@jwilleke/ngdpbase-types 5.21.0 → 5.23.0

package/lib/src/utils/siteRestore.js

@@ -0,0 +1,309 @@
+/**
+ * A whole-site restore, staged for the next start, all or nothing (#1876).
+ *
+ * The databases already restore this way (#1723): each is copied to
+ * `<live>.staged`, and the next start renames it into place before anything
+ * opens it. This extends the same shape to every part of the site whose
+ * owning manager stages its restore (attachments, role membership, persons,
+ * organizations, footnotes and comments). Each owner does its own work, as
+ * Manager-SOT asks; this module only holds the one record that binds the
+ * parts together, so they go in together or not at all.
+ *
+ * The record is the __site restore manifest__ (`ngdpbase.backup.restore-manifest`,
+ * default `${FAST_STORAGE}/site-restore.json`):
+ *
+ * - __Staging__ (BackupManager.restoreFromFile): the manifest is written in
+ *   state `staging` before any part is staged. Each owner stages its files
+ *   beside its live ones and records its part — the pairs `{ live, staged }`
+ *   it will swap. Any failure discards every part already recorded and the
+ *   manifest. Only when every part is staged is the state set to `staged`:
+ *   that write is the commit.
+ * - __Applying__ (each owner's `initialize`, before it reads its data): the
+ *   owner asks {@link gatePart}. A part is applied only when the manifest is
+ *   committed and every part that is still pending has all of its staged
+ *   files in place, so a set that lost a part applies none of it. Each live
+ *   path steps aside as `<live>.pre-restore`, and the staged one takes its
+ *   name: a rename, never a write into live data. The part is then marked
+ *   applied in the manifest, so a start that stops half-way picks up where it
+ *   stopped instead of seeing a "missing" part.
+ * - __Refused__: an interrupted staging, a part whose staged files are gone,
+ *   or a tampered manifest (an owner checks every live path it is asked to
+ *   replace) sets the manifest to `refused`, and each part's staged files are
+ *   set aside as `*.incomplete` — never applied, never retried.
+ * - __Done__: once every part is applied or set aside, the manifest is
+ *   renamed `<manifest>.done`, which BackupManager reports to admins at the
+ *   end of the start and keeps as `<manifest>.last`.
+ *
+ * Everything here is synchronous file renames on the owner's own paths: it
+ * runs once at start, before the owner serves anything.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+/** The config key naming the site restore manifest. */
+export const SITE_RESTORE_MANIFEST_KEY = 'ngdpbase.backup.restore-manifest';
+/** Its default: beside the other instance data in FAST_STORAGE. */
+export const SITE_RESTORE_MANIFEST_DEFAULT = './data/site-restore.json';
+/** The staged copy of a live path: beside it, so staging and applying name the same path. */
+export const stagedPathFor = (live) => `${live}.staged`;
+/** Where a live path is kept once a restore has replaced it. */
+export const keptPathFor = (live) => `${live}.pre-restore`;
+/** The manifest file for this site, read through the configuration (never a constant). */
+export function siteRestoreFile(configManager) {
+    return configManager?.getResolvedDataPath(SITE_RESTORE_MANIFEST_KEY, SITE_RESTORE_MANIFEST_DEFAULT) ?? SITE_RESTORE_MANIFEST_DEFAULT;
+}
+function isFile(file) {
+    try {
+        return statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The manifest, or null when there is none. Throws when a file is there but
+ * is not a manifest: a restore record that can't be read is never ignored.
+ */
+export function readSiteRestore(file) {
+    if (!isFile(file))
+        return null;
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    if (parsed?.version !== 1 || !Array.isArray(parsed.parts) || !['staging', 'staged', 'refused'].includes(parsed.state)) {
+        throw new Error(`${path.basename(file)} is not a site restore manifest`);
+    }
+    return parsed;
+}
+function writeSiteRestore(file, manifest) {
+    mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp`;
+    writeFileSync(tmp, JSON.stringify(manifest, null, 2) + '\n', { mode: 0o600 });
+    renameSync(tmp, file);
+}
+/** Start staging a site restore: the record exists before any part is staged, so an interrupted staging is recognised. */
+export function beginSiteRestore(file, meta) {
+    if (isFile(file))
+        throw new Error('A site restore is already staged; cancel it or replace it first');
+    writeSiteRestore(file, { version: 1, state: 'staging', ...meta, parts: [] });
+}
+/** Record one owner's staged part. Only while staging. */
+export function recordStagedPart(file, part) {
+    const manifest = readSiteRestore(file);
+    if (!manifest || manifest.state !== 'staging')
+        throw new Error('No site restore is being staged');
+    manifest.parts = [...manifest.parts.filter((p) => p.manager !== part.manager), { manager: part.manager, swaps: part.swaps, ...(part.discard ? { discard: part.discard } : {}) }];
+    writeSiteRestore(file, manifest);
+}
+/** The commit: every part is staged. */
+export function commitSiteRestore(file) {
+    const manifest = readSiteRestore(file);
+    if (!manifest || manifest.state !== 'staging')
+        throw new Error('No site restore is being staged');
+    for (const part of manifest.parts) {
+        const missing = part.swaps.filter((s) => !existsSync(s.staged));
+        if (missing.length > 0)
+            throw new Error(`${part.manager} recorded staged files that are not there: ${missing.map((s) => path.basename(s.staged)).join(', ')}`);
+    }
+    manifest.state = 'staged';
+    writeSiteRestore(file, manifest);
+    return manifest;
+}
+/**
+ * Throw a staged (or half-staged) site restore away: every part's staged
+ * files and the manifest are removed. Live data is never touched.
+ */
+export function discardSiteRestore(file) {
+    let manifest;
+    try {
+        manifest = readSiteRestore(file);
+    }
+    catch {
+        manifest = null;
+    }
+    for (const part of manifest?.parts ?? []) {
+        for (const swap of part.swaps)
+            rmSync(swap.staged, { recursive: true, force: true });
+        for (const extra of part.discard ?? [])
+            rmSync(extra, { recursive: true, force: true });
+    }
+    rmSync(file, { force: true });
+    return manifest;
+}
+/** Move a staged path aside as `*.incomplete`, so it is neither applied nor retried. */
+export function setAsidePath(staged) {
+    if (!existsSync(staged))
+        return;
+    const target = `${staged}.incomplete`;
+    rmSync(target, { recursive: true, force: true });
+    renameSync(staged, target);
+}
+/**
+ * Whether `manager`'s part of a site restore is to be applied now. `none`:
+ * there is no site restore, or it has no part for this manager, or that part
+ * is done. `apply`: the restore is committed and every part still pending has
+ * its staged files. `set-aside`: it isn't, and the set is marked refused.
+ */
+export function gatePart(file, manager) {
+    let manifest;
+    try {
+        manifest = readSiteRestore(file);
+    }
+    catch (err) {
+        // A record that can't be read applies nothing. It is left where it is,
+        // untouched — the path may be misconfigured to name some other file —
+        // and every start says so until it is fixed.
+        return { decision: 'set-aside', reason: `the site restore manifest ${file} cannot be read: ${err.message}` };
+    }
+    if (!manifest)
+        return { decision: 'none' };
+    const part = manifest.parts.find((p) => p.manager === manager);
+    if (!part || part.status)
+        return { decision: 'none' };
+    if (manifest.state === 'staging') {
+        return refuse(file, manifest, part, 'the site restore was still being staged when the server stopped (interrupted staging)');
+    }
+    if (manifest.state === 'refused') {
+        return { decision: 'set-aside', reason: manifest.reason ?? 'the site restore was refused', part };
+    }
+    const setAsideAlready = manifest.parts.filter((p) => p.status === 'set-aside').map((p) => p.manager);
+    if (setAsideAlready.length > 0) {
+        return refuse(file, manifest, part, `part of it (${setAsideAlready.join(', ')}) was not applied, and the parts belong together`);
+    }
+    const missing = manifest.parts
+        .filter((p) => !p.status)
+        .flatMap((p) => p.swaps.filter((s) => !existsSync(s.staged)).map((s) => `${p.manager}: ${path.basename(s.staged)}`));
+    if (missing.length > 0) {
+        return refuse(file, manifest, part, `staged files are missing (${missing.join(', ')}), and the parts belong together`);
+    }
+    return { decision: 'apply', part, manifest };
+}
+function refuse(file, manifest, part, reason) {
+    manifest.state = 'refused';
+    manifest.reason = reason;
+    writeSiteRestore(file, manifest);
+    return { decision: 'set-aside', reason, part };
+}
+/**
+ * Record what became of `manager`'s part. A part set aside refuses the rest
+ * of the set. When every part is done the manifest becomes `<file>.done`.
+ */
+export function markPart(file, manager, status, note) {
+    let manifest;
+    try {
+        manifest = readSiteRestore(file);
+    }
+    catch {
+        return;
+    }
+    if (!manifest)
+        return;
+    const part = manifest.parts.find((p) => p.manager === manager);
+    if (!part)
+        return;
+    part.status = status;
+    if (note)
+        part.note = note;
+    if (status === 'set-aside' && manifest.state !== 'refused') {
+        manifest.state = 'refused';
+        manifest.reason = note ?? `${manager}'s part was not applied`;
+    }
+    writeSiteRestore(file, manifest);
+    if (manifest.parts.every((p) => p.status)) {
+        const done = `${file}.done`;
+        rmSync(done, { force: true });
+        renameSync(file, done);
+    }
+}
+/**
+ * Apply `manager`'s part of a staged site restore, at start, before the
+ * manager reads its data. `allowed` says which live paths this manager may
+ * replace, so a tampered manifest cannot rename an arbitrary file.
+ * `strays` lists staged paths of this manager's that exist on disk, found by
+ * the manager: with no committed restore naming them they are set aside.
+ * Returns null when there was nothing to do.
+ */
+export function applyPartAtStart(file, manager, options) {
+    const gate = gatePart(file, manager);
+    if (gate.decision === 'none') {
+        const strays = options.strays?.() ?? [];
+        if (strays.length === 0)
+            return null;
+        for (const s of strays)
+            setAsidePath(s);
+        return { applied: [], refused: `staged files with no site restore naming them (an interrupted staging): ${strays.map((s) => path.basename(s)).join(', ')} — set aside as *.incomplete` };
+    }
+    if (gate.decision === 'set-aside') {
+        for (const swap of gate.part?.swaps ?? [])
+            setAsidePath(swap.staged);
+        for (const s of options.strays?.() ?? [])
+            setAsidePath(s);
+        if (gate.part)
+            markPart(file, manager, 'set-aside', gate.reason);
+        return { applied: [], refused: gate.reason };
+    }
+    const bad = gate.part.swaps.find((s) => !options.allowed(s) || s.staged !== stagedPathFor(s.live));
+    if (bad) {
+        const reason = `the site restore manifest names ${bad.live}, which is not ${manager}'s to replace`;
+        for (const swap of gate.part.swaps)
+            if (swap.staged === stagedPathFor(swap.live))
+                setAsidePath(swap.staged);
+        markPart(file, manager, 'set-aside', reason);
+        return { applied: [], refused: reason };
+    }
+    const applied = [];
+    try {
+        for (const swap of gate.part.swaps) {
+            const kept = keptPathFor(swap.live);
+            rmSync(kept, { recursive: true, force: true });
+            if (existsSync(swap.live))
+                renameSync(swap.live, kept);
+            mkdirSync(path.dirname(swap.live), { recursive: true });
+            renameSync(swap.staged, swap.live);
+            applied.push({ live: swap.live, kept });
+        }
+    }
+    catch (err) {
+        const reason = `applying ${manager}'s part failed after ${applied.length} of ${gate.part.swaps.length} paths: ${err.message}`;
+        markPart(file, manager, 'set-aside', reason);
+        return { applied, refused: reason };
+    }
+    markPart(file, manager, 'applied');
+    return { applied };
+}
+/**
+ * What a start did with a site restore, for BackupManager to tell admins at
+ * the end of the start: the finished record (`<file>.done`, then kept as
+ * `<file>.last`), or a record with parts still pending — their managers did
+ * not start — which is then refused and its pending parts set aside.
+ */
+export function finishSiteRestoreAtBoot(file) {
+    const done = `${file}.done`;
+    let manifest;
+    try {
+        manifest = readSiteRestore(file);
+    }
+    catch {
+        manifest = null;
+    }
+    if (manifest) {
+        if (manifest.state === 'staging')
+            refuse(file, manifest, manifest.parts[0], 'the site restore was still being staged when the server stopped (interrupted staging)');
+        const pending = manifest.parts.filter((p) => !p.status);
+        for (const part of pending) {
+            for (const swap of part.swaps)
+                setAsidePath(swap.staged);
+            for (const extra of part.discard ?? [])
+                setAsidePath(extra);
+            markPart(file, part.manager, 'set-aside', `${part.manager} did not apply its part at start, so it was set aside`);
+        }
+        if (manifest.parts.length === 0 && isFile(file)) {
+            rmSync(done, { force: true });
+            renameSync(file, done);
+        }
+    }
+    if (!isFile(done))
+        return null;
+    const finished = JSON.parse(readFileSync(done, 'utf8'));
+    const last = `${file}.last`;
+    rmSync(last, { force: true });
+    renameSync(done, last);
+    return finished;
+}

package/lib/src/utils/treeArchive.d.ts

@@ -0,0 +1,44 @@
+export interface TreeArchiveOutcome {
+    /** Regular files written. */
+    files: number;
+    /** Their bytes. */
+    bytes: number;
+    /** Entries left out because they are not a file or a folder (a symbolic link), relative to the root. */
+    skipped: string[];
+}
+/**
+ * Write `entries` (paths relative to `root`; default: everything in it) into
+ * `target`, streamed. `exclude` leaves out a path relative to `root`, in
+ * posix form. A missing `root` writes an empty archive. Never overwrites.
+ */
+export declare function writeTreeArchive(target: string, root: string, options?: {
+    entries?: string[];
+    exclude?: (relative: string) => boolean;
+    backupKey?: string;
+}): Promise<TreeArchiveOutcome>;
+/**
+ * Extract `archive` into `dest`, which is emptied first, streamed.
+ * `select(relative)` picks the entries to extract (default: all). Refuses —
+ * removing `dest` — an entry that is not a file or a folder, an absolute
+ * path, or one that climbs out (`..`).
+ */
+export declare function extractTreeArchive(archive: string, dest: string, options?: {
+    select?: (relative: string) => boolean;
+    strip?: number;
+    backupKey?: string;
+}): Promise<{
+    files: number;
+    bytes: number;
+}>;
+/**
+ * Every entry in an archive, plain or encrypted, read as a stream: what a
+ * caller checks before extracting. `onEntry` gets each entry's path and type.
+ */
+export declare function listTreeArchive(archive: string, onEntry: (entry: {
+    path: string;
+    type: string;
+}) => void, options?: {
+    backupKey?: string;
+}): Promise<void>;
+/** The first `n` bytes of a file, read without reading the rest. */
+export declare function readHead(file: string, n: number): Promise<Buffer>;

package/lib/src/utils/username.d.ts

@@ -49,5 +49,11 @@ export declare function sameUsername(a: unknown, b: unknown): boolean;
  * checked separately by `isSystemPrincipal`, because an operator chooses it.
  */
 export declare const RESERVED_USERNAMES: readonly string[];
-/** True when the name belongs to a principal rather than a person. */
+/**
+ * The prefix of a person's identifier when the person has no account (#1930):
+ * `person:<uuid>`. No username may start with it, so an account-less person's
+ * identifier can never be, or later become, someone's username.
+ */
+export declare const ACCOUNTLESS_PERSON_PREFIX = "person:";
+/** True when the name belongs to a principal rather than a person, or has the account-less person prefix. */
 export declare function isReservedUsername(username: unknown): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilleke/ngdpbase-types",
-  "version": "5.21.0",
+  "version": "5.23.0",
   "description": "TypeScript types for ngdpbase add-ons, and a test kit of core's own values. A dev dependency, versioned with ngdpbase.",
   "license": "Apache-2.0",
   "author": "Jim Willeke",
@@ -46,7 +46,7 @@
     "ipaddr.js": "^2.5.0",
     "jose": "^6.2.12",
     "linkedom": "^0.18.13",
-    "markdown-it": "^14.3.1",
+    "markdown-it": "^14.3.3",
     "minimatch": "^10.2.6",
     "minisearch": "7.2.0",
     "multer": "^2.4.0",

package/lib/src/utils/startupState.d.ts

@@ -1,65 +0,0 @@
-/**
- * What the initialisation gate serves, and when (#1152).
- *
- * `app.ts` used to treat every initialisation failure the same way:
- * `process.exit(1)`. A mistyped CIDR and an unreadable data directory produced
- * the identical outcome — a process that is gone, and an operator whose only
- * route back is the filesystem. Under a supervisor it is worse than useless: a
- * process that exits on a bad config value restarts, fails identically, and
- * restarts again, and nothing in that loop ever reaches the admin UI.
- *
- * __The test is not severity.__ A malformed deny rule is serious, and the
- * instance should stop serving because of it. The question is whether stopping
- * the *process* helps, and it only helps when the process cannot offer a way
- * out.
- *
- * See D9 to D13 of docs/security-posture.md.
- */
-/**
- * Paths served in every state, so the maintenance page can render itself.
- *
- * Assets only. Adding a route here would open it during `starting` too, when
- * the managers behind it are not up.
- */
-export declare const STARTUP_BYPASS_PATHS: readonly ["/css", "/js", "/images", "/themes", "/addons"];
-export type GateDecision = 'serve' | 'block';
-/**
- * What the initialisation gate should do with a request.
- *
- * The server either is `engineReady` or it is not. What decides the third
- * behaviour is not a third readiness value but a second, independent fact:
- * whether the engine finished and a configuration value is unusable. Both are
- * passed in, so the impossible combination — ready AND blocked — simply never
- * arises at the call site rather than being modelled away.
- */
-export declare function gateDecision(engineReady: boolean, blocked: boolean, path: string): GateDecision;
-/**
- * The message shown on the maintenance page and logged at boot.
- *
- * Every reason at once, rather than the first: an operator who fixes one and
- * restarts into the next has been made to do the work twice.
- */
-export declare function describeBlocked(reasons: readonly string[]): string;
-/**
- * What a visitor is told about a blocked instance: on the maintenance page and
- * in `/health/readiness`, both served without sign-in (#1883).
- *
- * Every reason, as {@link describeBlocked} words them, unless one was recorded
- * for administrators only (a site-critical add-on that did not load): then
- * only `publicMessage`, and no reason at all — not even the ones that could be
- * shown, since one detail beside a vague notice still says what failed.
- * Administrators get the reasons in the log and the admin notification.
- */
-export declare function blockedForVisitors(reasons: readonly string[], publicMessage: string | null): {
-    message: string;
-    detail: readonly string[];
-};
-/**
- * #1883: what visitors see while a failure for administrators only holds the
- * site in maintenance mode — a site-critical add-on that did not load, or an
- * application database that cannot be opened safely (#1892). Empty leaves
- * only the page's heading.
- */
-export declare const SITE_CRITICAL_PUBLIC_MESSAGE_KEY = "ngdpbase.managers.addons-manager.site-critical.public-message";
-/** The configured public message ({@link SITE_CRITICAL_PUBLIC_MESSAGE_KEY}); '' when unset or not a string. */
-export declare function sitePublicMessage(getProperty: ((key: string, fallback: unknown) => unknown) | undefined): string;

package/lib/src/utils/startupState.js

@@ -1,115 +0,0 @@
-/**
- * What the initialisation gate serves, and when (#1152).
- *
- * `app.ts` used to treat every initialisation failure the same way:
- * `process.exit(1)`. A mistyped CIDR and an unreadable data directory produced
- * the identical outcome — a process that is gone, and an operator whose only
- * route back is the filesystem. Under a supervisor it is worse than useless: a
- * process that exits on a bad config value restarts, fails identically, and
- * restarts again, and nothing in that loop ever reaches the admin UI.
- *
- * __The test is not severity.__ A malformed deny rule is serious, and the
- * instance should stop serving because of it. The question is whether stopping
- * the *process* helps, and it only helps when the process cannot offer a way
- * out.
- *
- * See D9 to D13 of docs/security-posture.md.
- */
-/**
- * Paths served in every state, so the maintenance page can render itself.
- *
- * Assets only. Adding a route here would open it during `starting` too, when
- * the managers behind it are not up.
- */
-export const STARTUP_BYPASS_PATHS = ['/css', '/js', '/images', '/themes', '/addons'];
-/** Exact paths served in every state. */
-const BYPASS_FILES = ['/favicon.ico', '/favicon.svg'];
-/**
- * Paths served when the engine finished and a configuration value is unusable,
- * but NOT while the engine is merely starting.
- *
- * The difference is whether the screens work. While the engine is initialising
- * the managers behind `/admin` are not up, so letting a request through fails
- * in a worse way than a 503. Once it has finished and only a value is wrong,
- * they are exactly what the operator needs.
- */
-const REPAIR_PATHS = ['/admin', '/login', '/logout'];
-/**
- * Does `path` sit under `prefix` as a route, rather than merely starting with
- * its characters?
- *
- * `/adminish` is an ordinary page and must not reach the admin bypass. Prefix
- * matching without a boundary is how a gate springs a leak.
- */
-function isUnder(path, prefix) {
-    return path === prefix || path.startsWith(`${prefix}/`) || path.startsWith(`${prefix}?`);
-}
-/**
- * What the initialisation gate should do with a request.
- *
- * The server either is `engineReady` or it is not. What decides the third
- * behaviour is not a third readiness value but a second, independent fact:
- * whether the engine finished and a configuration value is unusable. Both are
- * passed in, so the impossible combination — ready AND blocked — simply never
- * arises at the call site rather than being modelled away.
- */
-export function gateDecision(engineReady, blocked, path) {
-    if (engineReady)
-        return 'serve';
-    if (BYPASS_FILES.includes(path))
-        return 'serve';
-    if (STARTUP_BYPASS_PATHS.some((prefix) => isUnder(path, prefix)))
-        return 'serve';
-    // Blocked means the engine FINISHED and a value is wrong, so these screens
-    // work and are the only repair path without filesystem access. While merely
-    // starting they stay closed, because the managers behind them are not up.
-    if (blocked && REPAIR_PATHS.some((prefix) => isUnder(path, prefix)))
-        return 'serve';
-    return 'block';
-}
-/**
- * The message shown on the maintenance page and logged at boot.
- *
- * Every reason at once, rather than the first: an operator who fixes one and
- * restarts into the next has been made to do the work twice.
- */
-export function describeBlocked(reasons) {
-    if (reasons.length === 0) {
-        // Blocked with no reason is an internal inconsistency: nothing sets the
-        // blocked state without recording why. Say "unknown" rather than render an
-        // empty page — and note that the repair path stays OPEN in this case, so
-        // an operator can still sign in and look, which is the recoverable answer.
-        return 'The instance is not serving because its configuration could not be used. '
-            + 'The reason is UNKNOWN, which is itself a bug — nothing should block the instance without recording why. '
-            + 'Please report it, and check the startup log.';
-    }
-    const list = reasons.map((r) => `• ${r}`).join('\n');
-    return `The instance is not serving because its configuration could not be used:\n${list}`;
-}
-/**
- * What a visitor is told about a blocked instance: on the maintenance page and
- * in `/health/readiness`, both served without sign-in (#1883).
- *
- * Every reason, as {@link describeBlocked} words them, unless one was recorded
- * for administrators only (a site-critical add-on that did not load): then
- * only `publicMessage`, and no reason at all — not even the ones that could be
- * shown, since one detail beside a vague notice still says what failed.
- * Administrators get the reasons in the log and the admin notification.
- */
-export function blockedForVisitors(reasons, publicMessage) {
-    if (publicMessage !== null)
-        return { message: publicMessage, detail: [publicMessage] };
-    return { message: describeBlocked(reasons), detail: reasons };
-}
-/**
- * #1883: what visitors see while a failure for administrators only holds the
- * site in maintenance mode — a site-critical add-on that did not load, or an
- * application database that cannot be opened safely (#1892). Empty leaves
- * only the page's heading.
- */
-export const SITE_CRITICAL_PUBLIC_MESSAGE_KEY = 'ngdpbase.managers.addons-manager.site-critical.public-message';
-/** The configured public message ({@link SITE_CRITICAL_PUBLIC_MESSAGE_KEY}); '' when unset or not a string. */
-export function sitePublicMessage(getProperty) {
-    const value = getProperty?.(SITE_CRITICAL_PUBLIC_MESSAGE_KEY, '');
-    return typeof value === 'string' ? value : '';
-}