devpush 0.0.0-stage → 1.0.0-beta.3

package/src/server/admin/service.ts

@@ -0,0 +1,260 @@
+import { and, desc, eq, sql, or, count } from 'drizzle-orm'
+import {
+  allowlistRuleSchema,
+  allowlistImportSchema,
+  parseAllowlistEmails,
+} from '#devpush/lib/allowlist-schema'
+
+import { adminSearchSchema } from '#devpush/lib/admin-search-schema'
+import { db } from '#devpush/server/db'
+import { allowlist, session, user } from '#devpush/server/db/schema'
+import { deleteUserAccountAsAdmin } from '#devpush/server/users/service'
+import {
+  requireInstallationAdmin,
+  requireInstallationAdminById,
+  installationAdminPredicate,
+} from '#devpush/server/admin/access'
+
+export type AdminOverview = Awaited<ReturnType<typeof getAdminOverview>>
+export type AllowlistRuleType = 'email' | 'domain' | 'pattern'
+
+export async function getAdminOverview(
+  actor: { id: string; email: string },
+  search: {
+    allowlistQuery?: string
+    allowlistPage?: number
+    userQuery?: string
+    userPage?: number
+  } = {},
+) {
+  await requireInstallationAdmin(actor)
+  const [users, allowlistEntries] = await Promise.all([
+    getAdminUsers(actor, search),
+    getAdminAllowlist(actor, search),
+  ])
+
+  return {
+    users: users.items,
+    userPagination: users.pagination,
+    allowlist: allowlistEntries.items,
+    allowlistPagination: allowlistEntries.pagination,
+  }
+}
+
+export async function getAdminUsers(
+  actor: { id: string; email: string },
+  search: { userQuery?: string; userPage?: number } = {},
+) {
+  await requireInstallationAdmin(actor)
+  const { userQuery: query, userPage: requestedPage } =
+    adminSearchSchema.parse(search)
+  const escaped = query.replace(/[\\%_]/g, '\\$&')
+  const where = query
+    ? or(
+        ...[user.name, user.username, user.email, user.status].map(
+          (column) => sql`${column} like ${`%${escaped}%`} escape '\\'`,
+        ),
+      )
+    : undefined
+  const [totalRow] = await db.select({ total: count() }).from(user).where(where)
+  const total = totalRow?.total ?? 0
+  const pageSize = 25
+  const pageCount = Math.max(1, Math.ceil(total / pageSize))
+  const page = Math.min(requestedPage, pageCount)
+  const entries = await db
+    .select({
+      id: user.id,
+      name: user.name,
+      username: user.username,
+      email: user.email,
+      emailVerified: user.emailVerified,
+      status: user.status,
+      image: user.image,
+      createdAt: user.createdAt,
+    })
+    .from(user)
+    .where(where)
+    .orderBy(desc(user.createdAt), desc(user.id))
+    .limit(pageSize)
+    .offset((page - 1) * pageSize)
+  return {
+    items: entries.map((entry) => ({
+      ...entry,
+      createdAt: entry.createdAt.toISOString(),
+    })),
+    pagination: { query, page, pageCount, total, pageSize },
+  }
+}
+
+export async function getAdminAllowlist(
+  actor: { id: string; email: string },
+  search: { allowlistQuery?: string; allowlistPage?: number } = {},
+) {
+  await requireInstallationAdmin(actor)
+  const { allowlistQuery: query, allowlistPage: requestedPage } =
+    adminSearchSchema.parse(search)
+  // Treat SQL wildcard characters as literal search text.
+  const escaped = query.replace(/[\\%_]/g, '\\$&')
+  const where = query
+    ? or(
+        sql`${allowlist.value} like ${`%${escaped}%`} escape '\\'`,
+        sql`${allowlist.type} like ${`%${escaped}%`} escape '\\'`,
+      )
+    : undefined
+  const [totalRow] = await db
+    .select({ total: count() })
+    .from(allowlist)
+    .where(where)
+  const total = totalRow?.total ?? 0
+  const pageSize = 25
+  const pageCount = Math.max(1, Math.ceil(total / pageSize))
+  const page = Math.min(requestedPage, pageCount)
+  const entries = await db
+    .select({
+      id: allowlist.id,
+      type: allowlist.type,
+      value: allowlist.value,
+      createdAt: allowlist.createdAt,
+    })
+    .from(allowlist)
+    .where(where)
+    .orderBy(desc(allowlist.createdAt), desc(allowlist.id))
+    .limit(pageSize)
+    .offset((page - 1) * pageSize)
+  return {
+    items: entries.map((entry) => ({
+      ...entry,
+      createdAt: entry.createdAt.toISOString(),
+    })),
+    pagination: { query, page, pageCount, total, pageSize },
+  }
+}
+
+export async function addAllowlistRule({
+  actorUserId,
+  type,
+  value,
+}: {
+  actorUserId: string
+  type: AllowlistRuleType
+  value: string
+}) {
+  await requireInstallationAdminById(actorUserId)
+  const normalizedValue = allowlistRuleSchema.parse({ type, value }).value
+
+  await db
+    .insert(allowlist)
+    .values({
+      id: crypto.randomUUID(),
+      type,
+      value: normalizedValue,
+    })
+    .onConflictDoNothing()
+}
+
+export async function importAllowlistEmails({
+  actorUserId,
+  emails,
+}: {
+  actorUserId: string
+  emails: string
+}) {
+  await requireInstallationAdminById(actorUserId)
+  const parsed = allowlistImportSchema.parse({ emails })
+  const entries = parseAllowlistEmails(parsed.emails).map((value) => ({
+    id: crypto.randomUUID(),
+    value,
+  }))
+  // One bound JSON value keeps large imports within every SQLite driver's limit.
+  await db.run(sql`insert into ${allowlist} (id, type, value)
+    select json_extract(value, '$.id'), 'email', json_extract(value, '$.value')
+    from json_each(${JSON.stringify(entries)}) where true
+    on conflict do nothing`)
+}
+
+export async function deleteAllowlistRule({
+  actorUserId,
+  id,
+}: {
+  actorUserId: string
+  id: string
+}) {
+  await requireInstallationAdminById(actorUserId)
+  await db.delete(allowlist).where(eq(allowlist.id, id))
+}
+
+export async function banUser({
+  actorUserId,
+  targetUserId,
+}: {
+  actorUserId: string
+  targetUserId: string
+}) {
+  await requireInstallationAdminById(actorUserId)
+  if (actorUserId === targetUserId) {
+    throw new Error('You cannot ban yourself.')
+  }
+
+  await db.batch([
+    db
+      .delete(session)
+      .where(
+        and(
+          eq(session.userId, targetUserId),
+          installationAdminPredicate(actorUserId),
+        ),
+      ),
+    db
+      .update(user)
+      .set({ status: 'banned', updatedAt: new Date() })
+      .where(
+        and(
+          eq(user.id, targetUserId),
+          eq(user.status, 'active'),
+          installationAdminPredicate(actorUserId),
+        ),
+      ),
+  ])
+}
+
+export async function unbanUser({
+  actorUserId,
+  targetUserId,
+}: {
+  actorUserId: string
+  targetUserId: string
+}) {
+  await requireInstallationAdminById(actorUserId)
+  if (actorUserId === targetUserId) {
+    throw new Error('You cannot unban yourself.')
+  }
+
+  await db
+    .update(user)
+    .set({ status: 'active', updatedAt: new Date() })
+    .where(
+      and(
+        eq(user.id, targetUserId),
+        eq(user.status, 'banned'),
+        installationAdminPredicate(actorUserId),
+      ),
+    )
+}
+
+export async function deleteAdminUser({
+  actorUserId,
+  targetUserId,
+}: {
+  actorUserId: string
+  targetUserId: string
+}) {
+  await requireInstallationAdminById(actorUserId)
+  if (actorUserId === targetUserId) {
+    throw new Error('You cannot delete yourself from admin.')
+  }
+
+  await deleteUserAccountAsAdmin({
+    userId: targetUserId,
+    adminActorUserId: actorUserId,
+  })
+}

package/src/server/agents/backup-state.ts

@@ -0,0 +1,210 @@
+import { sql } from 'drizzle-orm'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+import {
+  agentJobs,
+  backupArtifacts,
+  backupRuns,
+} from '#devpush/server/db/schema'
+import type {
+  AgentBackupCompletion,
+  AgentBackupCleanupCompletion,
+} from './protocol'
+
+function runningJob(
+  jobId: string,
+  serverId: string,
+  type: 'backup' | 'backup_cleanup',
+) {
+  return sql`exists(select 1 from ${agentJobs} where id = ${jobId} and server_id = ${serverId}
+    and type = ${type} and status = 'running')`
+}
+
+export async function failStaleAgentJob(
+  store: AtomicStore,
+  input: {
+    job: typeof agentJobs.$inferSelect
+    payloadSnapshot: string
+    now: Date
+    timeoutMs: number
+    message: string
+    backupRunId: string | null
+    cleanupRunIds: string[]
+  },
+) {
+  const now = input.now.getTime()
+  const guard = sql`id = ${input.job.id} and server_id = ${input.job.serverId}
+    and type = ${input.job.type} and payload = ${input.payloadSnapshot} and status = ${input.job.status}
+    and attempt = ${input.job.attempt} and updated_at = ${input.job.updatedAt.getTime()}
+    and ((status = 'running' and (claimed_at is null or claimed_at < ${now - input.timeoutMs}))
+      or (status = 'queued' and available_at < ${now - input.timeoutMs}))`
+  const eligible = sql`exists(select 1 from ${agentJobs} where ${guard})`
+  const effects = []
+  if (input.backupRunId) {
+    effects.push(
+      store.run(sql`update ${backupRuns} set status = 'failed', error_message = ${input.message},
+      finished_at = ${now}, updated_at = ${now} where id = ${input.backupRunId}
+      and server_id = ${input.job.serverId} and status = ${input.job.status} and ${eligible}`),
+    )
+  }
+  for (let offset = 0; offset < input.cleanupRunIds.length; offset += 80) {
+    effects.push(
+      store.run(sql`update ${backupRuns} set cleanup_queued_at = null,
+      cleanup_error_message = ${input.message}, updated_at = ${now}
+      where id in (select value from json_each(${JSON.stringify(input.cleanupRunIds.slice(offset, offset + 80))}))
+      and server_id = ${input.job.serverId} and ${eligible}`),
+    )
+  }
+  const finish =
+    store.all(sql`update ${agentJobs} set status = 'failed', error_message = ${input.message},
+    finished_at = ${now}, updated_at = ${now} where ${guard} returning id`)
+  const [first, ...rest] = effects
+  if (!first) return (await finish).length === 1
+  const results = await store.batch([first, ...rest, finish])
+  const completed = results.at(-1)
+  return Array.isArray(completed) && completed.length === 1
+}
+
+export async function finishBackup(
+  store: AtomicStore,
+  input: {
+    serverId: string
+    completion: AgentBackupCompletion
+    errorMessage: string | null
+    now: Date
+    manifest: unknown
+  },
+) {
+  const { completion } = input
+  const now = input.now.getTime()
+  const guard = runningJob(completion.jobId, input.serverId, 'backup')
+  const artifactGuard = sql`${guard} and exists(select 1 from ${backupRuns}
+    where id = ${completion.backupRunId} and server_id = ${input.serverId} and status = 'running')`
+  const artifacts =
+    completion.status === 'succeeded'
+      ? (completion.artifacts ?? [])
+      : completion.status === 'failed' &&
+          typeof input.manifest === 'object' &&
+          input.manifest !== null &&
+          'localRecoveryAvailable' in input.manifest &&
+          input.manifest.localRecoveryAvailable === true
+        ? (completion.artifacts ?? []).filter(
+            (artifact) => artifact.storage === 'local',
+          )
+        : []
+  const inserts = []
+  for (let offset = 0; offset < artifacts.length; offset += 8) {
+    const rows = artifacts.slice(offset, offset + 8).map(
+      (artifact) =>
+        sql`(${crypto.randomUUID()}, ${completion.backupRunId}, ${artifact.type}, ${artifact.storage},
+          ${artifact.objectKey}, ${artifact.checksumSha256}, ${artifact.sizeBytes}, ${now})`,
+    )
+    inserts.push(
+      store.run(sql`insert into ${backupArtifacts} (id, backup_run_id, type, storage, object_key, checksum_sha256, size_bytes, created_at)
+      select column1, column2, column3, column4, column5, column6, column7, column8
+      from (values ${sql.join(rows, sql`, `)}) where ${artifactGuard}
+      on conflict(backup_run_id, object_key) do nothing`),
+    )
+  }
+  const patch =
+    store.run(sql`update ${backupRuns} set status = ${completion.status},
+    manifest = json_set(json_patch(coalesce(manifest, '{}'), ${JSON.stringify(input.manifest ?? {})}), '$.databaseTargets', json(coalesce(json_extract(manifest, '$.databaseTargets'), '[]'))), error_message = ${input.errorMessage},
+    started_at = coalesce(started_at, ${now}), finished_at = ${now}, updated_at = ${now}
+    where id = ${completion.backupRunId} and server_id = ${input.serverId} and status = 'running' and ${guard}`)
+  const finish =
+    store.all(sql`update ${agentJobs} set status = ${completion.status}, error_message = ${input.errorMessage},
+    finished_at = ${now}, updated_at = ${now} where id = ${completion.jobId} and server_id = ${input.serverId}
+    and type = 'backup' and status = 'running' returning id`)
+  const [first, ...rest] = inserts
+  const results = first
+    ? await store.batch([first, ...rest, patch, finish])
+    : await store.batch([patch, finish])
+  const completed = results.at(-1)
+  return Array.isArray(completed) && completed.length === 1
+}
+
+export async function finishBackupCleanup(
+  store: AtomicStore,
+  input: {
+    serverId: string
+    completion: AgentBackupCleanupCompletion
+    errorMessage: string | null
+    now: Date
+    backupRunIds: string[]
+    localObjectKeys: string[]
+    remoteObjectKeys: string[]
+  },
+) {
+  const now = input.now.getTime()
+  const { completion } = input
+  const guard = runningJob(completion.jobId, input.serverId, 'backup_cleanup')
+  const deletes = []
+  if (completion.status === 'succeeded') {
+    for (const [storage, keys] of [
+      ['local', input.localObjectKeys],
+      ['remote', input.remoteObjectKeys],
+    ] as const) {
+      for (let offset = 0; offset < keys.length; offset += 80) {
+        deletes.push(
+          store.run(sql`delete from ${backupArtifacts}
+          where backup_run_id in (select value from json_each(${JSON.stringify(input.backupRunIds)}))
+          and storage = ${storage} and object_key in (select value from json_each(${JSON.stringify(keys.slice(offset, offset + 80))}))
+          and ${guard} and exists(select 1 from ${backupRuns} as run
+            where run.id = ${backupArtifacts.backupRunId} and run.server_id = ${input.serverId})`),
+        )
+      }
+    }
+  }
+  const patches = []
+  for (let offset = 0; offset < input.backupRunIds.length; offset += 80) {
+    patches.push(
+      store.run(sql`update ${backupRuns} set cleanup_queued_at = null,
+      cleanup_error_message = ${input.errorMessage}, updated_at = ${now}
+      ${completion.status === 'succeeded' ? sql`, cleanup_finished_at = ${now}` : sql``}
+      where id in (select value from json_each(${JSON.stringify(input.backupRunIds.slice(offset, offset + 80))}))
+      and server_id = ${input.serverId} and ${guard}`),
+    )
+  }
+  const finish =
+    store.all(sql`update ${agentJobs} set status = ${completion.status}, error_message = ${input.errorMessage},
+    finished_at = ${now}, updated_at = ${now} where id = ${completion.jobId} and server_id = ${input.serverId}
+    and type = 'backup_cleanup' and status = 'running' returning id`)
+  const [first, ...rest] = [...deletes, ...patches]
+  if (!first) return (await finish).length === 1
+  const results = await store.batch([first, ...rest, finish])
+  const completed = results.at(-1)
+  return Array.isArray(completed) && completed.length === 1
+}
+
+export async function failClaimedAgentJob(
+  store: AtomicStore,
+  input: {
+    job: typeof agentJobs.$inferSelect
+    now: Date
+    message: string
+    backupRunId: string | null
+    cleanupRunIds: string[]
+  },
+) {
+  const job = input.job,
+    now = input.now.getTime()
+  const guard = sql`id = ${job.id} and server_id = ${job.serverId} and type = ${job.type} and status = 'running'
+    and attempt = ${job.attempt} and claimed_at is ${job.claimedAt?.getTime() ?? null} and updated_at = ${job.updatedAt.getTime()}`
+  const eligible = sql`exists(select 1 from agent_jobs where ${guard})`
+  const effects = []
+  if (input.backupRunId)
+    effects.push(
+      store.run(sql`update backup_runs set status = 'failed', error_message = ${input.message}, finished_at = ${now}, updated_at = ${now}
+    where id = ${input.backupRunId} and project_id = ${job.projectId} and server_id = ${job.serverId} and status = 'running' and ${eligible}`),
+    )
+  if (input.cleanupRunIds.length)
+    effects.push(
+      store.run(sql`update backup_runs set cleanup_queued_at = null, cleanup_error_message = ${input.message}, updated_at = ${now}
+    where id in (select value from json_each(${JSON.stringify(input.cleanupRunIds)})) and project_id = ${job.projectId} and server_id = ${job.serverId} and ${eligible}`),
+    )
+  const finish = store.run(
+    sql`update agent_jobs set status = 'failed', error_message = ${input.message}, finished_at = ${now}, updated_at = ${now} where ${guard}`,
+  )
+  const [first, ...rest] = effects
+  if (first) await store.batch([first, ...rest, finish])
+  else await finish
+}

package/src/server/agents/certificates.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod'
+import { getPluginServices } from '#devpush/server/plugins/services.server'
+import { pluginContext } from '#devpush/server/plugins/server-context'
+import { requireAgentServer } from '#devpush/server/servers/service'
+import { AgentRequestError } from './protocol'
+
+export const certificateRequestSchema = z.strictObject({
+  serverId: z.string().min(1).max(128),
+  token: z.string().min(1).max(1024),
+  csrPem: z.string().min(1).max(16384).optional(),
+  installedCertificateSha256: z
+    .string()
+    .regex(/^[a-f0-9]{64}$/)
+    .optional(),
+})
+
+const resultSchema = z.discriminatedUnion('status', [
+  z.strictObject({
+    status: z.literal('configuration'),
+    dnsNames: z
+      .array(
+        z
+          .string()
+          .max(253)
+          .regex(
+            /^\*\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/,
+          ),
+      )
+      .length(1),
+  }),
+  z.strictObject({
+    status: z.literal('pending'),
+    retryAfter: z.number().int().min(1).max(3600),
+  }),
+  z.strictObject({
+    status: z.literal('ready'),
+    certificatePem: z
+      .string()
+      .min(1)
+      .max(65536)
+      .regex(
+        /^(?:-----BEGIN CERTIFICATE-----\r?\n[A-Za-z0-9+/=\r\n]+\r?\n-----END CERTIFICATE-----\s*)+$/,
+      ),
+    expiresAt: z.iso.datetime(),
+  }),
+])
+
+export async function requestAgentCertificate(
+  input: z.infer<typeof certificateRequestSchema>,
+) {
+  await requireAgentServer({ serverId: input.serverId, token: input.token })
+  const services = getPluginServices()
+  if (!services.certificates)
+    throw new AgentRequestError(404, 'Managed certificates are not configured.')
+  const server = await pluginContext.readServer(input.serverId)
+  if (
+    !server ||
+    server.status === 'deleted' ||
+    server.status === 'disabled' ||
+    server.teamStatus !== 'active'
+  )
+    throw new AgentRequestError(403, 'Server is not active.')
+  try {
+    await services.serverLifecycle?.reconcile(server)
+    const result = resultSchema.parse(
+      await services.certificates.request({
+        server,
+        csrPem: input.csrPem,
+        ...(input.installedCertificateSha256
+          ? { installedCertificateSha256: input.installedCertificateSha256 }
+          : {}),
+      }),
+    )
+    return Response.json(
+      result,
+      result.status === 'pending'
+        ? {
+            status: 202,
+            headers: {
+              'Retry-After': String(result.retryAfter),
+              'Cache-Control': 'no-store',
+            },
+          }
+        : { headers: { 'Cache-Control': 'no-store' } },
+    )
+  } catch (error) {
+    console.error('Agent certificate provider failed.', {
+      serverId: server.id,
+      error: error instanceof Error ? error.message : 'Unknown error',
+    })
+    throw new AgentRequestError(
+      503,
+      'Certificate service is temporarily unavailable.',
+    )
+  }
+}

package/src/server/agents/claims.ts

@@ -0,0 +1,116 @@
+import { and, eq, gt, sql } from 'drizzle-orm'
+import type { BaseSQLiteDatabase } from 'drizzle-orm/sqlite-core'
+import { config } from '#devpush/server/config'
+import * as schema from '#devpush/server/db/schema'
+import { isUniqueConstraintError } from '#devpush/server/db/errors'
+import type { AtomicStore } from '#devpush/server/db/atomic'
+
+type Store = Pick<BaseSQLiteDatabase<'async', unknown, typeof schema>, 'update'>
+
+export async function claimDeployment(
+  store: Store,
+  serverId: string,
+  now: Date,
+) {
+  const { deployments } = schema
+  const runtimeAvailable = sql`not exists(select 1 from ${deployments} as running
+    where running.runtime_id = ${deployments.runtimeId} and running.status = 'running')`
+  try {
+    const [claimed] = await store
+      .update(deployments)
+      .set({ status: 'running', phase: 'agent_connected', startedAt: now })
+      .where(
+        and(
+          eq(deployments.status, 'queued'),
+          gt(
+            deployments.createdAt,
+            new Date(
+              now.getTime() -
+                config.DEVPUSH_DEPLOYMENT_QUEUE_TTL_HOURS * 3600000,
+            ),
+          ),
+          runtimeAvailable,
+          sql`${deployments.id} = (select id from ${deployments}
+          where server_id = ${serverId} and status = 'queued' and created_at > ${now.getTime() - config.DEVPUSH_DEPLOYMENT_QUEUE_TTL_HOURS * 3600000} and ${runtimeAvailable}
+          order by created_at, id limit 1)`,
+        ),
+      )
+      .returning()
+    return claimed ?? null
+  } catch (error) {
+    if (isUniqueConstraintError(error)) return null
+    throw error
+  }
+}
+
+export async function claimCleanup(store: Store, serverId: string, now: Date) {
+  const { agentJobs } = schema
+  const [claimed] = await store
+    .update(agentJobs)
+    .set({
+      status: 'running',
+      attempt: sql`${agentJobs.attempt} + 1`,
+      claimedAt: now,
+      updatedAt: now,
+    })
+    .where(
+      and(
+        eq(agentJobs.status, 'queued'),
+        sql`${agentJobs.id} = (select id from ${agentJobs} where server_id = ${serverId}
+        and type in ('deprovision', 'purge') and status = 'queued' and available_at <= ${now.getTime()}
+        order by created_at, id limit 1)`,
+      ),
+    )
+    .returning()
+  return claimed ?? null
+}
+
+export async function claimBackupCandidate(
+  store: Store & Pick<AtomicStore, 'batch'>,
+  input: {
+    job: typeof schema.agentJobs.$inferSelect
+    payloadSnapshot: string
+    backupRunId: string | null
+    now: Date
+  },
+) {
+  const { agentJobs, backupRuns } = schema
+  const guard = and(
+    eq(agentJobs.id, input.job.id),
+    eq(agentJobs.serverId, input.job.serverId),
+    eq(agentJobs.status, 'queued'),
+    eq(agentJobs.type, input.job.type),
+    sql`${agentJobs.payload} = ${input.payloadSnapshot}`,
+    eq(agentJobs.attempt, input.job.attempt),
+    eq(agentJobs.updatedAt, input.job.updatedAt),
+    sql`${agentJobs.availableAt} <= ${input.now.getTime()}`,
+  )
+  const claim = store
+    .update(agentJobs)
+    .set({
+      status: 'running',
+      attempt: sql`${agentJobs.attempt} + 1`,
+      claimedAt: input.now,
+      updatedAt: input.now,
+    })
+    .where(guard)
+    .returning()
+  if (input.backupRunId) {
+    const [, [claimed]] = await store.batch([
+      store
+        .update(backupRuns)
+        .set({ status: 'running', startedAt: input.now, updatedAt: input.now })
+        .where(
+          and(
+            eq(backupRuns.id, input.backupRunId),
+            eq(backupRuns.status, 'queued'),
+            sql`exists(select 1 from ${agentJobs} where ${guard})`,
+          ),
+        ),
+      claim,
+    ])
+    return claimed ?? null
+  }
+  const [claimed] = await claim
+  return claimed ?? null
+}