({ reason: `shopify app dev stopped before it reported "${ready}".` });
+	yield* Console.log(`Pushed ${slotConfigName}'s app config to ${store ?? "the dev store"}.`);
+});
+//#endregion
+//#region src/slot/slot.ts
+const defaultStage = "main";
+const HarnessSettings = Schema.fromJsonString(Schema.Struct({ harness: Schema.optional(Schema.Struct({ defaultBranch: Schema.optional(Schema.String) })) }));
+const slotContext = Effect.fn("slotContext")(function* slotContext(directory) {
+	const checkout = yield* checkoutAt(directory);
+	const { devStore, routerHost } = yield* readAppConfig$1(checkout.root);
+	return {
+		...checkout,
+		devStore,
+		lockFile: yield* lockFileIn(checkout.commonDirectory),
+		routerHost
+	};
+});
+const defaultBranchOf = Effect.fn("defaultBranchOf")(function* defaultBranchOf(checkout) {
+	const fs = yield* FileSystem.FileSystem;
+	const manifest = (yield* Path.Path).join(checkout, "package.json");
+	const branch = (yield* fs.readFileString(manifest).pipe(Effect.flatMap(Schema.decodeUnknownEffect(HarnessSettings)), Effect.mapError((error) => new CommandFailed({ reason: `${manifest}: ${error.message}` })))).harness?.defaultBranch;
+	if (branch === void 0) return yield* new CommandFailed({ reason: `${manifest} has no harness.defaultBranch. harness init writes it.` });
+	return branch;
+});
+const defaultBranchAppConfig = Effect.fn("defaultBranchAppConfig")(function* defaultBranchAppConfig(checkout) {
+	const branch = yield* defaultBranchOf(checkout);
+	yield* git(checkout, [
+		"fetch",
+		"--quiet",
+		"origin",
+		branch
+	]);
+	return {
+		branch,
+		source: yield* git(checkout, ["show", `origin/${branch}:${appConfigFile}`])
+	};
+});
+const pushConfig = Effect.fn("pushConfig")(function* pushConfig(context, source, stage, store) {
+	yield* writeSlotConfig({
+		checkout: context.root,
+		routerHost: context.routerHost,
+		source,
+		stage,
+		webDirectories: [noWebDirectory]
+	});
+	yield* pushPreview(context.root, context.routerHost, store ?? context.devStore);
+});
+const pushDefaultBranch = Effect.fn("pushDefaultBranch")(function* pushDefaultBranch(context, store) {
+	const { branch, source } = yield* defaultBranchAppConfig(context.root);
+	yield* pushConfig(context, source, defaultStage, store);
+	return branch;
+});
+const stageOf = (context, stage) => Effect.try({
+	catch: (error) => new CommandFailed({ reason: error instanceof Error ? error.message : String(error) }),
+	try: () => stage ?? branchStage(context.routerHost, context.branch)
+}).pipe(Effect.filterOrFail((name) => isBranchName(context.routerHost, name), (name) => new CommandFailed({ reason: `${name} isn't a stage name that fits a host under ${context.routerHost}.` })));
+const slotStatus = Effect.fn("slotStatus")(function* slotStatus(context) {
+	const holder = yield* readHolder(context.lockFile);
+	if (holder === void 0) return yield* Console.log("The store's slot is free.");
+	const stale = (yield* isStale(holder)) ? ", but its checkout or process is gone" : "";
+	yield* Console.log(`${holder.stage} holds the store's slot since ${holder.since} (${holder.checkout})${stale}.`);
+});
+const takeAndPush = Effect.fn("takeAndPush")(function* takeAndPush(context, stage, store) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const source = yield* fs.readFileString(path.join(context.root, appConfigFile)).pipe(Effect.mapError((error) => new CommandFailed({ reason: error.message })));
+	const before = yield* takeSlot(context.lockFile, {
+		checkout: context.root,
+		pid: null,
+		stage
+	});
+	yield* pushConfig(context, source, stage, store).pipe(Effect.tapError(() => restoreSlot(context.lockFile, before)));
+	yield* Console.log(`\nThe store runs ${stage}'s app config now. Give it back with harness app slot give.`);
+});
+const giveBack = Effect.fn("giveBack")(function* giveBack(context, store) {
+	const holder = yield* readHolder(context.lockFile);
+	if (yield* heldElsewhere(holder, context.root)) return yield* new CommandFailed({ reason: `${holder?.stage} holds the slot from ${holder?.checkout}, not this checkout.` });
+	const branch = yield* pushDefaultBranch(context, store);
+	yield* giveSlot(context.lockFile);
+	yield* Console.log(`\nThe store runs ${branch}'s app config again, and the slot is free.`);
+});
+//#endregion
+//#region src/dev/command.ts
+const tunnelPort = 3458;
+const localStage = (user) => `local-${user.toLowerCase().replaceAll(/[^a-z0-9]+/gu, "-")}`.replace(/-+$/u, "");
+const giveBackAfterDev = Effect.fn("giveBackAfterDev")(function* giveBackAfterDev(context) {
+	yield* Console.log("\nGiving the store back to the default branch's app config.");
+	const ranOn = yield* readAppConfig$1(context.root, slotConfigFile);
+	yield* pushDefaultBranch(context, ranOn.devStore);
+	yield* giveSlot(context.lockFile);
+});
+const devCommand = Command.make("dev", { shopifyArgs: Argument.String("shopify-args").pipe(Argument.withDescription("Passed on to shopify app dev, after --"), Argument.variadic()) }, Effect.fn("dev")(function* dev({ shopifyArgs }) {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const context = yield* slotContext(globalThis.process.cwd());
+	const user = yield* Config.String("USER").pipe(Config.withDefault("dev"), Effect.mapError(() => new CommandFailed({ reason: "USER can't be read" })));
+	const stage = localStage(user);
+	const tunnelHost = stageHost(context.routerHost, stage);
+	if (tunnelHost === void 0 || !isBranchName(context.routerHost, stage)) return yield* new CommandFailed({ reason: `${stage} isn't a stage name that fits a host under ${context.routerHost}.` });
+	const source = yield* fs.readFileString(path.join(context.root, appConfigFile)).pipe(Effect.mapError((error) => new CommandFailed({ reason: error.message })));
+	const status = yield* Effect.acquireUseRelease(takeSlot(context.lockFile, {
+		checkout: context.root,
+		pid: globalThis.process.pid,
+		stage
+	}).pipe(Effect.mapError((error) => new CommandFailed({ reason: `${error.reason} harness unisian stage proves code without it.` }))), () => Effect.gen(function* runShopifyDev() {
+		yield* Console.log(`harness app dev needs your named tunnel routing ${tunnelHost} to http://localhost:${tunnelPort}. Open the app with /__branch/${stage}.\n`);
+		yield* writeSlotConfig({
+			checkout: context.root,
+			routerHost: context.routerHost,
+			source,
+			stage
+		});
+		return yield* runInherited("shopify", [
+			"app",
+			"dev",
+			"--config",
+			slotConfigName,
+			"--no-update",
+			"--tunnel-url",
+			`https://${tunnelHost}:${tunnelPort}`,
+			...shopifyArgs
+		], { cwd: context.root });
+	}), () => giveBackAfterDev(context));
+	if (status !== 0) return yield* new CommandFailed({ reason: `shopify app dev exited ${status}.` });
+})).pipe(Command.withDescription("Run shopify app dev on this checkout's local-<user> stage, holding the store's slot, and give the store back to the default branch's app config when it stops. The app's shopify.web.toml runs the Alchemy half, harness unisian dev"));
+//#endregion
+//#region src/slot/command.ts
+const store = Flag.String("store").pipe(Flag.withDescription("The store's domain, such as example.myshopify.com. Defaults to dev_store_url in shopify.app.toml"), Flag.optional);
+const here = Effect.suspend(() => slotContext(globalThis.process.cwd()));
+const statusCommand = Command.make("status", {}, () => here.pipe(Effect.flatMap(slotStatus))).pipe(Command.withDescription("Say which checkout holds the store's slot, and since when"));
+const takeCommand = Command.make("take", {
+	stage: Flag.String("stage").pipe(Flag.withDescription("The stage whose host gets the store's traffic. Defaults to w-<branch>"), Flag.optional),
+	store
+}, Effect.fn("take")(function* take({ stage, store }) {
+	const context = yield* here;
+	const name = yield* stageOf(context, Option.getOrUndefined(stage));
+	yield* takeAndPush(context, name, Option.getOrUndefined(store));
+})).pipe(Command.withDescription("Push this checkout's shopify.app.toml to the store as its one dev preview, with webhooks, Events and the app proxy sent to the stage's host, and hold the slot until harness app slot give"));
+const giveCommand = Command.make("give", { store }, Effect.fn("give")(function* give({ store }) {
+	yield* giveBack(yield* here, Option.getOrUndefined(store));
+})).pipe(Command.withDescription("Push the default branch's shopify.app.toml back to the store, sent to the main stage, and free the slot"));
+const slotCommand = Command.make("slot").pipe(Command.withDescription("The store holds one dev preview per app. A branch that changes app config takes the slot to prove it, and gives it back"), Command.withSubcommands([
+	statusCommand,
+	takeCommand,
+	giveCommand
+]));
+//#endregion
+//#region src/stage/command.ts
+const stageCommand = Command.make("stage", { config: Argument.String("config").pipe(Argument.withDescription("The Alchemy entrypoint"), Argument.withDefault("alchemy.run.ts")) }, Effect.fn("stage")(function* stage({ config }) {
+	const { branch, root } = yield* currentCheckout;
+	const { routerHost } = yield* readAppConfig$1(root);
+	const status = yield* runInherited("harness", [
+		"unisian",
+		"stage",
+		"--host",
+		routerHost,
+		config
+	]);
+	if (status !== 0) return yield* new CommandFailed({ reason: `harness unisian stage --host ${routerHost} ${config} exited ${status}.` });
+	yield* Console.log(`In the Admin, open the app's ${switchPath}${branchStage(routerHost, branch)}.`);
+})).pipe(Command.withDescription("Deploy this checkout to its branch's stage with harness unisian stage, under the router host in shopify.app.toml, and say where the Admin opens it"));
+//#endregion
+//#region src/worktree/commands.ts
+const placeholderAppConfig = {
+	SHOPIFY_API_KEY: "dev-stage-destroy",
+	SHOPIFY_API_SECRET: "dev-stage-destroy"
+};
+const pullEnvCommand = Command.make("pull-env", {}, Effect.fn("pullEnv")(function* pullEnv() {
+	const { root } = yield* currentCheckout;
+	yield* envIgnored(root);
+	if ((yield* runInherited("shopify", [
+		"app",
+		"env",
+		"pull",
+		"--path",
+		root
+	], {
+		cwd: root,
+		env: { CI: void 0 }
+	})) !== 0) return yield* new CommandFailed({ reason: `.env wasn't pulled; run shopify app env pull in ${root}.` });
+})).pipe(Command.withDescription("Pull the dev app's .env with shopify app env pull, once git ignores .env. harness worktree runs it in each new worktree"));
+const destroyCommand = Command.make("destroy", {}, Effect.fn("destroy")(function* destroy() {
+	const { commonDirectory, root } = yield* currentCheckout;
+	const holder = yield* readHolder(yield* lockFileIn(commonDirectory));
+	if (yield* holds(holder, root)) return yield* new CommandFailed({ reason: `${root} holds the store's slot; run harness app slot give there first.` });
+	if ((yield* runInherited("harness", ["unisian", "destroy"], {
+		cwd: root,
+		env: {
+			...placeholderAppConfig,
+			CI: void 0
+		}
+	})) !== 0) return yield* new CommandFailed({ reason: "harness unisian destroy failed." });
+})).pipe(Command.withDescription("Refuse while this checkout holds the store's slot, then destroy its stages with harness unisian destroy under a placeholder app config, since alchemy.run.ts reads SHOPIFY_API_KEY and SHOPIFY_API_SECRET. harness worktree --done runs it"));
+//#endregion
+//#region src/extensions/files.ts
+const filesNamed = Effect.fn("filesNamed")(function* filesNamed(name) {
+	return (yield* (yield* ChildProcessSpawner.ChildProcessSpawner).lines(ChildProcess.make("git", [
+		"ls-files",
+		"--cached",
+		"--others",
+		"--exclude-standard",
+		`*${name}`
+	])).pipe(Effect.mapError((error) => new CommandFailed({ reason: `Can't list this checkout's files: ${error.message}` })))).filter((file) => path.basename(file) === name && existsSync(file)).toSorted();
+});
+//#endregion
+//#region src/extensions/functions.ts
+const ExtensionConfig = Schema.Struct({ extensions: Schema.optional(Schema.Array(Schema.Struct({ type: Schema.optional(Schema.String) }))) });
+const isFunction = (config) => Effect.try({
+	catch: (error) => new CommandFailed({ reason: `Can't read ${config}: ${error instanceof Error ? error.message : String(error)}` }),
+	try: () => (Schema.decodeUnknownSync(ExtensionConfig)(parse(readFileSync(config, "utf-8"))).extensions ?? []).some(({ type }) => type === "function")
+});
+const functionsWithoutCargo = Effect.gen(function* functionsWithoutCargo() {
+	const configs = yield* filesNamed("shopify.extension.toml");
+	const manifests = new Set((yield* filesNamed("Cargo.toml")).map((manifest) => path.dirname(manifest)));
+	return (yield* Effect.filter(configs, isFunction)).map((config) => path.dirname(config)).filter((folder) => !manifests.has(folder));
+});
+const functionsCommand = Command.make("functions", {}, () => Effect.gen(function* functions() {
+	const missing = yield* functionsWithoutCargo;
+	if (missing.length > 0) return yield* new CommandFailed({ reason: [
+		"Shopify Functions are Rust, and these Function folders have no Cargo.toml:",
+		...missing.map((folder) => `  ${folder}`),
+		"Write each in Rust: shopify app generate extension --flavor rust."
+	].join("\n") });
+	yield* Console.log("harness app functions: every Shopify Function is a Rust crate.");
+})).pipe(Command.withDescription("Fail when a Shopify Function (a shopify.extension.toml with type = \"function\") has no Cargo.toml beside it"));
+//#endregion
+//#region src/extensions/rust.ts
+const cargo = Effect.fn("cargo")(function* cargo(args) {
+	return yield* (yield* ChildProcessSpawner.ChildProcessSpawner).exitCode(ChildProcess.make("cargo", args, {
+		stderr: "inherit",
+		stdin: "inherit",
+		stdout: "inherit"
+	})).pipe(Effect.mapError((error) => new CommandFailed({ reason: `Can't run cargo (${error.message}). This repo has a Cargo.toml, so it needs Rust: https://rustup.rs.` })));
+});
+const eachCrate = Effect.fn("eachCrate")(function* eachCrate(runs) {
+	const manifests = yield* filesNamed("Cargo.toml");
+	if (manifests.length === 0) {
+		yield* Console.log("harness app rust: no Cargo.toml in this repo, so nothing to run.");
+		return;
+	}
+	for (const [subcommand, ...rest] of runs) for (const manifest of manifests) {
+		yield* Console.log(`cargo ${subcommand} ${manifest}`);
+		if ((yield* cargo([
+			subcommand,
+			"--manifest-path",
+			manifest,
+			...rest
+		])) !== 0) return yield* new CommandFailed({ reason: `cargo ${subcommand} failed on ${manifest}.` });
+	}
+});
+const checkCommand = Command.make("check", {}, () => eachCrate([["fmt", "--check"], [
+	"clippy",
+	"--all-targets",
+	"--locked",
+	"--",
+	"-D",
+	"warnings"
+]])).pipe(Command.withDescription("Run cargo fmt --check, then cargo clippy -D warnings, on every Cargo.toml git lists"));
+const testCommand = Command.make("test", {}, () => eachCrate([["test", "--locked"]])).pipe(Command.withDescription("Run cargo test on every Cargo.toml git lists"));
+const rustCommand = Command.make("rust").pipe(Command.withDescription("Rust checks for the repo's crates and Shopify Functions"), Command.withSubcommands([checkCommand, testCommand]));
+//#endregion
+//#region src/extensions/switch.ts
+const extensionFiles = "apps/*/extensions/*/shopify.extension.toml";
+//#endregion
+//#region src/verify/admin.ts
+const ClientCredentialsToken = Schema.Struct({
+	access_token: Schema.String,
+	expires_in: Schema.Int,
+	scope: Schema.String
+});
+const AdminDocumentBody = Schema.Struct({
+	data: Schema.optional(Schema.NullOr(Schema.Json)),
+	errors: Schema.optional(Schema.Array(Schema.Json))
+});
+const clientCredentialsToken = Effect.fn("clientCredentialsToken")(function* clientCredentialsToken(app) {
+	const client = yield* HttpClient.HttpClient;
+	const request = HttpClientRequest.post(`https://${app.shop}/admin/oauth/access_token`).pipe(HttpClientRequest.acceptJson, HttpClientRequest.bodyUrlParams({
+		client_id: app.apiKey,
+		client_secret: Redacted.value(app.apiSecret),
+		grant_type: "client_credentials"
+	}));
+	const response = yield* client.execute(request).pipe(Effect.mapError((error) => new VerifyFailed({ check: `The client credentials request to ${app.shop} failed: ${error.message}` })));
+	if (response.status < 200 || response.status >= 300) return yield* new VerifyFailed({ check: `Shopify refused the client credentials grant for ${app.shop} (HTTP ${response.status}). The app and the store must be in the same Dev Dashboard organization, and the app installed on the store` });
+	return yield* HttpClientResponse.schemaBodyJson(ClientCredentialsToken)(response).pipe(Effect.mapError(() => new VerifyFailed({ check: `${app.shop} answered the client credentials grant without an access_token` })));
+});
+const openAdmin = Effect.fn("openAdmin")(function* openAdmin(app) {
+	const client = yield* HttpClient.HttpClient;
+	const token = yield* clientCredentialsToken(app);
+	const accessToken = Redacted.make(token.access_token);
+	const now = yield* Clock.currentTimeMillis;
+	const send = (document, variables = {}) => Effect.gen(function* sendAdminDocument() {
+		const request = HttpClientRequest.post(`https://${app.shop}/admin/api/${app.apiVersion}/graphql.json`).pipe(HttpClientRequest.acceptJson, HttpClientRequest.setHeader("X-Shopify-Access-Token", Redacted.value(accessToken)), HttpClientRequest.bodyJsonUnsafe({
+			query: document,
+			variables
+		}));
+		const failed = (reason) => new VerifyFailed({ check: `The Admin API request to ${app.shop} failed: ${reason}` });
+		const response = yield* client.execute(request).pipe(Effect.mapError((error) => failed(error.message)));
+		const body = yield* HttpClientResponse.schemaBodyJson(AdminDocumentBody)(response).pipe(Effect.mapError(() => failed(`HTTP ${response.status} with a body that isn't GraphQL`)));
+		return {
+			data: body.data ?? null,
+			errors: body.errors ?? [],
+			status: response.status
+		};
+	});
+	return {
+		accessToken,
+		app,
+		expiresAt: now + token.expires_in * 1e3,
+		send
+	};
+});
+const secretsOf = (admin) => [admin.accessToken, admin.app.apiSecret];
+const readData = (admin, document, data, variables) => admin.send(document, variables).pipe(Effect.flatMap((result) => result.status === 200 && result.errors.length === 0 && result.data !== null ? Schema.decodeUnknownEffect(data)(result.data).pipe(Effect.mapError((issue) => new VerifyFailed({
+	check: "The Admin API answered in an unexpected shape",
+	detail: String(issue)
+}))) : Effect.fail(new VerifyFailed({
+	check: `The Admin API answered ${result.status} with errors`,
+	detail: [...result.errors]
+}))));
+//#endregion
+//#region src/verify/app-config.ts
+const targetDescriptions = {
+	app: "The app config: reads shopify.app.<app>.toml and .env.<app>. Leave it out for shopify.app.toml and .env",
+	shop: "A second store's domain, such as other-store.myshopify.com. Leave it out for the dev store, [build] dev_store_url in the app's config"
+};
+const ShopDomain = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9-]*\.myshopify\.com$/u));
+const AppToml = Schema.Struct({
+	app_proxy: Schema.optional(Schema.Struct({
+		prefix: Schema.String,
+		subpath: Schema.String
+	})),
+	application_url: Schema.String,
+	build: Schema.optional(Schema.Struct({ dev_store_url: Schema.optional(Schema.String) })),
+	client_id: Schema.String,
+	webhooks: Schema.Struct({ api_version: Schema.String })
+});
+const appConfigName = /^shopify\.app(?:\.[\w-]+)?\.toml$/u;
+const envEntries = (text) => new Map(text.split("\n").flatMap((line) => {
+	const match = /^(?<key>[A-Z0-9_]+)=(?<value>.*)$/u.exec(line.trim());
+	return match?.groups?.key === void 0 ? [] : [[match.groups.key, (match.groups.value ?? "").replaceAll(/^["']|["']$/gu, "")]];
+}));
+const readText = (file, hint) => FileSystem.FileSystem.use((fs) => fs.readFileString(file)).pipe(Effect.mapError(() => new VerifyFailed({ check: `Can't read ${file}. ${hint}` })));
+const configFileOf = (app) => app === void 0 ? "shopify.app.toml" : `shopify.app.${app}.toml`;
+const readAppToml = (config) => readText(config, "Run this from the app's folder, or pass --app <config> for shopify.app.<config>.toml.").pipe(Effect.flatMap((text) => Effect.try({
+	catch: () => new VerifyFailed({ check: `${config} isn't valid TOML` }),
+	try: () => parse(text)
+})), Effect.flatMap((toml) => Schema.decodeUnknownEffect(AppToml)(toml).pipe(Effect.mapError(() => new VerifyFailed({ check: `${config} needs client_id, application_url and [webhooks] api_version` })))));
+const appUrlsOfEveryConfig = FileSystem.FileSystem.use((fs) => fs.readDirectory(".")).pipe(Effect.mapError(() => new VerifyFailed({ check: "Can't list the app's configs" })), Effect.flatMap((entries) => Effect.forEach(entries.filter((entry) => appConfigName.test(entry)).toSorted((a, b) => a.localeCompare(b)), (config) => readAppToml(config).pipe(Effect.map((toml) => toml.application_url)))));
+const readSecrets = (envFile, clientId) => Effect.gen(function* readEnvFile() {
+	const env = envEntries(yield* readText(envFile, `Write it with \`shopify app env pull${envFile === ".env" ? "" : ` --config ${envFile.slice(5)}`}\`.`));
+	const apiKey = env.get("SHOPIFY_API_KEY");
+	const apiSecret = env.get("SHOPIFY_API_SECRET");
+	if (apiKey === void 0 || apiSecret === void 0 || apiSecret === "") return yield* new VerifyFailed({ check: `${envFile} needs SHOPIFY_API_KEY and SHOPIFY_API_SECRET` });
+	if (apiKey !== clientId) return yield* new VerifyFailed({ check: `${envFile} holds another app's key (${apiKey}), not this config's client_id (${clientId}). Pull it again for this config.` });
+	return {
+		apiKey,
+		apiSecret: Redacted.make(apiSecret)
+	};
+});
+const toShop = (shop, from) => Schema.decodeEffect(ShopDomain)(shop).pipe(Effect.mapError(() => new VerifyFailed({ check: `${shop} (${from}) isn't a store domain like my-store.myshopify.com` })));
+const readAppConfig = Effect.fn("readAppConfig")(function* readAppConfig(target) {
+	const config = configFileOf(target.app);
+	const envFile = target.app === void 0 ? ".env" : `.env.${target.app}`;
+	const toml = yield* readAppToml(config);
+	const secrets = yield* readSecrets(envFile, toml.client_id);
+	const devStore = toml.build?.dev_store_url ?? null;
+	const chosen = target.shop ?? devStore;
+	if (chosen === null) return yield* new VerifyFailed({ check: `${config} names no dev store in [build] dev_store_url. Add it, or pass --shop` });
+	const shop = yield* toShop(chosen, target.shop === void 0 ? `${config} [build] dev_store_url` : "--shop");
+	return {
+		...secrets,
+		apiVersion: toml.webhooks.api_version,
+		appUrl: toml.application_url,
+		config,
+		devStore,
+		envFile,
+		proxyPrefix: toml.app_proxy === void 0 ? null : `/${toml.app_proxy.prefix}/${toml.app_proxy.subpath}`,
+		shop
+	};
+});
+//#endregion
+//#region src/verify/identity.ts
+const identityDocument = `query HarnessVerifyIdentity {
+	shop { name myshopifyDomain }
+	currentAppInstallation { app { apiKey handle title } accessScopes { handle } }
+}`;
+const Identity = Schema.Struct({
+	currentAppInstallation: Schema.Struct({
+		accessScopes: Schema.Array(Schema.Struct({ handle: Schema.String })),
+		app: Schema.Struct({
+			apiKey: Schema.String,
+			handle: Schema.String,
+			title: Schema.String
+		})
+	}),
+	shop: Schema.Struct({
+		myshopifyDomain: Schema.String,
+		name: Schema.String
+	})
+});
+const appIdentity = Effect.fn("appIdentity")(function* appIdentity(admin) {
+	const identity = yield* readData(admin, identityDocument, Identity);
+	const { app, accessScopes } = identity.currentAppInstallation;
+	if (identity.shop.myshopifyDomain !== admin.app.shop) return yield* new VerifyFailed({ check: `The token answered for ${identity.shop.myshopifyDomain}, not ${admin.app.shop}` });
+	if (app.apiKey !== admin.app.apiKey) return yield* new VerifyFailed({ check: `The installed app is ${app.handle} (${app.apiKey}), not the one ${admin.app.config} names` });
+	return {
+		app: {
+			apiKey: app.apiKey,
+			handle: app.handle,
+			title: app.title
+		},
+		scopes: accessScopes.map((scope) => scope.handle),
+		shop: {
+			domain: identity.shop.myshopifyDomain,
+			name: identity.shop.name
+		}
+	};
+});
+//#endregion
+//#region src/verify/store-fields.ts
+const storeFields = {
+	app: optionalFlag("app", targetDescriptions.app),
+	shop: optionalFlag("shop", targetDescriptions.shop)
+};
+//#endregion
+//#region src/verify/admin-url.ts
+const adminPageUrl = Effect.fn("adminPageUrl")(function* adminPageUrl(target, path) {
+	const config = yield* readAppConfig(target);
+	const { app } = yield* appIdentity(yield* openAdmin(config));
+	const appPath = path ?? "/app";
+	const store = config.shop.replace(/\.myshopify\.com$/u, "");
+	return {
+		handle: app.handle,
+		shop: config.shop,
+		url: `https://admin.shopify.com/store/${store}/apps/${app.handle}${appPath.startsWith("/") ? appPath : `/${appPath}`}`
+	};
+});
+const adminUrlCommand = command("admin-url", "Print the Shopify Admin URL that opens a page of the app, embedded, the way a merchant reaches it. Reads the app's handle from Shopify rather than guessing it", {
+	...storeFields,
+	path: optionalFlag("path", "The app path to open, such as /app/settings. Defaults to /app")
+}, ({ path, ...target }) => adminPageUrl(target, path).pipe(Effect.provide(FetchHttpClient.layer)));
+//#endregion
+//#region src/verify/branch-step.ts
+const shopifyPartition = "https://shopify.com";
+const adminPage = "https://admin.shopify.com/";
+const BranchInput = Schema.Struct({
+	app: Schema.optional(Schema.String),
+	headed: Schema.optional(Schema.Boolean),
+	name: Schema.String
+});
+const branchStep = flowStep(BranchInput, ({ app, headed = false, name }) => Effect.gen(function* routeToBranch() {
+	const config = configFileOf(app);
+	const appUrl = new URL((yield* readAppToml(config)).application_url);
+	if (!isBranchName(appUrl.hostname, name)) return yield* new VerifyFailed({ check: `${name} isn't a stage the branch router at ${appUrl.hostname} can route to, such as main, pr-31 or w-my-branch` });
+	const now = yield* Clock.currentTimeMillis;
+	yield* Effect.scoped(openedPage(headed, adminPage).pipe(Effect.flatMap((page) => attempt(`Can't set the ${branchCookie} cookie`, () => page.context().addCookies([{
+		expires: Math.floor(now / 1e3) + 604800,
+		httpOnly: true,
+		name: branchCookie,
+		partitionKey: shopifyPartition,
+		sameSite: "None",
+		secure: true,
+		url: appUrl.origin,
+		value: name
+	}])))));
+	return {
+		app: appUrl.origin,
+		branch: name,
+		config
+	};
+}));
+//#endregion
+//#region src/verify/graphql.ts
+const Variables = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Json));
+const decodeVariables = (variables) => variables === void 0 ? Effect.succeed({}) : Schema.decodeUnknownEffect(Variables)(variables).pipe(Effect.mapError(() => new VerifyFailed({ check: "--variables isn't a JSON object, e.g. '{\"id\":\"gid://shopify/Shop/1\"}'" })));
+const documentFrom = (query, file) => {
+	if (query !== void 0) return Effect.succeed(query);
+	if (file === void 0) return Effect.fail(new VerifyFailed({ check: "Pass the document with --query or --file" }));
+	return FileSystem.FileSystem.use((fs) => fs.readFileString(file)).pipe(Effect.mapError(() => new VerifyFailed({ check: `Can't read ${file}` })));
+};
+const operationsOf = (document) => Effect.try({
+	catch: (error) => new VerifyFailed({ check: `Not a GraphQL document: ${error instanceof Error ? error.message : String(error)}` }),
+	try: () => parse$1(document).definitions.flatMap((definition) => definition.kind === Kind.OPERATION_DEFINITION ? [definition.operation] : [])
+});
+const graphqlCommand = command("graphql", "Send one Admin GraphQL document as the app, with its own token from the client credentials grant. Refuses a mutation, before calling Shopify, unless --write is given, and --write is only for a write the feature file allows", {
+	...storeFields,
+	file: optionalFlag("file", "Read the document from this file"),
+	out: optionalFlag("out", "Also write the result to <artifacts>/<out>, e.g. admin-graphql/shop.json"),
+	query: optionalFlag("query", "The document, e.g. '{ shop { name } }'"),
+	variables: optionalFlag("variables", "The variables as a JSON object"),
+	write: toggle("write", "Allow a mutation")
+}, ({ file, out, query, variables, write, ...target }) => Effect.gen(function* runGraphql() {
+	const document = yield* documentFrom(query, file);
+	const operations = yield* operationsOf(document);
+	const values = yield* decodeVariables(variables);
+	if (operations.includes("mutation") && !write) return yield* new VerifyFailed({ check: "That document is a mutation. Run it again with --write only if the feature file allows this write" });
+	const config = yield* readAppConfig(target);
+	const admin = yield* openAdmin(config);
+	const result = yield* admin.send(document, values);
+	const report = {
+		apiVersion: config.apiVersion,
+		data: result.data,
+		errors: [...result.errors],
+		shop: config.shop,
+		status: result.status
+	};
+	const evidence = out === void 0 ? null : yield* writeEvidence(out, report, secretsOf(admin));
+	if (result.status !== 200 || result.errors.length > 0 || result.data === null) return yield* new VerifyFailed({
+		check: `The Admin API answered ${result.status}${evidence === null ? "" : ` (evidence in ${evidence})`}`,
+		detail: report.errors
+	});
+	return {
+		...report,
+		evidence
+	};
+}).pipe(Effect.provide(FetchHttpClient.layer)));
+//#endregion
+//#region src/verify/safe-write.ts
+const namespace = "$app";
+const key = "harness_verify";
+const readProbe = `query HarnessVerifySafeWriteRead {
+	shop { id metafield(namespace: "${namespace}", key: "${key}") { value } }
+}`;
+const setProbe = `mutation HarnessVerifySafeWriteSet($metafields: [MetafieldsSetInput!]!) {
+	metafieldsSet(metafields: $metafields) { userErrors { field message } }
+}`;
+const deleteProbe = `mutation HarnessVerifySafeWriteDelete($metafields: [MetafieldIdentifierInput!]!) {
+	metafieldsDelete(metafields: $metafields) { userErrors { field message } }
+}`;
+const ShopProbe = Schema.Struct({ shop: Schema.Struct({
+	id: Schema.String,
+	metafield: Schema.NullOr(Schema.Struct({ value: Schema.String }))
+}) });
+const UserErrors = Schema.Array(Schema.Struct({ message: Schema.String }));
+const read = (admin) => readData(admin, readProbe, ShopProbe).pipe(Effect.map(({ shop }) => ({
+	ownerId: shop.id,
+	value: shop.metafield?.value ?? null
+})));
+const set = (admin, ownerId, value) => readData(admin, setProbe, Schema.Struct({ metafieldsSet: Schema.Struct({ userErrors: UserErrors }) }), { metafields: [{
+	key,
+	namespace,
+	ownerId,
+	type: "single_line_text_field",
+	value
+}] }).pipe(Effect.map(({ metafieldsSet }) => metafieldsSet.userErrors));
+const remove = (admin, ownerId) => readData(admin, deleteProbe, Schema.Struct({ metafieldsDelete: Schema.Struct({ userErrors: UserErrors }) }), { metafields: [{
+	key,
+	namespace,
+	ownerId
+}] }).pipe(Effect.map(({ metafieldsDelete }) => metafieldsDelete.userErrors));
+const expectNoUserErrors = (step) => (errors) => errors.length === 0 ? Effect.void : Effect.fail(new VerifyFailed({
+	check: `safe-write's ${step} failed`,
+	detail: errors.map((error) => error.message)
+}));
+const safeWriteRoundTrip = Effect.fn("safeWriteRoundTrip")(function* safeWriteRoundTrip(admin) {
+	const before = yield* read(admin);
+	const now = yield* Clock.currentTimeMillis;
+	const probe = `harness verify ${DateTime.formatIso(DateTime.makeUnsafe(now))}`;
+	yield* set(admin, before.ownerId, probe).pipe(Effect.flatMap(expectNoUserErrors("write")));
+	const readBack = (yield* read(admin)).value;
+	yield* (before.value === null ? remove(admin, before.ownerId) : set(admin, before.ownerId, before.value)).pipe(Effect.flatMap(expectNoUserErrors("restore")));
+	const restoredTo = (yield* read(admin)).value;
+	if (readBack !== probe || restoredTo !== before.value) return yield* new VerifyFailed({
+		check: "safe-write didn't round-trip",
+		detail: {
+			previous: before.value,
+			probe,
+			readBack,
+			restoredTo
+		}
+	});
+	return {
+		key,
+		namespace,
+		previous: before.value,
+		probe,
+		readBack,
+		restoredTo,
+		shop: admin.app.shop
+	};
+});
+const safeWriteCommand = command("safe-write", `Make the one write verification may always make: set the app-owned ${namespace}.${key} metafield on the shop, read it back, then restore what was there`, storeFields, (target) => Effect.gen(function* runSafeWrite() {
+	const admin = yield* openAdmin(yield* readAppConfig(target));
+	const report = yield* safeWriteRoundTrip(admin);
+	const evidence = yield* writeEvidence("admin-graphql/safe-write.json", report, secretsOf(admin));
+	return {
+		...report,
+		evidence
+	};
+}).pipe(Effect.provide(FetchHttpClient.layer)));
+//#endregion
+//#region src/verify/delivery.ts
+const pathFor = {
+	event: "/events",
+	webhook: "/webhooks"
+};
+const clockSkewSeconds = 5;
+const Kind$1 = Schema.Literals(["webhook", "event"]);
+const sendWrite = (admin, step, document, variables) => admin.send(document, variables).pipe(Effect.flatMap((result) => result.status === 200 && result.errors.length === 0 && result.data !== null ? Effect.succeed(result.data) : Effect.fail(new VerifyFailed({
+	check: `${step} answered ${result.status}`,
+	detail: [...result.errors]
+}))));
+const makeChange = (admin, write, restore, variables) => Effect.gen(function* changeTheStore() {
+	if (write === void 0) return {
+		restored: null,
+		safeWrite: yield* safeWriteRoundTrip(admin),
+		written: null
+	};
+	const written = yield* sendWrite(admin, "--write", write, variables);
+	return {
+		restored: restore === void 0 ? null : yield* sendWrite(admin, "--restore", restore, variables),
+		safeWrite: null,
+		written
+	};
+});
+const decodeReport = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Json));
+const runWorkersLogs = (args) => Effect.scoped(Effect.gen(function* spawnWorkersLogs() {
+	const handle = yield* (yield* ChildProcessSpawner.ChildProcessSpawner).spawn(ChildProcess.make(process.execPath, [
+		...process.execArgv,
+		process.argv[1] ?? "",
+		"verify",
+		"workers-logs",
+		...args
+	], {
+		stderr: "inherit",
+		stdin: "ignore",
+		stdout: "pipe"
+	}));
+	const [stdout, exitCode] = yield* Effect.all([handle.stdout.pipe(Stream.decodeText(), Stream.mkString), handle.exitCode], { concurrency: 2 });
+	return {
+		exitCode,
+		stdout
+	};
+})).pipe(Effect.mapError((error) => new VerifyFailed({ check: `Can't run harness verify workers-logs: ${error.message}` })));
+const deliveryCommand = command("delivery", "Make a real change on the store, then run harness-unisian's harness verify workers-logs for the webhook or Events delivery Shopify sent for it, from the moment of the change. Passes when the app answered 200. The change is the safe write unless --write gives a mutation the feature file allows", {
+	...storeFields,
+	handle: optionalFlag("handle", "The Events subscription handle to wait for"),
+	kind: checkedArgument("kind", "webhook (/webhooks) or event (/events)", Kind$1),
+	out: optionalFlag("out", "Where the change's evidence goes under the artifacts folder. Defaults to deliveries/<kind>.json"),
+	profile: optionalFlag("profile", "The Alchemy profile whose Cloudflare login reads Workers Logs. Defaults to workers-logs' own default"),
+	restore: optionalFlag("restore", "A mutation that undoes --write, sent right after it"),
+	timeout: optionalFlag("timeout", "Seconds to wait for the delivery. Defaults to workers-logs' own default"),
+	topic: optionalFlag("topic", "The webhook topic to wait for, e.g. shop/update"),
+	variables: optionalFlag("variables", "The variables for --write and --restore, as a JSON object"),
+	write: optionalFlag("write", "A mutation that makes the change, instead of the safe write")
+}, ({ handle, kind, out, profile, restore, timeout, topic, variables, write, ...target }) => Effect.gen(function* runDelivery() {
+	const config = yield* readAppConfig(target);
+	const values = yield* decodeVariables(variables);
+	const admin = yield* openAdmin(config);
+	const startedAt = yield* Clock.currentTimeMillis;
+	const change = yield* makeChange(admin, write, restore, values);
+	const appHost = new URL(config.appUrl).host;
+	const otherHosts = (yield* appUrlsOfEveryConfig).map((url) => new URL(url).host).filter((host) => host !== appHost);
+	const evidence = yield* writeEvidence(out ?? `deliveries/${kind}.json`, {
+		change,
+		kind,
+		shop: config.shop
+	}, secretsOf(admin));
+	const since = Math.ceil(((yield* Clock.currentTimeMillis) - startedAt) / 1e3) + clockSkewSeconds;
+	const args = [
+		"--host",
+		appHost,
+		...otherHosts.flatMap((host) => ["--other-host", host]),
+		"--path",
+		pathFor[kind],
+		"--responded",
+		`${kind} responded`,
+		"--where",
+		`shop=${config.shop}`,
+		...topic === void 0 ? [] : ["--where-if-logged", `topic=${topic}`],
+		...handle === void 0 ? [] : ["--where-if-logged", `handle=${handle}`],
+		"--since",
+		String(since),
+		...profile === void 0 ? [] : ["--profile", profile],
+		...timeout === void 0 ? [] : ["--timeout", timeout]
+	];
+	const { exitCode, stdout } = yield* runWorkersLogs(args);
+	if (exitCode !== 0) return yield* new VerifyFailed({ check: `harness verify workers-logs found no 200 for the ${kind} delivery; its reason is above (the change's evidence is in ${evidence})` });
+	return {
+		change,
+		delivery: yield* decodeReport(stdout).pipe(Effect.mapError(() => new VerifyFailed({ check: "harness verify workers-logs printed something that isn't JSON" }))),
+		evidence,
+		shop: config.shop
+	};
+}).pipe(Effect.provide(FetchHttpClient.layer)));
+//#endregion
+//#region src/verify/doctor.ts
+const doctorFlags = targetDescriptions;
+const doctor = Effect.gen(function* runAppDoctor() {
+	const { app, shop } = yield* DoctorFlags;
+	const config = yield* readAppConfig({
+		app,
+		shop
+	});
+	const admin = yield* openAdmin(config);
+	const identity = yield* appIdentity(admin);
+	const report = {
+		...identity,
+		apiVersion: config.apiVersion,
+		config: config.config,
+		devStore: config.devStore,
+		scopes: [...identity.scopes],
+		tokenExpiresAt: DateTime.formatIso(DateTime.makeUnsafe(admin.expiresAt))
+	};
+	const evidence = yield* writeEvidence("admin-graphql/doctor.json", report, secretsOf(admin));
+	return {
+		...report,
+		evidence
+	};
+}).pipe(Effect.provide(FetchHttpClient.layer));
+//#endregion
+//#region src/verify/proxy-signature.ts
+const hex = (bytes) => [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+const byCodePoint = (a, b) => {
+	if (a === b) return 0;
+	return a < b ? -1 : 1;
+};
+const proxySignature = Effect.fn("proxySignature")(function* proxySignature(secret, params) {
+	const message = [...params].map(([name, values]) => `${name}=${values.join(",")}`).toSorted(byCodePoint).join("");
+	const encoder = new TextEncoder();
+	const key = yield* Effect.promise(() => crypto.subtle.importKey("raw", encoder.encode(Redacted.value(secret)), {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, false, ["sign"]));
+	const signature = yield* Effect.promise(() => crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+	return hex(signature);
+});
+//#endregion
+//#region src/verify/proxy.ts
+const chromeUserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36";
+const bodyLimit = 2e4;
+const proxyCommand = command("proxy", "Send a request to the app signed the way Shopify signs app proxy requests, as the storefront would forward it. The signature is the merchant's auth path, not a bypass", {
+	...storeFields,
+	base: optionalFlag("base", "The origin that serves the app, e.g. a stage's. Defaults to the config's application_url"),
+	body: optionalFlag("body", "The request body, for POST"),
+	customer: optionalFlag("customer", "logged_in_customer_id: a customer ID on this shop, resolved this run. Leave it out for a logged-out visitor"),
+	method: optionalFlag("method", "GET or POST. Defaults to GET", Schema.Literals(["GET", "POST"])),
+	out: optionalFlag("out", "Also write the response to <artifacts>/<out>, e.g. proxy/registry.json"),
+	path: argument("path", "The app path Shopify forwards to, e.g. /proxy/registry?page=2"),
+	prefix: optionalFlag("prefix", "path_prefix, e.g. /apps/wishlist. Defaults to the config's [app_proxy] prefix and subpath")
+}, ({ base, body, customer, method = "GET", out, path, prefix, ...target }) => Effect.gen(function* runProxy() {
+	const config = yield* readAppConfig(target);
+	const pathPrefix = prefix ?? config.proxyPrefix;
+	if (pathPrefix === null) return yield* new VerifyFailed({ check: `${config.config} has no [app_proxy]; pass --prefix` });
+	const url = new URL(path, base ?? config.appUrl);
+	const now = yield* Clock.currentTimeMillis;
+	const params = new Map([
+		...[...new Set(url.searchParams.keys())].map((name) => [name, url.searchParams.getAll(name)]),
+		["logged_in_customer_id", [customer ?? ""]],
+		["path_prefix", [pathPrefix]],
+		["shop", [config.shop]],
+		["timestamp", [String(Math.floor(now / 1e3))]]
+	]);
+	const signature = yield* proxySignature(config.apiSecret, params);
+	const signed = new URL(url.pathname, url);
+	for (const [name, values] of params) for (const value of values) signed.searchParams.append(name, value);
+	const unsigned = signed.toString();
+	signed.searchParams.set("signature", signature);
+	const request = HttpClientRequest.make(method === "POST" ? "POST" : "GET")(signed.toString()).pipe(HttpClientRequest.setHeader("User-Agent", chromeUserAgent), body === void 0 ? (same) => same : HttpClientRequest.bodyText(body));
+	const response = yield* (yield* HttpClient.HttpClient).pipe(HttpClient.followRedirects(0)).execute(request).pipe(Effect.mapError((error) => new VerifyFailed({ check: `Request to ${unsigned} failed: ${error.message}` })));
+	const report = {
+		body: (yield* response.text.pipe(Effect.orElseSucceed(() => ""))).slice(0, bodyLimit),
+		location: response.headers.location ?? null,
+		method,
+		shop: config.shop,
+		status: response.status,
+		url: unsigned
+	};
+	const evidence = out === void 0 ? null : yield* writeEvidence(out, report, [config.apiSecret]);
+	return {
+		...report,
+		evidence
+	};
+}).pipe(Effect.provide(FetchHttpClient.layer)));
+//#endregion
+//#region src/verify/skill-blocks.ts
+const skill = (slot, lines) => ({
+	file: "skills/verify/SKILL.md",
+	id: slot,
+	slot,
+	text: lines.join("\n")
+});
+const verifySkillBlocks = [
+	skill("verify-what", [
+		"## A merchant, in Shopify Admin",
+		"",
+		"{{name}} is an embedded Shopify app. A merchant only uses it inside Shopify Admin: Polaris in the app's iframe, App Bridge navigation in the Admin around it. Proof is what the merchant sees there, or a request signed the way Shopify signs app proxy traffic. Fetching a route outside Admin, minting a token, `vite preview` and `pnpm test` don't prove the app: they never run App Bridge or talk to Shopify as the installed app."
+	]),
+	skill("verify-setup", [
+		"- The store is the app's dev store, `[build] dev_store_url` in `shopify.app.toml`, the one place it's named, and `pnpm verify doctor` prints it. A feature that needs a second store, such as one that copies between stores, names it in its feature file's frontmatter, and every app command takes `--shop <domain>` for it.",
+		"- `.env` holds the app's key and secret. `pnpm worktree` pulls it into a new worktree (`harness app pull-env`), and `shopify app env pull` refreshes it. A second config, `shopify.app.<config>.toml`, reads `.env.<config>` with `--app <config>`.",
+		"- The browser's login is a Shopify login: run `pnpm verify open https://admin.shopify.com/ --headed` and have a person log in once.",
+		"- The dev app's URL is the branch router, so prove a branch on its own stage. Deploy it with `pnpm exec harness app stage`, then start a flow with `{ \"step\": \"branch\", \"name\": \"w-<branch>\" }`, which sets the router's `__Host-branch` cookie in this checkout's browser, under Shopify's partition, for seven days. Without it the browser keeps its last choice, or gets `main`. A branch that changes `shopify.app.toml` or an extension takes the store's slot first."
+	]),
+	skill("verify-doctor", [
+		"```sh",
+		"pnpm verify doctor",
+		"```",
+		"",
+		"The app's check gets the app's own Admin token for the store through the client credentials grant, and passes when Shopify answers as this app installed on this store. It prints `devStore`, needs no dev server and no login, and writes `admin-graphql/doctor.json`. `--shop <domain>` checks a second store instead. A failure names what to fix: a missing `.env`, an `.env` for another app, a config with no dev store, or a store the grant can't reach, since the app and the store must share a Dev Dashboard organization and the app must be installed there."
+	]),
+	skill("verify-drive", [
+		"### The app's iframe",
+		"",
+		"The app lives in `iframe[name=app-iframe]` on `https://admin.shopify.com/`. Pass `--frame 'iframe[name=app-iframe]'` to every command that acts inside it, or to `flow` once for every step; leave it out to act on the Admin around the iframe, such as the app's items in the left nav or a page action Admin draws in its title bar. `open` takes the URL `pnpm verify admin-url --path /app/<route>` prints, and `--heading 'h1, s-page[heading]'` reads a Polaris page's heading.",
+		"",
+		"```sh",
+		"pnpm verify admin-url --path /app/settings",
+		"pnpm verify open <admin url> --frame 'iframe[name=app-iframe]' --heading 'h1, s-page[heading]' --out settings/page",
+		"pnpm verify flow skills/verify/flows/<name>.json --frame 'iframe[name=app-iframe]'",
+		"pnpm verify graphql --query '{ shop { name } }' --out admin-graphql/shop.json",
+		"pnpm verify safe-write",
+		"pnpm verify proxy /proxy/<path> --base <origin> --out <feature>/<name>.json",
+		"pnpm verify delivery webhook --topic shop/update",
+		"```",
+		"",
+		"- `graphql` refuses a mutation unless you pass `--write`, and `--write` is only for a write the feature file allows. `safe-write` is the one write that's always allowed.",
+		"- A server function's path ends in its contract's name on a stage, such as `/_serverFn/saveSettings`, so `click --fail /_serverFn/saveSettings` fails its next call and `requests --match _serverFn` lists the calls. Under `shopify app dev` the path is base64 of the source file and export instead (TanStack Start names IDs in builds only), so neither matches there.",
+		"- Page-load time: `requests` gives each entry a `startMs` and an `endMs` from the start of the iframe document's navigation. The page has loaded at the largest `endMs` among the document and the scripts, stylesheets and fonts it asks for; leave out the idle preload of other routes, which starts after the page's own requests end. An App Bridge navigation keeps the document, so it adds no `navigation` entry. The first load after a deploy runs slow: drop it, then compare stages on the median of three `open` and `requests` pairs.",
+		"- The recipes: [embedded Admin](embedded-admin.md) for driving the iframe, [building Admin features](building-admin-features.md) for a new Admin page, [Admin GraphQL](admin-graphql.md) for the app's own Admin access, and [when the app grows](when-the-app-grows.md) for proxy routes, webhooks, Events, extensions and a second app config."
+	])
+];
+//#endregion
+//#region src/verify/surfaces.ts
+const decodeSurfaceModule = Schema.decodeUnknownEffect(Schema.Struct({ surfaces: Schema.Array(Schema.String) }));
+const serviceSurfaceList = (service) => `services/${service}/src/features/shell/surfaces.ts`;
+const listed = (fs, directory) => fs.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
+const existing = (fs, files) => Effect.filter(files, (file) => fs.exists(file).pipe(Effect.orElseSucceed(() => false)));
+const extensionFolders = Effect.gen(function* findExtensionFolders() {
+	const fs = yield* FileSystem.FileSystem;
+	const apps = (yield* listed(fs, "apps")).map((app) => `apps/${app}/extensions`);
+	const folders = [];
+	for (const directory of ["extensions", ...apps.toSorted((a, b) => a.localeCompare(b))]) for (const name of (yield* listed(fs, directory)).toSorted((a, b) => a.localeCompare(b))) folders.push(`${directory}/${name}`);
+	return folders;
+});
+const surfacesIn = (file) => Effect.gen(function* importSurfaceList() {
+	const path = yield* Path.Path;
+	const url = yield* path.toFileUrl(path.resolve(file));
+	const module = yield* Effect.tryPromise({
+		catch: () => ({ message: `Can't import ${file}` }),
+		try: () => import(url.href)
+	});
+	return (yield* decodeSurfaceModule(module).pipe(Effect.mapError(() => ({ message: `${file} doesn't export a surfaces list of strings` })))).surfaces;
+});
+const appSurfaces = Effect.gen(function* listAppSurfaces() {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const extensions = yield* existing(fs, (yield* extensionFolders).map((folder) => `${folder}/shopify.extension.toml`));
+	const services = yield* existing(fs, (yield* listed(fs, "services")).toSorted((a, b) => a.localeCompare(b)).map(serviceSurfaceList));
+	const serviceSurfaces = yield* Effect.forEach(services, surfacesIn);
+	return [...extensions.map((file) => `extension:${path.basename(path.dirname(file))}`), ...serviceSurfaces.flat()];
+});
+//#endregion
+//#region src/harness.ts
+var harness_default = {
+	blocks: [
+		...baseBlocks,
+		...verifySkillBlocks,
+		...unisianDocBlocks
+	],
+	checkSteps: [
+		"harness app env-check",
+		"harness app codegen-check",
+		"harness app functions",
+		"harness app rust check"
+	],
+	testSteps: ["harness app rust test"],
+	commands: [
+		envCheckCommand,
+		codegenCheckCommand,
+		functionsCommand,
+		rustCommand,
+		slotCommand,
+		devCommand,
+		stageCommand,
+		pullEnvCommand,
+		destroyCommand
+	],
+	pieces: [{
+		blocks: [...featureWorkerBlocks, ...unisianDocFeatureWorkerBlocks],
+		when: { dependency: "@unisian/service-contract" }
+	}, {
+		blocks: [...extensionBlocks, ...unisianDocExtensionBlocks],
+		when: { file: extensionFiles }
+	}],
+	verify: {
+		commands: [
+			adminUrlCommand,
+			graphqlCommand,
+			safeWriteCommand,
+			proxyCommand,
+			deliveryCommand
+		],
+		doctor,
+		doctorFlags,
+		settings: { refusedFramingHint: "The app's iframe loads the application_url Shopify has for this app. The dev app's URL is the branch router, which serves the stage this browser's branch cookie names, else main" },
+		steps: { branch: branchStep },
+		surfaces: appSurfaces
+	},
+	worktree: {
+		postCreate: ["pnpm exec harness app pull-env"],
+		preRemove: ["pnpm exec harness app destroy"]
+	}
+};
+//#endregion
+export { harness_default as default };