@mriekki/project-forge 4.2.0 → 4.4.0

package/assets/generated/deployment/src/project_forge_deployment/environment_isolation.py

@@ -0,0 +1,438 @@
+"""Read-only colocated-environment isolation and collision preflight."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from collections import defaultdict
+from typing import Any, Iterable
+
+from .app_runtime import APP_ROOT, app_inventory
+from .errors import DeploymentKitError
+from .route_registry import route_inventory
+from .sqlite_adapter import sqlite_inventory
+
+ISOLATION_SCHEMA_VERSION = 1
+_LOCK_ROOT = "/run/lock"
+_SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
+_REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
+_CONTAINER_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$")
+_DB_FILE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
+
+
+def _owner_repo(value: str) -> str:
+    if not isinstance(value, str) or _REPO_RE.fullmatch(value) is None:
+        raise DeploymentKitError("ownerRepo must use GitHub owner/repository form without URL syntax.")
+    return value
+
+
+def _slug(value: str, field: str) -> str:
+    if not isinstance(value, str) or _SLUG_RE.fullmatch(value) is None:
+        raise DeploymentKitError(f"{field} must use lowercase letters, digits, and internal hyphens.")
+    return value
+
+
+def _container(value: str | None) -> str | None:
+    if value is None:
+        return None
+    if not isinstance(value, str) or _CONTAINER_RE.fullmatch(value) is None:
+        raise DeploymentKitError("containerName contains unsupported characters.")
+    return value
+
+
+def _port(value: int | None) -> int | None:
+    if value is None:
+        return None
+    if type(value) is not int or not 1 <= value <= 65535:
+        raise DeploymentKitError("runtimePort must be an integer from 1 through 65535.")
+    return value
+
+
+def _database_file(value: str | None) -> str | None:
+    if value is None:
+        return None
+    if not isinstance(value, str) or _DB_FILE_RE.fullmatch(value) is None or value in {".", ".."}:
+        raise DeploymentKitError("databaseFile must be a safe file name without path separators.")
+    return value
+
+
+def _hostnames(values: Iterable[str] | None) -> list[str]:
+    result: set[str] = set()
+    for value in values or ():
+        if not isinstance(value, str) or not value.strip():
+            raise DeploymentKitError("routeHostnames must contain non-empty strings.")
+        result.add(value.lower().rstrip("."))
+    return sorted(result)
+
+
+def _snapshot(value: Any) -> str:
+    return hashlib.sha256(
+        json.dumps(value, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    ).hexdigest()
+
+
+def _resource_state(conflicts: list[dict[str, Any]], resources: set[str]) -> str:
+    return "blocked" if any(item["resource"] in resources for item in conflicts) else "clear"
+
+
+def _identity(item: dict[str, Any]) -> tuple[str, str, str]:
+    return (item["ownerRepo"], item["appSlug"], item["environment"])
+
+
+def _conflict(
+    code: str,
+    resource: str,
+    message: str,
+    **detail: Any,
+) -> dict[str, Any]:
+    return {"code": code, "resource": resource, "message": message, **detail}
+
+
+def environment_isolation_preflight(
+    target_name: str,
+    *,
+    owner_repo: str,
+    environment: str,
+    production: bool = False,
+    app_slug: str | None = None,
+    container_name: str | None = None,
+    runtime_port: int | None = None,
+    persistence_mode: str | None = None,
+    database_file: str | None = None,
+    route_hostnames: Iterable[str] | None = None,
+    require_vacant_app_identity: bool = False,
+) -> dict[str, Any]:
+    """Inspect managed shared-host state without mutating it.
+
+    Same-target colocation is allowed. The preflight blocks only ambiguous ownership,
+    duplicate managed identities, route/runtime drift, or a requested footprint that
+    would take over a sibling Project/environment resource.
+    """
+
+    owner = _owner_repo(owner_repo)
+    env = _slug(environment, "environment")
+    app = _slug(app_slug, "appSlug") if app_slug is not None else None
+    container = _container(container_name)
+    port = _port(runtime_port)
+    database = _database_file(database_file)
+    hosts = _hostnames(route_hostnames)
+    if not isinstance(production, bool):
+        raise DeploymentKitError("production must be true or false.")
+    if not isinstance(require_vacant_app_identity, bool):
+        raise DeploymentKitError("requireVacantAppIdentity must be true or false.")
+    if persistence_mode not in {None, "none", "directory"}:
+        raise DeploymentKitError("persistenceMode must be omitted, 'none', or 'directory'.")
+    if app is None and any(value is not None for value in (container, port, persistence_mode, database)):
+        raise DeploymentKitError("appSlug is required when an application footprint is supplied.")
+    if app is None and hosts:
+        raise DeploymentKitError("appSlug is required when routeHostnames are supplied.")
+    if persistence_mode == "none" and database is not None:
+        raise DeploymentKitError("databaseFile cannot be supplied when persistenceMode is 'none'.")
+
+    app_state = app_inventory(target_name)
+    route_state = route_inventory(target_name)
+    sqlite_state = sqlite_inventory(target_name)
+    applications = list(app_state.get("applications", []))
+    routes = list(route_state.get("managedRoutes", []))
+    sqlite = list(sqlite_state.get("sqlite", []))
+
+    conflicts: list[dict[str, Any]] = []
+
+    containers: dict[str, list[dict[str, Any]]] = defaultdict(list)
+    for item in applications:
+        containers[item["containerName"]].append(item)
+    for name, items in containers.items():
+        identities = {_identity(item) for item in items}
+        if len(identities) > 1:
+            conflicts.append(
+                _conflict(
+                    "duplicate-managed-container",
+                    "runtime",
+                    f"Managed container name {name!r} is claimed by multiple Project/environment identities.",
+                    containerName=name,
+                    identities=[list(value) for value in sorted(identities)],
+                )
+            )
+
+    route_hosts: dict[str, list[dict[str, Any]]] = defaultdict(list)
+    for route in routes:
+        for hostname in route["hostnames"]:
+            route_hosts[hostname].append(route)
+    for hostname, items in route_hosts.items():
+        route_ids = sorted({item["routeId"] for item in items})
+        if len(route_ids) > 1:
+            conflicts.append(
+                _conflict(
+                    "duplicate-managed-hostname",
+                    "route",
+                    f"Managed hostname {hostname!r} is claimed by multiple routes.",
+                    hostname=hostname,
+                    routeIds=route_ids,
+                )
+            )
+
+    sqlite_keys: dict[tuple[str, str], list[dict[str, Any]]] = defaultdict(list)
+    for item in sqlite:
+        sqlite_keys[(item["appSlug"], item["environment"])].append(item)
+    for key, items in sqlite_keys.items():
+        owners = sorted({item["ownerRepo"] for item in items})
+        if len(items) > 1:
+            conflicts.append(
+                _conflict(
+                    "duplicate-sqlite-reservation",
+                    "persistence",
+                    f"SQLite identity {key[0]}--{key[1]} has multiple managed reservations.",
+                    appSlug=key[0],
+                    environment=key[1],
+                    owners=owners,
+                )
+            )
+
+    apps_by_key = {(item["appSlug"], item["environment"]): item for item in applications}
+    for route in routes:
+        runtime = apps_by_key.get((route["appSlug"], route["environment"]))
+        if runtime is None:
+            conflicts.append(
+                _conflict(
+                    "route-without-managed-runtime",
+                    "route",
+                    f"Route {route['routeId']} has no matching managed application runtime.",
+                    routeId=route["routeId"],
+                )
+            )
+            continue
+        if runtime["ownerRepo"] != route["ownerRepo"]:
+            conflicts.append(
+                _conflict(
+                    "route-runtime-owner-mismatch",
+                    "ownership",
+                    f"Route {route['routeId']} and its managed runtime have different repository owners.",
+                    routeOwnerRepo=route["ownerRepo"],
+                    runtimeOwnerRepo=runtime["ownerRepo"],
+                )
+            )
+        if runtime["containerName"] != route["upstreamContainer"]:
+            conflicts.append(
+                _conflict(
+                    "route-upstream-container-mismatch",
+                    "route",
+                    f"Route {route['routeId']} points at a different container than its managed runtime.",
+                    upstreamContainer=route["upstreamContainer"],
+                    runtimeContainer=runtime["containerName"],
+                )
+            )
+        if runtime["runtimePort"] != route["upstreamPort"]:
+            conflicts.append(
+                _conflict(
+                    "route-upstream-port-mismatch",
+                    "route",
+                    f"Route {route['routeId']} port does not match its managed runtime port.",
+                    upstreamPort=route["upstreamPort"],
+                    runtimePort=runtime["runtimePort"],
+                )
+            )
+
+    sibling_environments: set[str] = set()
+    for collection in (applications, routes, sqlite):
+        for item in collection:
+            if item["ownerRepo"] == owner and item["environment"] != env:
+                sibling_environments.add(item["environment"])
+
+    desired_identity = (owner, app, env) if app is not None else None
+    matching_apps = [
+        item for item in applications if app is not None and item["appSlug"] == app and item["environment"] == env
+    ]
+    matching_routes = [
+        item for item in routes if app is not None and item["appSlug"] == app and item["environment"] == env
+    ]
+    matching_sqlite = [
+        item for item in sqlite if app is not None and item["appSlug"] == app and item["environment"] == env
+    ]
+
+    for item in matching_apps:
+        if item["ownerRepo"] != owner:
+            conflicts.append(
+                _conflict(
+                    "application-identity-owned-by-other-project",
+                    "ownership",
+                    f"Application identity {app}--{env} is already owned by another repository.",
+                    existingOwnerRepo=item["ownerRepo"],
+                )
+            )
+    for item in matching_routes:
+        if item["ownerRepo"] != owner:
+            conflicts.append(
+                _conflict(
+                    "route-identity-owned-by-other-project",
+                    "ownership",
+                    f"Route identity {app}--{env} is already owned by another repository.",
+                    existingOwnerRepo=item["ownerRepo"],
+                )
+            )
+    for item in matching_sqlite:
+        if item["ownerRepo"] != owner:
+            conflicts.append(
+                _conflict(
+                    "sqlite-identity-owned-by-other-project",
+                    "ownership",
+                    f"SQLite identity {app}--{env} is already owned by another repository.",
+                    existingOwnerRepo=item["ownerRepo"],
+                )
+            )
+
+    if app is not None and require_vacant_app_identity:
+        if matching_apps:
+            conflicts.append(
+                _conflict(
+                    "reserved-application-identity-not-vacant",
+                    "runtime",
+                    f"Reserved application identity {app}--{env} already has managed runtime state.",
+                )
+            )
+        if matching_routes:
+            conflicts.append(
+                _conflict(
+                    "reserved-route-identity-not-vacant",
+                    "route",
+                    f"Reserved application identity {app}--{env} already has managed route state.",
+                )
+            )
+        if matching_sqlite:
+            conflicts.append(
+                _conflict(
+                    "reserved-persistence-identity-not-vacant",
+                    "persistence",
+                    f"Reserved application identity {app}--{env} already has managed SQLite state.",
+                )
+            )
+
+    if container is not None and desired_identity is not None:
+        for item in applications:
+            if item["containerName"] == container and _identity(item) != desired_identity:
+                conflicts.append(
+                    _conflict(
+                        "requested-container-name-collision",
+                        "runtime",
+                        f"Requested container name {container!r} belongs to another managed Project/environment.",
+                        existingIdentity=list(_identity(item)),
+                    )
+                )
+
+    requested_hosts = set(hosts)
+    if requested_hosts:
+        desired_route_id = f"{app}--{env}"
+        for route in routes:
+            if route["routeId"] == desired_route_id and route["ownerRepo"] == owner:
+                continue
+            collision = requested_hosts.intersection(route["hostnames"])
+            if collision:
+                conflicts.append(
+                    _conflict(
+                        "requested-hostname-collision",
+                        "route",
+                        "Requested hostname is already owned by another managed route.",
+                        routeId=route["routeId"],
+                        hostnames=sorted(collision),
+                    )
+                )
+
+    if persistence_mode == "none" and matching_sqlite:
+        conflicts.append(
+            _conflict(
+                "requested-no-persistence-conflicts-with-sqlite",
+                "persistence",
+                f"Application identity {app}--{env} requests no persistence but has managed SQLite state.",
+            )
+        )
+
+    conflicts.sort(
+        key=lambda item: (
+            item["resource"],
+            item["code"],
+            json.dumps(item, sort_keys=True, separators=(",", ":")),
+        )
+    )
+
+    app_root = f"{APP_ROOT}/{app}/{env}" if app is not None else None
+    lock_identity = f"{_LOCK_ROOT}/project-forge-app-{app}--{env}.lock" if app is not None else None
+    database_path = f"{app_root}/data/{database}" if app_root is not None and database is not None else None
+
+    desired = {
+        "appSlug": app,
+        "containerName": container,
+        "runtimePort": port,
+        "routeHostnames": hosts,
+        "persistenceMode": persistence_mode,
+        "databaseFile": database,
+        "requireVacantAppIdentity": require_vacant_app_identity,
+    }
+    evidence_value = {
+        "schemaVersion": ISOLATION_SCHEMA_VERSION,
+        "targetName": target_name,
+        "ownerRepo": owner,
+        "environment": env,
+        "production": production,
+        "desired": desired,
+        "applications": applications,
+        "routes": routes,
+        "sqlite": sqlite,
+    }
+    evidence_sha = _snapshot(evidence_value)
+
+    return {
+        "schemaVersion": ISOLATION_SCHEMA_VERSION,
+        "targetName": target_name,
+        "ownerRepo": owner,
+        "environment": env,
+        "production": production,
+        "state": "blocked" if conflicts else "clear",
+        "sharedFailureDomain": bool(sibling_environments),
+        "siblingEnvironments": sorted(sibling_environments),
+        "desired": desired,
+        "checks": {
+            "managedOwnership": {
+                "state": _resource_state(conflicts, {"ownership"}),
+                "applicationRecords": len(applications),
+                "routeRecords": len(routes),
+                "sqliteRecords": len(sqlite),
+            },
+            "runtimeIdentity": {
+                "state": _resource_state(conflicts, {"runtime", "ownership"}),
+                "appRoot": app_root,
+                "containerName": container,
+                "composeProject": {
+                    "state": "not-applicable",
+                    "reason": "The remote managed runtime uses direct Docker container ownership, not Docker Compose project identity.",
+                },
+                "hostPortPublishing": {
+                    "state": "not-applicable",
+                    "reason": "Managed remote application containers do not publish host ports; sibling containers may safely reuse the same internal runtime port.",
+                },
+            },
+            "routes": {
+                "state": _resource_state(conflicts, {"route", "ownership"}),
+                "requestedHostnames": hosts,
+                "runtimePort": port,
+                "portIsolation": "container-scoped",
+            },
+            "persistence": {
+                "state": _resource_state(conflicts, {"persistence", "ownership"}),
+                "appRoot": app_root,
+                "databasePath": database_path,
+            },
+            "deploymentLock": {
+                "state": _resource_state(conflicts, {"runtime", "ownership"}),
+                "lockIdentity": lock_identity,
+                "scope": "app/environment",
+            },
+        },
+        "conflicts": conflicts,
+        "inventorySnapshots": {
+            "applications": _snapshot(applications),
+            "routes": _snapshot(routes),
+            "sqlite": _snapshot(sqlite),
+        },
+        "evidenceSha256": evidence_sha,
+        "mutated": False,
+    }

package/assets/generated/deployment/src/project_forge_deployment/environment_probe.py

@@ -12,6 +12,7 @@ from typing import Any
 from .app_runtime import normalize_app_spec, plan_app_deploy
 from .app_runtime_workstation import apply_app_deploy_with_preloaded_image
 from .box_platform import platform_status
+from .environment_isolation import environment_isolation_preflight
 from .errors import DeploymentKitError
 from .image_transfer import remote_image_present, transfer_image, verify_local_image
 from .proof_receipt import write_environment_proof_receipt
@@ -92,6 +93,27 @@ def _resolve_probe_image(image_tag: str) -> str:
     raise DeploymentKitError("Environment proof image has no usable immutable sha256 RepoDigest.")
 
 
+def _proof_isolation_preflight(
+    target_name: str,
+    *,
+    owner_repo: str,
+    environment: str,
+    production: bool,
+    probe_app_slug: str,
+) -> dict[str, Any]:
+    return environment_isolation_preflight(
+        target_name,
+        owner_repo=owner_repo,
+        environment=environment,
+        production=production,
+        app_slug=probe_app_slug,
+        container_name=f"{probe_app_slug}--{environment}",
+        runtime_port=80,
+        persistence_mode="none",
+        require_vacant_app_identity=True,
+    )
+
+
 def plan_environment_proof(
     target_name: str,
     *,
@@ -111,17 +133,27 @@ def plan_environment_proof(
         raise DeploymentKitError(
             f"Environment proof requires a ready shared platform; target '{target_name}' is '{platform.get('state', 'unknown')}'."
         )
+    probe_app_slug = _probe_slug(owner)
+    isolation = _proof_isolation_preflight(
+        target_name,
+        owner_repo=owner,
+        environment=env,
+        production=production,
+        probe_app_slug=probe_app_slug,
+    )
     return {
         "targetName": target_name,
         "ownerRepo": owner,
         "environment": env,
         "production": production,
-        "probeAppSlug": _probe_slug(owner),
+        "probeAppSlug": probe_app_slug,
         "probeImageTag": probe_image,
         "artifactDelivery": "workstation-transfer",
         "persistence": "none",
         "healthPath": "/",
         "cleanup": "automatic",
+        "isolationPreflight": isolation,
+        "runnable": isolation["state"] == "clear",
         "requiredAuthorization": (
             PRODUCTION_ENVIRONMENT_PROOF_WRITE_PHRASE if production else ENVIRONMENT_PROOF_WRITE_PHRASE
         ),
@@ -139,6 +171,8 @@ def _proof_result(plan: dict[str, Any]) -> dict[str, Any]:
         "preflight": {
             "targetAccess": "verified-by-platform-doctor",
             "hostPlatform": "ready",
+            "environmentIsolation": plan["isolationPreflight"]["state"],
+            "isolationEvidenceSha256": plan["isolationPreflight"]["evidenceSha256"],
         },
         "registryDigest": None,
         "localImageId": None,
@@ -199,10 +233,32 @@ def run_environment_proof(plan: dict[str, Any]) -> dict[str, Any]:
         "persistence",
         "healthPath",
         "cleanup",
+        "isolationPreflight",
+        "runnable",
         "requiredAuthorization",
     }
     if not isinstance(plan, dict) or set(plan) != required:
         raise DeploymentKitError("Malformed environment proof plan.")
+    if plan["isolationPreflight"].get("state") != "clear" or not plan["runnable"]:
+        raise DeploymentKitError(
+            "Environment proof is blocked by the reviewed isolation/collision preflight; resolve the reported conflicts and create a fresh plan."
+        )
+
+    current_isolation = _proof_isolation_preflight(
+        plan["targetName"],
+        owner_repo=plan["ownerRepo"],
+        environment=plan["environment"],
+        production=plan["production"],
+        probe_app_slug=plan["probeAppSlug"],
+    )
+    if current_isolation["state"] != "clear":
+        raise DeploymentKitError(
+            "Environment isolation became blocked after the proof plan was reviewed; no proof mutation was attempted."
+        )
+    if current_isolation["evidenceSha256"] != plan["isolationPreflight"].get("evidenceSha256"):
+        raise DeploymentKitError(
+            "Environment isolation evidence changed after the proof plan was reviewed; create and authorize a fresh plan."
+        )
 
     result = _proof_result(plan)
     deploy_plan: dict[str, Any] | None = None

package/assets/generated/deployment/src/project_forge_deployment/environment_setup.py

@@ -248,7 +248,7 @@ def _next_action(status: dict[str, Any]) -> dict[str, Any]:
         return {
             "kind": "complete",
             "action": "remote-environment-ready",
-            "reason": "Fresh workstation-local proof evidence matches this Project/environment/target context.",
+            "reason": "Fresh workstation-local proof evidence matches this Project/environment/target context and current isolation remains clear.",
             "proofReceipt": phases["deploymentPath"].get("detail"),
         }
 
@@ -259,6 +259,36 @@ def _next_action(status: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def _proof_command(name: str, proof: dict[str, Any], *, production: bool) -> str:
+    command = (
+        f"project-forge-deploy environment proof plan {name} "
+        f"--owner-repo {proof['ownerRepo']} --environment {proof['environment']}"
+    )
+    if production:
+        command += " --production"
+    return command
+
+
+def _blocked_isolation_action(
+    name: str,
+    proof: dict[str, Any],
+    *,
+    production: bool,
+) -> dict[str, Any]:
+    return {
+        "kind": "blocked",
+        "action": "resolve-environment-isolation-collision",
+        "command": _proof_command(name, proof, production=production),
+        "reason": (
+            "The read-only colocated-environment preflight found a managed ownership or footprint collision. "
+            "Do not redirect this environment to a sibling target identity or take over existing runtime, route, persistence, or lock state."
+        ),
+        "proofPlan": proof,
+        "isolationPreflight": proof.get("isolationPreflight"),
+        "safety": "Inspect the reported managed ownership records and resolve the collision explicitly before creating a fresh proof plan.",
+    }
+
+
 def remote_setup_plan(
     name: str,
     *,
@@ -272,48 +302,64 @@ def remote_setup_plan(
         raise DeploymentKitError("ownerRepo and environment must be supplied together for setup proof planning.")
 
     status = remote_setup_status(name)
-    if owner_repo is not None and environment is not None and status["phases"]["hostPlatform"]["state"] == "ready":
-        receipt = load_environment_proof_receipt(
+    proof: dict[str, Any] | None = None
+    receipt: dict[str, Any] | None = None
+    if (
+        owner_repo is not None
+        and environment is not None
+        and status["phases"]["hostPlatform"]["state"] == "ready"
+    ):
+        # Current machine isolation must be checked even when a prior proof receipt is
+        # otherwise reusable. A sibling environment can be added after the receipt was
+        # recorded without changing workstation/target identity or trust evidence.
+        proof = plan_environment_proof(
             name,
             owner_repo=owner_repo,
             environment=environment,
             production=production,
         )
-        status["phases"]["deploymentPath"] = _phase(
-            "DEPLOYMENT PATH PROVEN",
-            "proven" if receipt["state"] == "proven" else "not-proven",
-            detail=receipt,
+        receipt = load_environment_proof_receipt(
+            name,
+            owner_repo=owner_repo,
+            environment=environment,
+            production=production,
         )
+        isolation_clear = proof.get("runnable", True)
+        if isolation_clear:
+            status["phases"]["deploymentPath"] = _phase(
+                "DEPLOYMENT PATH PROVEN",
+                "proven" if receipt["state"] == "proven" else "not-proven",
+                detail=receipt,
+            )
+            if receipt["state"] == "proven":
+                status["state"] = "environment-ready"
+        else:
+            status["phases"]["deploymentPath"] = _phase(
+                "DEPLOYMENT PATH PROVEN",
+                "blocked",
+                detail={
+                    "proofReceipt": receipt,
+                    "isolationPreflight": proof.get("isolationPreflight"),
+                },
+            )
+            status["state"] = "needs-setup"
         status["currentPhase"] = _current_phase(status["phases"])
-        if receipt["state"] == "proven":
-            status["state"] = "environment-ready"
 
     next_action = _next_action(status)
 
-    if (
+    if proof is not None and not proof.get("runnable", True):
+        next_action = _blocked_isolation_action(name, proof, production=production)
+    elif (
         next_action["action"] == "plan-deployment-path-proof"
-        and owner_repo is not None
-        and environment is not None
+        and proof is not None
     ):
-        proof = plan_environment_proof(
-            name,
-            owner_repo=owner_repo,
-            environment=environment,
-            production=production,
-        )
-        command = (
-            f"project-forge-deploy environment proof plan {name} "
-            f"--owner-repo {proof['ownerRepo']} --environment {proof['environment']}"
-        )
-        if production:
-            command += " --production"
         next_action = {
             "kind": "read-only",
             "action": "review-deployment-path-proof",
-            "command": command,
+            "command": _proof_command(name, proof, production=production),
             "proofPlan": proof,
             "runAuthorization": proof["requiredAuthorization"],
-            "previousProof": status["phases"]["deploymentPath"].get("detail"),
+            "previousProof": receipt,
         }
 
     return {