@nickmeriano/task 0.7.1 → 0.9.0

package/src/publish.ts

@@ -18,9 +18,14 @@
  * same operation as re-running it here.
  */
 
-import { execFileSync } from "node:child_process"
 import process from "node:process"
 
+import { detectRepo, parseRemote, type RepoRef } from "./git.ts"
+
+// Re-exported so the CLI keeps one import site for "which repo is this";
+// the implementations moved to git.ts with the rest of the git access.
+export { detectRepo, parseRemote, type RepoRef }
+
 /** Overridable so the flow can be exercised against a local `vite dev`. */
 export const DEFAULT_HOST = "https://task.nickmeriano.com"
 
@@ -28,58 +33,6 @@ export type Visibility = "private" | "public"
 
 export type Action = "publish" | "unpublish"
 
-export interface RepoRef {
-  owner: string
-  repo: string
-}
-
-/**
- * The GitHub repo this working copy pushes to.
- *
- * `origin` first, then the only remote if there's exactly one — a clone with
- * `upstream` and a fork remote should not silently publish the wrong one, so
- * ambiguity is an error the user resolves with `--repo`.
- */
-export function detectRepo(cwd: string): RepoRef | null {
-  const remotes = gitRemotes(cwd)
-  const url = remotes.get("origin") ?? (remotes.size === 1 ? [...remotes.values()][0] : null)
-  return url ? parseRemote(url) : null
-}
-
-function gitRemotes(cwd: string): Map<string, string> {
-  const out = new Map<string, string>()
-  let raw: string
-  try {
-    raw = execFileSync("git", ["remote", "-v"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-    })
-  } catch {
-    return out
-  }
-  for (const line of raw.split("\n")) {
-    const match = /^(\S+)\s+(\S+)\s+\(fetch\)$/.exec(line.trim())
-    if (match) out.set(match[1], match[2])
-  }
-  return out
-}
-
-/**
- * Every shape git writes a GitHub remote in: https, ssh, `git@`-scp, with or
- * without `.git`, and with or without credentials embedded in the host.
- */
-export function parseRemote(url: string): RepoRef | null {
-  const cleaned = url.trim().replace(/\.git$/, "")
-  const match =
-    /^(?:https?:\/\/|ssh:\/\/)?(?:[^@/]+@)?github\.com[:/]([^/]+)\/([^/]+?)\/?$/.exec(cleaned)
-  if (!match) return null
-  const [, owner, repo] = match
-  if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(owner)) return null
-  if (!/^[A-Za-z0-9._-]{1,100}$/.test(repo)) return null
-  return { owner, repo }
-}
-
 /** `owner/repo`, for `--repo`. */
 export function parseSlug(slug: string): RepoRef | null {
   const [owner, repo, ...rest] = slug.split("/")

package/src/search.test.ts

@@ -0,0 +1,64 @@
+import assert from "node:assert/strict"
+import { test } from "node:test"
+import { mkdtempSync, rmSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { initProject } from "./file-store.ts"
+import { searchStore } from "./search.ts"
+
+function tempRoot(): string {
+  const dir = mkdtempSync(join(tmpdir(), "task-search-"))
+  process.on("exit", () => rmSync(dir, { recursive: true, force: true }))
+  return dir
+}
+
+test("search covers titles, descriptions and comments, case-insensitively", () => {
+  const store = initProject(tempRoot(), { name: "search", prefix: "SRC" })
+  const a = store.create({ title: "Wire up Webhook retries", description: "exponential backoff" })
+  const b = store.create({ title: "Unrelated", description: "The webhook queue drains here." })
+  const c = store.create({ title: "Also unrelated" })
+  store.create({ title: "Noise" })
+  store.addComment(c.key, "root cause: the WEBHOOK signature check", "claude")
+
+  const results = searchStore(store, "webhook", {}, false)
+  assert.deepEqual(
+    results.map((r) => r.task.key).sort(),
+    [a.key, b.key, c.key].sort(),
+  )
+  const byKey = new Map(results.map((r) => [r.task.key, r.matches]))
+  assert.deepEqual(byKey.get(a.key)!.map((m) => m.field), ["title"])
+  assert.equal(byKey.get(b.key)![0].snippet, "The webhook queue drains here.")
+  const comment = byKey.get(c.key)![0]
+  assert.equal(comment.field, "comment")
+  assert.equal(comment.author, "claude")
+  assert.match(comment.snippet, /WEBHOOK signature/)
+})
+
+test("filters scope the search; --archived adds the archive in", () => {
+  const store = initProject(tempRoot(), { name: "scope", prefix: "SCP" })
+  const live = store.create({ title: "deploy pipeline", tags: ["infra"] })
+  store.create({ title: "deploy docs", tags: ["docs"] })
+  const old = store.create({ title: "deploy v1", status: "done" })
+  store.archive(old.key)
+
+  assert.deepEqual(
+    searchStore(store, "deploy", { tags: ["infra"] }, false).map((r) => r.task.key),
+    [live.key],
+  )
+  const withArchive = searchStore(store, "deploy", {}, true)
+  assert.ok(withArchive.some((r) => r.task.key === old.key && r.task.archived))
+  assert.equal(withArchive.length, 3)
+  // Without the flag the archived ticket stays out.
+  assert.equal(searchStore(store, "deploy", {}, false).length, 2)
+})
+
+test("long lines are windowed so the hit is visible", () => {
+  const store = initProject(tempRoot(), { name: "win", prefix: "WIN" })
+  const filler = "x".repeat(150)
+  store.create({ title: "Long", description: `${filler} needle in here ${filler}` })
+  const [result] = searchStore(store, "needle", {}, false)
+  assert.ok(result.matches[0].snippet.length <= 102) // window + ellipses
+  assert.match(result.matches[0].snippet, /needle in here/)
+  assert.match(result.matches[0].snippet, /^…/)
+  assert.match(result.matches[0].snippet, /…$/)
+})

package/src/search.ts

@@ -0,0 +1,105 @@
+/**
+ * `task search` — find tickets by what they say, not just what they're tagged.
+ *
+ * Case-insensitive substring match over titles, descriptions and comments,
+ * scoped by the usual list filters. At current board sizes a straight scan of
+ * the parsed files is plenty; if boards ever grow to thousands of tickets,
+ * this is the one feature that would justify a derived FTS index — rebuilt
+ * from the files, never as state, which the text-canonical format was designed
+ * to allow.
+ */
+
+import type { Store } from "./store.ts"
+import { STATUSES, type Task, type TaskFilter } from "./types.ts"
+
+export interface SearchMatch {
+  field: "title" | "description" | "comment" | "ask"
+  /** The matching line, trimmed and windowed around the first hit. */
+  snippet: string
+  /** Set on comment matches. */
+  commentId?: string
+  author?: string
+  /** Set on ask matches — the ordinal `task resolve` takes. */
+  askOrdinal?: number
+}
+
+export interface SearchResult {
+  task: Task
+  matches: SearchMatch[]
+}
+
+/** How much of a matching line a snippet shows. */
+const SNIPPET_MAX = 100
+
+/** The first line containing the needle, windowed so the hit is visible. */
+function snippetOf(text: string, needle: string): string {
+  const lines = text.split("\n")
+  const line = (lines.find((l) => l.toLowerCase().includes(needle)) ?? lines[0]).trim()
+  if (line.length <= SNIPPET_MAX) return line
+  const at = line.toLowerCase().indexOf(needle)
+  const start = Math.max(0, Math.min(at - 30, line.length - SNIPPET_MAX))
+  const end = Math.min(line.length, start + SNIPPET_MAX)
+  return `${start > 0 ? "…" : ""}${line.slice(start, end).trim()}${end < line.length ? "…" : ""}`
+}
+
+/**
+ * Every task matching `query`, with one snippet per matching field (and one
+ * per matching comment). `includeArchived` searches the archive *in addition
+ * to* the board — unlike `list --archived`, which shows the archive instead,
+ * a search is a question about everything ever written down.
+ */
+export function searchStore(
+  store: Store,
+  query: string,
+  filter: TaskFilter,
+  includeArchived: boolean,
+): SearchResult[] {
+  const needle = query.toLowerCase()
+  const pool = [
+    ...store.list(filter),
+    ...(includeArchived ? store.list({ ...filter, archived: true }) : []),
+  ]
+
+  const results: SearchResult[] = []
+  for (const task of pool) {
+    const matches: SearchMatch[] = []
+    if (task.title.toLowerCase().includes(needle)) {
+      matches.push({ field: "title", snippet: snippetOf(task.title, needle) })
+    }
+    if (task.description.toLowerCase().includes(needle)) {
+      matches.push({ field: "description", snippet: snippetOf(task.description, needle) })
+    }
+    // Asks ride along on the task, so no extra read — and a hit names the
+    // ordinal, which is the handle you'd resolve it by.
+    for (const ask of task.asks) {
+      if (!ask.text.toLowerCase().includes(needle)) continue
+      matches.push({
+        field: "ask",
+        snippet: snippetOf(ask.text, needle),
+        askOrdinal: ask.ordinal,
+        ...(ask.author ? { author: ask.author } : {}),
+      })
+    }
+    for (const comment of store.comments(task.key)) {
+      if (!comment.body.toLowerCase().includes(needle)) continue
+      matches.push({
+        field: "comment",
+        snippet: snippetOf(comment.body, needle),
+        commentId: comment.id,
+        ...(comment.author ? { author: comment.author } : {}),
+      })
+    }
+    if (matches.length > 0) results.push({ task, matches })
+  }
+
+  // Board order — grouped by status column, then position — same as `list`.
+  const order = new Map(STATUSES.map((s, i) => [s, i]))
+  results.sort(
+    (a, b) =>
+      order.get(a.task.status)! - order.get(b.task.status)! ||
+      a.task.position - b.task.position ||
+      a.task.createdAt.localeCompare(b.task.createdAt) ||
+      a.task.key.localeCompare(b.task.key),
+  )
+  return results
+}

package/src/server.ts

@@ -3,8 +3,11 @@ import { watch, existsSync, readFileSync, statSync, type FSWatcher } from "node:
 import { extname, join, normalize } from "node:path"
 import { fileURLToPath } from "node:url"
 import { resolveAuthor } from "./author.ts"
+import { addAskRouted, deleteAskRouted, setAskResolvedRouted } from "./claim-io.ts"
 import { openBoard } from "./file-store.ts"
-import { findBoards, type BoardRef, type Store } from "./store.ts"
+import { GitServe, GitServeError } from "./git-serve.ts"
+import { buildInbox } from "./inbox.ts"
+import { boardConfig, findBoards, type BoardRef, type Store } from "./store.ts"
 import { STATUSES, isStatus, type TaskPatch } from "./types.ts"
 
 /** The prebuilt SPA, shipped inside the package next to dist/. */
@@ -45,12 +48,11 @@ function parsePatch(body: Record<string, unknown>): TaskPatch {
     patch.status = body.status
   }
   if (Array.isArray(body.tags)) patch.tags = body.tags.map(String)
-  if (typeof body.milestone === "string" || body.milestone === null) {
-    patch.milestone = body.milestone === "" ? null : body.milestone
+  if (typeof body.goal === "string" || body.goal === null) {
+    patch.goal = body.goal === "" ? null : body.goal
   }
-  if (typeof body.needsHuman === "boolean") patch.needsHuman = body.needsHuman
-  if (Array.isArray(body.blocks)) patch.blocks = body.blocks.map(taskNumber)
-  if (Array.isArray(body.blockedBy)) patch.blockedBy = body.blockedBy.map(taskNumber)
+  if (Array.isArray(body.blocks)) patch.blocks = body.blocks.map(taskKey)
+  if (Array.isArray(body.blockedBy)) patch.blockedBy = body.blockedBy.map(taskKey)
   if (Array.isArray(body.prs)) {
     patch.prs = body.prs.map((pr) => {
       const url = String(pr).trim()
@@ -63,10 +65,32 @@ function parsePatch(body: Record<string, unknown>): TaskPatch {
   return patch
 }
 
-function taskNumber(value: unknown): number {
-  const n = Number(value)
-  if (!Number.isInteger(n) || n <= 0) throw new Error(`invalid task number: ${String(value)}`)
-  return n
+function taskKey(value: unknown): string {
+  if (typeof value !== "string" || !/^[a-z0-9]+$/.test(value)) {
+    throw new Error(`invalid task key: ${String(value)}`)
+  }
+  return value
+}
+
+/**
+ * The CSRF gate. `task serve` is an unauthenticated HTTP server, and any
+ * webpage in the same browser can aim a POST at it — before this check, a
+ * drive-by page could edit the board, and with the git surface it could
+ * commit and push. Same-origin is the whole auth model, so a write has to
+ * prove it: browsers attach `Origin` to every cross-origin request (and to
+ * all fetch POSTs), and the only origin allowed to write is the board's own —
+ * whatever host the request itself was addressed to. No Origin header means
+ * no browser page is speaking (curl, scripts), which is the local-trust case
+ * the server already accepts.
+ */
+function sameOrigin(req: IncomingMessage): boolean {
+  const origin = req.headers.origin
+  if (origin === undefined) return true
+  try {
+    return new URL(origin).host === req.headers.host
+  } catch {
+    return false // "null" and other unparseable origins are nobody we trust
+  }
 }
 
 /**
@@ -144,6 +168,28 @@ export function createTaskServer(serveRoot: string): Server {
     throw new Error(`no .task directory found at or below ${serveRoot} — run \`task init\` first`)
   }
 
+  const gitServe = new GitServe(serveRoot, () =>
+    ordered.map((id) => ({ id, store: boards.get(id)!.store })),
+  )
+
+  // Branch switches don't touch `.task/` files, but they change what every
+  // board file *says* — so watch the git dir for HEAD moving (a checkout,
+  // from this server or a terminal) and ping every board's SSE listeners.
+  // Non-recursive on the resolved git dir (worktrees keep HEAD there), and
+  // best-effort: a repo this can't watch simply refreshes on the next edit.
+  let gitWatcher: FSWatcher | null = null
+  const gitDir = gitServe.gitDir()
+  if (gitDir) {
+    try {
+      gitWatcher = watch(gitDir, (_event, filename) => {
+        if (filename === "HEAD") for (const id of ordered) noteChange(id)
+      })
+      gitWatcher.on("error", () => {})
+    } catch {
+      gitWatcher = null
+    }
+  }
+
   const heartbeat = setInterval(() => {
     for (const client of clients) client.write(`: ping\n\n`)
   }, 30_000)
@@ -159,6 +205,7 @@ export function createTaskServer(serveRoot: string): Server {
   server.on("close", () => {
     if (pending) clearTimeout(pending)
     clearInterval(heartbeat)
+    gitWatcher?.close()
     for (const board of boards.values()) {
       board.watcher.close()
       board.store.close()
@@ -170,6 +217,19 @@ export function createTaskServer(serveRoot: string): Server {
     const url = new URL(req.url ?? "/", "http://localhost")
     const path = url.pathname
 
+    // Every mutation, one gate — the ask routes push commits and the git
+    // routes run git, so this cannot be per-endpoint courtesy.
+    const method = req.method ?? "GET"
+    if (
+      path.startsWith("/api/") &&
+      method !== "GET" &&
+      method !== "HEAD" &&
+      !sameOrigin(req)
+    ) {
+      json(res, 403, { error: "cross-origin request refused — the board only writes for its own pages" })
+      return
+    }
+
     if (path === "/api/events") {
       res.writeHead(200, {
         "Content-Type": "text/event-stream",
@@ -193,6 +253,94 @@ export function createTaskServer(serveRoot: string): Server {
       return
     }
 
+    if (path === "/api/inbox") {
+      // Deliberately cross-board — the header badge is repo-wide attention.
+      // Scope follows the CLI's selection rule: the root board's `boards`
+      // list when it has one (matched by prefix), every served board
+      // otherwise — so a vendored board can't put asks in your face unless
+      // the root board opted it in.
+      syncBoards()
+      const all = ordered.map((id) => ({ id, store: boards.get(id)!.store }))
+      let scoped = all
+      try {
+        const wanted = boardConfig(all[0].store.root).boards
+        if (Array.isArray(wanted) && wanted.length > 0) {
+          const prefixes = new Set(wanted.map((p) => String(p).toUpperCase()))
+          const matched = all.filter((b) => prefixes.has(b.store.config.prefix.toUpperCase()))
+          if (matched.length > 0) scoped = matched
+        }
+      } catch {
+        // Unreadable root config — serve everything rather than nothing.
+      }
+      json(res, 200, { inbox: buildInbox(scoped) })
+      return
+    }
+
+    // The git surface (TAS-42). Repo-level, not board-level — one working
+    // tree holds every served board — so it lives beside /api/inbox rather
+    // than inside routeApi. Every handler 404s ("no git surface here") when
+    // the capability is off, which is also what the prebuilt UI probes.
+    if (path.startsWith("/api/git/")) {
+      const fail = (error: unknown): void => {
+        const status = error instanceof GitServeError ? error.status : 400
+        json(res, status, { error: error instanceof Error ? error.message : String(error) })
+      }
+      try {
+        if (path === "/api/git/status" && req.method === "GET") {
+          json(res, 200, gitServe.status())
+          return
+        }
+        if (path === "/api/git/branches" && req.method === "GET") {
+          json(res, 200, { branches: gitServe.branches() })
+          return
+        }
+        if (path === "/api/git/pr" && req.method === "GET") {
+          const branch = url.searchParams.get("branch")
+          if (!branch) {
+            json(res, 400, { error: "branch is required" })
+            return
+          }
+          json(res, 200, gitServe.prFor(branch))
+          return
+        }
+        if (path === "/api/git/commit" && req.method === "POST") {
+          void readBody(req)
+            .then((body) => json(res, 200, gitServe.commit(body)))
+            .catch(fail)
+          return
+        }
+        if (path === "/api/git/checkout" && req.method === "POST") {
+          void readBody(req)
+            .then((body) => json(res, 200, gitServe.checkout(body)))
+            .catch(fail)
+          return
+        }
+        if (path === "/api/git/pr" && req.method === "POST") {
+          void readBody(req)
+            .then((body) => json(res, 200, gitServe.pr(body)))
+            .catch(fail)
+          return
+        }
+        if (path === "/api/git/release" && req.method === "POST") {
+          const id = url.searchParams.get("board") ?? ordered[0]
+          const board = boards.get(id)
+          if (!board) {
+            json(res, 404, { error: `no such board: ${id}` })
+            return
+          }
+          void readBody(req)
+            .then((body) => json(res, 200, gitServe.releaseClaim(board.store, body, author)))
+            .catch(fail)
+          return
+        }
+      } catch (error) {
+        fail(error)
+        return
+      }
+      json(res, 404, { error: "not found" })
+      return
+    }
+
     if (path.startsWith("/api/")) {
       const id = url.searchParams.get("board") ?? ordered[0]
       const board = boards.get(id)
@@ -219,15 +367,28 @@ export function createTaskServer(serveRoot: string): Server {
         prefix: store.config.prefix,
         statuses: STATUSES,
         author,
+        // The git capability, or nothing: its absence is how the hosted and
+        // snapshot deployments (whose /project never carries it) and a serve
+        // with no origin all tell the UI to draw no git surface at all.
+        git: gitServe.capability() ?? undefined,
       })
       return
     }
 
+    if (path === "/api/goals" && req.method === "GET") {
+      // Read-only on purpose: a goal is created deliberately, with a
+      // description, via `task goal add` — a picker that mints goals from
+      // typed strings would just be milestones with extra steps. Archived
+      // goals ride along flagged, so old chips can still resolve a title.
+      json(res, 200, { goals: [...store.goals(), ...store.goals(true)] })
+      return
+    }
+
     if (path === "/api/tasks" && req.method === "GET") {
       const counts = store.commentCounts()
       const tasks = store
         .list()
-        .map((t) => ({ ...t, commentCount: counts.get(t.number) ?? 0 }))
+        .map((t) => ({ ...t, commentCount: counts.get(t.key) ?? 0 }))
       json(res, 200, { tasks })
       return
     }
@@ -239,19 +400,69 @@ export function createTaskServer(serveRoot: string): Server {
             throw new Error("title is required")
           }
           const patch = parsePatch(body)
-          const task = store.create({ title: body.title.trim(), ...patch })
+          let task = store.create({ title: body.title.trim(), ...patch })
+          // Asks at create time — the dialog's chip. Author is the server's
+          // resolved identity, same trust rule as comments.
+          if (Array.isArray(body.asks)) {
+            for (const text of body.asks) {
+              if (typeof text === "string" && text.trim()) {
+                store.addAsk(task.key, text.trim(), author)
+              }
+            }
+            task = store.get(task.key)!
+          }
           json(res, 201, { task })
         })
         .catch((error: Error) => json(res, 400, { error: error.message }))
       return
     }
 
+    // Routed, not raw store calls: on a claimed ticket the write lands on the
+    // claim branch as a pushed commit (claim-io.ts) — the branch owns a
+    // claimed ticket's asks, checkbox and CLI alike.
+    const askMatch = /^\/api\/tasks\/([^/]+)\/asks(?:\/([^/]+))?$/.exec(path)
+    if (askMatch) {
+      const key = store.parseId(decodeURIComponent(askMatch[1]))
+      if (!askMatch[2] && req.method === "POST") {
+        void readBody(req)
+          .then((body) => {
+            if (typeof body.text !== "string" || !body.text.trim()) {
+              throw new Error("text is required")
+            }
+            const { ask, branch } = addAskRouted(store, key, body.text.trim(), author)
+            json(res, 201, { ask, branch })
+          })
+          .catch((error: Error) => json(res, 400, { error: error.message }))
+        return
+      }
+      if (askMatch[2] && req.method === "PATCH") {
+        const ref = decodeURIComponent(askMatch[2])
+        void readBody(req)
+          .then((body) => {
+            if (typeof body.resolved !== "boolean") {
+              throw new Error("resolved must be true or false")
+            }
+            const { ask, branch } = setAskResolvedRouted(store, key, ref, body.resolved, author)
+            json(res, 200, { ask, branch })
+          })
+          .catch((error: Error) => json(res, 400, { error: error.message }))
+        return
+      }
+      if (askMatch[2] && req.method === "DELETE") {
+        const { branch } = deleteAskRouted(store, key, decodeURIComponent(askMatch[2]))
+        json(res, 200, { ok: true, branch })
+        return
+      }
+      json(res, 404, { error: "not found" })
+      return
+    }
+
     const taskMatch = /^\/api\/tasks\/([^/]+)(\/comments(?:\/([^/]+))?)?$/.exec(path)
     if (taskMatch) {
-      const number = store.parseId(decodeURIComponent(taskMatch[1]))
+      const key = store.parseId(decodeURIComponent(taskMatch[1]))
       if (taskMatch[3] && req.method === "DELETE") {
         const commentId = decodeURIComponent(taskMatch[3])
-        const existing = store.comments(number).find((c) => c.id === commentId)
+        const existing = store.comments(key).find((c) => c.id === commentId)
         if (!existing) {
           json(res, 404, { error: `no such comment: ${commentId}` })
           return
@@ -262,7 +473,7 @@ export function createTaskServer(serveRoot: string): Server {
           json(res, 403, { error: "only your own comments can be deleted" })
           return
         }
-        store.deleteComment(number, commentId)
+        store.deleteComment(key, commentId)
         json(res, 200, { ok: true })
         return
       }
@@ -273,7 +484,7 @@ export function createTaskServer(serveRoot: string): Server {
               throw new Error("body is required")
             }
             // `body.author` is ignored on purpose — unauthenticated noise.
-            const comment = store.addComment(number, body.body.trim(), author)
+            const comment = store.addComment(key, body.body.trim(), author)
             json(res, 201, { comment })
           })
           .catch((error: Error) => json(res, 400, { error: error.message }))
@@ -281,25 +492,25 @@ export function createTaskServer(serveRoot: string): Server {
       }
       if (!taskMatch[2]) {
         if (req.method === "GET") {
-          const task = store.get(number)
+          const task = store.get(key)
           if (!task) {
-            json(res, 404, { error: `no such task: ${store.displayId(number)}` })
+            json(res, 404, { error: `no such task: ${store.displayId(key)}` })
             return
           }
-          json(res, 200, { task, comments: store.comments(number) })
+          json(res, 200, { task, comments: store.comments(key) })
           return
         }
         if (req.method === "PATCH") {
           void readBody(req)
             .then((body) => {
-              const task = store.update(number, parsePatch(body))
+              const task = store.update(key, parsePatch(body))
               json(res, 200, { task })
             })
             .catch((error: Error) => json(res, 400, { error: error.message }))
           return
         }
         if (req.method === "DELETE") {
-          store.delete(number)
+          store.delete(key)
           json(res, 200, { ok: true })
           return
         }