@canonical/pragma-cli 0.31.0 → 0.32.0

package/src/kernel/completion/safety.test.ts

@@ -0,0 +1,374 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readdirSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createStore } from "@canonical/ke";
+import { describe, expect, it, vi } from "vitest";
+import { capabilities } from "../../capabilities/index.js";
+import { completionFixture } from "../../testing/fixtures/completionFixture.js";
+import type { CapabilityModule, VerbSpec } from "../spec/types.js";
+import { runComplete } from "./complete.js";
+import { emitScripts } from "./emitScripts.js";
+import { indexCompletionEnv } from "./entitySource.js";
+import { buildCompletionModel } from "./model.js";
+import { parseWords } from "./parse.js";
+import { resolveRequest } from "./resolve.js";
+
+// The store constructor (oxigraph WASM boot). Mocked so an entity `__complete`
+// can be proven to resolve names from the index WITHOUT ever booting it — the
+// runtime companion to the static import-graph guarantee below.
+vi.mock("@canonical/ke", () => ({
+  createStore: vi.fn(() => {
+    throw new Error("createStore called on the storeless completion path");
+  }),
+}));
+
+/** A hostile module whose names try to smuggle shell syntax. */
+function adversarialModule(path: readonly [string, string?]): CapabilityModule {
+  const verb: VerbSpec = {
+    path,
+    summary: "Adversarial.",
+    params: [],
+    output: {
+      formatters: { plain: () => "", llm: () => "", json: () => "null" },
+    },
+    capability: {
+      needsStore: false,
+      mutates: false,
+      mcp: { expose: false, reason: "test" },
+    },
+    run: async () => null,
+  };
+  return { name: "adversarial", verbs: [verb] };
+}
+
+const HOSTILE_NAMES = [
+  'x"; rm -rf ~',
+  "x$(rm -rf ~)",
+  "x`touch /tmp/pwned`",
+  "x;y",
+  "x y",
+  "x\ny",
+  "x'y",
+  "x|y",
+  "x&y",
+  "x>y",
+  "x*",
+];
+
+describe("injection safety (PROTECTED)", () => {
+  it("buildCompletionModel throws on every hostile verb name", () => {
+    for (const name of HOSTILE_NAMES) {
+      expect(() => buildCompletionModel([adversarialModule([name])])).toThrow(
+        /unsafe token/,
+      );
+      expect(() =>
+        buildCompletionModel([adversarialModule(["thing", name])]),
+      ).toThrow(/unsafe token/);
+    }
+  });
+
+  it("the resolver drops hostile index-sourced candidates", async () => {
+    const model = buildCompletionModel([completionFixture]);
+    const request = parseWords(["block", "get", ""], model);
+    const hostile = [
+      "$(rm -rf ~)",
+      "`touch /tmp/pwned`",
+      "a b",
+      "line\nbreak",
+      "semi;colon",
+      "quote'name",
+      'quote"name',
+      "pipe|name",
+      "-leading-dash",
+      "ok-name",
+    ];
+    const matches = await resolveRequest(request, model, {
+      names: () => hostile,
+    });
+    expect(matches).toEqual(["ok-name"]);
+  });
+
+  it("the runtime allowlist agrees with the emit-time gate", async () => {
+    // Anything the emit gate would inline, the runtime gate must pass.
+    const model = buildCompletionModel([completionFixture]);
+    const request = parseWords(["block", "get", ""], model);
+    const legitimate = ["button", "ds:Block", "a.b_c+d@e/f", "0numeric"];
+    const matches = await resolveRequest(request, model, {
+      names: () => legitimate,
+    });
+    expect([...matches].sort()).toEqual([...legitimate].sort());
+  });
+
+  it("buildCompletionModel and emitScripts throw for the same hostile grammar", () => {
+    for (const name of HOSTILE_NAMES) {
+      const module = adversarialModule(["thing", name]);
+      expect(() => buildCompletionModel([module])).toThrow(/unsafe token/);
+      expect(() => emitScripts([module])).toThrow(/unsafe token/);
+    }
+  });
+});
+
+describe("script safety (PROTECTED)", () => {
+  const scripts = emitScripts([completionFixture]);
+  const shells = ["bash", "zsh", "fish"] as const;
+
+  /** Script text with comment lines removed (headers may quote backticks). */
+  function code(script: string): string {
+    return script
+      .split("\n")
+      .filter((line) => !/^\s*#/.test(line))
+      .join("\n");
+  }
+
+  it("no script ever evals", () => {
+    for (const shell of shells) {
+      expect(code(scripts[shell])).not.toMatch(/\beval\b/);
+      expect(code(scripts[shell])).not.toContain("`");
+    }
+  });
+
+  it("every bash compgen -W wordlist is a generator-validated literal", () => {
+    const script = scripts.bash;
+    const uses = [...script.matchAll(/compgen -W (\S)/g)];
+    expect(uses.length).toBeGreaterThan(0);
+    // Every -W argument opens as a double-quoted literal…
+    for (const use of uses) expect(use[1]).toBe('"');
+    // …whose content is inert: no $, backtick, quote, or escape ever appears,
+    // so `compgen -W` has nothing to expand (its wordlist IS evaluated).
+    for (const [, list] of script.matchAll(/compgen -W "([^"]*)"/g)) {
+      expect(list).toMatch(/^[A-Za-z0-9@/:._+ -]*$/);
+    }
+  });
+
+  it("bash ingests dynamic candidates via mapfile, never word-splitting", () => {
+    expect(scripts.bash).toContain("mapfile -t COMPREPLY < <(");
+  });
+
+  it("zsh always guards compadd with -- and splits on newlines only", () => {
+    const compadds = [...code(scripts.zsh).matchAll(/compadd (\S+)/g)];
+    expect(compadds.length).toBeGreaterThan(0);
+    for (const use of compadds) expect(use[1]).toBe("--");
+    expect(scripts.zsh).toContain('"${(f)$(');
+  });
+
+  it("fish command substitutions are exactly the __complete delegation", () => {
+    const substitutions = [
+      ...code(scripts.fish).matchAll(/-a "\(([^)]*)/g),
+    ].map((use) => use[1]);
+    expect(substitutions.length).toBeGreaterThan(0);
+    for (const substitution of substitutions) {
+      expect(substitution).toMatch(/^pragma __complete -- /);
+    }
+  });
+
+  it("every inlined fish/zsh value list is inert", () => {
+    for (const [, list] of code(scripts.fish).matchAll(/-a "([^"(][^"]*)"/g)) {
+      expect(list).toMatch(/^[A-Za-z0-9@/:._+ -]*$/);
+    }
+    for (const [, list] of code(scripts.zsh).matchAll(
+      /compadd -- ([^\n"]+)$/gm,
+    )) {
+      const words = list.split(";")[0] ?? "";
+      expect(words.trimEnd()).toMatch(/^[A-Za-z0-9@/:._+ -]*$/);
+    }
+  });
+});
+
+/**
+ * Walk the *static* import graph from an entry file, following relative
+ * `from "./x.js"` and bare `import "./x.js"` specifiers (mapping `.js` back
+ * to `.ts`). Dynamic `import()` calls are not followed — that is exactly the
+ * lazy boundary the storeless invariant relies on. Mirrors the module-graph
+ * probe in `capabilities/lazy.test.ts`.
+ */
+function staticImportGraph(
+  entry: string,
+  seen = new Set<string>(),
+): Set<string> {
+  if (seen.has(entry) || !existsSync(entry)) return seen;
+  seen.add(entry);
+  const source = readFileSync(entry, "utf-8");
+  const fromRe = /\bfrom\s*["']([^"']+)["']/g;
+  const bareRe = /(?:^|\n)\s*import\s+["']([^"']+)["']/g;
+  for (const match of [
+    ...source.matchAll(fromRe),
+    ...source.matchAll(bareRe),
+  ]) {
+    const spec = match[1];
+    if (!spec?.startsWith(".")) continue;
+    staticImportGraph(
+      resolve(dirname(entry), spec.replace(/\.js$/, ".ts")),
+      seen,
+    );
+  }
+  return seen;
+}
+
+const here = dirname(fileURLToPath(import.meta.url));
+const has = (graph: Set<string>, fragment: string): boolean =>
+  [...graph].some((file) => file.includes(fragment));
+
+describe("storeless guarantee (PROTECTED)", () => {
+  const entries = [
+    resolve(here, "index.ts"),
+    resolve(here, "complete.ts"),
+    resolve(here, "emitScripts.ts"),
+    resolve(here, "../../capabilities/meta/complete.verb.ts"),
+  ];
+
+  it("the completion import graph never reaches boot, config, store, or zod", () => {
+    for (const entry of entries) {
+      const graph = staticImportGraph(entry);
+      // Runtime boot (bootRuntime) — never on the completion path.
+      expect(has(graph, "kernel/runtime/boot.ts")).toBe(false);
+      // The config LAYER (reader, evaluator, paths, schema) — storeless means
+      // no read. PR2's pure-leaf `config/types.ts` (the ConfigLayers type,
+      // imported type-only via VerbSpec.run's PragmaRuntime and erased at
+      // runtime) is the lone tolerated seam — as spec/types.ts and
+      // runtime/types.ts already sit in this graph as type-only.
+      const configModules = [...graph].filter(
+        (file) =>
+          file.includes("kernel/config/") &&
+          !file.endsWith("kernel/config/types.ts"),
+      );
+      expect(configModules).toEqual([]);
+      // zod stays off the fast path (validate.ts is the registration seam).
+      expect(has(graph, "kernel/spec/validate.ts")).toBe(false);
+      // No store/graph modules, present or future.
+      expect(has(graph, "store")).toBe(false);
+      expect(has(graph, "oxigraph")).toBe(false);
+    }
+  });
+
+  it("the model derivation is reachable from the grammar alone", () => {
+    const graph = staticImportGraph(resolve(here, "model.ts"));
+    expect(has(graph, "kernel/spec/emitSurface.ts")).toBe(true);
+    expect(has(graph, "kernel/spec/types.ts")).toBe(true);
+  });
+
+  it("an entity __complete resolves from the index, never constructs the store", async () => {
+    // The wired env (bin + verb) reads the active pack's index off disk; this
+    // proves the runtime never boots oxigraph for an entity completion.
+    const lookupModule: CapabilityModule = {
+      name: "store-spy-fixture",
+      verbs: [
+        {
+          path: ["block", "lookup"],
+          summary: "Look up a block.",
+          params: [
+            {
+              kind: "string",
+              name: "name",
+              doc: "The block name.",
+              positional: true,
+              required: true,
+              complete: {
+                kind: "names",
+                source: { from: "index", type: "ex:Component" },
+              },
+            },
+          ],
+          output: {
+            formatters: {
+              plain: String,
+              llm: String,
+              json: (value) => JSON.stringify(value),
+            },
+          },
+          capability: {
+            needsStore: true,
+            mutates: false,
+            mcp: { expose: false, reason: "test" },
+          },
+          run: async () => ({}),
+        } as VerbSpec,
+      ],
+    };
+    // Fresh cwd → no lock → the reader falls back to the embedded pack index.
+    const cwd = mkdtempSync(join(tmpdir(), "pragma-storespy-"));
+    const matches = await runComplete(
+      ["block", "lookup", "ex:B"],
+      [lookupModule],
+      indexCompletionEnv(cwd),
+    );
+    // It DID read the index (a real name came back)…
+    expect(matches).toEqual(["ex:Button"]);
+    // …and it did so without ever constructing the store.
+    expect(vi.mocked(createStore)).not.toHaveBeenCalled();
+  });
+
+  it("the non-index name sources resolve without constructing the store", async () => {
+    // skills (filesystem), prompts/tiers (index filter), prefixes (index ∪
+    // default map) — every family completes storelessly against the live
+    // capabilities. A fresh cwd → no lock → the embedded fallback index.
+    const cwd = mkdtempSync(join(tmpdir(), "pragma-storeless-src-"));
+    const env = indexCompletionEnv(cwd);
+
+    // prefixes: `ds` is in the default display map, so it comes back for `d`.
+    await expect(
+      runComplete(["ontology", "show", "d"], capabilities, env),
+    ).resolves.toContain("ds");
+
+    // skills / prompts / tiers: no data here, but the point is they never boot
+    // the store — an empty list is the correct storeless answer.
+    for (const words of [
+      ["skill", "lookup", "do"],
+      ["prompt", "lookup", "bu"],
+      ["tier", "lookup", "ap"],
+    ]) {
+      await expect(
+        runComplete(words, capabilities, env),
+      ).resolves.toBeInstanceOf(Array);
+    }
+
+    expect(vi.mocked(createStore)).not.toHaveBeenCalled();
+  });
+
+  it("the spawned __complete fast path answers without touching any state", () => {
+    // The perf globalSetup guarantees dist/pragma exists.
+    const binary = fileURLToPath(
+      new URL("../../../dist/pragma", import.meta.url),
+    );
+    const xdgConfig = mkdtempSync(join(tmpdir(), "pragma-storeless-cfg-"));
+    const xdgState = mkdtempSync(join(tmpdir(), "pragma-storeless-state-"));
+    const xdgCache = mkdtempSync(join(tmpdir(), "pragma-storeless-cache-"));
+
+    const result = spawnSync(binary, ["__complete", "--", "co"], {
+      encoding: "utf-8",
+      env: {
+        ...process.env,
+        XDG_CONFIG_HOME: xdgConfig,
+        XDG_STATE_HOME: xdgState,
+        XDG_CACHE_HOME: xdgCache,
+      },
+    });
+
+    expect(result.status).toBe(0);
+    expect(result.stdout).toBe("colophon\nconfig\n");
+    expect(result.stderr).toBe("");
+    // Storeless and config-free: no first-run marker, no config cache, no
+    // store artifacts — the fast path must leave the environment untouched.
+    expect(readdirSync(xdgConfig)).toEqual([]);
+    expect(readdirSync(xdgState)).toEqual([]);
+    expect(readdirSync(xdgCache)).toEqual([]);
+  });
+
+  it("the spawned fast path emits zero bytes for zero candidates, exit 0", () => {
+    const binary = fileURLToPath(
+      new URL("../../../dist/pragma", import.meta.url),
+    );
+    const result = spawnSync(binary, ["__complete", "--", "bogus", ""], {
+      encoding: "utf-8",
+      env: {
+        ...process.env,
+        XDG_CONFIG_HOME: mkdtempSync(join(tmpdir(), "pragma-zb-cfg-")),
+        XDG_STATE_HOME: mkdtempSync(join(tmpdir(), "pragma-zb-state-")),
+      },
+    });
+    expect(result.status).toBe(0);
+    expect(result.stdout).toBe("");
+    expect(result.stderr).toBe("");
+  });
+});

package/src/kernel/completion/templates/bash.ts

@@ -0,0 +1,249 @@
+// biome-ignore-all lint/suspicious/noTemplateCurlyInString: bash parameter expansions, not JS templates
+/**
+ * The bash completion script (static tier). Requires bash >= 4 (mapfile);
+ * the package pins os:["linux"], where that floor holds.
+ *
+ * Structure — nouns, verbs, flag names, enum values — is inlined into
+ * generator-validated LITERAL `compgen -W` tables (never a variable, never
+ * anything `compgen -W` could evaluate). File params use native `compgen -f`.
+ * Only `{kind:"names"}` contexts exec the CLI: `mapfile` ingests
+ * `pragma __complete` output line-by-line, so candidates are never
+ * word-split or evaluated. That exec is gated by `minChars` (structure + enum
+ * values still complete on bare TAB with zero exec). No `eval`, no backticks,
+ * `--` guards throughout.
+ */
+
+import type { CompletionModel, CompletionSource } from "../types.js";
+import {
+  globalFlagNames,
+  globalValueFlags,
+  hasOwnFlags,
+  nounNames,
+  offeredFlagNames,
+  rootFlagNames,
+  type VerbView,
+  valueFlagNames,
+  verbViews,
+  wordList,
+} from "./shared.js";
+
+/** A shell-safe function-name base for the bin (`pragma` -> `_pragma`). */
+function fnBase(binName: string): string {
+  return `_${binName.replace(/[^A-Za-z0-9_]/g, "_")}`;
+}
+
+/** The bash action completing a value source, or undefined for `none`. */
+function sourceAction(
+  source: CompletionSource,
+  fn: string,
+): string | undefined {
+  switch (source.kind) {
+    case "values":
+      return `COMPREPLY=($(compgen -W "${wordList(source.values, "bash values")}" -- "$cur"))`;
+    case "files":
+      return 'COMPREPLY=($(compgen -f -- "$cur"))';
+    case "names":
+      return `${fn}_dynamic`;
+    case "none":
+      return undefined;
+  }
+}
+
+/** The `noun/verb/--flag` case arms answering flag-value contexts. */
+function flagValueArms(model: CompletionModel, fn: string): string[] {
+  const arms: string[] = [];
+  for (const view of verbViews(model)) {
+    for (const flag of view.verb.flags) {
+      if (!flag.takesValue) continue;
+      const action = sourceAction(flag.source, fn);
+      // A known value flag with nothing to offer still returns silently, so
+      // its value slot is never mistaken for a positional.
+      arms.push(
+        `    ${view.key}/${flag.flag}) ${action === undefined ? "return" : `${action}; return`} ;;`,
+      );
+    }
+  }
+  return arms;
+}
+
+/** The global `--flag` case arms (e.g. --format, --detail values). */
+function globalValueArms(model: CompletionModel, fn: string): string[] {
+  return globalValueFlags(model).flatMap((flag) => {
+    const action = sourceAction(flag.source, fn);
+    return action === undefined
+      ? []
+      : [`    ${flag.flag}) ${action}; return ;;`];
+  });
+}
+
+/** The `noun/verb` case arms offering per-verb flag names. */
+function flagNameArms(model: CompletionModel): string[] {
+  return verbViews(model)
+    .filter(hasOwnFlags)
+    .map(
+      (view) =>
+        `      ${view.key}) COMPREPLY=($(compgen -W "${wordList(offeredFlagNames(model, view), "bash flags")}" -- "$cur")); return ;;`,
+    );
+}
+
+/** The `noun` case arms offering sub-verb labels. */
+function verbArms(model: CompletionModel): string[] {
+  return model.nouns
+    .filter((entry) => entry.verbs.length > 0)
+    .map(
+      (entry) =>
+        `      ${entry.noun}) COMPREPLY=($(compgen -W "${wordList(
+          entry.verbs.map((verb) => verb.label),
+          "bash verbs",
+        )}" -- "$cur")); return ;;`,
+    );
+}
+
+/** The positional case arm for one view, or undefined when it offers nothing. */
+function positionalArm(
+  model: CompletionModel,
+  view: VerbView,
+  fn: string,
+): string | undefined {
+  const slots: string[] = [];
+  view.verb.positionals.forEach((positional, index) => {
+    const action = sourceAction(positional.source, fn);
+    if (action === undefined) return;
+    const last = index === view.verb.positionals.length - 1;
+    const pattern = positional.variadic && last ? "*" : String(index);
+    slots.push(`        ${pattern}) ${action} ;;`);
+  });
+  if (slots.length === 0) return undefined;
+  return [
+    `    ${view.key})`,
+    `      ${fn}_pos ${view.skipWords} "${wordList(valueFlagNames(model, view), "bash value flags")}"`,
+    '      case "$POS" in',
+    ...slots,
+    "      esac",
+    "      ;;",
+  ].join("\n");
+}
+
+/** Wrap case arms in a `case` statement, or nothing when there are no arms. */
+function caseBlock(
+  subject: string,
+  arms: readonly string[],
+  indent: string,
+): string[] {
+  if (arms.length === 0) return [];
+  return [`${indent}case ${subject} in`, ...arms, `${indent}esac`];
+}
+
+/**
+ * Render the bash completion script.
+ *
+ * @param model - The completion model.
+ * @param binName - The binary to complete (function names derive from it).
+ * @param minChars - Minimum typed chars before a name source execs `__complete`.
+ * @returns The script text.
+ */
+export function bashScript(
+  model: CompletionModel,
+  binName: string,
+  minChars: number,
+): string {
+  const fn = fnBase(binName);
+  const positionalArms = verbViews(model).flatMap((view) => {
+    const arm = positionalArm(model, view, fn);
+    return arm === undefined ? [] : [arm];
+  });
+  const globalValueSkips = globalValueFlags(model)
+    .map((flag) => flag.flag)
+    .join("|");
+  // Emit the verb block only when there are arms (bash rejects an empty then).
+  const verbSection =
+    verbArms(model).length === 0
+      ? []
+      : [
+          "",
+          "  # verbs",
+          '  if [ -z "$verb" ]; then',
+          ...caseBlock('"$noun"', verbArms(model), "    "),
+          "  fi",
+        ];
+
+  const lines = [
+    `# ${binName} bash completion (static tier) — generated by \`${binName} setup completions\`. Do not edit.`,
+    "# Structure (nouns, verbs, flags, enum values) is inlined and never execs;",
+    `# entity arguments call \`${binName} __complete\` (storeless, never-throw);`,
+    "# file arguments use native completion. Requires bash >= 4 (mapfile).",
+    `${fn}_dynamic() {`,
+    ...(minChars > 0 ? [`  [ \${#cur} -ge ${minChars} ] || return 0`] : []),
+    `  mapfile -t COMPREPLY < <("${binName}" __complete -- "\${COMP_WORDS[@]:1:COMP_CWORD-1}" "$cur" 2>/dev/null)`,
+    "}",
+    `${fn}_pos() {`,
+    '  local skip="$1" vflags=" $2 " i w',
+    "  POS=0",
+    "  for ((i = 1; i < COMP_CWORD; i++)); do",
+    '    w="${COMP_WORDS[i]}"',
+    '    case "$w" in',
+    '      -*) case "$vflags" in *" $w "*) ((i++)) ;; esac ;;',
+    '      *) if [ "$skip" -gt 0 ]; then skip=$((skip - 1)); else POS=$((POS + 1)); fi ;;',
+    "    esac",
+    "  done",
+    "}",
+    `${fn}() {`,
+    "  local cur prev noun verb i w POS",
+    '  cur="${COMP_WORDS[COMP_CWORD]}"',
+    '  prev="${COMP_WORDS[COMP_CWORD-1]}"',
+    "  # Normalize the COMP_WORDBREAKS '=' split so a --flag=value context routes",
+    "  # as a flag value (mirrors parse.ts). The default breaks split",
+    "  # `--flag=val` into `--flag` `=` `val`; a custom COMP_WORDBREAKS may keep",
+    "  # `--flag=val` whole. Either way, recover $prev=flag and $cur=value.",
+    '  if [[ "$cur" == "=" ]]; then',
+    '    cur=""',
+    '  elif [[ "$prev" == "=" ]]; then',
+    '    prev="${COMP_WORDS[COMP_CWORD-2]}"',
+    '  elif [[ "$cur" == --*=* ]]; then',
+    '    prev="${cur%%=*}"',
+    '    cur="${cur#*=}"',
+    "  fi",
+    '  noun="" verb="" POS=0',
+    "  for ((i = 1; i < COMP_CWORD; i++)); do",
+    '    w="${COMP_WORDS[i]}"',
+    '    case "$w" in',
+    `      ${globalValueSkips}) ((i++)) ;;`,
+    "      -*) ;;",
+    "      *)",
+    '        if [ -z "$noun" ]; then noun="$w"',
+    '        elif [ -z "$verb" ]; then verb="$w"',
+    "        fi",
+    "        ;;",
+    "    esac",
+    "  done",
+    "",
+    "  # flag values (verb-scoped, then global)",
+    ...caseBlock('"$noun/$verb/$prev"', flagValueArms(model, fn), "  "),
+    ...caseBlock('"$prev"', globalValueArms(model, fn), "  "),
+    "",
+    "  # flag names",
+    '  if [[ "$cur" == -* ]]; then',
+    ...caseBlock('"$noun/$verb"', flagNameArms(model), "    "),
+    '    if [ -z "$noun" ]; then',
+    `      COMPREPLY=($(compgen -W "${wordList(rootFlagNames(model), "bash root flags")}" -- "$cur"))`,
+    "    else",
+    `      COMPREPLY=($(compgen -W "${wordList(globalFlagNames(model), "bash global flags")}" -- "$cur"))`,
+    "    fi",
+    "    return",
+    "  fi",
+    "",
+    "  # nouns",
+    '  if [ -z "$noun" ]; then',
+    `    COMPREPLY=($(compgen -W "${wordList(nounNames(model), "bash nouns")}" -- "$cur"))`,
+    "    return",
+    "  fi",
+    ...verbSection,
+    "",
+    "  # positionals",
+    ...caseBlock('"$noun/$verb"', positionalArms, "  "),
+    "}",
+    `complete -F ${fn} ${binName}`,
+    "",
+  ];
+  return lines.join("\n");
+}