gina 0.6.12 → 0.6.13

package/framework/{v0.6.12 → v0.6.13}/core/model/entity.js

@@ -254,11 +254,19 @@ function EntitySuper(conn, caller, injected) {
                                         // (its third guard skips setListener when `!Array.isArray`), so
                                         // this `.on` listener receives the emit arguments directly.
                                         if ( entity.listenerCount(_fpShortName) === 0 ) {
+                                            // #B395 — these DISPATCH:* dispatch diagnostics use console.debug,
+                                            // NOT console.log, and the distinction is load-bearing: in gina
+                                            // console.log is the logger's raw `process.stdout.write` path, which
+                                            // bypasses container dispatch (file/mq) AND the level gate, while a
+                                            // daemon-spawned bundle's stdout is filtered by lib/cmd/bundle/start.js
+                                            // — so as console.log they reached neither the bundle log nor docker
+                                            // logs, and only flooded a foreground boot. Levelled, they are off by
+                                            // default and appear when a consumer raises the hierarchy to debug.
                                             var _onFpQueueEmit = function onFpQueueEmit() {
                                                 var _q = entity._callbacks[_fpShortName];
                                                 if ( !_q || _q.length === 0 ) { return; }
                                                 var _fn = _q.shift();
-                                                console.log('\nDISPATCH:CALLBACK_FLUSH ' + _fpShortName);
+                                                console.debug('[ MODEL ][ ENTITY ] DISPATCH:CALLBACK_FLUSH ' + _fpShortName);
                                                 _fn.apply(this, arguments);
                                                 if ( !entity._callbacks[_fpShortName] || entity._callbacks[_fpShortName].length === 0 ) {
                                                     delete entity._callbacks[_fpShortName];
@@ -268,7 +276,7 @@ function EntitySuper(conn, caller, injected) {
                                             entity.on(_fpShortName, _onFpQueueEmit);
                                         }
                                     } else { // in case the event is not ready yet
-                                        console.log('\nDISPATCH:BUFFER_CALLBACK ' + events[i].shortName);
+                                        console.debug('[ MODEL ][ ENTITY ] DISPATCH:BUFFER_CALLBACK ' + events[i].shortName);
                                         // #M2 — queue consume: shift oldest buffered result so concurrent
                                         // callers each receive their own result, not a shared stale one.
                                         var _firing2Args = entity._arguments[events[i].shortName].shift();
@@ -529,7 +537,7 @@ function EntitySuper(conn, caller, injected) {
                     self
                         //.off(events[i].shortName, function(){ delete self._callbacks[trigger]; })
                         .on(events[i].shortName, function () {
-                            console.log('\nDISPATCH:ALIAS_TRIGGER ' + trigger);
+                            console.debug('[ MODEL ][ ENTITY ] DISPATCH:ALIAS_TRIGGER ' + trigger);
                             this._callbacks[trigger.replace(/[0-9]/g, '')].apply(this[method], arguments);
                             delete self._callbacks[trigger];
                         })
@@ -537,7 +545,7 @@ function EntitySuper(conn, caller, injected) {
 
             } else {
                 if ( typeof(self._callbacks[trigger]) != 'undefined' ) {
-                    console.log('\nDISPATCH:CALLBACK_FLUSH ' + trigger);
+                    console.debug('[ MODEL ][ ENTITY ] DISPATCH:CALLBACK_FLUSH ' + trigger);
                     self._callbacks[trigger].apply(this, args);
                     delete self._callbacks[trigger];
                 } else {
@@ -562,7 +570,7 @@ function EntitySuper(conn, caller, injected) {
                             if (!this._arguments[trigger]) {
                                 this._arguments[trigger] = [];
                             }
-                            console.log('\nDISPATCH:PREEMPTIVE_BUFFER ' + trigger);
+                            console.debug('[ MODEL ][ ENTITY ] DISPATCH:PREEMPTIVE_BUFFER ' + trigger);
                             this._arguments[trigger].push(arguments);
 
                         })

package/framework/{v0.6.12 → v0.6.13}/core/router.js

@@ -20,6 +20,9 @@ var fs                  = require('fs')
     // #COMPLY1 — the default-on route authorization gate (plain-required in
     // lib/index.js, so this gen-0 binding IS the live module).
     , authzGate         = lib.authzGate
+    // #MS6 — the identified-caller quota gate (plain-required in lib/index.js,
+    // so this gen-0 binding IS the live module).
+    , rateLimit         = lib.rateLimit
     , SuperController   = require('./controller')
     , Config            = require('./config')
 ;
@@ -915,9 +918,13 @@ function Router(env, scope) {
                             Setup.requireController     = controller.requireController;
 
 
-                            Setup.apply(Setup, arguments);
-
-                            return Setup;
+                            // #B399 — return the app setup's own result instead of the
+                            // function object (the wrapper's return had zero consumers):
+                            // an async `setup.js`'s promise was discarded right here, so
+                            // the dispatch-loop guard could never own its rejection.
+                            // was: Setup.apply(Setup, arguments);
+                            //      return Setup;
+                            return Setup.apply(Setup, arguments);
                         }(request, response, next)
                     }
                 }
@@ -962,41 +969,88 @@ function Router(env, scope) {
                             return;
                         }
 
-                        // #DTO2 — default-on request-payload validation. A strict NO-OP
-                        // unless the route declares `param.dto`. Placed BEFORE the
-                        // reservedActions loop so a 422 short-circuits the whole controller
-                        // invocation (`onReady` never runs for a rejected request). Route
-                        // middleware has already drained here, so auth (401) still precedes
-                        // validation (422).
-                        if ( !dtoPipe.validateRequestPayload(controller, request, response) ) {
-                            return;
-                        }
-
-                        // handle superController events
-                        for (let e=0; e<reservedActions.length; ++e) {
-                            if ( typeof(controller[reservedActions[e]]) == 'function' ) {
-                                controller[reservedActions[e]](request, response, next)
+                        // #MS6 — identified-caller quota gate. AFTER authz (authorizeRequest
+                        // is the principal resolver — the only writer of req.machineCaller,
+                        // and session identity is its own predicate) and BEFORE the DTO pipe
+                        // (a throttled caller must not receive a 422 field map — the same
+                        // disclosure ordering that puts the 401 above the 422). The band
+                        // below is wrapped so the armed path can defer it behind the store
+                        // read; DORMANT (`enabled` not strictly true, exempt route, or no
+                        // principal) mints ZERO promises — the wrapped band runs on today's
+                        // exact synchronous path (the #B383 family: async-ness in a gate is
+                        // a behaviour change, so it is confined to callers who armed it).
+                        var _dispatchControllerAction = function() {
+                            // #DTO2 — default-on request-payload validation. A strict NO-OP
+                            // unless the route declares `param.dto`. Placed BEFORE the
+                            // reservedActions loop so a 422 short-circuits the whole controller
+                            // invocation (`onReady` never runs for a rejected request). Route
+                            // middleware has already drained here, so auth (401) still precedes
+                            // validation (422).
+                            if ( !dtoPipe.validateRequestPayload(controller, request, response) ) {
+                                return;
                             }
-                        }
 
-                        try {
-                            var _result = controller[action](request, response, next);
-                            if (_result && typeof _result.then === 'function') {
-                                _result.catch(function(err) {
-                                    serverInstance.throwError(response, 500, err.stack || err.message || String(err));
-                                });
+                            // handle superController events
+                            try {
+                                // #B399 — the reserved-action hooks (`onReady`, `setup`) were dispatched
+                                // BARE here, OUTSIDE the try, while the main action below owns its
+                                // promise: an async hook rejection was unowned — no response, the
+                                // request hung to client/proxy timeout, and the only trace was a
+                                // levelled line in the daemon-dropped stdout — and a sync hook throw
+                                // escaped to process level (isaac: uncaughtException → emerg + SIGTERM,
+                                // the whole bundle dies; express: its layer-catch answers its own 500 —
+                                // engine-asymmetric). Inside the try, a sync throw is this catch's 500;
+                                // the thenable capture gives an async rejection the SAME .catch → 500
+                                // the action carries. throwError is `!headersSent`-guarded, so a
+                                // rejection landing after the action responded degrades to the #ERRREF
+                                // pairing line. Sync/absent hooks mint ZERO promises (the band's
+                                // dormancy rule).
+                                for (let e=0; e<reservedActions.length; ++e) {
+                                    if ( typeof(controller[reservedActions[e]]) == 'function' ) {
+                                        let _hookResult = controller[reservedActions[e]](request, response, next);
+                                        if ( _hookResult && typeof _hookResult.then === 'function' ) {
+                                            _hookResult.catch(function(err) {
+                                                serverInstance.throwError(response, 500, 'reserved action `'+ reservedActions[e] +'` rejected: '+ ( err && (err.stack || err.message) || String(err) ));
+                                            });
+                                        }
+                                    }
+                                }
+
+                                var _result = controller[action](request, response, next);
+                                if (_result && typeof _result.then === 'function') {
+                                    _result.catch(function(err) {
+                                        serverInstance.throwError(response, 500, err.stack || err.message || String(err));
+                                    });
+                                }
+                            } catch (err) {
+                                var superController = new SuperController(options);
+                                // Required before setting options
+                                superController.serverInstance = serverInstance;
+                                superController.setOptions(request, response, next, options);
+                                if (typeof (controller) != 'undefined' && typeof (controller[action]) == 'undefined') {
+                                    return serverInstance.throwError(response, 500, (new Error('control not found: `' + action + '`. Please, check your routing.json ('+ options.rule +') or the related control in your `' + controllerFile + '`.')).stack);
+                                }
+
+                                return serverInstance.throwError(response, 500, err.stack);
                             }
-                        } catch (err) {
-                            var superController = new SuperController(options);
-                            // Required before setting options
-                            superController.serverInstance = serverInstance;
-                            superController.setOptions(request, response, next, options);
-                            if (typeof (controller) != 'undefined' && typeof (controller[action]) == 'undefined') {
-                                return serverInstance.throwError(response, 500, (new Error('control not found: `' + action + '`. Please, check your routing.json ('+ options.rule +') or the related control in your `' + controllerFile + '`.')).stack);
+                        };
+                        var _rlConf = serverInstance._rateLimit;
+                        if ( _rlConf && _rlConf.enabled === true ) {
+                            var _rlGate = rateLimit.gate(request, response, controller, _rlConf);
+                            if ( _rlGate ) {
+                                // Every terminal of this promise is owned: allow -> the band,
+                                // deny/outage -> answered inside the gate; this catch is the
+                                // last-resort belt (an unowned rejection in the dispatch spine
+                                // is a hung request with no visible log line).
+                                _rlGate.then(function onRateLimitVerdict(proceed) {
+                                    if (proceed) { _dispatchControllerAction(); }
+                                }).catch(function onRateLimitError(rlErr) {
+                                    serverInstance.throwError(response, 500, (rlErr && rlErr.stack) || String(rlErr));
+                                });
+                                return;
                             }
-
-                            return serverInstance.throwError(response, 500, err.stack);
                         }
+                        _dispatchControllerAction();
 
                     });
             } else {
@@ -1011,34 +1065,71 @@ function Router(env, scope) {
                     return;
                 }
 
-                // #DTO2 — default-on request-payload validation (see the with-middleware
-                // site above). A strict NO-OP unless the route declares `param.dto`.
-                if ( !dtoPipe.validateRequestPayload(controller, request, response) ) {
-                    return;
-                }
+                // #MS6 — identified-caller quota gate (see the with-middleware site
+                // above for the full rationale: after authz, before the DTO pipe;
+                // dormant mints ZERO promises and runs the band synchronously).
+                var _dispatchControllerAction = function() {
+                    // #DTO2 — default-on request-payload validation (see the with-middleware
+                    // site above). A strict NO-OP unless the route declares `param.dto`.
+                    if ( !dtoPipe.validateRequestPayload(controller, request, response) ) {
+                        return;
+                    }
+
+                    // handle superController events
+                    // e.g.: inside your controller, you can defined: `this.onReady = function(){...}` which will always be called before the main action
+                    try {
+                        // #B399 — the reserved-action hooks (`onReady`, `setup`) were dispatched
+                        // BARE here, OUTSIDE the try, while the main action below owns its
+                        // promise: an async hook rejection was unowned — no response, the
+                        // request hung to client/proxy timeout, and the only trace was a
+                        // levelled line in the daemon-dropped stdout — and a sync hook throw
+                        // escaped to process level (isaac: uncaughtException → emerg + SIGTERM,
+                        // the whole bundle dies; express: its layer-catch answers its own 500 —
+                        // engine-asymmetric). Inside the try, a sync throw is this catch's 500;
+                        // the thenable capture gives an async rejection the SAME .catch → 500
+                        // the action carries. throwError is `!headersSent`-guarded, so a
+                        // rejection landing after the action responded degrades to the #ERRREF
+                        // pairing line. Sync/absent hooks mint ZERO promises (the band's
+                        // dormancy rule).
+                        for (let e=0; e<reservedActions.length; ++e) {
+                            if ( typeof(controller[reservedActions[e]]) == 'function' ) {
+                                let _hookResult = controller[reservedActions[e]](request, response, next);
+                                if ( _hookResult && typeof _hookResult.then === 'function' ) {
+                                    _hookResult.catch(function(err) {
+                                        serverInstance.throwError(response, 500, 'reserved action `'+ reservedActions[e] +'` rejected: '+ ( err && (err.stack || err.message) || String(err) ));
+                                    });
+                                }
+                            }
+                        }
 
-                // handle superController events
-                // e.g.: inside your controller, you can defined: `this.onReady = function(){...}` which will always be called before the main action
-                for (let e=0; e<reservedActions.length; ++e) {
-                    if ( typeof(controller[reservedActions[e]]) == 'function' ) {
-                        controller[reservedActions[e]](request, response, next)
+                        var _result = controller[action](request, response, next);
+                        if (_result && typeof _result.then === 'function') {
+                            _result.catch(function(err) {
+                                serverInstance.throwError(response, 500, err.stack || err.message || String(err));
+                            });
+                        }
+                    } catch (err) {
+                        if ( typeof(controller) != 'undefined' && typeof (controller[action]) == 'undefined') {
+                            serverInstance.throwError(response, 500, (new Error('control not found: `' + action + '`. Please, check your routing.json or the related control in your `' + controllerFile + '`.')).stack);
+                        } else {
+                            serverInstance.throwError(response, 500, err.stack);
+                        }
+                        return;
                     }
-                }
-                try {
-                    var _result = controller[action](request, response, next);
-                    if (_result && typeof _result.then === 'function') {
-                        _result.catch(function(err) {
-                            serverInstance.throwError(response, 500, err.stack || err.message || String(err));
+                };
+                var _rlConf = serverInstance._rateLimit;
+                if ( _rlConf && _rlConf.enabled === true ) {
+                    var _rlGate = rateLimit.gate(request, response, controller, _rlConf);
+                    if ( _rlGate ) {
+                        _rlGate.then(function onRateLimitVerdict(proceed) {
+                            if (proceed) { _dispatchControllerAction(); }
+                        }).catch(function onRateLimitError(rlErr) {
+                            serverInstance.throwError(response, 500, (rlErr && rlErr.stack) || String(rlErr));
                         });
+                        return;
                     }
-                } catch (err) {
-                    if ( typeof(controller) != 'undefined' && typeof (controller[action]) == 'undefined') {
-                        serverInstance.throwError(response, 500, (new Error('control not found: `' + action + '`. Please, check your routing.json or the related control in your `' + controllerFile + '`.')).stack);
-                    } else {
-                        serverInstance.throwError(response, 500, err.stack);
-                    }
-                    return;
                 }
+                _dispatchControllerAction();
             }
 
             // controller = null;

package/framework/{v0.6.12 → v0.6.13}/core/server.js

@@ -2143,6 +2143,36 @@ function Server(options) {
         }
     }
 
+    /**
+     * #MS5 — resolve and validate the `server.query.circuitBreaker` block ONCE at
+     * engine start, for the stamp below that `controller.query()` reads (the same
+     * boot-resolved-once pattern as `_cacheName` / #B238). Dormant contract: an
+     * absent block, or `enabled` not strictly `true`, resolves to
+     * `{ enabled: false }` and the breaker path in `query()` is never entered.
+     * Structurally invalid values on an ENABLED block are a boot refusal (throw),
+     * not a warn-and-disable: silently running without the protection the operator
+     * asked for is exactly the fail-open shape the storage/kv boot bands refuse.
+     *
+     * @inner
+     * @param {object} [serverConf] - Post-fold `server` block (env.json keys win, settings.json fills — see the config.js #MS5 fold)
+     * @returns {object} `{ enabled: false }` or `{ enabled: true, failureThreshold, cooldownMs }`
+     */
+    var resolveQueryCircuitBreakerConf = function(serverConf) {
+        var block = serverConf && serverConf.query && serverConf.query.circuitBreaker;
+        if ( !block || block.enabled !== true ) {
+            return { enabled: false };
+        }
+        var threshold = ( typeof(block.failureThreshold) == 'undefined' ) ? 5 : block.failureThreshold;
+        if ( typeof(threshold) != 'number' || threshold !== ~~threshold || threshold < 1 ) {
+            throw new Error('[SERVER][#MS5] `server.query.circuitBreaker.failureThreshold` must be an integer >= 1 — got `'+ threshold +'`');
+        }
+        var cooldownMs = parseTimeout( ( typeof(block.cooldown) == 'undefined' ) ? '30s' : block.cooldown );
+        if ( typeof(cooldownMs) != 'number' || cooldownMs < 1 ) {
+            throw new Error('[SERVER][#MS5] `server.query.circuitBreaker.cooldown` must be a positive timeout (e.g. "30s", 500) — got `'+ block.cooldown +'`');
+        }
+        return { enabled: true, failureThreshold: threshold, cooldownMs: cooldownMs };
+    };
+
     /**
      * Attaches the server engine instance, injects helper references
      * (`throwError`, `getAssets`, `completeHeaders`) onto it, and returns
@@ -2188,6 +2218,33 @@ function Server(options) {
                 instance._cacheName = lib.RenderCache.resolveCacheName(self.conf[self.appName][self.env].server.cache);
             }
 
+            // #MS5 — per-authority query circuit-breaker policy, resolved ONCE
+            // from the post-fold `server.query.circuitBreaker` and stamped where
+            // `controller.query()` reads it (mirrors the `_cache*` scalars above;
+            // breaker STATE lives separately on `instance._queryCircuitBreakers`,
+            // minted lazily by the controller).
+            if ( typeof(instance._queryCircuitBreaker) == 'undefined' ) {
+                instance._queryCircuitBreaker = resolveQueryCircuitBreakerConf(self.conf[self.appName][self.env].server);
+            }
+
+            // #MS6 — identified-caller quota policy, resolved ONCE from the
+            // post-fold `server.rateLimit` and stamped where the router reads it
+            // (the same instance-scalars family as the breaker above: survives
+            // dev-mode hot reloads, dies on restart). The resolver is fail-closed
+            // on an enabled block (a bad value refuses the boot) and verifies the
+            // named kv namespace is DECLARED — the kv boot band installed the
+            // namespaces before the first request, upstream of this engine start.
+            if ( typeof(instance._rateLimit) == 'undefined' ) {
+                var _rlContent = self.conf[self.appName][self.env].content;
+                instance._rateLimit = lib.rateLimit.resolveConf(self.conf[self.appName][self.env].server, {
+                    kv         : lib.kv,
+                    kvSettings : _rlContent && _rlContent.settings && _rlContent.settings.kv,
+                    connectors : _rlContent && _rlContent.connectors,
+                    routing    : _rlContent && _rlContent.routing,
+                    warn       : function(rlWarnMsg) { console.warn('[rate-limit] ' + rlWarnMsg); }
+                });
+            }
+
             // #B115 — publish the engine so the form-validator's server-side `query`
             // rule can hand its hand-built controller the LIVE instance (one engine
             // per process). Without this, queryFromBackend mints a second `_cached`
@@ -7461,6 +7518,10 @@ function Server(options) {
                     queryTimeout        : parseTimeout(routing[name].queryTimeout) || null,
                     // #CSRF2 — per-route opt-out for the Csrf middleware (webhook receivers, etc.)
                     csrfExempt          : routing[name].csrfExempt || false,
+                    // #MS6 — per-route rate-limit override/exempt. typeof-guarded,
+                    // NOT `||`: `false` is a MEANINGFUL value (exempt) that `|| null`
+                    // would erase into the default policy.
+                    rateLimit           : ( typeof(routing[name].rateLimit) != 'undefined' ) ? routing[name].rateLimit : null,
                     // #I18N1 slice 3 — per-route culture-prefix opt-in.
                     // When true, the i18n negotiator reads
                     // req.routing.param.culture as the highest-priority

package/framework/{v0.6.12 → v0.6.13}/lib/cmd/service/help.txt

@@ -21,8 +21,14 @@
   Notes:
 
     `@gina` is the only project currently supported by `service:list`.
-    Services live under the framework's `services/` directory and are
-    bundles of the @gina project: `proxy` and `inspector`.
+    Services are bundles of the @gina project under the framework's
+    `services/` directory — a maintainer-side tree that is NOT part of the
+    published package, so a released install lists nothing until that tree
+    exists locally. `inspector` is the one maintained service.
+
+    gina ships no edge / reverse proxy, by design: run one in front of your
+    bundles (nginx, Traefik, an ingress controller). That is the topology the
+    authentication, rate-limiting and Kubernetes guidance already assume.
 
     Running state is derived from ~/.gina/run/<service>@gina.pid combined
     with `process.kill(pid, 0)` — a stale pidfile (process gone) reports

package/framework/{v0.6.12 → v0.6.13}/lib/cmd/service/start.js

@@ -11,7 +11,7 @@ var CmdHelper = require('./../helper');
  */
 /**
  * Starts a framework-internal service — a bundle registered under the @gina
- * project (today: `inspector`, `proxy`). The service is launched via the
+ * project (today: `inspector`). The service is launched via the
  * daemon-free `bin/gina-container` foreground launcher spawned detached, so no
  * `gina start` socket server (port 8124) is required. The service is started in
  * the @gina project's own `dev`/`local` defaults (the current shell's

package/framework/{v0.6.12 → v0.6.13}/lib/index.js

@@ -104,6 +104,12 @@ function Lib() {
         // to protect from eviction). No connector ships an implementation yet —
         // demand-gated, the audit-store shipping order.
         StorageStore    : _require('./storage-store'),
+        // #KV1 — connector-backed KV namespace-store factory (lib/kv,
+        // `settings.kv.namespaces.<name>.store`). Stateless dispatcher invoked
+        // once per store-backed namespace at boot; _require like JobStore /
+        // StorageStore. No connector ships an implementation yet — naming one
+        // refuses the boot (the audit-store shipping order).
+        KvStore         : _require('./kv-store'),
         SwigFilters     : _require('./swig-filters'),
         Cache           : require('./cache'),    // #B32-residual — plain require (leaf class held at gen-0 via server.isaac.js:35; Cache._events is a Collection). See Collection note above.
         RenderCache     : require('./render-cache'), // #B32-residual — plain require (server-only render-cache strategy dispatcher; wraps lib/cache and is held at gen-0 in server.isaac.js + the render delegates). See Cache above.
@@ -195,6 +201,12 @@ function Lib() {
         // per-request require() can never grow a dead-`children` tail (#B32-residual).
         // It also keeps a security gate out of the dev-mode hot-reload path entirely.
         authzGate       : require('./authz-gate'),
+        // #MS6 — identified-caller quota gate, run by core/router.js between the
+        // authz gate and the DTO pipe. require() — NOT _require — for the same
+        // reason as dtoPipe/authzGate above: router-bound, load-once, no
+        // per-request require() (#B32-residual), and its policy/state live on the
+        // engine instance + in the kv store, so hot-reload would gain nothing.
+        rateLimit       : require('./rate-limit'),
         // #COMPLY3 — authentication hardening primitives (password hashing +
         // verification, password policy, lockout, TOTP). require() — NOT _require —
         // for the authzGate reason above: a security primitive stays out of the
@@ -334,6 +346,12 @@ function Lib() {
         // the same reason job / State / audit are plain requires. Plain require =
         // cache hit = the singleton survives.
         storage         : require('./storage'),
+        // #KV1 — general-purpose KV primitive (strict-declared namespaces
+        // behind gina.kv()). PLAIN require, like job / State / logger /
+        // storage: a singleton holding the namespace registry and per-
+        // namespace sweep timers — it must survive dev-mode refreshCore(),
+        // and re-requiring it would orphan live timers and state.
+        kv              : require('./kv'),
     };
 
     /**

package/framework/v0.6.13/lib/kv/package.json

@@ -0,0 +1,7 @@
+{
+    "name": "kv",
+    "description": "General-purpose key-value primitive (#KV1): strict-declared namespaces behind gina.kv(), promise-native 13-op surface (get/set/del/has/ttl/expire/setnx/consume/incr/decr/delIfEquals/clear/getOrSet) over pluggable per-namespace backends. Ships the in-memory backend",
+    "version": "0.0.1",
+    "private": true,
+    "main": "src/main"
+}