@haystackeditor/cli 0.17.1 → 0.18.0

package/dist/commands/fleet-policy-contract.js

@@ -0,0 +1,28 @@
+/** FIXED CONTRACT — FLEET PHASE 1 (2026-09-27): mirror of the fleet policy
+ * admin API for the published CLI, whose build cannot import repository files
+ * outside `src`. The authority is
+ * `infra/lambda/haystack-design-verifier-shared/fleet_policy_authority_contracts.ts`;
+ * this file restates only what `haystack admin fleet-policy` sends and reads.
+ * Policies are opaque JSON here: the worker is the only parser.
+ *
+ * The CLI carries no fleet credential. Its only credential is the operator's
+ * Cloudflare Access token, sent as `cf-access-token`.
+ */
+export const FLEET_POLICY_ADMIN_ROUTES = {
+    show: '/admin/fleet-policy/show',
+    set: '/admin/fleet-policy/set',
+    revoke: '/admin/fleet-policy/revoke',
+    history: '/admin/fleet-policy/history',
+    importKv: '/admin/fleet-policy/import-kv',
+};
+export const FLEET_POLICY_CLI_VERBS = ['show', 'diff', 'set', 'revoke', 'history', 'import-kv'];
+export const FLEET_POLICY_CLI_EXIT = { ok: 0, error: 1, conflict: 3 };
+export const FLEET_POLICY_DEFAULT_WORKER_URL = 'https://haystack-agent.akshaysg.workers.dev';
+export const FLEET_POLICY_WORKER_URL_ENV = 'HAYSTACK_ADMIN_WORKER_URL';
+export const FLEET_POLICY_ACCESS_HEADER = 'cf-access-token';
+/** `owner/name` or `github.com:<id>`. */
+export const FLEET_POLICY_REPOSITORY_ARGUMENT = /^(?:github\.com:[1-9][0-9]{0,19}|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)$/;
+export const FLEET_POLICY_ADMIN_ERROR_CODES = [
+    'invalid-request', 'invalid-policy', 'tenant-required', 'operator-identity-required', 'scope-not-found',
+    'epoch-conflict', 'scope-not-active', 'installation-required', 'binding-mismatch', 'github-unavailable',
+];

package/dist/commands/fleet-policy.js

@@ -0,0 +1,305 @@
+/**
+ * `haystack admin fleet-policy show|diff|set|revoke|history|import-kv`: the
+ * operator command for the fleet policy authority in D1 (FLEET PHASE 1,
+ * design Appendix A). The only credential is the operator's Cloudflare Access
+ * token from `cloudflared access token -app=<worker URL>`, sent as
+ * `cf-access-token`. Exit codes: 0 ok, 1 error, 3 on a 409 (epoch conflict).
+ */
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import chalk from 'chalk';
+import { FLEET_POLICY_ACCESS_HEADER, FLEET_POLICY_ADMIN_ROUTES, FLEET_POLICY_CLI_EXIT, FLEET_POLICY_DEFAULT_WORKER_URL, FLEET_POLICY_REPOSITORY_ARGUMENT, FLEET_POLICY_WORKER_URL_ENV, } from './fleet-policy-contract.js';
+class UsageError extends Error {
+}
+function workerOrigin(options) {
+    const raw = options.workerUrl ?? process.env[FLEET_POLICY_WORKER_URL_ENV] ?? FLEET_POLICY_DEFAULT_WORKER_URL;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new UsageError(`worker URL is not a URL: ${raw}`);
+    }
+    if (url.protocol !== 'https:' && url.hostname !== 'localhost' && url.hostname !== '127.0.0.1') {
+        throw new UsageError(`worker URL must be https: ${raw}`);
+    }
+    return url.origin;
+}
+/** Non-interactive: never opens a browser. A missing token means the operator
+ * logs in once with the printed command. */
+function accessToken(origin) {
+    let output = '';
+    try {
+        output = execFileSync('cloudflared', ['access', 'token', `-app=${origin}`], {
+            encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 30_000,
+        }).trim();
+    }
+    catch {
+        output = '';
+    }
+    if (!/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(output)) {
+        throw new UsageError(`No Cloudflare Access token for ${origin}. Log in once, then re-run:\n  cloudflared access login ${origin}`);
+    }
+    return output;
+}
+async function post(origin, route, body, token) {
+    const response = await fetch(`${origin}${route}`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Accept: 'application/json',
+            'User-Agent': 'Haystack-CLI',
+            [FLEET_POLICY_ACCESS_HEADER]: token ?? accessToken(origin),
+        },
+        body: JSON.stringify(body),
+        redirect: 'manual',
+        signal: AbortSignal.timeout(120_000),
+    });
+    if (response.status >= 300 && response.status < 400) {
+        throw new UsageError(`Cloudflare Access refused the token. Log in again:\n  cloudflared access login ${origin}`);
+    }
+    const text = await response.text();
+    let parsed = null;
+    try {
+        parsed = text ? JSON.parse(text) : null;
+    }
+    catch {
+        parsed = null;
+    }
+    if (response.status === 200 && parsed !== null)
+        return { kind: 'ok', body: parsed };
+    if (response.status === 409 && parsed !== null)
+        return { kind: 'conflict', body: parsed };
+    const record = parsed && typeof parsed === 'object' ? parsed : {};
+    return {
+        kind: 'error',
+        status: response.status,
+        error: typeof record.error === 'string' ? record.error : text.slice(0, 200) || `HTTP ${response.status}`,
+        ...(typeof record.detail === 'string' ? { detail: record.detail } : {}),
+    };
+}
+function reportFailure(result) {
+    if (result.kind === 'conflict') {
+        const c = result.body;
+        console.error(chalk.red(`${c.error}: ${c.tenantId} ${c.repositoryId} expected epoch ${c.expectedEpoch}, current epoch ${c.currentEpoch}`));
+        console.error(`  active version: ${c.activeVersion ?? 'none'}`);
+        console.error(`  active digest:  ${c.activePolicySha256 ?? 'none'}`);
+        console.error(`  revocation generation: ${c.revocationGeneration}`);
+        return FLEET_POLICY_CLI_EXIT.conflict;
+    }
+    console.error(chalk.red(`${result.error} (HTTP ${result.status})${result.detail ? `: ${result.detail}` : ''}`));
+    return FLEET_POLICY_CLI_EXIT.error;
+}
+function selector(repository, options) {
+    if (!FLEET_POLICY_REPOSITORY_ARGUMENT.test(repository)) {
+        throw new UsageError(`repository must be owner/name or github.com:<id> (got "${repository}")`);
+    }
+    return { repository, ...(options.tenant === undefined ? {} : { tenant: options.tenant }) };
+}
+function epochOption(value) {
+    if (value === undefined)
+        throw new UsageError('--expected-epoch is required (read it with `show`)');
+    if (!/^(0|[1-9][0-9]{0,15})$/.test(value))
+        throw new UsageError(`--expected-epoch must be a non-negative integer (got "${value}")`);
+    return Number(value);
+}
+function reasonOption(value) {
+    if (value === undefined || value.trim() === '')
+        throw new UsageError('--reason is required');
+    return value;
+}
+function policyFile(file) {
+    if (!file)
+        throw new UsageError('--file <policy.json> is required');
+    try {
+        return JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw new UsageError(`cannot read ${file} as JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function bindingText(binding) {
+    return binding
+        ? `installation ${binding.installationId}, account ${binding.accountId}, repository ${binding.githubRepositoryId}`
+        : 'none';
+}
+async function run(action) {
+    try {
+        return await action();
+    }
+    catch (error) {
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        return FLEET_POLICY_CLI_EXIT.error;
+    }
+}
+function printScope(view) {
+    console.log(chalk.bold(`${view.tenantId} ${view.repositoryId}${view.repositoryFullName ? ` (${view.repositoryFullName})` : ''}`));
+    console.log(`  status: ${view.status}   epoch: ${view.epoch}   revocation generation: ${view.revocationGeneration}`);
+    if (!view.active)
+        return;
+    console.log(`  version: ${view.active.version}   kind: ${view.active.scopeKind}   binding: ${bindingText(view.active.binding)}`);
+    console.log(`  digest: ${view.active.policySha256}`);
+    console.log(`  set by ${view.active.actor} at ${view.active.createdAt}: ${view.active.reason}`);
+    console.log(JSON.stringify(view.active.policy, null, 2).split('\n').map(line => `  ${line}`).join('\n'));
+}
+export function fleetPolicyShowCommand(repository, options) {
+    return run(async () => {
+        const result = await post(workerOrigin(options), FLEET_POLICY_ADMIN_ROUTES.show, { scope: selector(repository, options) });
+        if (result.kind !== 'ok')
+            return reportFailure(result);
+        if (options.json)
+            console.log(JSON.stringify(result.body, null, 2));
+        else
+            result.body.scopes.forEach(printScope);
+        return FLEET_POLICY_CLI_EXIT.ok;
+    });
+}
+/** Dotted paths of every leaf, for the field diff. */
+function leaves(value, path = '', out = new Map()) {
+    if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+        for (const key of Object.keys(value).sort())
+            leaves(value[key], path ? `${path}.${key}` : key, out);
+    }
+    else {
+        out.set(path, JSON.stringify(value));
+    }
+    return out;
+}
+export function fleetPolicyDiffCommand(repository, options) {
+    return run(async () => {
+        const origin = workerOrigin(options);
+        const scope = selector(repository, options);
+        const policy = policyFile(options.file);
+        const token = accessToken(origin);
+        const dryRun = (expectedEpoch) => post(origin, FLEET_POLICY_ADMIN_ROUTES.set, {
+            scope, policy, expectedEpoch, reason: 'diff (dry run)', dryRun: true,
+        }, token);
+        // The dry run resolves the repository live, so it names the exact scope a
+        // set would write; the comparison then reads that scope, never a name match.
+        let proposed = await dryRun(0);
+        if (proposed.kind === 'error')
+            return reportFailure(proposed);
+        const target = proposed.body;
+        const shown = await post(origin, FLEET_POLICY_ADMIN_ROUTES.show, { scope: { repository: target.repositoryId, tenant: target.tenantId } }, token);
+        let current = null;
+        if (shown.kind === 'ok')
+            current = shown.body.scopes[0] ?? null;
+        else if (!(shown.kind === 'error' && shown.error === 'scope-not-found'))
+            return reportFailure(shown);
+        if (proposed.kind === 'conflict' || (current && current.epoch !== 0))
+            proposed = await dryRun(current?.epoch ?? 0);
+        if (proposed.kind !== 'ok')
+            return reportFailure(proposed);
+        const next = proposed.body;
+        if (next.tenantId !== target.tenantId || next.repositoryId !== target.repositoryId) {
+            throw new UsageError('the repository resolved to another scope between reads; run diff again');
+        }
+        console.log(chalk.bold(`${next.tenantId} ${next.repositoryId} (${next.repositoryFullName})`));
+        console.log(`  epoch ${next.epoch}: version ${current?.active?.version ?? 'none'} -> ${next.version}`);
+        console.log(`  digest: ${current?.active?.policySha256 ?? 'none'} -> ${next.policySha256}`);
+        console.log(`  kind: ${current?.active?.scopeKind ?? 'none'} -> ${next.scopeKind}`);
+        console.log(`  binding: ${current?.active ? bindingText(current.active.binding) : 'none'} -> ${bindingText(next.binding)}`);
+        if (current?.active?.policySha256 === next.policySha256) {
+            console.log('  no field changes');
+            return FLEET_POLICY_CLI_EXIT.ok;
+        }
+        const before = current?.active ? leaves(current.active.policy) : new Map();
+        const after = leaves(JSON.parse(next.canonicalPolicy));
+        for (const path of [...new Set([...before.keys(), ...after.keys()])].sort()) {
+            const old = before.get(path);
+            const now = after.get(path);
+            if (old === now)
+                continue;
+            if (old === undefined)
+                console.log(chalk.green(`  + ${path}: ${now}`));
+            else if (now === undefined)
+                console.log(chalk.red(`  - ${path}: ${old}`));
+            else
+                console.log(chalk.yellow(`  ~ ${path}: ${old} -> ${now}`));
+        }
+        return FLEET_POLICY_CLI_EXIT.ok;
+    });
+}
+export function fleetPolicySetCommand(repository, options) {
+    return run(async () => {
+        const body = {
+            scope: selector(repository, options),
+            policy: policyFile(options.file),
+            expectedEpoch: epochOption(options.expectedEpoch),
+            reason: reasonOption(options.reason),
+        };
+        const result = await post(workerOrigin(options), FLEET_POLICY_ADMIN_ROUTES.set, body);
+        if (result.kind !== 'ok')
+            return reportFailure(result);
+        const set = result.body;
+        console.log(chalk.green(`set ${set.tenantId} ${set.repositoryId} (${set.repositoryFullName}): version ${set.version}, epoch ${set.epoch}`));
+        console.log(`  digest: ${set.policySha256}`);
+        console.log(`  kind: ${set.scopeKind}   binding: ${bindingText(set.binding)}`);
+        console.log(`  previous: ${set.previous ? `version ${set.previous.version} ${set.previous.policySha256}` : 'none'}`);
+        return FLEET_POLICY_CLI_EXIT.ok;
+    });
+}
+export function fleetPolicyRevokeCommand(repository, options) {
+    return run(async () => {
+        const body = {
+            scope: selector(repository, options),
+            expectedEpoch: epochOption(options.expectedEpoch),
+            reason: reasonOption(options.reason),
+        };
+        const result = await post(workerOrigin(options), FLEET_POLICY_ADMIN_ROUTES.revoke, body);
+        if (result.kind !== 'ok')
+            return reportFailure(result);
+        const revoked = result.body;
+        console.log(chalk.green(`revoked ${revoked.tenantId} ${revoked.repositoryId}: version ${revoked.revokedVersion}, now epoch ${revoked.epoch}`));
+        console.log(`  revocation generation: ${revoked.revocationGeneration}   stopped attempts: ${revoked.stoppedAttempts}`);
+        return FLEET_POLICY_CLI_EXIT.ok;
+    });
+}
+export function fleetPolicyHistoryCommand(repository, options) {
+    return run(async () => {
+        let limit;
+        if (options.limit !== undefined) {
+            if (!/^[1-9][0-9]{0,2}$/.test(options.limit) || Number(options.limit) > 500)
+                throw new UsageError('--limit must be 1 to 500');
+            limit = Number(options.limit);
+        }
+        const result = await post(workerOrigin(options), FLEET_POLICY_ADMIN_ROUTES.history, { scope: selector(repository, options), ...(limit === undefined ? {} : { limit }) });
+        if (result.kind !== 'ok')
+            return reportFailure(result);
+        const { events, versions, tenantId, repositoryId } = result.body;
+        console.log(chalk.bold(`${tenantId} ${repositoryId}`));
+        console.log('  events (newest first):');
+        const version = (value) => value === null ? 'none' : `v${value}`;
+        for (const event of events) {
+            console.log(`    epoch ${event.fromEpoch}->${event.toEpoch} ${event.action} ${version(event.fromVersion)}->${version(event.toVersion)} `
+                + `${event.toPolicySha256 ?? ''} by ${event.actor} at ${event.createdAt}: ${event.reason}`);
+        }
+        console.log('  versions (newest first):');
+        for (const version of versions) {
+            console.log(`    v${version.version} ${version.policySha256} ${version.scopeKind} (${version.repositoryFullName}) `
+                + `by ${version.actor} at ${version.createdAt}`);
+        }
+        return FLEET_POLICY_CLI_EXIT.ok;
+    });
+}
+export function fleetPolicyImportKvCommand(options) {
+    return run(async () => {
+        const dryRun = options.dryRun === true;
+        const result = await post(workerOrigin(options), FLEET_POLICY_ADMIN_ROUTES.importKv, { dryRun });
+        if (result.kind !== 'ok')
+            return reportFailure(result);
+        const { policies, overrides } = result.body;
+        console.log(chalk.bold(`${dryRun ? 'dry run: ' : ''}${policies.length} policy keys, ${overrides.length} tenant override keys`));
+        for (const item of policies) {
+            const scope = item.scope ? ` ${item.scope.tenantId} ${item.scope.repositoryId}` : '';
+            console.log(`  ${item.outcome} ${item.key}${scope}${item.repositoryFullName ? ` (${item.repositoryFullName})` : ''}`
+                + `${item.scopeKind ? ` ${item.scopeKind}` : ''}${item.binding ? ` [${bindingText(item.binding)}]` : ''}`
+                + `${item.policySha256 ? ` ${item.policySha256}` : ''}${item.detail ? `: ${item.detail}` : ''}`);
+        }
+        for (const item of overrides) {
+            console.log(`  ${item.outcome} ${item.key}${item.tenantId ? ` -> ${item.tenantId}` : ''}${item.detail ? `: ${item.detail}` : ''}`);
+        }
+        const failed = [...policies, ...overrides].filter(item => item.outcome === 'conflict' || item.outcome === 'invalid');
+        return failed.length === 0 ? FLEET_POLICY_CLI_EXIT.ok : FLEET_POLICY_CLI_EXIT.error;
+    });
+}

package/dist/commands/precompute-delivery-worker.js

@@ -52,8 +52,22 @@ try {
     }
     if (accessRejected)
         terminal('failed', 'captured-request-access-rejected');
-    const acknowledgment = await deliverPrecomputeRequest(delivery.request, controller.signal);
-    finish({ status: 'acknowledged', acknowledgment });
+    // A momentary 429/5xx or a dropped connection (a server or runner restarting) is retried inside the same deadline:
+    // admission is idempotent for one capture, so a repeat can only find what the first created.
+    const pauses = [2_000, 5_000, 10_000];
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            const acknowledgment = await deliverPrecomputeRequest(delivery.request, controller.signal);
+            finish({ status: 'acknowledged', acknowledgment });
+        }
+        catch (error) {
+            const transient = error instanceof HaystackApiError ? [429, 502, 503, 504].includes(error.status)
+                : !(error instanceof NotLoggedInError) && !controller.signal.aborted;
+            if (!transient || attempt >= pauses.length)
+                throw error;
+            await new Promise(resolve => setTimeout(resolve, pauses[attempt]));
+        }
+    }
 }
 catch (error) {
     if (finished)
@@ -63,6 +77,6 @@ catch (error) {
     if (error instanceof NotLoggedInError)
         terminal('failed', 'authentication-required');
     if (error instanceof HaystackApiError)
-        terminal('failed', `server-http-${error.status}`);
+        terminal('failed', `server-http-${error.status}: ${error.message.slice(0, 400)}`);
     terminal('failed', 'delivery-not-acknowledged; remote-acceptance-unknown');
 }

package/dist/commands/precompute-delivery.js

@@ -3,7 +3,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { validateCapturedSearch } from './combination-search-hook.js';
+import { CRAWL_TITLE_MAX_CHARS } from './crawl-contract.js';
 const requestFile = 'request.json';
 const receiptFile = 'receipt.json';
 const deliverySchema = 'precompute-delivery-v1';
@@ -127,7 +127,7 @@ function validateRequest(value) {
     const request = value.request;
     const component = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.-';
     if (!onlyKeys(request, ['owner', 'repository', 'baseCommit', 'workCommit', 'observedAt',
-        'cacheKey', 'patchGzBase64', 'patchSha256', ...(request.combinationSearch === undefined ? [] : ['combinationSearch'])])
+        'cacheKey', 'patchGzBase64', 'patchSha256', 'crawl'])
         || !characters(request.owner, component) || request.owner.length > 100
         || !characters(request.repository, component) || request.repository.length > 100
         || !characters(request.baseCommit, '0123456789abcdef', 40)
@@ -142,10 +142,20 @@ function validateRequest(value) {
         || createHash('sha256').update(patch).digest('hex') !== request.patchSha256) {
         throw new Error('Captured patch identity does not match.');
     }
-    if (request.combinationSearch !== undefined)
-        validateCapturedSearch(request.combinationSearch, {
-            owner: request.owner, repository: request.repository, baseCommit: request.baseCommit, workCommit: request.workCommit,
-        });
+    // The crawl's tree is the captured tree the cache key names (its third field). A capture of the base itself (no change)
+    // carries no crawl: there is nothing to compare.
+    const crawl = request.crawl;
+    if (crawl === undefined) {
+        if (request.workCommit !== request.baseCommit)
+            throw new Error('Invalid captured crawl submission.');
+        return;
+    }
+    if (!object(crawl) || !onlyKeys(crawl, ['treeSha', 'changeTitle'])
+        || !characters(crawl.treeSha, '0123456789abcdef', 40)
+        || request.cacheKey.split('-')[2] !== crawl.treeSha.slice(0, 16)
+        || typeof crawl.changeTitle !== 'string' || crawl.changeTitle.length > CRAWL_TITLE_MAX_CHARS) {
+        throw new Error('Invalid captured crawl submission.');
+    }
 }
 export class PrecomputeDeliveryAccessError extends Error {
     delivery;

package/dist/commands/verify-hosted.js

@@ -126,6 +126,8 @@ export function parseHostedRunState(value, expectedRunId) {
         if (fleetResult.savedChecks !== undefined) {
             parseHostedSavedChecks(fleetResult.savedChecks, runId, headCommit);
         }
+        if (fleetResult.databaseStandIn !== undefined)
+            hostedDatabaseStandInLine(fleetResult.databaseStandIn);
         requireString(provenance, 'intent', /^(user|inferred)$/);
         if (status === 'complete' && fleetResult.lifecycle !== 'complete') {
             throw new Error('Hosted fleet lifecycle disagrees with its completed job.');
@@ -244,6 +246,21 @@ function parseHostedSavedChecks(value, runId, headSha) {
     }
     return saved;
 }
+/** The result's `databaseStandIn`, present only when the run's environment was
+ * onboarded with an uploaded database profile: which profile the stand-in
+ * database was built from and for which run-map dependency, or why onboarding
+ * built none (the reason names the run map's dependency ids). */
+function hostedDatabaseStandInLine(value) {
+    const standIn = requireRecord(value, 'Hosted stand-in database');
+    if (standIn.status === 'present') {
+        const used = requireRecord(standIn.value, 'Hosted stand-in database');
+        const sha256 = requireString(used, 'profileSha256', /^[0-9a-f]{64}$/);
+        return `built from your uploaded profile ${sha256.slice(0, 12)} for ${savedCheckDisplay(requireString(used, 'dependencyId'))}`;
+    }
+    if (standIn.status !== 'absent')
+        throw new Error('Hosted stand-in database has an invalid status.');
+    return `not used: ${savedCheckDisplay(requireString(standIn, 'reason'))}`;
+}
 function savedCheckDisplay(value) {
     // eslint-disable-next-line no-control-regex -- rejecting/stripping control characters is the point
     return String(value).replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
@@ -484,6 +501,9 @@ function printHostedState(operation, state, options) {
         console.log(`  ${chalk.dim('Run health:')} ${result.runHealth}`);
         console.log(`  ${chalk.dim('Intent:')} ${provenance.intent}`);
         console.log(`  ${chalk.dim('Cleanup:')} ${cleanup.status} (${cleanup.pending.length} pending)`);
+        if (result.databaseStandIn !== undefined) {
+            console.log(`  ${chalk.dim('Stand-in database:')} ${hostedDatabaseStandInLine(result.databaseStandIn)}`);
+        }
         for (const value of result.findings) {
             const finding = requireRecord(value, 'Hosted fleet finding');
             console.log(`  ${chalk.dim('Finding:')} ${finding.findingId} / ${finding.caseId}: ${finding.judgment}`);