@astram/identity 0.13.0 → 0.15.0

package/dist/features/org-bootstrap/org-state.reader.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgStateReader = void 0;
+/**
+ * G-009 T9: the read-only org state reader.
+ *
+ * Issues SELECTs only, every name bound as a parameter, database names taken from the injected
+ * `schemas` (never a literal). Scope: the file's tenants' subtrees (top-level companies matched by name,
+ * then `scope_closure`), plus the global lookups the planner's conflicts need (roles by name and the
+ * tenant that owns them, usernames, emails, credential state). The row-to-state mapping is proven live.
+ * A query failure propagates: a partial state is never returned.
+ */
+const guard_1 = require("@astram/guard");
+const org_names_js_1 = require("./org-names.js");
+/** `?, ?, ?`; an empty list reads as `NULL` so the clause stays valid SQL and matches nothing. */
+const marks = (n) => n === 0 ? 'NULL' : Array.from({ length: n }, () => '?').join(', ');
+const str = (v) => (v === null || v === undefined ? '' : String(v));
+const strOrNull = (v) => (v === null || v === undefined ? null : String(v));
+function collect(file) {
+    const names = {
+        tenants: [],
+        roles: new Set(),
+        departments: new Set(),
+        branches: new Set(),
+        usernames: new Set(),
+        emails: new Set(),
+    };
+    const walk = (c) => {
+        for (const d of c.departments ?? [])
+            names.departments.add(d);
+        for (const b of c.branches ?? [])
+            names.branches.add(b);
+        for (const r of c.roles ?? [])
+            names.roles.add(r.name);
+        for (const u of c.users ?? []) {
+            names.usernames.add(u.username);
+            names.emails.add(u.email);
+        }
+        for (const ch of c.children ?? [])
+            walk(ch);
+    };
+    for (const t of file.tenants) {
+        names.tenants.push(t.name);
+        walk(t);
+    }
+    for (const r of file.roots) {
+        names.usernames.add(r.username);
+        names.emails.add(r.email);
+    }
+    return {
+        tenants: names.tenants,
+        roles: [...names.roles],
+        departments: [...names.departments],
+        branches: [...names.branches],
+        usernames: [...names.usernames],
+        emails: [...names.emails],
+    };
+}
+class OrgStateReader {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async read(file) {
+        const { query, schemas } = this.opts;
+        const app = `\`${schemas.app}\``;
+        const authz = `\`${schemas.authz}\``;
+        const identity = `\`${schemas.identity}\``;
+        const names = collect(file);
+        // 1. the file's top-level tenants, by name (the column collation does the matching)
+        const tenantRows = await query(`SELECT c_uuid, c_name FROM ${app}.companies WHERE c_parent_uuid IS NULL AND c_name IN (${marks(names.tenants.length)})`, names.tenants);
+        const tenantUuids = tenantRows.map((r) => str(r.c_uuid));
+        // 2. their subtrees, through scope_closure
+        const subtreeRows = await query(`SELECT c.c_uuid, c.c_name, c.c_parent_uuid FROM ${authz}.scope_closure sc ` +
+            `JOIN ${app}.companies c ON c.c_uuid = sc.descendant_uuid WHERE sc.ancestor_uuid IN (${marks(tenantUuids.length)})`, tenantUuids);
+        const byUuid = new Map(subtreeRows.map((r) => [str(r.c_uuid), r]));
+        const pathOf = (uuid) => {
+            const segs = [];
+            const seen = new Set();
+            for (let r = byUuid.get(uuid); r && !seen.has(str(r.c_uuid)); r = byUuid.get(str(r.c_parent_uuid))) {
+                seen.add(str(r.c_uuid));
+                segs.unshift(str(r.c_name));
+            }
+            return segs.join('/');
+        };
+        const subtreeUuids = [...byUuid.keys()];
+        // R1-3: a name matching several top-level companies, or several children of one parent, is
+        // reported (the planner refuses); the run never picks one.
+        const ambiguousCompanies = [];
+        const markAmbiguous = (rows, groupOf, pathFor) => {
+            const groups = new Map();
+            for (const r of rows) {
+                const key = groupOf(r);
+                groups.set(key, [...(groups.get(key) ?? []), r]);
+            }
+            for (const group of groups.values()) {
+                if (group.length > 1)
+                    ambiguousCompanies.push(pathFor(group[0]));
+            }
+        };
+        markAmbiguous(tenantRows, (r) => (0, org_names_js_1.nameKey)(str(r.c_name)), (r) => str(r.c_name));
+        markAmbiguous(subtreeRows.filter((r) => r.c_parent_uuid !== null && r.c_parent_uuid !== undefined), (r) => `${str(r.c_parent_uuid)}\u0000${(0, org_names_js_1.nameKey)(str(r.c_name))}`, (r) => pathOf(str(r.c_uuid)));
+        // 3. catalogs and the company junctions
+        const deptCatalog = await query(`SELECT d_name FROM ${app}.departments WHERE d_name IN (${marks(names.departments.length)})`, names.departments);
+        const branchCatalog = await query(`SELECT b_name FROM ${app}.branches WHERE b_name IN (${marks(names.branches.length)})`, names.branches);
+        const deptJunction = await query(`SELECT cd.cd_company_uuid, d.d_name FROM ${app}.company_departments cd ` +
+            `JOIN ${app}.departments d ON d.d_uuid = cd.cd_department_uuid WHERE cd.cd_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
+        const branchJunction = await query(`SELECT cb.cb_company_uuid, b.b_name FROM ${app}.company_branches cb ` +
+            `JOIN ${app}.branches b ON b.b_uuid = cb.cb_branch_uuid WHERE cb.cb_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
+        const companies = new Map();
+        for (const uuid of subtreeUuids) {
+            companies.set(uuid, { path: pathOf(uuid), departments: [], branches: [] });
+        }
+        for (const r of deptJunction)
+            companies.get(str(r.cd_company_uuid))?.departments.push(str(r.d_name));
+        for (const r of branchJunction)
+            companies.get(str(r.cb_company_uuid))?.branches.push(str(r.b_name));
+        // 4. roles by name or owned in the subtrees; owner's top-level tenant; held outside the subtrees
+        const roleRows = await query(`SELECT r.r_uuid, r.r_name, r.r_owner_company_uuid, t.c_name AS owner_tenant, ` +
+            `EXISTS (SELECT 1 FROM ${app}.membership_posting mp JOIN ${app}.company_membership cm ON cm.cm_uuid = mp.mp_membership_uuid ` +
+            `WHERE mp.mp_role_uuid = r.r_uuid AND cm.cm_company_uuid NOT IN (` +
+            `SELECT sc2.descendant_uuid FROM ${authz}.scope_closure sc2 WHERE sc2.ancestor_uuid IN (${marks(tenantUuids.length)}))) AS held_outside ` +
+            `FROM ${app}.roles r ` +
+            `LEFT JOIN ${authz}.scope_closure oc ON oc.descendant_uuid = r.r_owner_company_uuid ` +
+            `LEFT JOIN ${app}.companies t ON t.c_uuid = oc.ancestor_uuid AND t.c_parent_uuid IS NULL ` +
+            `WHERE r.r_name IN (${marks(names.roles.length)}) OR r.r_owner_company_uuid IN (${marks(subtreeUuids.length)})`, [...tenantUuids, ...names.roles, ...subtreeUuids]);
+        const roleUuids = roleRows.map((r) => str(r.r_uuid));
+        const grantRows = await query(`SELECT rp_role_uuid, rp_perm_key FROM ${authz}.role_permission WHERE rp_role_uuid IN (${marks(roleUuids.length)})`, roleUuids);
+        const grants = new Map();
+        for (const g of grantRows) {
+            const list = grants.get(str(g.rp_role_uuid)) ?? [];
+            list.push(str(g.rp_perm_key));
+            grants.set(str(g.rp_role_uuid), list);
+        }
+        const roles = [];
+        for (const r of roleRows) {
+            if (roles.some((x) => x.name === str(r.r_name)))
+                continue; // duplicate rows from closure joins
+            roles.push({
+                name: str(r.r_name),
+                ownerTenant: strOrNull(r.owner_tenant),
+                heldOutside: Number(r.held_outside) === 1,
+                permissions: grants.get(str(r.r_uuid)) ?? [],
+            });
+        }
+        // 5. users (by username, or a member of the subtrees) with their credential
+        const userRows = await query(`SELECT u.u_uuid, u.u_username, u.u_email, u.u_is_platform_superuser, ic.ic_password_hash ` +
+            `FROM ${app}.users u LEFT JOIN ${identity}.identity_credential ic ON ic.ic_principal_id = u.u_uuid ` +
+            `WHERE u.u_username IN (${marks(names.usernames.length)}) ` +
+            `OR u.u_uuid IN (SELECT cm_user_uuid FROM ${app}.company_membership WHERE cm_company_uuid IN (${marks(subtreeUuids.length)}))`, [...names.usernames, ...subtreeUuids]);
+        // R1-1: usernames are global, so say which of those users also belong somewhere outside the file's
+        // tenants (another tenant's account); the planner refuses to adopt them.
+        const userUuids = [...new Set(userRows.map((u) => str(u.u_uuid)))];
+        const outsideRows = await query(`SELECT DISTINCT cm_user_uuid FROM ${app}.company_membership ` +
+            `WHERE cm_user_uuid IN (${marks(userUuids.length)}) AND cm_company_uuid NOT IN (` +
+            `SELECT sc3.descendant_uuid FROM ${authz}.scope_closure sc3 WHERE sc3.ancestor_uuid IN (${marks(tenantUuids.length)}))`, [...userUuids, ...tenantUuids]);
+        const outsideUsers = new Set(outsideRows.map((r) => str(r.cm_user_uuid)));
+        const emailRows = await query(`SELECT u_email, u_username FROM ${app}.users WHERE u_email IN (${marks(names.emails.length)})`, names.emails);
+        // 6. memberships and postings inside the subtrees
+        const memberRows = await query(`SELECT cm_uuid, cm_user_uuid, cm_company_uuid, cm_is_active FROM ${app}.company_membership ` +
+            `WHERE cm_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
+        const postingRows = await query(`SELECT mp.mp_membership_uuid, r.r_name, d.d_name, b.b_name FROM ${app}.membership_posting mp ` +
+            `JOIN ${app}.company_membership cm ON cm.cm_uuid = mp.mp_membership_uuid ` +
+            `JOIN ${app}.roles r ON r.r_uuid = mp.mp_role_uuid ` +
+            `LEFT JOIN ${app}.departments d ON d.d_uuid = mp.mp_department_uuid ` +
+            `LEFT JOIN ${app}.branches b ON b.b_uuid = mp.mp_branch_uuid ` +
+            `WHERE cm.cm_company_uuid IN (${marks(subtreeUuids.length)})`, subtreeUuids);
+        const postings = new Map();
+        for (const p of postingRows) {
+            const posting = { role: str(p.r_name) };
+            if (p.d_name !== null && p.d_name !== undefined)
+                posting.department = str(p.d_name);
+            if (p.b_name !== null && p.b_name !== undefined)
+                posting.branch = str(p.b_name);
+            const list = postings.get(str(p.mp_membership_uuid)) ?? [];
+            list.push(posting);
+            postings.set(str(p.mp_membership_uuid), list);
+        }
+        const memberships = new Map();
+        for (const m of memberRows) {
+            const list = memberships.get(str(m.cm_user_uuid)) ?? [];
+            list.push({
+                companyPath: pathOf(str(m.cm_company_uuid)),
+                active: Number(m.cm_is_active) === 1,
+                postings: postings.get(str(m.cm_uuid)) ?? [],
+            });
+            memberships.set(str(m.cm_user_uuid), list);
+        }
+        const rank = { none: 0, locked: 1, usable: 2 };
+        const users = new Map();
+        for (const u of userRows) {
+            const hash = u.ic_password_hash;
+            const credential = hash === null || hash === undefined
+                ? 'none'
+                : (0, guard_1.isLockedHash)(str(hash))
+                    ? 'locked'
+                    : 'usable';
+            const id = str(u.u_uuid);
+            const prior = users.get(id);
+            if (prior) {
+                if (rank[credential] > rank[prior.credential])
+                    prior.credential = credential;
+                continue;
+            }
+            users.set(id, {
+                username: str(u.u_username),
+                email: str(u.u_email),
+                credential,
+                isPlatformSuperuser: Number(u.u_is_platform_superuser) === 1,
+                memberships: memberships.get(id) ?? [],
+                membershipsOutside: outsideUsers.has(id),
+            });
+        }
+        return {
+            companies: [...companies.values()],
+            departments: deptCatalog.map((r) => str(r.d_name)),
+            branches: branchCatalog.map((r) => str(r.b_name)),
+            roles,
+            users: [...users.values()],
+            emailHolders: emailRows.map((r) => ({ email: str(r.u_email), username: str(r.u_username) })),
+            ambiguousCompanies,
+        };
+    }
+}
+exports.OrgStateReader = OrgStateReader;

package/dist/features/org-bootstrap/root-password-source.d.ts

@@ -0,0 +1,9 @@
+export declare const rootPasswordVariable: (username: string) => string;
+/**
+ * Two roots whose names fold to one variable (`a.b`, `a_b`) would share a password: refused before
+ * any write. The refusal names the variable only.
+ */
+export declare function assertDistinctRootPasswordVariables(usernames: readonly string[]): void;
+/** The password of every listed root, or a refusal before anything is written. */
+export declare function resolveRootPasswords(usernames: readonly string[], env: NodeJS.ProcessEnv, prompt: ((username: string) => Promise<string>) | undefined): Promise<Map<string, string>>;
+//# sourceMappingURL=root-password-source.d.ts.map

package/dist/features/org-bootstrap/root-password-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-password-source.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/root-password-source.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,oBAAoB,GAAI,UAAU,MAAM,KAAG,MACgC,CAAC;AAEzF;;;GAGG;AACH,wBAAgB,mCAAmC,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAYtF;AAED,kFAAkF;AAClF,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,GAC1D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiC9B"}

package/dist/features/org-bootstrap/root-password-source.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rootPasswordVariable = void 0;
+exports.assertDistinctRootPasswordVariables = assertDistinctRootPasswordVariables;
+exports.resolveRootPasswords = resolveRootPasswords;
+/**
+ * Where a root's first password comes from (G-009 R7): `ASTRAM_BOOTSTRAP_ROOT_PASSWORD_<USERNAME>`,
+ * which outside development/test must have been resolved from a `secret-ref:` value, or an
+ * interactive prompt the caller supplies. A password is never echoed: every error names only the
+ * variable.
+ */
+const guard_1 = require("@astram/guard");
+const org_bootstrap_error_js_1 = require("./org-bootstrap-error.js");
+const MIN_PASSWORD_LENGTH = 8;
+const rootPasswordVariable = (username) => `ASTRAM_BOOTSTRAP_ROOT_PASSWORD_${username.toUpperCase().replace(/[^A-Z0-9]/gu, '_')}`;
+exports.rootPasswordVariable = rootPasswordVariable;
+/**
+ * Two roots whose names fold to one variable (`a.b`, `a_b`) would share a password: refused before
+ * any write. The refusal names the variable only.
+ */
+function assertDistinctRootPasswordVariables(usernames) {
+    const seen = new Set();
+    for (const username of usernames) {
+        const variable = (0, exports.rootPasswordVariable)(username);
+        if (seen.has(variable)) {
+            throw new org_bootstrap_error_js_1.OrgBootstrapError('root_password_collision', `Two roots map to the same password variable ${variable}; rename one so each root has its own.`);
+        }
+        seen.add(variable);
+    }
+}
+/** The password of every listed root, or a refusal before anything is written. */
+async function resolveRootPasswords(usernames, env, prompt) {
+    const passwords = new Map();
+    const devOrTest = (0, guard_1.isDevOrTestNodeEnv)(env.NODE_ENV);
+    for (const username of usernames) {
+        const variable = (0, exports.rootPasswordVariable)(username);
+        let password;
+        if (prompt !== undefined) {
+            password = await prompt(username);
+        }
+        else {
+            const value = env[variable];
+            if (value === undefined || value === '') {
+                throw new org_bootstrap_error_js_1.OrgBootstrapError('root_password_missing', `No password source for root "${username}": set ${variable} (a secret-ref value outside development/test) or run interactively.`);
+            }
+            if (!devOrTest && !(0, guard_1.wasResolvedFromSecretRef)(variable, env)) {
+                throw new org_bootstrap_error_js_1.OrgBootstrapError('root_password_literal', `${variable} must be a secret-ref value resolved at boot outside development/test; a literal password is refused.`);
+            }
+            password = value;
+        }
+        if ([...password].length < MIN_PASSWORD_LENGTH) {
+            throw new org_bootstrap_error_js_1.OrgBootstrapError('root_password_weak', `The password for root "${username}" must be at least ${MIN_PASSWORD_LENGTH} characters.`);
+        }
+        passwords.set(username, password);
+    }
+    return passwords;
+}

package/dist/features/org-bootstrap/run-org-bootstrap.d.ts

@@ -0,0 +1,61 @@
+import type { INestApplicationContext } from '@nestjs/common';
+import { type OrgBootstrapWritten } from './org-bootstrap-error.js';
+import { type OrgPlan } from './org-bootstrap-plan.js';
+export { OrgBootstrapError } from './org-bootstrap-error.js';
+export type { OrgBootstrapErrorCode, OrgBootstrapWritten } from './org-bootstrap-error.js';
+export interface RunOrgBootstrapOptions {
+    /** Path of a JSON file, or the already parsed object. */
+    file: string | object;
+    /** Write. Without it the run is a dry run: it prints the plan and writes nothing. */
+    apply?: boolean;
+    /** The human operator (audit `onBehalfOf`); else `ASTRAM_BOOTSTRAP_OPERATOR`. Required with `apply`. */
+    operator?: string;
+    env?: NodeJS.ProcessEnv;
+    /** Claim roles that have no owner and that nobody outside the file's tenants holds. */
+    claimUnownedRoles?: boolean;
+    /** Issue a fresh set-password link to users whose credential is still locked. */
+    reissueLinks?: boolean;
+    /** Link lifetime in whole hours, 1 to 168 (default 72). */
+    linkTtlHours?: number;
+    /** Print links although stdout is not a terminal. */
+    linksToStdout?: boolean;
+    /**
+     * G-010 R12: email each link through the message dispatcher (purpose `invite`) instead of printing
+     * it. Needs a bound dispatcher with mail on (`ShieldModule.forRoot({ emailSender })`), else the run
+     * is refused before any write. A link that cannot be sent is killed and not printed. ROOT links
+     * are never emailed (a root link is a platform takeover): they print under the G-009 rule (a
+     * terminal, or `linksToStdout`), else they are not issued and are reported as not delivered.
+     */
+    emailLinks?: boolean;
+    isTTY?: boolean;
+    /** Seconds to wait for the run lock (default 30). */
+    lockTimeoutSeconds?: number;
+    /** Line writer for the plan, links and root ids (default: stdout). */
+    out?: (line: string) => void;
+    /** Interactive root password source; replaces `ASTRAM_BOOTSTRAP_ROOT_PASSWORD_<USERNAME>`. */
+    promptRootPassword?: (username: string) => Promise<string>;
+}
+/** Never contains a link, a token or a password. */
+export interface OrgBootstrapReport {
+    applied: boolean;
+    plan: OrgPlan;
+    /** Plan entries of each kind this run created. */
+    written: OrgBootstrapWritten;
+    /** Set-password links issued. */
+    links: number;
+    /**
+     * With `emailLinks`: links emailed, and links not delivered (a failed send, killed; or a root
+     * link with no terminal to print it on, never issued). Nothing undelivered is printed.
+     */
+    linksEmailed: number;
+    linksNotEmailed: number;
+    /**
+     * With `emailLinks`: root links printed to the terminal instead. A root link is a platform
+     * takeover, so it is never emailed; it follows the G-009 print rule.
+     */
+    linksPrintedRoots: number;
+    /** Uuid of every root in the file that exists after the run. */
+    rootIds: string[];
+}
+export declare function runOrgBootstrap(app: INestApplicationContext, opts: RunOrgBootstrapOptions): Promise<OrgBootstrapReport>;
+//# sourceMappingURL=run-org-bootstrap.d.ts.map

package/dist/features/org-bootstrap/run-org-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-org-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/features/org-bootstrap/run-org-bootstrap.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,uBAAuB,EAAQ,MAAM,gBAAgB,CAAC;AA+BpE,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAEL,KAAK,OAAO,EAIb,MAAM,yBAAyB,CAAC;AAiBjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wGAAwG;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,uFAAuF;IACvF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iFAAiF;IACjF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,8FAA8F;IAC9F,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAwFD,wBAAsB,eAAe,CACnC,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAqtB7B"}