@yourrealm/sdk 0.0.0-alpha.1378.ce03c8dc

package/LICENSE-EXCEPTION

@@ -0,0 +1,26 @@
+Realm SDK Licensing Exception
+
+SPDX-License-Identifier: AGPL-3.0-only WITH Classpath-exception-2.0
+
+The Realm SDK (@yourrealm/sdk) is licensed under the GNU Affero General
+Public License, version 3 (see the LICENSE file at the repository root),
+with the following exception. The exception text is the GNU Classpath
+Exception 2.0, with its reference to the covering license retargeted to
+the GNU Affero General Public License version 3:
+
+  Linking this library statically or dynamically with other modules is
+  making a combined work based on this library. Thus, the terms and
+  conditions of the GNU Affero General Public License version 3 cover the
+  whole combination.
+
+  As a special exception, the copyright holders of this library give you
+  permission to link this library with independent modules to produce an
+  executable, regardless of the license terms of these independent
+  modules, and to copy and distribute the resulting executable under
+  terms of your choice, provided that you also meet, for each linked
+  independent module, the terms and conditions of the license of that
+  module. An independent module is a module which is not derived from or
+  based on this library. If you modify this library, you may extend this
+  exception to your version of the library, but you are not obligated to
+  do so. If you do not wish to do so, delete this exception statement
+  from your version.

package/README.md

@@ -0,0 +1,34 @@
+# @yourrealm/sdk
+
+The Realm SDK: the authoring surface for Realm apps (`createApp`, `r`, the
+service classes), the `ui` surface, the `realm-sdk` CLI and the test harness.
+
+## Install
+
+Every push to Realm's `main` publishes the SDK under the `alpha` dist-tag,
+versioned by commit. Pin the tag and move it when you want to:
+
+```bash
+pnpm add @yourrealm/sdk@alpha
+pnpm update @yourrealm/sdk
+```
+
+The runtime is Deno: `realm-sdk test` runs `Deno.test` underneath, and the
+package ships its TypeScript source as the `types` condition, so `deno check`
+sees the real signatures. Set `nodeModulesDir` to `"manual"` in `deno.json`
+and let pnpm own `node_modules`.
+
+## License
+
+`AGPL-3.0-only WITH Classpath-exception-2.0`.
+
+Realm's platform (Home, Worker) is licensed under the GNU Affero General
+Public License v3. This SDK adds a linking exception, based on the GNU
+Classpath Exception 2.0, so that authoring a Realm app (`realm.ts`) that
+imports this SDK does not, by itself, place your app under the AGPL. The
+exception frees users of the SDK; it does not extend to modified versions
+of the SDK itself, which remain AGPL.
+
+See [LICENSE-EXCEPTION](./LICENSE-EXCEPTION) for the full text and the
+repository's [LICENSE](https://github.com/benjick/holden/blob/main/LICENSE) for
+the AGPL.

package/dist/chunk-3R6KEFOI.js

@@ -0,0 +1,22 @@
+// src/service-url.ts
+function structuredHost(appId, serviceId, slug, baseDomain) {
+  return `${appId}-${serviceId}.${slug}.${baseDomain}`;
+}
+function serviceUrl(args) {
+  if (!args.hasRouter) return null;
+  if (args.publicDomain) return `https://${args.publicDomain}`;
+  if (!args.slug || !args.baseDomain) return null;
+  return `https://${structuredHost(args.appId, args.serviceId, args.slug, args.baseDomain)}`;
+}
+function firstPublicDomain(publicDomain) {
+  if (publicDomain == null || typeof publicDomain !== "object") return void 0;
+  const hosts = publicDomain.hosts;
+  if (Array.isArray(hosts) && typeof hosts[0] === "string") return hosts[0];
+  return void 0;
+}
+
+export {
+  structuredHost,
+  serviceUrl,
+  firstPublicDomain
+};

package/dist/chunk-67BDAMYX.js

@@ -0,0 +1,376 @@
+import {
+  SPECULATIVE_SILO,
+  hostKey,
+  nameSchema
+} from "./chunk-VHTUSZUX.js";
+
+// src/worker-protocol/worker-state.ts
+import { z as z2 } from "zod";
+
+// src/worker-protocol/ingress.ts
+import { z } from "zod";
+var acmeIssuerSchema = z.object({
+  serverUrl: z.string(),
+  username: z.string(),
+  apiKey: z.string(),
+  ca: z.string(),
+  caRootPem: z.string()
+});
+var ingressRouterSchema = z.object({
+  containerPort: z.number().int().min(1).max(65535),
+  /** Operator-granted hostnames for the additional ungated public route. */
+  publicDomain: z.union([z.string(), z.array(z.string())]).optional(),
+  /** With several granted hosts: serve them all, or serve one and 301 the rest. */
+  domainMode: z.enum(["redirect", "all"]),
+  pathPrefix: z.string().regex(/^\/[a-zA-Z0-9/_-]*$/, "pathPrefix must start with / and contain only [a-zA-Z0-9/_-]").optional(),
+  compress: z.boolean(),
+  maxRequestSizeMb: z.number().nullable(),
+  rateLimit: z.union([
+    z.number(),
+    z.object({
+      requests: z.number(),
+      window: z.string().regex(/^\d+(ms|s|m|h)$/, "window must be a duration like 10s, 1m, 1h")
+    })
+  ]).nullable(),
+  /** Response-header overrides; `null` deletes the renderer's default. */
+  headers: z.record(z.string(), z.string().nullable()).optional()
+});
+var ingressRoutedAppSchema = z.object({
+  appId: z.string(),
+  services: z.array(z.object({ serviceId: z.string(), router: ingressRouterSchema })),
+  /**
+   * Header-brokering names the app declared via `getTrustedHeaders`. The
+   * renderer injects these on the authenticated route (lifted off the
+   * forward-auth response) and strips them everywhere else, so identity can't
+   * be spoofed.
+   */
+  trustedHeaderKeys: z.array(z.string()).optional()
+});
+var ingressInputSchema = z.object({
+  /** Every routed service on this worker, ordered canonically by `appId`. */
+  routedApps: z.array(ingressRoutedAppSchema),
+  /**
+   * The Home dashboard's own host, `{homeSlug}.{workerId}.{baseDomain}` - one
+   * label under the worker wildcard, which a renderer has to match ahead of
+   * that wildcard so the not-routed holding page never shadows it.
+   *
+   * Null on a box that does not run Home. The name resolves realm-wide (it
+   * sits under the realm's wildcard), so emitting the route on a worker-only
+   * box would answer a hit there with a page claiming the control plane is
+   * down - and, under BYO public providers, cost a real per-host certificate
+   * on every worker. Home knows which box is which from `home_state
+   * .home_worker_id`.
+   */
+  dashboardHost: z.string().nullable(),
+  /**
+   * This worker's short slug: the `{workerId}` level of every app subdomain,
+   * and the label it owns under acme-dns.
+   */
+  workerId: z.string(),
+  /**
+   * The realm's domain base (`{slug}.yourrealm.me`, or the operator's own).
+   * With `workerId` it forms every structured authenticated subdomain. Empty
+   * on the placeholder identity, before an install is configured.
+   */
+  baseDomain: z.string(),
+  /** DNS-01 inputs for the worker wildcard, or null (dev / e2e / first boot). */
+  acmeDns: acmeIssuerSchema.extend({ baseDomain: z.string() }).nullable(),
+  /**
+   * BYO public-DNS providers, in issue order. `apiToken` is a plain string:
+   * a `Ref` cannot ride the wire, and by this point Home has resolved it.
+   */
+  publicProviders: z.array(
+    z.object({ name: z.enum(["cloudflare", "hetzner"]), apiToken: z.string() })
+  ),
+  /**
+   * CDNs in front of this realm, whose edge addresses ingress trusts when
+   * resolving the real client IP. The addresses themselves are not here - the
+   * renderer's runtime fetches and refreshes them.
+   */
+  cdnProviders: z.array(z.string()),
+  /**
+   * The signing-certificate fingerprints in the Digital Asset Links statement
+   * the ingress serves on every host - the statement's
+   * `sha256_cert_fingerprints`, which Chrome matches the companion APK's own
+   * signature against before it drops the Trusted Web Activity's toolbar.
+   *
+   * Operator-set rather than a constant, because which certificate signs the
+   * installed APK is a property of how that operator got it: Play App Signing
+   * re-signs with Google's key, direct distribution keeps the release
+   * keystore's, and a locally built debug APK carries a third.
+   *
+   * The shape is pinned here because the renderer inlines these strings into a
+   * JSON body Caddy's `ReplaceKnown` walks: uppercase hex bytes and colons can
+   * never form a `{placeholder}`, so a value that parses cannot reach into the
+   * replacer.
+   */
+  companionFingerprints: z.array(
+    z.string().regex(/^[0-9A-F]{2}(:[0-9A-F]{2}){31}$/, "expected 32 colon-separated uppercase hex bytes")
+  )
+});
+var PLATFORM_INGRESS_PORTS = [80, 443];
+
+// src/worker-protocol/worker-state.ts
+var dependsOnEdgeSchema = z2.object({
+  providerAppId: z2.string(),
+  providerServiceName: z2.string(),
+  condition: z2.enum(["started", "healthy"])
+});
+var duration = z2.number().int().nonnegative();
+var containerPort = z2.number().int().min(1).max(65535);
+var healthcheckSchema = z2.object({
+  test: z2.array(z2.string()),
+  interval: duration,
+  timeout: duration,
+  retries: z2.number().int().nonnegative(),
+  startPeriod: duration
+});
+var hostPortSchema = z2.object({
+  containerPort,
+  hostPort: z2.number().int().min(1).max(65535),
+  protocol: z2.enum(["tcp", "udp"]).optional()
+});
+var backupStrategySchema = z2.discriminatedUnion("kind", [
+  z2.object({ kind: z2.literal("file-copy") }),
+  z2.object({ kind: z2.literal("sqlite"), file: z2.string() }),
+  z2.object({ kind: z2.literal("pg-dump"), url: z2.string(), version: z2.number().int().positive() }),
+  z2.object({ kind: z2.literal("valkey-save"), url: z2.string() }),
+  z2.object({
+    kind: z2.literal("mysql-dump"),
+    url: z2.string(),
+    version: z2.number().int().positive()
+  })
+]);
+var volumeSchema = z2.object({
+  // Refused by name: the wire is where "this was fully resolved" stops being a
+  // promise and becomes a check. A speculative eval fabricates a Silo so an app
+  // can be previewed before the operator picks one (`speculative-silo.ts`), and
+  // that placeholder is otherwise an ordinary absolute path - shipping it binds
+  // an empty directory in place of the operator's library, silently. `evalApps`
+  // refuses that combination up front; this is the half that cannot be bypassed.
+  hostPath: z2.string().refine((p) => p !== SPECULATIVE_SILO.hostPath, {
+    message: "the speculative Silo placeholder must never reach the wire"
+  }),
+  containerPath: z2.string(),
+  // The Silo group that owns this directory. The renderer turns it into
+  // `group_add` on every service that mounts the volume, so directory
+  // preparation and group membership are driven by the same field and can
+  // never disagree.
+  gid: z2.number().int().positive().optional(),
+  readOnly: z2.boolean().optional(),
+  backup: z2.union([backupStrategySchema, z2.literal(false)]).optional()
+});
+var wireServiceSchema = z2.object({
+  image: z2.string().min(1),
+  hostPorts: z2.array(hostPortSchema).optional(),
+  env: z2.record(z2.string(), z2.union([z2.string(), z2.number()])).optional(),
+  // containerPath -> 64-char hex digest the renderer resolves to bytes. The two
+  // sources hash different things: artifact refs collapse to their bare content
+  // sha, while inline content is keyed by *identity* — sha256 of
+  // `appId:serviceKey:fileKey` (plaintext rides in `WorkerApp.inlineFiles`). An
+  // inline file therefore keeps the same digest and worker path across content
+  // changes, so `--watch` consumers reload without recreating the container.
+  files: z2.record(z2.string().startsWith("/"), z2.string().regex(/^[a-f0-9]{64}$/)).optional(),
+  command: z2.array(z2.string()).optional(),
+  volumes: z2.array(volumeSchema).optional(),
+  gpu: z2.boolean().optional(),
+  iptables: z2.boolean().optional(),
+  joinNetworks: z2.array(z2.string()).optional(),
+  healthcheck: healthcheckSchema.optional(),
+  memory: z2.string().optional(),
+  cpu: z2.number().positive().max(128).optional(),
+  // Defaulted to 1 upstream, so always present on the wire.
+  replicas: z2.number().int().min(1).max(100),
+  labels: z2.array(z2.string()).optional(),
+  shmSizeMb: z2.number().int().positive().optional()
+});
+var workerAppSchema = z2.object({
+  appId: z2.string(),
+  // Flattened: in the resolve model these live under `.state` (matching
+  // `getDesiredState`'s shape), but on the wire only these two of that
+  // object's fields survive, so they're hoisted onto the app directly.
+  services: z2.record(nameSchema, wireServiceSchema),
+  /** `true` makes the per-app network `internal: true` (no egress). */
+  egress: z2.literal(true).optional(),
+  /** Worker-owned external nets this app's services join (e.g. `management-net`). */
+  externalNetworks: z2.array(z2.string()),
+  /**
+   * Service-name (unprefixed) -> producer edges. The renderer namespaces
+   * `providerServiceName` with `providerAppId` to form the final compose key.
+   */
+  dependsOn: z2.record(z2.string(), z2.array(dependsOnEdgeSchema)),
+  /** Plaintext for inline `files` entries, keyed by their identity digest. */
+  inlineFiles: z2.record(z2.string(), z2.string()),
+  /**
+   * Absolute host paths exempted from the absolute-mount gate and
+   * bound verbatim by the renderer (peer backup volumes, the logs socket).
+   */
+  allowedAbsoluteHostPaths: z2.array(z2.string()),
+  /**
+   * Host path the worker binds this app's `home-proxy.sock` at. Present only
+   * when the app holds a `home.apiAccess` grant.
+   */
+  homeProxySocketPath: z2.string().optional(),
+  /**
+   * Host path the worker binds this app's spawn broker socket at. Present
+   * only when the app holds a `host.spawn` grant.
+   */
+  spawnSocketPath: z2.string().optional(),
+  /**
+   * This app's registry credentials, keyed by registry host. The worker
+   * renders a per-app docker `config.json` from these so private images pull.
+   */
+  registryAuth: z2.record(hostKey, z2.object({ username: z2.string(), password: z2.string() })).optional()
+});
+var workerStateSchema = z2.object({
+  apps: z2.array(workerAppSchema),
+  /** SHAs of every artifact the worker keeps in `files/` after a reconcile. */
+  artifactHashes: z2.array(z2.string()),
+  /** Docker networks the worker container itself joins this reconcile. */
+  workerNetworks: z2.array(z2.string()),
+  /**
+   * Where traffic goes on this box, as `apps` says what runs on it. Runtime-
+   * neutral: the Docker worker renders it with `buildCaddyConfig`
+   * (`runtime/docker/ingress`) exactly as it renders `apps` with
+   * `convertToDockerCompose`.
+   *
+   * Required, not optional. Every producer can state an honest value - an
+   * unconfigured box gets the empty-identity placeholder, which is a real
+   * answer ("no domain yet") rather than a missing one - and a box with no
+   * schedulable app still needs a front door, so absence must never be a legal
+   * way to say "no ingress here".
+   */
+  ingress: ingressInputSchema
+});
+
+// src/worker-protocol/node-version.ts
+import { z as z3 } from "zod";
+var nodeVersionSchema = z3.object({
+  // The pinned ref this container runs: `benjick/realm-worker@sha256:…` for a
+  // pulled image, a bare image ID for a locally-loaded one (see the installer's
+  // pin_image). This is the string an `applied` audit entry matches against.
+  imageRef: z3.string().nullable(),
+  // The commit the image was built from - a full SHA from the publish workflow,
+  // null for anything built outside it.
+  gitHash: z3.string().nullable(),
+  // ISO-8601 build timestamp, read back off the image's OCI `created` label by
+  // the publish workflow so the reported date and the image's own can't drift.
+  buildDate: z3.string().nullable()
+});
+function readEnv(name) {
+  const value = Deno.env.get(name);
+  return value === void 0 || value === "" ? null : value;
+}
+function readNodeVersion() {
+  return {
+    imageRef: readEnv("REALM_IMAGE_REF"),
+    gitHash: readEnv("REALM_GIT_HASH"),
+    buildDate: readEnv("REALM_BUILD_DATE")
+  };
+}
+function shortNodeVersion(version) {
+  if (version.gitHash) return version.gitHash.slice(0, 7);
+  const digest = version.imageRef?.split("sha256:")[1];
+  return digest ? digest.slice(0, 12) : null;
+}
+
+// src/worker-protocol/update-files.ts
+var UPDATE_ERROR_MAX_CHARS = 2048;
+var MAX_ERROR_FILE_BYTES = 16 * 1024;
+async function readUpdateFiles(dir) {
+  const [pending, error] = await Promise.all([
+    isFile(`${dir}/.update`),
+    readError(`${dir}/.update.error`)
+  ]);
+  return { pending, error };
+}
+async function isFile(path) {
+  try {
+    return (await Deno.stat(path)).isFile;
+  } catch {
+    return false;
+  }
+}
+async function readError(path) {
+  let text;
+  try {
+    const stat = await Deno.stat(path);
+    if (!stat.isFile || stat.size > MAX_ERROR_FILE_BYTES) return null;
+    text = await Deno.readTextFile(path);
+  } catch {
+    return null;
+  }
+  const trimmed = text.trim();
+  if (trimmed === "") return null;
+  return trimmed.length > UPDATE_ERROR_MAX_CHARS ? trimmed.slice(-UPDATE_ERROR_MAX_CHARS) : trimmed;
+}
+
+// src/worker-protocol/app-dirs.ts
+var REALM_APP_DIR_GID = 999999;
+function isPreparedAppDir(appId, volume, exemptHostPaths) {
+  if (volume.gid !== void 0) return false;
+  if (exemptHostPaths.has(volume.hostPath)) return false;
+  if (!volume.hostPath.startsWith("./")) return false;
+  return scopeBindSource(volume.hostPath, appId) !== `./apps/${appId}`;
+}
+function scopeBindSource(source, appId) {
+  if (!source.startsWith("./")) return source;
+  const scoped = `./apps/${appId}/${source.slice(2)}`;
+  const segments = scoped.split("/");
+  const resolved = [];
+  for (const seg of segments) {
+    if (seg === "..") resolved.pop();
+    else if (seg !== "." && seg !== "") resolved.push(seg);
+  }
+  const normalized = "./" + resolved.join("/");
+  if (!normalized.startsWith(`./apps/${appId}/`) && normalized !== `./apps/${appId}`) {
+    throw new Error(`bind source escapes app directory: ${source}`);
+  }
+  return normalized;
+}
+
+// src/worker-protocol/silo-paths.ts
+var REALM_SILO_DIR = "/opt/realm/worker/silo";
+function managedSiloPath(id) {
+  return `${REALM_SILO_DIR}/${id}`;
+}
+function isManagedSiloPath(hostPath) {
+  return hostPath.startsWith(`${REALM_SILO_DIR}/`);
+}
+function shellQuote(path) {
+  return `'${path.replaceAll("'", "'\\''")}'`;
+}
+function siloSetupCommand(silo) {
+  const path = shellQuote(silo.hostPath);
+  return `chgrp -R ${silo.gid} ${path}
+chmod g+rwxs ${path}`;
+}
+function siloWidenCommand(silo) {
+  return `find ${shellQuote(silo.hostPath)} -type d -exec chmod g+rwxs {} +`;
+}
+function siloReclaimCommand(orphan) {
+  return `ssh root@${orphan.workerIp}
+rm -rf ${shellQuote(orphan.hostPath)}`;
+}
+
+export {
+  ingressInputSchema,
+  PLATFORM_INGRESS_PORTS,
+  dependsOnEdgeSchema,
+  wireServiceSchema,
+  workerAppSchema,
+  workerStateSchema,
+  nodeVersionSchema,
+  readNodeVersion,
+  shortNodeVersion,
+  readUpdateFiles,
+  REALM_APP_DIR_GID,
+  isPreparedAppDir,
+  scopeBindSource,
+  REALM_SILO_DIR,
+  managedSiloPath,
+  isManagedSiloPath,
+  siloSetupCommand,
+  siloWidenCommand,
+  siloReclaimCommand
+};

package/dist/chunk-AITGS27R.js

@@ -0,0 +1,139 @@
+// src/ref.ts
+var REF_SYMBOL = /* @__PURE__ */ Symbol.for("realm.ref");
+var DEFERRED_SYMBOL = /* @__PURE__ */ Symbol.for("realm.deferred");
+function isRef(value) {
+  return typeof value === "object" && value !== null && REF_SYMBOL in value;
+}
+function containsRef(value) {
+  if (isRef(value) || isRefMarker(value)) return true;
+  if (Array.isArray(value)) return value.some(containsRef);
+  if (typeof value === "object" && value !== null) {
+    for (const v of Object.values(value)) {
+      if (containsRef(v)) return true;
+    }
+  }
+  return false;
+}
+function isRefMarker(value) {
+  return typeof value === "object" && value !== null && "__realmRef" in value && typeof value.__realmRef === "object";
+}
+function throwOnToString() {
+  throw new Error(
+    "Refs cannot be stringified directly. Use interpolate`...` for templates or pass the ref through as an env/command/volume value."
+  );
+}
+function identityRef(field) {
+  return {
+    [REF_SYMBOL]: true,
+    toJSON: () => ({ __realmRef: { kind: "identity", field } }),
+    toString: throwOnToString
+  };
+}
+function ref(marker) {
+  return {
+    [REF_SYMBOL]: true,
+    toJSON: () => ({ __realmRef: marker }),
+    toString: throwOnToString
+  };
+}
+function stringRef(resolve) {
+  return {
+    [REF_SYMBOL]: true,
+    toJSON: resolve,
+    toString: throwOnToString
+  };
+}
+function deferredRef(marker) {
+  return {
+    [DEFERRED_SYMBOL]: true,
+    toJSON: () => ({ __realmRef: marker }),
+    toString: throwOnToString
+  };
+}
+function interpolate(strings, ...values) {
+  return {
+    [REF_SYMBOL]: true,
+    toJSON() {
+      const parts = [];
+      let allStrings = true;
+      for (let i = 0; i < strings.length; i++) {
+        const literal = strings[i];
+        if (literal.length > 0) parts.push(literal);
+        if (i < values.length) {
+          const val = values[i];
+          let marker = null;
+          if (isRef(val)) {
+            const resolved = val.toJSON();
+            if (typeof resolved === "object" && resolved !== null && "__realmRef" in resolved) {
+              marker = resolved.__realmRef;
+            } else {
+              parts.push(String(resolved));
+            }
+          } else if (isRefMarker(val)) {
+            const m = val.__realmRef;
+            if (m.kind === "deferred") {
+              throw new Error(
+                "interpolate cannot accept a deferred ref; move affix logic into apply()"
+              );
+            }
+            marker = m;
+          } else {
+            parts.push(String(val));
+          }
+          if (marker) {
+            if (marker.kind === "concat") {
+              for (const p of marker.parts) {
+                parts.push(p);
+                if (typeof p !== "string") allStrings = false;
+              }
+            } else {
+              parts.push(marker);
+              allStrings = false;
+            }
+          }
+        }
+      }
+      if (allStrings) return parts.join("");
+      return { __realmRef: { kind: "concat", parts } };
+    },
+    toString: throwOnToString
+  };
+}
+
+// src/service.ts
+var SELF_APP_ID = "__self__";
+var Service = class {
+  _serviceKey;
+  /** Called by the framework after scanning the services map */
+  _setServiceKey(key) {
+    this._serviceKey = key;
+  }
+  /**
+   * A per-service derived secret. Within the same app, same-named secrets
+   * collide intentionally (Postgres.password and Valkey.password in the
+   * same app share a hash) - that's the ergonomic contract.
+   */
+  derived(name) {
+    return ref({ kind: "derived", appId: SELF_APP_ID, name });
+  }
+  /**
+   * DNS name of this service within the per-app compose project. Resolves
+   * to a plain string at serialization time - `_setServiceKey` is
+   * guaranteed to have run before `getServiceDefinition`, which is the
+   * only time a `host` ref is serialized.
+   */
+  get host() {
+    return stringRef(() => this._serviceKey ?? "__unresolved__");
+  }
+};
+
+export {
+  REF_SYMBOL,
+  containsRef,
+  identityRef,
+  ref,
+  deferredRef,
+  interpolate,
+  SELF_APP_ID,
+  Service
+};

package/dist/chunk-CMAEHQ4F.js

@@ -0,0 +1,6 @@
+// src/home-cookie.ts
+var HOME_COOKIE_PREFIX = "realm-home";
+
+export {
+  HOME_COOKIE_PREFIX
+};

package/dist/chunk-MLKGABMK.js

@@ -0,0 +1,9 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};