@owlmeans/viable-sdk 0.1.18-rc.8 → 0.1.18

package/build/executor/consts.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The runtime safety net `ensure` appends, so a first commit never captures dependencies, build
+ * output, secrets or the connector's own scratch files.
+ *
+ * `.viable/connect.json` is deliberately NOT here: it is the project's identity, it holds no
+ * secret, and a developer who clones their own repository elsewhere should find it. The two files
+ * beside it are — a run record names pids on one machine, and the local keypair is a credential.
+ */
+export declare const IGNORE_BASELINE: string[];
+/**
+ * Why a local repository is never pushed, pulled or given a remote.
+ *
+ * DELIBERATE DIFFERENCE from the publisher, which does all three against a token the platform
+ * holds. A slot's volume is the platform's and its remote is a repository the platform created;
+ * a developer's checkout is THEIRS, its remote is whatever they configured, and pushing to it
+ * would mean the platform writing to a repository nobody here was asked about — with the
+ * developer's own credential helper supplying the authentication. So the platform touches none
+ * of it: whoever owns the directory owns its remotes.
+ */
+export declare const REMOTE_REFUSAL: string;
+/**
+ * Why a local target is never cloned into.
+ *
+ * A clone exists for one case — the platform fetching an origin repository onto a slot's volume it
+ * owns — and a local target has already answered that question: the directory the connector was
+ * started in IS the origin, and there is nothing to fetch. Overwriting it with a remote tree would
+ * replace a developer's working copy, including whatever they had not committed.
+ *
+ * Answered as TEXT beside {@link REMOTE_REFUSAL} and never thrown, for the same reason: a caller
+ * that received an exception would retry something that can never succeed, while a `cloned: false`
+ * in the shape it already parses is a fact its next step can read.
+ */
+export declare const CLONE_REFUSAL: string;
+/** Where the api answers. The worker has a health port but no api base in front of it. */
+export declare const TARGET_HEALTH_PATH = "/api/healtz";
+/**
+ * The one reason a script refuses that is NOT a verdict about the code.
+ *
+ * A build with nothing to build on is an ordinary no-op that the next trigger repeats correctly —
+ * it happens between attaching to a fresh clone and the first install. It must not be reported as
+ * a failed build, or the connector announces broken code during a window in which nothing was
+ * even attempted.
+ */
+export declare const NOT_INSTALLED_REASON = "cannot run: the target's dependencies are not installed yet";
+/**
+ * Output ceiling for every validate/build child process.
+ *
+ * Node's default is 1 MiB, and a target project with a few hundred type errors exceeds it: the
+ * child is killed and the fixer receives `stdout maxBuffer length exceeded` instead of the errors
+ * it is supposed to repair.
+ */
+export declare const MAX_OUTPUT_BUFFER: number;
+/** One-shot script ceiling. A build that outlives it is wedged, not slow. */
+export declare const BUILD_TIMEOUT = 300000;
+//# sourceMappingURL=consts.d.ts.map

package/build/executor/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../src/executor/consts.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,UAQ3B,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,QAC6C,CAAA;AAExE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,QACmC,CAAA;AAE7D,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,gBAA+B,CAAA;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,gEAAgE,CAAA;AAEjG;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAAmB,CAAA;AAEjD,6EAA6E;AAC7E,eAAO,MAAM,aAAa,SAAU,CAAA"}

package/build/executor/consts.js

@@ -0,0 +1,66 @@
+import { TARGET_API_BASE } from '@owlmeans/viable-common';
+/**
+ * The runtime safety net `ensure` appends, so a first commit never captures dependencies, build
+ * output, secrets or the connector's own scratch files.
+ *
+ * `.viable/connect.json` is deliberately NOT here: it is the project's identity, it holds no
+ * secret, and a developer who clones their own repository elsewhere should find it. The two files
+ * beside it are — a run record names pids on one machine, and the local keypair is a credential.
+ */
+export const IGNORE_BASELINE = [
+    'node_modules/',
+    'dist/',
+    'build/',
+    '.env',
+    '.viable/run.json',
+    '.viable/local.json',
+    'tsconfig.tsbuildinfo',
+];
+/**
+ * Why a local repository is never pushed, pulled or given a remote.
+ *
+ * DELIBERATE DIFFERENCE from the publisher, which does all three against a token the platform
+ * holds. A slot's volume is the platform's and its remote is a repository the platform created;
+ * a developer's checkout is THEIRS, its remote is whatever they configured, and pushing to it
+ * would mean the platform writing to a repository nobody here was asked about — with the
+ * developer's own credential helper supplying the authentication. So the platform touches none
+ * of it: whoever owns the directory owns its remotes.
+ */
+export const REMOTE_REFUSAL = 'This project lives on your own machine, so the platform does not touch its '
+    + 'git remotes. Push, pull and remote configuration are yours to run.';
+/**
+ * Why a local target is never cloned into.
+ *
+ * A clone exists for one case — the platform fetching an origin repository onto a slot's volume it
+ * owns — and a local target has already answered that question: the directory the connector was
+ * started in IS the origin, and there is nothing to fetch. Overwriting it with a remote tree would
+ * replace a developer's working copy, including whatever they had not committed.
+ *
+ * Answered as TEXT beside {@link REMOTE_REFUSAL} and never thrown, for the same reason: a caller
+ * that received an exception would retry something that can never succeed, while a `cloned: false`
+ * in the shape it already parses is a fact its next step can read.
+ */
+export const CLONE_REFUSAL = 'This project is the directory the connector was started in, so there is '
+    + 'nothing to clone into it. Its sources are already here.';
+/** Where the api answers. The worker has a health port but no api base in front of it. */
+export const TARGET_HEALTH_PATH = `/${TARGET_API_BASE}/healtz`;
+/**
+ * The one reason a script refuses that is NOT a verdict about the code.
+ *
+ * A build with nothing to build on is an ordinary no-op that the next trigger repeats correctly —
+ * it happens between attaching to a fresh clone and the first install. It must not be reported as
+ * a failed build, or the connector announces broken code during a window in which nothing was
+ * even attempted.
+ */
+export const NOT_INSTALLED_REASON = "cannot run: the target's dependencies are not installed yet";
+/**
+ * Output ceiling for every validate/build child process.
+ *
+ * Node's default is 1 MiB, and a target project with a few hundred type errors exceeds it: the
+ * child is killed and the fixer receives `stdout maxBuffer length exceeded` instead of the errors
+ * it is supposed to repair.
+ */
+export const MAX_OUTPUT_BUFFER = 10 * 1024 * 1024;
+/** One-shot script ceiling. A build that outlives it is wedged, not slow. */
+export const BUILD_TIMEOUT = 300_000;
+//# sourceMappingURL=consts.js.map

package/build/executor/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../src/executor/consts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe;IACf,OAAO;IACP,QAAQ;IACR,MAAM;IACN,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;CACvB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,6EAA6E;MACvG,oEAAoE,CAAA;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,0EAA0E;MACnG,yDAAyD,CAAA;AAE7D,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,eAAe,SAAS,CAAA;AAE9D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,6DAA6D,CAAA;AAEjG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAA"}

package/build/executor/consts.local.d.ts

@@ -0,0 +1,63 @@
+import { type TargetLayout } from '@owlmeans/viable-common';
+export declare const STARTUP_LOG_CAP = 16384;
+/**
+ * Outer bound on one boot-check job.
+ *
+ * `runBootCheck` caps its own ready poll but not the build in front of it, so this is the only
+ * thing that guarantees a poller eventually reads `running: false` — a check that outlives it is
+ * abandoned, not awaited.
+ */
+export declare const WATCHDOG_MS = 600000;
+/** Keys the frontend build injects on its own, so they are never announced as extras. */
+export declare const FRONTEND_STANDARD_KEYS: Set<string>;
+/**
+ * What a tree walk never descends into.
+ *
+ * {@link CENSUS_SKIP_DIRS} is the shared half — the two directories that are never the repository
+ * in any tree, spread from `@owlmeans/viable-common` rather than restated, because the publisher
+ * and the library-local helper walk the SAME question and a caller cannot tell which executor
+ * produced the listing it is holding. This one used to add `dist`, `build` and `.next` on top,
+ * which are ordinary directory names an origin may keep sources in: the same repository then had
+ * one `total` here and another one in the slot.
+ *
+ * {@link CONNECT_MARKER_DIR} is added for a reason that belongs to this executor alone: it is THIS
+ * CONNECTOR's directory, not the origin's. It holds the local key pair and the run record and
+ * never a line of the application, while a census exists to be followed by a `readHead` of what it
+ * listed — and nothing downstream knows which of the two wrote a path.
+ */
+export declare const WALK_SKIP: Set<string>;
+/**
+ * The git half of the local executor, over the `git` CLI.
+ *
+ * The platform's own implementation is `@owlmeans/git`, which is private and carries `simple-git`
+ * and a GitHub client — neither of which may reach a package a developer installs to drive their
+ * own machine. So the semantics are ported and the two constants below are copied, with this
+ * comment as the record of where they came from: a connector that invented its own author name
+ * would produce a history that does not match what the platform writes for the same project in a
+ * slot.
+ */
+export declare const DEFAULT_BRANCH = "main";
+export declare const DEFAULT_GIT_USER_NAME = "OwlMeans Viable";
+export declare const DEFAULT_GIT_USER_EMAIL = "agent@owlmeans.com";
+export declare const LOG_LIMIT = 20;
+export declare const STATUS_FILES_CAP = 50;
+export declare const LOG_FORMAT = "--format=%H%x1f%h%x1f%an%x1f%ae%x1f%cI%x1f%s";
+/**
+ * How long a clean verdict is reused.
+ *
+ * Short on purpose. The check runs before every spawn — the build, the backend start, the boot
+ * check, every `bun` invocation — and several of those run back to back inside one operation. A
+ * longer window would let a write land between the check and the spawn it was meant to guard, so
+ * this is a de-duplication of one burst, not a cache.
+ */
+export declare const VERDICT_TTL_MS = 2000;
+/** How long a port may stay bound after the process holding it was told to die. */
+export declare const PORT_FREE_TIMEOUT = 10000;
+export declare const PORT_POLL_MS = 200;
+export declare const TERM_TIMEOUT = 5000;
+export declare const KILL_TIMEOUT = 2000;
+/** What every target process runs; the marker is what tells the three of them apart. */
+export declare const TARGET_SCRIPT = "dist/index.js";
+/** Each layout's marker file, as a path of this platform — the probe `detectLayout` runs per call. */
+export declare const LAYOUT_MARKER_PATHS: Array<[TargetLayout, string]>;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/executor/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../src/executor/consts.local.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwD,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAEjH,eAAO,MAAM,eAAe,QAAS,CAAA;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,SAAU,CAAA;AAElC,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,aAGjC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,aAAqD,CAAA;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,SAAS,CAAA;AAEpC,eAAO,MAAM,qBAAqB,oBAAoB,CAAA;AAEtD,eAAO,MAAM,sBAAsB,uBAAuB,CAAA;AAE1D,eAAO,MAAM,SAAS,KAAK,CAAA;AAE3B,eAAO,MAAM,gBAAgB,KAAK,CAAA;AAIlC,eAAO,MAAM,UAAU,iDAAiD,CAAA;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,OAAQ,CAAA;AAEnC,mFAAmF;AACnF,eAAO,MAAM,iBAAiB,QAAS,CAAA;AAEvC,eAAO,MAAM,YAAY,MAAM,CAAA;AAE/B,eAAO,MAAM,YAAY,OAAQ,CAAA;AAEjC,eAAO,MAAM,YAAY,OAAQ,CAAA;AAEjC,wFAAwF;AACxF,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAE5C,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAE7D,CAAA"}

package/build/executor/consts.local.js

@@ -0,0 +1,69 @@
+import path from 'node:path';
+import { CENSUS_SKIP_DIRS, CONNECT_MARKER_DIR, LAYOUT_MARKERS } from '@owlmeans/viable-common';
+export const STARTUP_LOG_CAP = 16_384;
+/**
+ * Outer bound on one boot-check job.
+ *
+ * `runBootCheck` caps its own ready poll but not the build in front of it, so this is the only
+ * thing that guarantees a poller eventually reads `running: false` — a check that outlives it is
+ * abandoned, not awaited.
+ */
+export const WATCHDOG_MS = 600_000;
+/** Keys the frontend build injects on its own, so they are never announced as extras. */
+export const FRONTEND_STANDARD_KEYS = new Set([
+    'FRONTEND_PORT', 'FRONTEND_HOST', 'BACKEND_HOST', 'BACKEND_PORT', 'BACKEND_BASE_URL',
+    'BASE_URL', 'FRONTEND_ENV_KEYS', 'SOURCEMAP',
+]);
+/**
+ * What a tree walk never descends into.
+ *
+ * {@link CENSUS_SKIP_DIRS} is the shared half — the two directories that are never the repository
+ * in any tree, spread from `@owlmeans/viable-common` rather than restated, because the publisher
+ * and the library-local helper walk the SAME question and a caller cannot tell which executor
+ * produced the listing it is holding. This one used to add `dist`, `build` and `.next` on top,
+ * which are ordinary directory names an origin may keep sources in: the same repository then had
+ * one `total` here and another one in the slot.
+ *
+ * {@link CONNECT_MARKER_DIR} is added for a reason that belongs to this executor alone: it is THIS
+ * CONNECTOR's directory, not the origin's. It holds the local key pair and the run record and
+ * never a line of the application, while a census exists to be followed by a `readHead` of what it
+ * listed — and nothing downstream knows which of the two wrote a path.
+ */
+export const WALK_SKIP = new Set([...CENSUS_SKIP_DIRS, CONNECT_MARKER_DIR]);
+/**
+ * The git half of the local executor, over the `git` CLI.
+ *
+ * The platform's own implementation is `@owlmeans/git`, which is private and carries `simple-git`
+ * and a GitHub client — neither of which may reach a package a developer installs to drive their
+ * own machine. So the semantics are ported and the two constants below are copied, with this
+ * comment as the record of where they came from: a connector that invented its own author name
+ * would produce a history that does not match what the platform writes for the same project in a
+ * slot.
+ */
+export const DEFAULT_BRANCH = 'main';
+export const DEFAULT_GIT_USER_NAME = 'OwlMeans Viable';
+export const DEFAULT_GIT_USER_EMAIL = 'agent@owlmeans.com';
+export const LOG_LIMIT = 20;
+export const STATUS_FILES_CAP = 50;
+// Unit separator: it cannot appear in any of the fields, so a subject with tabs or spaces in it
+// still parses.
+export const LOG_FORMAT = '--format=%H%x1f%h%x1f%an%x1f%ae%x1f%cI%x1f%s';
+/**
+ * How long a clean verdict is reused.
+ *
+ * Short on purpose. The check runs before every spawn — the build, the backend start, the boot
+ * check, every `bun` invocation — and several of those run back to back inside one operation. A
+ * longer window would let a write land between the check and the spawn it was meant to guard, so
+ * this is a de-duplication of one burst, not a cache.
+ */
+export const VERDICT_TTL_MS = 2_000;
+/** How long a port may stay bound after the process holding it was told to die. */
+export const PORT_FREE_TIMEOUT = 10_000;
+export const PORT_POLL_MS = 200;
+export const TERM_TIMEOUT = 5_000;
+export const KILL_TIMEOUT = 2_000;
+/** What every target process runs; the marker is what tells the three of them apart. */
+export const TARGET_SCRIPT = 'dist/index.js';
+/** Each layout's marker file, as a path of this platform — the probe `detectLayout` runs per call. */
+export const LAYOUT_MARKER_PATHS = LAYOUT_MARKERS.map(([layout, marker]) => [layout, path.join(...marker.split('/'))]);
+//# sourceMappingURL=consts.local.js.map

package/build/executor/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../src/executor/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAEjH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAA;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB;IACpF,UAAU,EAAE,mBAAmB,EAAE,WAAW;CAC7C,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAA;AAE3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAA;AAEpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAA;AAEtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAA;AAE1D,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAA;AAE3B,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAElC,gGAAgG;AAChG,gBAAgB;AAChB,MAAM,CAAC,MAAM,UAAU,GAAG,8CAA8C,CAAA;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAA;AAEnC,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAA;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAA;AAEjC,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAA;AAEjC,wFAAwF;AACxF,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAE5C,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAkC,cAAc,CAAC,GAAG,CAClF,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAChE,CAAA"}

package/build/executor/env/types.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The environment a locally-run target sees, composed for ONE directory.
+ *
+ * Same tables the publisher composes for a pod, with two differences that follow from where this
+ * runs. The hosts are `localhost` — a loopback address, not a claimed preview hostname — and the
+ * VALUES come from the target's own `.env` files rather than from slot metadata, because on a
+ * developer's machine the platform provisions nothing: the database URL, the queue URL and the
+ * OIDC identity are lines in a file the developer and the configure push both write.
+ *
+ * The defaults are laid down first and the `.env` is overlaid on top, so a user who set a value
+ * gets the value they set. Callers that own a port — the boot check, the worker — spread their
+ * override over the result, exactly as the publisher does.
+ */
+export interface TargetEnvHelper {
+    /**
+     * Runtime environment for the target's api and worker processes.
+     *
+     * Read at runtime, never baked into the bundle — the api resolves `DATABASE_URL`, `VALKEY_URL`
+     * and the OIDC triple when it boots, which is why a configure push that lands after a build still
+     * reaches it with nothing more than a restart.
+     */
+    backendEnv: () => Promise<Record<string, string>>;
+    /**
+     * Build-time environment for the target's browser bundle.
+     *
+     * DELIBERATE DIFFERENCE from the publisher: `BACKEND_PORT` names the WEB port, not the api's.
+     * A slot serves the app and its `/api` from one hostname behind one TLS front door, so the
+     * publisher can leave the port blank and let the scheme imply it. A local run has two processes
+     * on two loopback ports, and the local server proxies `/api` precisely so the browser stays
+     * same-origin — pointing the bundle at 3000 instead would make every call cross-origin and put
+     * the target's CORS configuration in the path of a developer's first page load.
+     *
+     * Composed from the WEB package's own `.env` and never from the root one. The publisher has the
+     * same boundary as an allow-list (`frontendEnvVars` / `frontendSecrets`); here it is the file
+     * split, and it is what keeps `DATABASE_URL` and `OIDC_SECRET` out of a bundle every visitor
+     * downloads.
+     */
+    frontendEnv: () => Promise<Record<string, string>>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/executor/env/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/executor/env/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnD"}

package/build/executor/env/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/executor/env/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/executor/env/types.ts"],"names":[],"mappings":""}

package/build/executor/env.d.ts

@@ -1,25 +1,16 @@
+import type { TargetEnvHelper } from './env/types.js';
 /**
- * Runtime environment for the target's api and worker processes.
+ * The environment a locally-run target sees.
  *
- * Read at runtime, never baked into the bundle — the api resolves `DATABASE_URL`, `VALKEY_URL`
- * and the OIDC triple when it boots, which is why a configure push that lands after a build still
- * reaches it with nothing more than a restart.
- */
-export declare const backendEnv: (dir: string) => Promise<Record<string, string>>;
-/**
- * Build-time environment for the target's browser bundle.
- *
- * DELIBERATE DIFFERENCE from the publisher: `BACKEND_PORT` names the WEB port, not the api's.
- * A slot serves the app and its `/api` from one hostname behind one TLS front door, so the
- * publisher can leave the port blank and let the scheme imply it. A local run has two processes
- * on two loopback ports, and the local server proxies `/api` precisely so the browser stays
- * same-origin — pointing the bundle at 3000 instead would make every call cross-origin and put
- * the target's CORS configuration in the path of a developer's first page load.
+ * Same tables the publisher composes for a pod, with two differences that follow from where this
+ * runs. The hosts are `localhost` — a loopback address, not a claimed preview hostname — and the
+ * VALUES come from the target's own `.env` files rather than from slot metadata, because on a
+ * developer's machine the platform provisions nothing: the database URL, the queue URL and the
+ * OIDC identity are lines in a file the developer and the configure push both write.
  *
- * Composed from the WEB package's own `.env` and never from the root one. The publisher has the
- * same boundary as an allow-list (`frontendEnvVars` / `frontendSecrets`); here it is the file
- * split, and it is what keeps `DATABASE_URL` and `OIDC_SECRET` out of a bundle every visitor
- * downloads.
+ * The defaults are laid down first and the `.env` is overlaid on top, so a user who set a value
+ * gets the value they set. Callers that own a port — the boot check, the worker — spread their
+ * override over the result, exactly as the publisher does.
  */
-export declare const frontendEnv: (dir: string) => Promise<Record<string, string>>;
+export declare const makeTargetEnvHelper: (dir: string) => TargetEnvHelper;
 //# sourceMappingURL=env.d.ts.map

package/build/executor/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AA0BA;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAe,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiB5E,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,QAAe,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmB7E,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,KAAG,eA6CjD,CAAA"}

package/build/executor/env.js

@@ -1,5 +1,7 @@
 import { TARGET_API_BASE, TARGET_API_PORT, TARGET_WEB_PORT, TARGET_WORKER_PORT } from '@owlmeans/viable-common';
-import { readEnvFile, ROOT_ENV_FILE, webEnvFile } from '../project/env.js';
+import { makeProjectEnvHelper } from '../project/env.js';
+import { ROOT_ENV_FILE } from '../project/consts.js';
+import { FRONTEND_STANDARD_KEYS } from './consts.local.js';
 /**
  * The environment a locally-run target sees.
  *
@@ -13,65 +15,43 @@ import { readEnvFile, ROOT_ENV_FILE, webEnvFile } from '../project/env.js';
  * gets the value they set. Callers that own a port — the boot check, the worker — spread their
  * override over the result, exactly as the publisher does.
  */
-/** Keys the frontend build injects on its own, so they are never announced as extras. */
-const FRONTEND_STANDARD_KEYS = new Set([
-    'FRONTEND_PORT', 'FRONTEND_HOST', 'BACKEND_HOST', 'BACKEND_PORT', 'BACKEND_BASE_URL',
-    'BASE_URL', 'FRONTEND_ENV_KEYS', 'SOURCEMAP',
-]);
-/**
- * Runtime environment for the target's api and worker processes.
- *
- * Read at runtime, never baked into the bundle — the api resolves `DATABASE_URL`, `VALKEY_URL`
- * and the OIDC triple when it boots, which is why a configure push that lands after a build still
- * reaches it with nothing more than a restart.
- */
-export const backendEnv = async (dir) => {
-    // The ROOT `.env` alone. The web package's file is compiled into a bundle anybody can read, so
-    // the two are never merged in either direction.
-    const values = await readEnvFile(dir, ROOT_ENV_FILE);
-    return {
-        BACKEND_PORT: `${TARGET_API_PORT}`,
-        BACKEND_HOST: 'localhost',
-        BACKEND_BASE_URL: TARGET_API_BASE,
-        FRONTEND_HOST: 'localhost',
-        FRONTEND_PORT: `${TARGET_WEB_PORT}`,
-        BASE_URL: '',
-        WORKER_PORT: `${TARGET_WORKER_PORT}`,
-        // The target's own values last: everything above is a default this machine can state without
-        // asking, and everything the user or a configure push wrote outranks it.
-        ...values,
+export const makeTargetEnvHelper = (dir) => {
+    const projectEnv = makeProjectEnvHelper(dir);
+    const backendEnv = async () => {
+        // The ROOT `.env` alone. The web package's file is compiled into a bundle anybody can read, so
+        // the two are never merged in either direction.
+        const values = await projectEnv.readEnvFile(ROOT_ENV_FILE);
+        return {
+            BACKEND_PORT: `${TARGET_API_PORT}`,
+            BACKEND_HOST: 'localhost',
+            BACKEND_BASE_URL: TARGET_API_BASE,
+            FRONTEND_HOST: 'localhost',
+            FRONTEND_PORT: `${TARGET_WEB_PORT}`,
+            BASE_URL: '',
+            WORKER_PORT: `${TARGET_WORKER_PORT}`,
+            // The target's own values last: everything above is a default this machine can state without
+            // asking, and everything the user or a configure push wrote outranks it.
+            ...values,
+        };
     };
-};
-/**
- * Build-time environment for the target's browser bundle.
- *
- * DELIBERATE DIFFERENCE from the publisher: `BACKEND_PORT` names the WEB port, not the api's.
- * A slot serves the app and its `/api` from one hostname behind one TLS front door, so the
- * publisher can leave the port blank and let the scheme imply it. A local run has two processes
- * on two loopback ports, and the local server proxies `/api` precisely so the browser stays
- * same-origin — pointing the bundle at 3000 instead would make every call cross-origin and put
- * the target's CORS configuration in the path of a developer's first page load.
- *
- * Composed from the WEB package's own `.env` and never from the root one. The publisher has the
- * same boundary as an allow-list (`frontendEnvVars` / `frontendSecrets`); here it is the file
- * split, and it is what keeps `DATABASE_URL` and `OIDC_SECRET` out of a bundle every visitor
- * downloads.
- */
-export const frontendEnv = async (dir) => {
-    const values = await readEnvFile(dir, webEnvFile(dir));
-    const env = {
-        FRONTEND_PORT: `${TARGET_WEB_PORT}`,
-        BACKEND_HOST: 'localhost',
-        BACKEND_PORT: `${TARGET_WEB_PORT}`,
-        BACKEND_BASE_URL: TARGET_API_BASE,
-        BASE_URL: '/',
-        ...values,
+    const frontendEnv = async () => {
+        const values = await projectEnv.readEnvFile(projectEnv.webEnvFile());
+        const env = {
+            APP_UNSECURE: 'true',
+            FRONTEND_PORT: `${TARGET_WEB_PORT}`,
+            BACKEND_HOST: 'localhost',
+            BACKEND_PORT: `${TARGET_WEB_PORT}`,
+            BACKEND_BASE_URL: TARGET_API_BASE,
+            BASE_URL: '/',
+            ...values,
+        };
+        // What the target's bundler substitutes. A key absent from this list is not replaced at build
+        // time and reaches the browser as `process.env.X` against an object that does not exist there.
+        env.FRONTEND_ENV_KEYS = Object.keys(env)
+            .filter(key => !FRONTEND_STANDARD_KEYS.has(key))
+            .join(',');
+        return env;
     };
-    // What the target's bundler substitutes. A key absent from this list is not replaced at build
-    // time and reaches the browser as `process.env.X` against an object that does not exist there.
-    env.FRONTEND_ENV_KEYS = Object.keys(env)
-        .filter(key => !FRONTEND_STANDARD_KEYS.has(key))
-        .join(',');
-    return env;
+    return { backendEnv, frontendEnv };
 };
 //# sourceMappingURL=env.js.map

package/build/executor/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EACtE,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE1E;;;;;;;;;;;;GAYG;AAEH,yFAAyF;AACzF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB;IACpF,UAAU,EAAE,mBAAmB,EAAE,WAAW;CAC7C,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAmC,EAAE;IAC/E,+FAA+F;IAC/F,gDAAgD;IAChD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAEpD,OAAO;QACL,YAAY,EAAE,GAAG,eAAe,EAAE;QAClC,YAAY,EAAE,WAAW;QACzB,gBAAgB,EAAE,eAAe;QACjC,aAAa,EAAE,WAAW;QAC1B,aAAa,EAAE,GAAG,eAAe,EAAE;QACnC,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,GAAG,kBAAkB,EAAE;QACpC,6FAA6F;QAC7F,yEAAyE;QACzE,GAAG,MAAM;KACV,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAmC,EAAE;IAChF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAEtD,MAAM,GAAG,GAA2B;QAClC,aAAa,EAAE,GAAG,eAAe,EAAE;QACnC,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,GAAG,eAAe,EAAE;QAClC,gBAAgB,EAAE,eAAe;QACjC,QAAQ,EAAE,GAAG;QACb,GAAG,MAAM;KACV,CAAA;IAED,8FAA8F;IAC9F,+FAA+F;IAC/F,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACrC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/executor/env.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EACtE,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAG1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAmB,EAAE;IAClE,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAE5C,MAAM,UAAU,GAAG,KAAK,IAAqC,EAAE;QAC7D,+FAA+F;QAC/F,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,aAAa,CAAC,CAAA;QAE1D,OAAO;YACL,YAAY,EAAE,GAAG,eAAe,EAAE;YAClC,YAAY,EAAE,WAAW;YACzB,gBAAgB,EAAE,eAAe;YACjC,aAAa,EAAE,WAAW;YAC1B,aAAa,EAAE,GAAG,eAAe,EAAE;YACnC,QAAQ,EAAE,EAAE;YACZ,WAAW,EAAE,GAAG,kBAAkB,EAAE;YACpC,6FAA6F;YAC7F,yEAAyE;YACzE,GAAG,MAAM;SACV,CAAA;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,KAAK,IAAqC,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;QAEpE,MAAM,GAAG,GAA2B;YAClC,YAAY,EAAE,MAAM;YACpB,aAAa,EAAE,GAAG,eAAe,EAAE;YACnC,YAAY,EAAE,WAAW;YACzB,YAAY,EAAE,GAAG,eAAe,EAAE;YAClC,gBAAgB,EAAE,eAAe;YACjC,QAAQ,EAAE,GAAG;YACb,GAAG,MAAM;SACV,CAAA;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACrC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aAC/C,IAAI,CAAC,GAAG,CAAC,CAAA;QAEZ,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAA;AACpC,CAAC,CAAA"}

package/build/executor/errors.d.ts

@@ -23,6 +23,21 @@ export declare class SandboxPathError extends Error {
     readonly name = "SandboxPathError";
     constructor(file: string);
 }
+/**
+ * A file command was asked for something it must refuse whatever the caller intended.
+ *
+ * Two conditions today, and both are about not destroying what is already there: a relocation into
+ * a directory that already holds files (the move would interleave two trees, and nothing
+ * afterwards could tell them apart), and a removal of the project root (which is `deleteProject`,
+ * a command with its own name and its own keep list).
+ *
+ * Thrown rather than answered, unlike the git refusals: those are policies a caller can plan
+ * around, and these two mean the caller's own arguments were wrong.
+ */
+export declare class FileCommandRefused extends Error {
+    readonly name = "FileCommandRefused";
+    constructor(message: string);
+}
 /**
  * A revert was asked for on a tree with uncommitted work in it.
  *

package/build/executor/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/executor/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAGpE;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAyB,IAAI,sBAAqB;IAElD,YAAY,IAAI,EAAE,MAAM,EAEvB;CACF;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAyB,IAAI,kBAAiB;IAE9C,YAAY,GAAG,EAAE,MAAM,EAEtB;CACF;AAED,2FAA2F;AAC3F,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAyB,IAAI,mBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAGjB,MAAM,EAAE,qBAAqB;IAFzD,SAAyB,IAAI,0BAAyB;IAEtD,YAA4B,MAAM,EAAE,qBAAqB,EAExD;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/executor/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAGpE;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAyB,IAAI,sBAAqB;IAElD,YAAY,IAAI,EAAE,MAAM,EAEvB;CACF;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAyB,IAAI,wBAAuB;IAEpD,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAyB,IAAI,kBAAiB;IAE9C,YAAY,GAAG,EAAE,MAAM,EAEtB;CACF;AAED,2FAA2F;AAC3F,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAyB,IAAI,mBAAkB;IAE/C,YAAY,OAAO,EAAE,MAAM,EAE1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAGjB,MAAM,EAAE,qBAAqB;IAFzD,SAAyB,IAAI,0BAAyB;IAEtD,YAA4B,MAAM,EAAE,qBAAqB,EAExD;CACF"}

package/build/executor/errors.js

@@ -1,4 +1,4 @@
-import { formatIntegrityReport } from '@owlmeans/viable-common';
+import { targetIntegrityHelper } from '@owlmeans/viable-common';
 /**
  * What the local executor throws, and why so little of it does.
  *
@@ -25,6 +25,23 @@ export class SandboxPathError extends Error {
         super(`Path escapes the sandbox: ${file}`);
     }
 }
+/**
+ * A file command was asked for something it must refuse whatever the caller intended.
+ *
+ * Two conditions today, and both are about not destroying what is already there: a relocation into
+ * a directory that already holds files (the move would interleave two trees, and nothing
+ * afterwards could tell them apart), and a removal of the project root (which is `deleteProject`,
+ * a command with its own name and its own keep list).
+ *
+ * Thrown rather than answered, unlike the git refusals: those are policies a caller can plan
+ * around, and these two mean the caller's own arguments were wrong.
+ */
+export class FileCommandRefused extends Error {
+    name = 'FileCommandRefused';
+    constructor(message) {
+        super(message);
+    }
+}
 /**
  * A revert was asked for on a tree with uncommitted work in it.
  *
@@ -56,7 +73,7 @@ export class TargetIntegrityError extends Error {
     report;
     name = 'TargetIntegrityError';
     constructor(report) {
-        super(`The project in this directory is not a Viable application:\n${formatIntegrityReport(report)}`);
+        super(`The project in this directory is not a Viable application:\n${targetIntegrityHelper.formatIntegrityReport(report)}`);
         this.report = report;
     }
 }

package/build/executor/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/executor/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAE/D;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChB,IAAI,GAAG,kBAAkB,CAAA;IAElD,YAAY,IAAY;QACtB,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;IAC5C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACZ,IAAI,GAAG,cAAc,CAAA;IAE9C,YAAY,GAAW;QACrB,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;IACvD,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,OAAO,aAAc,SAAQ,KAAK;IACb,IAAI,GAAG,eAAe,CAAA;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;IAChB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGjB,MAAM;IAFT,IAAI,GAAG,sBAAsB,CAAA;IAEtD,YAA4B,MAA6B;QACvD,KAAK,CAAC,+DAA+D,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;sBAD3E,MAAM;IAElC,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/executor/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAE/D;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChB,IAAI,GAAG,kBAAkB,CAAA;IAElD,YAAY,IAAY;QACtB,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAA;IAC5C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClB,IAAI,GAAG,oBAAoB,CAAA;IAEpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;IAChB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACZ,IAAI,GAAG,cAAc,CAAA;IAE9C,YAAY,GAAW;QACrB,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAA;IACvD,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,OAAO,aAAc,SAAQ,KAAK;IACb,IAAI,GAAG,eAAe,CAAA;IAE/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;IAChB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGjB,MAAM;IAFT,IAAI,GAAG,sBAAsB,CAAA;IAEtD,YAA4B,MAA6B;QACvD,KAAK,CAAC,+DAA+D,qBAAqB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;sBADjG,MAAM;IAElC,CAAC;CACF"}