sdarbinyan/marketplaces
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

merge: B2B into main
Some checks failed
Architecture Governance / architecture (push) Has been cancelled
Details

Browse Source
This commit is contained in:
sdarbinyan
2026-08-18 02:08:09 +04:00
parent f079ef6f52 551a22a245
commit 7224bc56c2
7 changed files with 101 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.npmrc
View File

@@ -1,10 +0,0 @@
# @marketplaces/* packages are published to a private Verdaccio registry on
# the dev server (213.21.246.138:4873), not npmjs. The port isn't open in the
# server firewall (only 80/443/SSH are) - reach it via an SSH tunnel:
# ssh -L 4873:127.0.0.1:4873 seto@213.21.246.138
# See docs/PACKAGE-EXTRACTION.md for the full setup and the follow-up needed
# to expose this properly for CI (reverse proxy + TLS, or open the port).
@marketplaces:registry=http://127.0.0.1:4873/
# Auth token is NOT committed here. Set it locally (npm login --registry=http://127.0.0.1:4873/
# --scope=@marketplaces, or a user-level ~/.npmrc _authToken line) or via CI secret.

90
docs/PACKAGE-EXTRACTION.md
View File

@@ -1,66 +1,58 @@
# @marketplaces/auth & @marketplaces/payment — build, version, publish, consume
# @marketplaces/auth & @marketplaces/payment — build, version, release, infrastructure
See [ADR-0001](context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md) for why. This doc is the how — build, release, and infrastructure. For *consuming* the packages (install, providers, exported API), see [PACKAGES-USAGE.md](PACKAGES-USAGE.md).
See [ADR-0001](context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md) for why. This doc is the how. For *consuming* the packages (install, DI providers, exported API), see [PACKAGES-USAGE.md](PACKAGES-USAGE.md).
## Current state
Live end to end. `marketplaces` has no local copy of either package — it installs `@marketplaces/auth@0.1.0` from a private Verdaccio registry on the dev server. `packages/` no longer exists in this repo.
Working end to end with no credentials. `marketplaces` has no local copy of either package and no `.npmrc` — it installs `@marketplaces/auth` directly over git. A fresh clone plus `npm install` builds and tests green on any machine or CI runner.
## 1. Source repo
[sources.vitanova.network/sdarbinyan/vitanovaPackages](https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git) — single monorepo (npm workspaces), `packages/auth` + `packages/payment`, `main` branch. This is where the package source lives and where CI publishes from.
[sources.vitanova.network/sdarbinyan/vitanovaPackages](https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git) — npm workspaces monorepo, `packages/auth` + `packages/payment`, source on `main`.
## 2. Registry
## 2. How releases work
Verdaccio, running in Docker on the dev server (`213.21.246.138`, container `verdaccio`, config/storage at `/srv/marketplaces/verdaccio/`). **Not publicly reachable** — the server firewall only allows 80/443/SSH, and opening 4873 or loosening the registry's `$authenticated` access policy are both security-relevant changes that need an explicit decision, not something done silently. Reach it today via SSH tunnel:
npm cannot install a subdirectory of a git repo, so each package is published to its own **release branch** where the repo root *is* the package: `release/auth`, `release/payment`. Each contains only `package.json`, the built `dist/`, and a generated README.
```
"@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth"
```
This was chosen over a registry because it needs **nothing**: no npm registry, no token, no tunnel, no CI secret. Anonymous git read is the only requirement, which is what makes CI and fresh clones work unattended.
`release/*` branches are generated and force-pushed. Never commit to them by hand.
## 3. Versioning
[Changesets](https://github.com/changesets/changesets). A PR that changes a package adds a changeset file (`npx changeset` at the repo root — pick package, bump type, one-line description). `ci.yml` rejects PRs without one.
## 4. CI/CD (vitanovaPackages)
- **`ci.yml`** — on PRs and non-main pushes: install, build, test, require a changeset.
- **`release.yml`** — on push to `main`, two jobs:
- `release-branches` (matrix over `auth`/`payment`): builds each package and force-pushes its output to `release/<pkg>`. Skips cleanly when nothing changed.
- `version-pr`: opens/updates a "Version Packages" PR when unreleased changesets exist. Merging it bumps versions on `main`, which re-triggers the release.
Only the checkout token is needed — no secrets to configure.
Workflows use GitHub Actions syntax; Gitea/Forgejo Actions are compatible. Other CI needs translating (steps are: install, build, test, force-push a branch).
## 5. The Verdaccio registry (superseded, still running)
A private Verdaccio instance runs on the dev server: Docker container `verdaccio`, port 4873, config and storage at `/srv/marketplaces/verdaccio/`, registry user `marketplaces-ci`. It holds `@marketplaces/auth@0.1.0` and `@marketplaces/payment@0.1.0`.
**Nothing uses it.** It was the original plan, but it listens on `127.0.0.1:4873` and the server firewall allows only 80/443/SSH — so no CI runner and no developer could reach it without an SSH tunnel, which defeats the point. The git-release-branch approach (§2) replaced it.
Keep it or remove it; no code or workflow depends on it. To reach it manually:
```bash
ssh -L 4873:127.0.0.1:4873 seto@213.21.246.138
```
Follow-up decision needed before CI can publish/consume without a human at the keyboard: either (a) reverse-proxy `/verdaccio/` or a subdomain through the existing nginx on 443 with TLS, or (b) open 4873 directly (not recommended — plain HTTP with credentials). Neither is done yet.
Making it the primary path again would need a reverse proxy through nginx plus TLS (no certificate exists on that box), or an open port carrying credentials over plain HTTP — neither is done, and neither is necessary now.
`@marketplaces/*` packages require an authenticated user to install (`access: $authenticated` in Verdaccio config) — deliberately not `$all`, since loosening that is itself a security-relevant config change. A registry user `marketplaces-ci` exists; get a token via `npm login --registry=http://127.0.0.1:4873/` (through the tunnel) and set it locally as a user-level `~/.npmrc` `_authToken` line, or export `NPM_TOKEN` and append it to `.npmrc` at CI runtime — never commit a token into this repo's `.npmrc`.
## 6. Migration status
`marketplaces/.npmrc` maps the scope: `@marketplaces:registry=http://127.0.0.1:4873/` — update this once the registry has a real public/internal address.
**Auth: done.** `@marketplaces/auth` holds the real implementation — `telegram/` (live QR/session auth, customer + admin) and `ed25519/` (challenge/response admin auth, backend not shipped). Environment coupling was replaced with `AUTH_API_URL`/`TELEGRAM_BOT_USERNAME` injection tokens; `environment.production` became Angular's `isDevMode()`. `AdminPermissionsService` and `requireAdminPermission` stayed in `marketplaces` (`core/admin-auth/`) — they read this app's mock Users domain, not a portable auth concern. All ~30 call sites import from the package; the old in-app auth files are deleted. Build, boundary checks, and 103/103 tests pass.
## 3. Versioning
[Changesets](https://github.com/changesets/changesets) — built for "many packages, one repo, independent versions." A PR that changes `packages/auth` adds a changeset file (`npx changeset` from the vitanovaPackages repo root, picks package + bump type + writes a short description) alongside the code change.
## 4. Publishing (CI)
Two workflows in the vitanovaPackages repo:
- `ci.yml` — on PRs and non-main pushes: install, build, test, and reject the PR if it has no changeset.
- `release.yml` — on push to `main`: install, build, test, then `changesets/action` opens/updates a version-bump PR; merging that PR publishes.
`release.yml` needs repo secrets `NPM_REGISTRY_URL` and `NPM_TOKEN`. **Neither is set, because no CI runner can currently reach the registry** (§2). The workflow fails loudly at the auth step rather than silently skipping the publish — that's deliberate, so a broken release is visible instead of looking green.
Until it's resolved, publish manually through the tunnel:
```bash
npm login --registry=http://127.0.0.1:4873/ --scope=@marketplaces
npm run build
cd packages/auth && npm publish --registry http://127.0.0.1:4873/
```
## 5. Consuming from `marketplaces` (and other projects)
```bash
npm install @marketplaces/auth
```
```ts
import { AuthService, AdminAuthService, adminAuthGuard, ... } from '@marketplaces/auth';
```
Pinned to an exact version (`"0.1.0"`, no `^`/`~`) per ADR-0001's consequence about registry-outage blast radius — bump deliberately, not automatically.
[renovate.json](../renovate.json) at repo root opens a grouped PR whenever either package publishes a new version — review and merge it manually (`automerge: false`).
## 6. Migration cutover
**Auth: done.** `@marketplaces/auth@0.1.0` holds the real implementation — two independent modules, `telegram/` (live Telegram QR/session auth, customer + admin) and `ed25519/` (future challenge/response admin auth, backend not shipped). Environment coupling was replaced with `AUTH_API_URL`/`TELEGRAM_BOT_USERNAME` injection tokens, provided from `app.config.ts`; `environment.production` became Angular's `isDevMode()`. `AdminPermissionsService` and `requireAdminPermission` stayed in `marketplaces` (`core/admin-auth/`) since they read this app's mock Users domain, not a portable auth concern. All ~30 call sites import `@marketplaces/auth`. `npm run build`, `npm run arch:check:boundaries`, and `npm test` (103/103) all pass against the registry-installed package.
**Payment: not started.** `core/finance`/`core/pricing` still live in `marketplaces`, same process as above once prioritized. `@marketplaces/payment@0.1.0` is published (scaffold only) but not yet a `marketplaces` dependency.
**Payment: not started.** `core/finance`/`core/pricing` still live in `marketplaces`. `@marketplaces/payment` is published as an empty scaffold and is not a dependency of anything.

34
docs/PACKAGES-USAGE.md
View File

@@ -4,31 +4,21 @@ How to install and consume the shared packages in `marketplaces` or any other pr
## 1. Install
Both packages live on a private Verdaccio registry on the dev server, **not npmjs**. Two things are needed: a scope mapping and an auth token.
Nothing to set up. The packages are installed straight over git from release branches in [vitanovaPackages](https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git), where the repo root *is* the package:
Scope mapping goes in the project's `.npmrc` (already committed in `marketplaces`):
```
@marketplaces:registry=http://127.0.0.1:4873/
```json
"@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth"
```
The token is per-developer and **never committed**. Open a tunnel to the registry, then log in once:
That is already in `marketplaces`' `package.json`, so a fresh clone plus `npm install` just works — **no npm registry, no auth token, no SSH tunnel, no CI secret.** Anonymous git read is the only requirement.
To add it to another project:
```bash
ssh -L 4873:127.0.0.1:4873 seto@213.21.246.138
npm install "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth"
```
```bash
npm login --registry=http://127.0.0.1:4873/ --scope=@marketplaces
```
Then install normally:
```bash
npm install @marketplaces/auth
```
Versions are pinned exactly (`"@marketplaces/auth": "0.1.0"`, no `^`/`~`) — see [ADR-0001](context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md) on registry-outage blast radius.
**On pinning:** a branch ref tracks the tip, so `npm install` can pick up a new build. That is deliberate while the package churns. For reproducible installs, replace `#release/auth` with a commit SHA. See [ADR-0001](context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md) on blast radius.
## 2. Required providers
@@ -129,8 +119,8 @@ Published at `0.1.0` but **scaffold only** — no implementation yet, nothing ex
1. Clone [vitanovaPackages](https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git).
2. Edit under `packages/auth/src` (or `packages/payment/src`), export from `index.ts`.
3. `npx changeset` at the repo root — pick the package and bump type, write one line about the change.
4. Commit, push, open a PR to `main`.
5. On merge, CI opens a version-bump PR; merging *that* publishes the new version. (Currently blocked — see [PACKAGE-EXTRACTION.md](PACKAGE-EXTRACTION.md) §2/§4 for the registry-reachability follow-up. Until then, publish manually through the tunnel.)
6. In `marketplaces`, bump the pinned version and run the build + test suite before merging.
4. Commit, push, open a PR to `main`. CI builds, tests, and rejects the PR if the changeset is missing.
5. On merge, CI rebuilds and force-pushes `release/auth` / `release/payment`, and opens a "Version Packages" PR if there are unreleased changesets.
6. In `marketplaces`, run `npm update @marketplaces/auth`, then the build + test suite before merging.
Do not edit `node_modules/@marketplaces/*` directly — it is overwritten on every install.
Never commit to a `release/*` branch — they are generated and force-pushed. Never edit `node_modules/@marketplaces/*` — overwritten on every install.

44
docs/backend/BACKEND-HANDOFF.md
View File

@@ -6,6 +6,21 @@ Single entry point for a backend developer picking this up cold. Written 2026-08
`marketplaces` is a multi-tenant marketplace platform frontend (Angular 22). The frontend is built and waiting; **there is no backend yet**. Every wire contract the backend needs to implement is already written and sitting in this directory — see [README.md](README.md) for the full index and build order.
## 1a. Multi-tenancy — the thing that shapes every endpoint
One deployed bundle serves **every customer domain**. There is no per-tenant build. The chain is:
1. [`TenantResolverService`](../../src/app/core/config/tenant-resolver.service.ts) derives a `tenantKey` from `window.location.hostname` (first label; `www.` skipped; localhost falls back to a configured key).
2. [`ApiConfigService`](../../src/app/core/config/api-config.service.ts) turns that key into the API base URL — via an explicit per-tenant map or a `{tenant}` URL template.
3. `ApiBootstrapProvider` fetches that tenant's **bootstrap config**, which drives branding, theme, locales, currencies, navigation, footer, and which pages exist.
4. nginx is `default_server` / `server_name _`, so any domain pointed at the server IP gets the same bundle and self-resolves.
**What this means for you:** the bootstrap endpoint is the single most important thing to build after auth. Every request must be tenant-scoped server-side, and a tenant must never be able to read another tenant's data — return `403`, not an empty result (see [TRACK-S §2](TRACK-S-SECURITY-RBAC-CONTRACT.md)). The frontend supplies the tenant identity from the hostname; the backend must treat that as an untrusted hint and derive real scope from the authenticated session.
Constraints already fixed by the frontend design (see the platform-vision facts in `docs/context/`): no marketplace-specific code or hardcoded marketplace data in the frontend; bootstrap carries only what is needed before app start (branding, languages, homepage layout, navigation, enabled widgets, footer pages) and **never** products, orders, cart, or users.
[PHASE-9](PHASE-9-TENANT-REGISTRY-DOMAINS-CONTRACT.md) covers the marketplace registry, domain attachment, and publish/revision model.
## 2. Read in this order
1. [README.md](README.md) — index of all contracts, build order, and what's deliberately excluded.
@@ -40,26 +55,37 @@ Dev server `213.21.246.138` (user `seto`, sudo, SSH key provided separately).
| Go toolchain | Installed (`/usr/local/bin/go`). |
| Backend service on :8080 | **Not running.** Nothing is listening. `/srv/marketplaces/current/api` is an empty shell. nginx's `/api/` proxy currently 502s. |
| PostgreSQL | **Installed but inactive.** Needs starting, a database, a user, and schema before anything works. |
| Verdaccio (npm registry) | Running in Docker, port 4873, storage `/srv/marketplaces/verdaccio/`. Hosts `@marketplaces/auth@0.1.0` and `@marketplaces/payment@0.1.0`. **Only reachable from the server itself or via SSH tunnel** — the firewall allows 80/443/SSH only. |
| Shared packages | `@marketplaces/auth` installs over plain git from a release branch — no registry, token, or tunnel needed. `npm install` works out of the box. |
| Verdaccio (npm registry) | Running in Docker on port 4873, but **superseded and unused** — nothing depends on it. See [../PACKAGE-EXTRACTION.md](../PACKAGE-EXTRACTION.md) §5. |
| Firewall (ufw) | Active. 80/tcp, 443/tcp, OpenSSH. |
| TLS / certbot | **Not installed.** No certificates. Everything is plain HTTP today. |
| DNS / dynamic subdomains | **Not set up.** The server has no domain pointed at it (reverse DNS is the provider default `silky-bronze.ptr.network`). There is no wildcard record, no per-tenant subdomain automation, and no Hostinger DNS integration. [PHASE-9](PHASE-9-TENANT-REGISTRY-DOMAINS-CONTRACT.md) specifies what this should become — none of it exists yet. |
| CI runner | None on this server. `sources.vitanova.network` CI runs elsewhere and currently cannot reach the Verdaccio registry. |
| TLS / certbot | **Not installed.** No certificates. Everything is plain HTTP today. For multi-tenant this is real work: every customer domain needs a certificate (per-domain issuance, or a wildcard if all tenants sit under one apex). |
| DNS / dynamic subdomains | **Not set up.** No domain currently points at the server (reverse DNS is the provider default `silky-bronze.ptr.network`). No wildcard record, no per-tenant subdomain automation, no Hostinger DNS integration. The *application* is fully multi-tenant (§1a) — this is the missing infrastructure underneath it. [PHASE-9](PHASE-9-TENANT-REGISTRY-DOMAINS-CONTRACT.md) specifies the target. |
| Frontend deploy (CD) | **None.** Pushing to `main` deploys nothing. `architecture-governance.yml` builds and checks boundaries but has no deploy step, and nothing writes to `/srv/marketplaces/current/frontend`. Deploys are manual today. |
| CI runner | None on this server; `sources.vitanova.network` CI runs elsewhere. |
## 5. To get a working dev environment
Nothing here is done yet — this is the setup a backend dev does on day one.
1. Start and configure PostgreSQL; create the database and application user.
2. Design the schema from the Phase 1–4 contracts (schema design is explicitly the backend's own call — the contracts specify entities, endpoints, and invariants, never tables).
2. Design the schema from the Phase 1–4 contracts (schema design is explicitly the backend's own call — the contracts specify entities, endpoints, and invariants, never tables). Tenant scoping belongs in the schema from day one; retrofitting it is painful.
3. Build the API service, listen on `127.0.0.1:8080`. nginx already proxies `/api/` to it.
4. Implement the Telegram session endpoints first — the frontend's login flow is fully built and blocked only on these.
5. Implement `GET /api/identity/v1/session/permissions` ([TRACK-S §2](TRACK-S-SECURITY-RBAC-CONTRACT.md)) — frontend route guards derive from it.
6. Seed per-marketplace bootstrap admins ([TRACK-S §8](TRACK-S-SECURITY-RBAC-CONTRACT.md)): login = marketplace slug, password = `{slug}2026$`, `mustChangePassword: true`.
4. Implement the **bootstrap config endpoint** (§1a) — without it the frontend cannot render for any tenant.
5. Implement the Telegram session endpoints — the login flow is fully built client-side and blocked only on these.
6. Implement `GET /api/identity/v1/session/permissions` ([TRACK-S §2](TRACK-S-SECURITY-RBAC-CONTRACT.md)) — frontend route guards derive from it.
7. Seed per-marketplace bootstrap admins ([TRACK-S §8](TRACK-S-SECURITY-RBAC-CONTRACT.md)): login = marketplace slug, password = `{slug}2026$`, `mustChangePassword: true`.
Steps 4–6 unblock the entire frontend. Everything after is feature work.
## 6. Frontend deploy
The frontend builds with `npm run build` (Angular 22, Node 20+). Output goes to `dist/dexarmarket`, which is what nginx serves from `/srv/marketplaces/current/frontend`. Building it requires registry access for `@marketplaces/auth` — see [../PACKAGES-USAGE.md](../PACKAGES-USAGE.md) §1. **A fresh `npm install` on a machine without a registry token will fail.** That is the first thing to fix for anyone new joining.
```bash
git clone <marketplaces repo>
npm install # pulls @marketplaces/auth over git, no credentials needed
npm run build # -> dist/dexarmarket
```
Angular 22, Node 20+. nginx serves `/srv/marketplaces/current/frontend`, so deploying means copying `dist/dexarmarket` there — **manually, today.** There is no CD pipeline. Because of the multi-tenant design (§1a), one such deploy updates every domain at once.
## 7. Known open decisions

10
docs/context/adrs/ADR-0001-extract-auth-and-payment-into-shared-marketplaces-packages.md
View File

@@ -30,9 +30,17 @@ Each package:
Rollout order: scaffold packages and CI in this repo first (reversible, local-only) → hand over target git repo → publish → migrate `marketplaces` call sites to import from the package → delete the in-repo originals only after the app builds and passes tests against the package.
## Amendment 2026-08-18 — distribution mechanism
The original decision left distribution open ("private registry ... or installed straight from git"). A private Verdaccio registry was stood up on the dev server and both packages published to it. **That approach was then abandoned**: the registry listens on `127.0.0.1:4873` behind a firewall allowing only 80/443/SSH, so neither CI runners nor developers could install without an SSH tunnel. That broke `marketplaces`' existing `architecture-governance` workflow, whose `npm ci` step could no longer resolve `@marketplaces/auth`.
Distribution is now **git release branches**: `release/auth` and `release/payment` in vitanovaPackages, each an orphan branch whose root *is* the package (`package.json` + built `dist/`), force-pushed by CI on every release. Consumers install with `git+<repo>#release/auth` — no registry, no token, no tunnel, no CI secret; anonymous git read suffices.
The Verdaccio instance still runs but nothing depends on it. Making a registry the primary path again would require a reverse proxy plus TLS on the dev server, which buys nothing over the current approach at this scale.
## Consequences
- `marketplaces` loses direct edit access to auth/payment source — changes go through the package's own repo/PR/release cycle. Slower iteration, but consistent behavior across all consuming projects.
- ~30 call sites in `marketplaces` (see `core/auth`, `core/admin-auth`, `services/auth.service.ts`, interceptors) need import rewiring during migration — tracked as follow-up work, not done in this ADR.
- New failure mode: package registry/CI outage blocks `marketplaces` builds if a version bump lands mid-incident. Pin exact versions, do not use floating ranges, to keep this bounded.
- New failure mode: `marketplaces` builds now depend on `sources.vitanova.network` being reachable. A branch ref also tracks its tip, so an install can pick up a new build — acceptable while the package churns, but pin to a commit SHA once it stabilises.
- [TRACK-S-SECURITY-RBAC-CONTRACT.md](../../backend/TRACK-S-SECURITY-RBAC-CONTRACT.md) §8 (admin provisioning) becomes package-owned behavior once migrated — that doc's endpoint contracts stay backend-side and unaffected, only the frontend client implementation moves.

6
package-lock.json generated
View File

@@ -17,7 +17,7 @@
"@angular/platform-browser": "22.0.8",
"@angular/router": "22.0.8",
"@angular/service-worker": "22.0.8",
"@marketplaces/auth": "0.1.0",
"@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth",
"rxjs": "~7.8.0",
"tslib": "^2.8.0",
"zone.js": "~0.16.0"
@@ -1808,12 +1808,12 @@
},
"node_modules/@marketplaces/auth": {
"version": "0.1.0",
"resolved": "http://127.0.0.1:4873/@marketplaces/auth/-/auth-0.1.0.tgz",
"integrity": "sha512-BPd1xIDlSFhqtT3utDXT4cIj9HIbcRxodqvzVqjE0l5VkZ3TRC6anjTEiwRCjvCyaopWyyjFcuVj2fQPPZDxdg==",
"resolved": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#93f99cc7b19f88112337e7a6544c1c09d9904744",
"license": "UNLICENSED",
"peerDependencies": {
"@angular/common": ">=22.0.0",
"@angular/core": ">=22.0.0",
"@angular/router": ">=22.0.0",
"rxjs": ">=7.8.0"
}
},

2
package.json
View File

@@ -22,7 +22,7 @@
},
"private": true,
"dependencies": {
"@marketplaces/auth": "0.1.0",
"@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth",
"@angular/animations": "22.0.8",
"@angular/cdk": "22.0.6",
"@angular/common": "22.0.8",