tan-cli 0.7.0__py3-none-any.whl

tan/net.py

@@ -0,0 +1,73 @@
+# SPDX-License-Identifier: Apache-2.0
+"""The one TLS trust context every network call in `tan` uses (tan-cli#304).
+
+A PyInstaller `--onefile` freeze bundles its own Python and its own `ssl`, but
+NOT a CA bundle, and `ssl.create_default_context()`'s `set_default_verify_paths`
+falls back to whatever cert path OpenSSL was compiled with -- a path on the
+BUILD machine, not the one the frozen binary later runs on. The result is a
+frozen `tan` with zero trust anchors: every `urllib` HTTPS call fails
+`CERTIFICATE_VERIFY_FAILED`, even though the same host's `curl`/browser/system
+`python3` all verify the same endpoint fine (#304's single-variable proof:
+`SSL_CERT_FILE=/etc/ssl/cert.pem` alone fixed a bare invocation).
+
+Two mechanisms, layered:
+
+* `truststore` (preferred) -- `SSLContext` that verifies through the OS's own
+  trust store (Security.framework / CryptoAPI / OpenSSL-with-system-paths), so
+  a genuine corporate CA installed in the machine's keychain keeps working.
+  `certifi` alone cannot do that: it is a fixed, hermetic public-CA list, so a
+  host behind a real TLS-intercepting proxy would trade one failure for
+  another under `certifi`-only.
+* `certifi`'s bundled `cacert.pem` (the floor) -- used only if `truststore`
+  itself is unavailable or fails to construct a context, so a run never has
+  zero trust anchors just because the preferred mechanism came up short.
+  Hermetic: it verifies public CAs even on a host with no usable OS store.
+
+Mirrors `crates/tan-cli/src/http.rs`'s "merge, never narrow" intent (widen the
+webpki roots with the OS store rather than replacing them) with the tool the
+Python side actually has: there is no single Python API that merges a bundled
+list with the OS store in one context, so this falls back instead of merging.
+"""
+from __future__ import annotations
+
+import ssl
+
+
+def default_ssl_context() -> ssl.SSLContext:
+    """An `ssl.SSLContext` that actually has trust anchors, in a frozen build
+    or not. Pass as `urllib.request.urlopen(..., context=default_ssl_context())`.
+    """
+    import certifi
+
+    try:
+        import truststore
+
+        context = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        # tan-cli#354: the floor has to be UNDER truststore, not an
+        # ALTERNATIVE to it. `truststore.SSLContext(...)` constructs perfectly
+        # well on a host with an EMPTY OS trust store -- it defers to the
+        # platform verifier, and that verifier simply has no anchors. The
+        # failure then happens at VERIFY time, inside `urlopen`, which no
+        # `except` around construction can ever observe. So on any minimal
+        # container (`ubuntu:24.04`, `debian:*-slim`, and most CI base images
+        # ship no `ca-certificates`) every HTTPS call died
+        # `CERTIFICATE_VERIFY_FAILED` while tan's own `certifi` sat unused
+        # inside the freeze. Measured in a pristine `ubuntu:24.04`, and
+        # reproduced identically on the published `v0.5.0-rc4` asset -- so it
+        # predates the `--onedir` change and had shipped in every RC.
+        #
+        # Loading certifi into the SAME context WIDENS the anchor set instead
+        # of replacing it: a populated OS store -- the corporate-CA case #304
+        # chose truststore for -- keeps working, and a host with no OS store
+        # can still verify public CAs. That is the "merge, never narrow"
+        # intent this module's docstring takes from
+        # `crates/tan-cli/src/http.rs`, which the original fall-back shape
+        # could not actually express.
+        context.load_verify_locations(cafile=certifi.where())
+        return context
+    except Exception:
+        # `ImportError` if truststore is absent; anything else is truststore
+        # failing outright (an unsupported OS, a store it cannot open) or
+        # refusing the extra anchors. Either way certifi alone is a trust
+        # anchor set that does not depend on the platform at all.
+        return ssl.create_default_context(cafile=certifi.where())

tan/output_format.py

@@ -0,0 +1,213 @@
+# SPDX-License-Identifier: Apache-2.0
+"""The one declaration of what `--format` accepts (tan-cli#403).
+
+Before this module the answer was written out 31 times. Every command declared
+`output_format: str` with `metavar="FORMAT"` and a prose help sentence, then
+re-validated the value in its own body:
+
+    if output_format not in ("text", "json"):
+        raise typer.BadParameter(
+            f"'{output_format}' (choose from 'text', 'json')", param_hint="--format"
+        )
+
+29 byte-identical copies of that, a 30th over a wider domain in
+`validate_cmd.py`, a 31st spelled differently in `cli.py`'s root callback
+(`ctx.fail(f"'{value}' is not one of 'text', 'json'")`), and a 32nd, 33rd and
+34th hardcoded into the bash/zsh/fish scripts `completion_cmd.py` emits. The
+copies had already drifted: `validate` really accepts `diagnostic-v1` and
+`sarif` -- the two documents an IDE integration wants -- while the root
+callback, the help prose and all three completion scripts named only `text`
+and `json`. So `tan --format diagnostic-v1 validate --offline` (the
+pre-subcommand position `alp-sdk-vscode`'s `withSdkRoot` actually uses) was a
+usage error whose message taught that `diagnostic-v1` does not exist, and
+`tan validate --format <TAB>` said the same wrong thing.
+
+The oracle never had this problem: clap derives the parser, the `--help`
+choice list and the completions from ONE `ValueEnum`, which is why the frozen
+oracle help in `tests/fixtures/oracle_captures/test_run_oracle_parity.json`
+still prints a `Possible values:` block this port had lost.
+
+So: one enum per domain, declared here, annotated on every `--format`
+parameter. Click derives the parse-time value list, the rejection message and
+the `--help` metavar from the annotation, `completion_cmd.py` splices the same
+values into the scripts it emits, and
+`tests/commands/test_output_format.py` asserts all three surfaces agree per
+command. There is no body-level check left to drift.
+
+**Why `str` mixin and not `enum.StrEnum`.** A member has to compare equal to
+its own wire value: hundreds of call sites downstream of the parameter say
+`output_format == "json"`, and every one of them keeps working with a `str`
+subclass. `StrEnum` would do that too, but `(str, Enum)` with an explicit
+`__str__` is what also makes `f"{fmt}"` render `json` rather than
+`OutputFormat.JSON` on every Python this project supports -- and an enum
+member that stringifies to its Python name is exactly how a wrong value
+reaches a subprocess argv or a JSON payload unnoticed.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping, Sequence
+from enum import Enum
+from typing import TypeVar
+
+import typer
+
+
+class OutputFormat(str, Enum):
+    """What `--format` accepts on every command but `validate`.
+
+    Verbatim from the oracle's own `ValueEnum` (`crates/tan-cli/src/cli.rs`),
+    whose `--help` rendering the frozen capture in
+    `tests/fixtures/oracle_captures/test_run_oracle_parity.json` shows:
+    `text: Human-readable text (default)` / `json: Machine-readable JSON
+    envelope`.
+    """
+
+    TEXT = "text"
+    JSON = "json"
+
+    def __str__(self) -> str:
+        return self.value
+
+
+class ValidateOutputFormat(str, Enum):
+    """`validate`'s wider domain -- the same two, plus two IDE-oriented
+    documents no other command emits.
+
+    `diagnostic-v1` is alp-sdk's `metadata/schemas/diagnostic-v1.schema.json`
+    (mirroring `scripts/alp_cli/diagnostic_format.py:to_machine_json`'s shape
+    -- `schemaVersion`/`tool`/`diagnostics[]`, zero-based LSP ranges), `sarif`
+    is its SARIF 2.1.0 sibling (`to_sarif`). Both are additions this port
+    makes to the v0.4.1 oracle's two-value surface, not parity gaps: `text`
+    and `json` are unchanged by them, so only a caller who asks for one of the
+    new two sees anything new.
+
+    A SEPARATE enum rather than a wider shared one: every other command emits
+    an envelope and nothing else, and an accepted-but-unimplemented
+    `tan build --format sarif` would exit 0 having written the wrong document
+    -- or none.
+    """
+
+    TEXT = "text"
+    JSON = "json"
+    DIAGNOSTIC_V1 = "diagnostic-v1"
+    SARIF = "sarif"
+
+    def __str__(self) -> str:
+        return self.value
+
+
+#: The one `--format` help string. Click appends the choice list itself (it
+#: becomes the option's metavar), so naming the values in prose here would put
+#: the port straight back to hand-maintaining a second copy that can disagree
+#: with the parser -- which is what `Output format: text or json.` on a
+#: command accepting four values already was. Wording is the oracle's own
+#: (`Output format`), plus this port's trailing full stop.
+FORMAT_HELP = "Output format."
+
+#: Commands whose `--format` declares `ValidateOutputFormat`. Consumed by
+#: `completion_cmd.py`, which emits text and so cannot read the live Click
+#: tree the way `cli.py` can (importing `tan.cli` from a command module is a
+#: cycle). `tests/commands/test_output_format.py` pins this tuple to what the
+#: tree really declares, so it cannot silently go stale.
+WIDE_FORMAT_COMMANDS: tuple[str, ...] = ("validate",)
+
+_FormatT = TypeVar("_FormatT", bound=Enum)
+
+
+def format_values(choices: type[Enum]) -> tuple[str, ...]:
+    """The wire values of one `--format` enum, in declaration order.
+
+    Declaration order is deliberate: it is the order `--help` and the shell
+    completions present, and `text` is first because it is the default.
+    """
+    return tuple(str(member.value) for member in choices)
+
+
+def invalid_format_message(value: str, choices: Sequence[str]) -> str:
+    """Click's OWN wording for a rejected choice, reproduced verbatim.
+
+    `click.types.Choice.get_invalid_choice_message` builds
+    `"{value!r} is not one of {choices}."` from `", ".join(map(repr, ...))`.
+    Anything that refuses a `--format` value OUTSIDE Click's parser -- i.e.
+    `resolve_format` below, for a value inherited across the subcommand
+    boundary, and `cli.py`'s root callback, which cannot use a fixed enum at
+    all because its domain is whatever the INVOKED subcommand declares -- has
+    to say it the same way, or the identical mistake gets two different
+    messages depending on where the caller put the flag, which is the defect
+    tan-cli#403 was filed about.
+
+    Takes plain strings, not an enum type, precisely so the root callback can
+    pass `declared_formats(...)` straight through.
+    """
+    quoted = ", ".join(map(repr, choices))
+    return f"{value!r} is not one of {quoted}."
+
+
+def resolve_format(
+    # `str`, not the enum type: Click hands the body a member (which IS a str
+    # by mixin), while a test calling the command function directly passes the
+    # wire value. Both are accepted, and both come back as a member.
+    local: str | None,
+    ctx_obj: Mapping[str, object] | None,
+    *,
+    choices: type[_FormatT],
+) -> _FormatT:
+    """`--format` for a command that honours the PRE-subcommand position.
+
+    Precedence, unchanged from the eleven hand-written copies this replaces:
+    the command's own `--format` (declared after the subcommand name) wins;
+    otherwise the root callback's value off `ctx.obj` (`cli.py` records what
+    preceded the subcommand, since Click hands a group only what comes before
+    it); otherwise `text`.
+
+    `local is not None` rather than a truthiness test: the local value arrives
+    already parsed by Click, and the only falsey member an enum could ever
+    have would still be an explicit caller choice, not an absent flag.
+
+    The inherited value is re-validated because it did NOT come through this
+    command's parser -- it came through the root callback's, whose domain need
+    not be this command's. Passing an out-of-domain value straight through
+    would hand the body a format it has no branch for, and the caller would
+    get a silent text-mode run with an empty stdout instead of an error.
+    """
+    if local is not None:
+        return choices(local)
+    inherited = (ctx_obj or {}).get("format")
+    if not inherited:
+        return choices("text")
+    try:
+        return choices(inherited)
+    except ValueError:
+        raise typer.BadParameter(
+            invalid_format_message(str(inherited), format_values(choices)),
+            # Quoted INSIDE the string on purpose: Click's own hint comes from
+            # `Parameter.get_error_hint`, which is `repr` of the option string,
+            # so this renders `Invalid value for '--format': ...` -- byte-identical
+            # to what the parser itself would have printed for the same value.
+            param_hint="'--format'",
+        ) from None
+
+
+def declared_formats(command: object) -> tuple[str, ...]:
+    """The values one live Click command's `--format` accepts, read off the
+    command tree rather than any second list.
+
+    This is what lets `cli.py`'s root callback accept whatever the INVOKED
+    subcommand declares instead of a frozen pair -- `tan --format
+    diagnostic-v1 validate --offline` has to produce the same document as
+    `tan validate --offline --format diagnostic-v1`.
+
+    Duck-typed on `.opts`/`.type.choices`, never `isinstance`: Typer builds
+    its commands out of its own VENDORED click (`typer._click`), so an
+    `isinstance(param, click.Option)` test against the top-level `click`
+    package matches nothing -- the trap `cli._tokens_consumed_after` already
+    documents. An empty result means the command declares no `--format` at
+    all, which a caller must treat as "refuse", never as "anything goes".
+    """
+    for param in getattr(command, "params", ()):
+        if "--format" not in getattr(param, "opts", ()):
+            continue
+        found: Sequence[str] = getattr(param.type, "choices", ()) or ()
+        return tuple(str(choice) for choice in found)
+    return ()

tan/planner/__init__.py

@@ -0,0 +1,219 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""
+ALP heterogeneous-OS build orchestrator (Phase 2 of the 2026-05-15 design).
+
+A board.yaml declares per-core runtimes; this module loads the
+project, resolves topology defaults from the SoM preset, allocates
+IPC carve-outs from the SoM's memory_map, and fans out into one
+build slice per non-`off` core.
+
+Public API:
+
+    load_board_yaml(path)          -> BoardProject
+    resolve_carve_outs(project)    -> list[ResolvedCarveOut]
+    emit_system_manifest(project, slices=...) -> str
+    emit_dts_reservations(project) -> str
+    emit_ipc_contract_h(project)   -> str
+    emit_build_plan(project, board_yaml=..., build_root=...) -> str
+    iter_buildable_slices(project) -> Iterator[Slice]
+
+    BoardProject, Slice, ResolvedCarveOut, SystemManifest, OrchestratorError,
+    SdkRevisionUnsupported, SdkRevisionUnknown, SdkRevisionNotBuildable
+
+ADR-0020 Phase 4 (preview) retired the SDK-side executor (`Orchestrator`/
+`fan_out`) -- this module is planner/emit-only; execution is an external
+consumer's job.
+
+Reference: docs/superpowers/specs/2026-05-15-heterogeneous-os-orchestration-design.md
+"""
+
+from __future__ import annotations
+
+# The filesystem roots now live in paths.py (the #285 paths seam) -- a leaf both
+# __init__ and topology.py import, so topology no longer lazy-imports BOARD_SCHEMA
+# back through the package. Re-exported here so `from alp_orchestrate import REPO`
+# (and friends) keeps working unchanged.
+from .paths import (  # noqa: E402
+    BOARD_PRESET_SCHEMA,  # noqa: F401  (re-export for the public surface)
+    BOARD_SCHEMA,  # noqa: F401  (re-export for the public surface)
+    METADATA_ROOT,  # noqa: F401  (re-export for the public surface)
+    REPO,  # noqa: F401  (re-export for the public surface)
+)
+
+
+# The per-core OS-class taxonomy + topology view now live in topology.py (the
+# #285 topology seam). Re-export the names referenced outside the module:
+# `_default_os_from_core_type` (test_silicon_variant_and_os_inference) + the public
+# emit surface `core_os_topology` / `emit_os_topology` (alp_project.py + the
+# test_emit_os_topology tests). The
+# remaining helpers (CLASS_RUNTIMES, _allowed_os_for_core, _runtime_class) stay
+# topology-private -- nothing outside topology.py references them.
+from .topology import (  # noqa: E402
+    _default_os_from_core_type,  # noqa: F401  (re-export: test_silicon_variant_and_os_inference)
+    core_os_topology,  # noqa: F401  (re-export: test_emit_os_topology)
+    emit_os_topology,  # noqa: F401  (re-export: alp_project.py + tests)
+)
+
+# The orchestrator data model now lives in alp_orchestrate_models (the first
+# #285 modularization seam); re-exported here so `from alp_orchestrate import
+# Slice` (and friends) keeps working unchanged for callers + tests.
+from .models import (  # noqa: E402
+    BoardProject,  # noqa: F401  (re-export: public model surface)
+    IpcEntry,  # noqa: F401  (re-export: public model surface; consumed by loader.py)
+    OrchestratorError,  # noqa: F401  (re-export: alp_project's lazy imports + tests)
+    ResolvedCarveOut,  # noqa: F401  (re-export; consumed by carveout.py now, not __init__)
+    ResolvedPartition,  # noqa: F401  (re-export; consumed by partition.py + headers.py now)
+    SdkRevisionNotBuildable,  # noqa: F401  (re-export; alp-sdk maps it to its own exit code)
+    SdkRevisionUnknown,  # noqa: F401  (re-export: validate_board_yaml maps it to its own exit code)
+    SdkRevisionUnsupported,  # noqa: F401  (re-export: validate_board_yaml maps it to exit 3)
+    Slice,  # noqa: F401  (re-export: public model surface)
+    StorageEntry,  # noqa: F401  (re-export: public model surface; consumed by loader.py)
+    SystemManifest,  # noqa: F401  (re-export: public model surface)
+)
+
+
+# ---------------------------------------------------------------------
+# Loader
+# ---------------------------------------------------------------------
+# The board.yaml loader now lives in loader.py (the #285 loader seam).
+# Re-export load_board_yaml -- the public parse entry (cli, west alp-build via
+# the module form, alp_project's --emit dispatch, the tests + fuzzer).
+from .loader import load_board_yaml  # noqa: E402,F401  (re-export: cli + west + alp_project + tests)
+
+
+# ---------------------------------------------------------------------
+# Carve-out resolver
+# ---------------------------------------------------------------------
+# resolve_carve_outs lives in carveout.py (the #285 carve-out seam); re-exported
+# so the public surface (orchestrator + emitters + tests) stays unchanged.
+from .carveout import resolve_carve_outs  # noqa: E402,F401  (re-export: tests)
+
+
+# ---------------------------------------------------------------------
+# Storage partition resolver
+# ---------------------------------------------------------------------
+# The storage-partition resolver now lives in partition.py (the #285 partition
+# seam). Re-export resolve_storage_partitions (emitters + orchestrator + tests)
+# and _known_flash_devices (the loader's eager flash-device cross-check above).
+from .partition import resolve_storage_partitions  # noqa: E402,F401  (re-export for tests)
+
+
+# ---------------------------------------------------------------------
+# Memory-region view (#1365 item 3)
+# ---------------------------------------------------------------------
+# The manifest's `memory[]` pane -- the region table `ipc[]` and `storage[]`
+# refer INTO by name. Re-exported for the manifest emitter + tests.
+from .memory import resolve_memory_regions  # noqa: E402,F401  (re-export for tests)
+
+
+# ---------------------------------------------------------------------
+# Emitters
+# ---------------------------------------------------------------------
+
+
+# The header / DTS / mount-table emitters now live in headers.py (the #285
+# headers emit seam). Re-exported so cli.py + alp_project.py + the build-plan
+# artefact table + tests keep importing them unchanged.
+from .headers import (  # noqa: E402
+    emit_dts_partitions,  # noqa: F401  (re-export: cli + tests)
+    emit_dts_reservations,  # noqa: F401  (re-export: cli + alp_project + tests)
+    emit_ipc_contract_h,  # noqa: F401  (re-export: cli + alp_project + tests)
+    emit_storage_mounts_c,  # noqa: F401  (re-export: cli + alp_project + tests; not used in __init__)
+)
+
+
+# emit_system_manifest now lives in manifest.py (the #285 manifest emit seam);
+# re-exported for cli + alp_project + tests. (_helper_mcus + the shared build-plan
+# helpers are imported directly by orchestrator.py now, not back through here.)
+from .manifest import emit_system_manifest  # noqa: E402,F401  (re-export: cli + alp_project + tests)
+
+
+# ---------------------------------------------------------------------
+# Build-plan emission (the Wave C consumer contract)
+# ---------------------------------------------------------------------
+
+
+# The build-plan emitter now lives in buildplan.py (the #285 build-plan seam);
+# re-exported for cli + tests. (The shared materialise helpers are imported
+# directly by orchestrator.py now, not back through here.)
+from .buildplan import (  # noqa: E402
+    _slice_cmake_args_artefact,  # noqa: F401  (re-export: tests)
+    _slice_dts_overlay,  # noqa: F401  (re-export: alp_project + tests)
+    _slice_dts_overlay_artefact,  # noqa: F401  (re-export: tests)
+    _slice_hw_info_artefact,  # noqa: F401  (re-export: tests)
+    _slice_hw_info_h,  # noqa: F401  (re-export: alp_project + tests)
+    _slice_west_libraries,  # noqa: F401  (re-export: alp_project + tests)
+    _slice_west_libs_artefact,  # noqa: F401  (re-export: tests)
+    _v1_shaped_project,  # noqa: F401  (re-export: alp_project)
+    DtsOverlayUnavailable,  # noqa: F401  (re-export: tests)
+    HwInfoUnavailable,  # noqa: F401  (re-export: tests)
+    emit_build_plan,  # noqa: F401  (re-export: cli + tests)
+)
+
+
+# ---------------------------------------------------------------------
+# --emit kconfig -- the board-scoped Kconfig symbol menu for the LSP (#893)
+# ---------------------------------------------------------------------
+
+
+# The board-scoped Kconfig symbol-menu emitter lives in kconfig_symbols.py
+# (deliberately separate from kconfig.py, which is the alp.conf/local.conf
+# string-templater); re-exported for cli + tests.
+from .kconfig_symbols import emit_kconfig  # noqa: E402,F401  (re-export: cli + tests)
+
+
+# ---------------------------------------------------------------------
+# Slice-command resolution (planner-side; the executor was retired)
+# ---------------------------------------------------------------------
+# The slice-command / flash-recipe cluster lives in orchestrator.py.
+# Re-export _slice_command / _slice_post_commands (tests) and
+# iter_buildable_slices (ADR-0020 Phase 1 -- tests + buildplan.py).
+from .orchestrator import (  # noqa: E402,F401
+    _slice_command,
+    _slice_post_commands,  # noqa: F401  (re-export: tests -- see buildplan.py)
+    iter_buildable_slices,  # noqa: F401  (re-export: ADR-0020 Phase 1 -- tests + buildplan.py)
+)
+
+
+# ---------------------------------------------------------------------
+# Per-slice config emitters (consumed by both Orchestrator and the
+# new --core <id> --emit zephyr-conf / yocto-conf modes in alp_project.py).
+# ---------------------------------------------------------------------
+
+
+# The shared slug / peripheral-Kconfig helpers now live in slugs.py (the #285
+# slug leaf). Re-exported for the per-slice config emitters below + the tests.
+from .slugs import (  # noqa: E402
+    _slugs_from_helper_firmware,  # noqa: F401  (re-export for tests)
+    _slugs_from_on_module,  # noqa: F401  (re-export for tests)
+)
+
+
+# The per-slice Kconfig (alp.conf) emitter now lives in kconfig.py (the #285
+# kconfig emit seam); it pulls the slug tables from slugs.py. Re-exported for
+# the build-plan _slice_config_artefact helper (inline) + alp_project + tests.
+from .kconfig import (  # noqa: E402
+    _emit_extra_library_profile,  # noqa: F401  (re-export for tests)
+    _slice_alp_conf,  # noqa: F401  (re-export: alp_project + tests)
+    _slice_cmake_args,  # noqa: F401  (re-export: alp_project + tests)
+    _slice_local_conf,  # noqa: F401  (re-export: alp_project + tests)
+)
+
+
+# The sysbuild / TF-M secure-boot config emitters now live in secure.py (the
+# #285 secure emit seam). Re-exported so cli.py + tests + the build-plan artefact
+# table / slice-command helpers (still inline) keep importing them unchanged.
+from .secure import emit_sysbuild_conf, emit_tfm_sysbuild_conf  # noqa: E402,F401  (re-export: cli + tests)
+
+
+# ---------------------------------------------------------------------
+# CLI (thin wrapper for ad-hoc invocation)
+# ---------------------------------------------------------------------
+
+
+# Re-export the CLI entry: main() lives in __main__ (so `python -m
+# alp_orchestrate` is the invocation), but `from alp_orchestrate import main`
+# stays valid for callers + the test-suite.  Placed at module end so __main__'s
+# `from alp_orchestrate import ...` sees a fully-populated package.
+from .cli import main  # noqa: F401,E402  (intentional re-export)