@bussolabs/closeyourit-cli 0.2.1 → 0.4.0

package/README.md

@@ -81,6 +81,9 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `errors resolve\|reopen\|mute\|unmute <id> --project <id\|key>` | Triage an error group. |
 | `tokens list --project <id\|key>` | List ingest tokens. |
 | `tokens create --project <id\|key> --name <name> --environment-id <id>` | Create a token (secret shown once). |
+| `tokens provision --project <id\|key> --name <name> --environment-id <code\|id> --to-project <id\|key> --to-environment-id <code\|id> --secret-name <NAME>` | Generate and deliver a token without revealing its value. GitHub sync is enabled by default; use `--no-sync-github` for vault-only delivery. |
+| `tokens provisions show <id> --project <id\|key>` | Show secret-free provisioning status. |
+| `tokens provisions retry <id> --project <id\|key>` | Retry GitHub sync without regenerating or revealing the token. |
 | `tokens rotate <id> --project <id\|key>` | Rotate a token (new secret shown once). |
 | `tokens revoke <id> --project <id\|key>` | Revoke a token. |
 | `secrets assets list --project <id\|key>` | List encrypted secret-file metadata (never contents). |

package/dist/commands/personal/delete.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class PersonalDelete extends BaseCommand {
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/delete.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalDelete extends base_1.BaseCommand {
+    static args = {
+        name: core_1.Args.string({ description: 'Secret name', required: true }),
+    };
+    static description = 'Delete a personal secret from the current organization';
+    static examples = ['<%= config.bin %> personal delete API_KEY'];
+    async run() {
+        const { args } = await this.parse(PersonalDelete);
+        const name = args.name.toUpperCase();
+        await this.api.delete(`/cli/v1/personal_secrets/${encodeURIComponent(name)}`);
+        if (!this.jsonEnabled()) {
+            this.log(`Personal secret ${name} deleted.`);
+        }
+        return { deleted: name };
+    }
+}
+exports.default = PersonalDelete;

package/dist/commands/personal/download.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class PersonalDownload extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        out: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/download.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalDownload extends base_1.BaseCommand {
+    static description = 'Download all your personal secrets as .env or JSON (to a file or stdout). Values with newlines: use --format json. Prefer `cyi personal run` to avoid writing plaintext to disk.';
+    static examples = [
+        '<%= config.bin %> personal download --out .env',
+        '<%= config.bin %> personal download --format json',
+    ];
+    static flags = {
+        format: core_1.Flags.string({ default: 'env', description: 'Output format', options: ['env', 'json'] }),
+        out: core_1.Flags.string({ description: 'Write to this file instead of stdout' }),
+    };
+    async run() {
+        const { flags } = await this.parse(PersonalDownload);
+        const res = await this.api.get('/cli/v1/personal_secrets/bundle');
+        const map = res.data ?? {};
+        const body = flags.format === 'json'
+            ? JSON.stringify(map, null, 2)
+            : Object.entries(map)
+                .map(([key, value]) => `${key}=${value}`)
+                .join('\n');
+        if (flags.out) {
+            await (0, promises_1.writeFile)(flags.out, `${body}\n`);
+            if (!this.jsonEnabled()) {
+                this.log(`Wrote ${Object.keys(map).length} personal secrets → ${flags.out}`);
+                this.warn('The file contains plaintext secrets. Prefer `cyi personal run` to inject them without touching disk.');
+            }
+        }
+        else if (!this.jsonEnabled()) {
+            this.log(body);
+        }
+        return { count: Object.keys(map).length, format: flags.format, out: flags.out ?? null };
+    }
+}
+exports.default = PersonalDownload;

package/dist/commands/personal/get.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class PersonalGet extends BaseCommand {
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/get.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalGet extends base_1.BaseCommand {
+    static args = {
+        name: core_1.Args.string({ description: 'Secret name', required: true }),
+    };
+    static description = 'Print the value of a single personal secret (pipeable).';
+    static examples = ['<%= config.bin %> personal get OPENAI_API_KEY'];
+    async run() {
+        const { args } = await this.parse(PersonalGet);
+        const res = await this.api.get('/cli/v1/personal_secrets/bundle');
+        const map = res.data ?? {};
+        const key = args.name.toUpperCase();
+        if (!(key in map)) {
+            this.error(`Personal secret not found: ${key}`, { exit: 1 });
+        }
+        if (!this.jsonEnabled()) {
+            this.log(map[key]);
+        }
+        return { name: key, value: map[key] };
+    }
+}
+exports.default = PersonalGet;

package/dist/commands/personal/import.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class PersonalImport extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'from-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/import.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const stdin_1 = require("../../lib/stdin");
+// Reuse the exact env/JSON parsers from the project-secrets twin so the two vaults never diverge.
+const import_1 = require("../secrets/import");
+class PersonalImport extends base_1.BaseCommand {
+    static description = 'Import many personal secrets at once (all-or-nothing) from a .env or JSON file';
+    static examples = [
+        '<%= config.bin %> personal import --from-file .env',
+        '<%= config.bin %> personal import --format json --from-file secrets.json',
+        'doppler secrets download --no-file --format json | <%= config.bin %> personal import --format json',
+    ];
+    static flags = {
+        'from-file': core_1.Flags.string({ description: 'Path to a .env or JSON file (default: read from stdin)' }),
+        format: core_1.Flags.string({ default: 'env', description: 'Input format', options: ['env', 'json'] }),
+    };
+    async run() {
+        const { flags } = await this.parse(PersonalImport);
+        let text;
+        if (flags['from-file']) {
+            text = await (0, promises_1.readFile)(flags['from-file'], 'utf8');
+        }
+        else {
+            if (process.stdin.isTTY) {
+                this.error('Provide --from-file or pipe the input via stdin (e.g. `doppler secrets download --format json | cyi personal import --format json`)', { exit: 1 });
+            }
+            text = await (0, stdin_1.readStream)();
+        }
+        const variables = flags.format === 'json' ? (0, import_1.parseJson)(text) : (0, import_1.parseEnv)(text);
+        if (variables.length === 0) {
+            this.error('No variables found in the input', { exit: 1 });
+        }
+        const res = await this.api.post('/cli/v1/personal_secrets/import', { variables });
+        if (!this.jsonEnabled()) {
+            this.log(`Imported ${res.data?.imported ?? variables.length} personal secrets.`);
+        }
+        return res;
+    }
+}
+exports.default = PersonalImport;

package/dist/commands/personal/list.d.ts

@@ -0,0 +1,6 @@
+import { BaseCommand } from '../../base';
+export default class PersonalList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/list.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class PersonalList extends base_1.BaseCommand {
+    static description = 'List your personal secret names for the current organization. Never prints values.';
+    static examples = ['<%= config.bin %> personal list', '<%= config.bin %> personal list --json'];
+    async run() {
+        await this.parse(PersonalList);
+        const res = await this.api.get('/cli/v1/personal_secrets');
+        if (!this.jsonEnabled()) {
+            const rows = (res.data ?? []).map((secret) => [String(secret.name ?? ''), String(secret.description ?? '')]);
+            this.log((0, output_1.renderTable)(['NAME', 'DESCRIPTION'], rows));
+        }
+        return res;
+    }
+}
+exports.default = PersonalList;

package/dist/commands/personal/run.d.ts

@@ -0,0 +1,8 @@
+import { BaseCommand } from '../../base';
+export default class PersonalRun extends BaseCommand {
+    static strict: boolean;
+    static enableJsonFlag: boolean;
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/run.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const subprocess_1 = require("../../lib/subprocess");
+class PersonalRun extends base_1.BaseCommand {
+    // Everything after `--` is the child command + its args (not parsed as flags).
+    static strict = false;
+    // The output belongs to the child process, not to us.
+    static enableJsonFlag = false;
+    static description = 'Run a command with your personal secrets injected as env vars (like `doppler run`). Secrets never touch disk.';
+    static examples = [
+        '<%= config.bin %> personal run -- bundle exec rails server',
+        '<%= config.bin %> personal run -- printenv OPENAI_API_KEY',
+    ];
+    async run() {
+        const { argv } = await this.parse(PersonalRun);
+        const parts = argv;
+        if (parts.length === 0) {
+            this.error('Provide a command to run after `--`, e.g. `cyi personal run -- printenv`', { exit: 1 });
+        }
+        const { data } = await this.api.get('/cli/v1/personal_secrets/bundle');
+        const [command, ...commandArgs] = parts;
+        const code = await (0, subprocess_1.runCommand)(command, commandArgs, { ...process.env, ...(data ?? {}) });
+        // Propagate the child's exit code (0 on success) so `cyi personal run … && next` behaves like the child.
+        this.exit(code);
+    }
+}
+exports.default = PersonalRun;

package/dist/commands/personal/set.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class PersonalSet extends BaseCommand {
+    static args: {
+        assignment: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        value: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/set.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalSet extends base_1.BaseCommand {
+    static args = {
+        assignment: core_1.Args.string({ description: 'NAME=VALUE, or just NAME with --value', required: true }),
+    };
+    static description = 'Set (create or update) a personal secret for the current organization';
+    static examples = [
+        '<%= config.bin %> personal set OPENAI_API_KEY=sk-live-...',
+        '<%= config.bin %> personal set API_KEY --value s3cr3t --description "Stripe key"',
+    ];
+    static flags = {
+        value: core_1.Flags.string({ description: 'Secret value (use when the arg is just NAME)' }),
+        description: core_1.Flags.string({ description: 'Optional description' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PersonalSet);
+        const eq = args.assignment.indexOf('=');
+        const name = eq === -1 ? args.assignment : args.assignment.slice(0, eq);
+        const value = eq === -1 ? flags.value : args.assignment.slice(eq + 1);
+        if (value === undefined) {
+            this.error('Provide a value: use NAME=VALUE or pass --value', { exit: 1 });
+        }
+        const res = await this.api.post('/cli/v1/personal_secrets', {
+            name,
+            value,
+            description: flags.description,
+        });
+        if (!this.jsonEnabled()) {
+            this.log(`Personal secret ${String(name).toUpperCase()} saved.`);
+        }
+        return res;
+    }
+}
+exports.default = PersonalSet;

package/dist/commands/tokens/provision.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../base';
+export default class TokensProvision extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'environment-id': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        scope: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'to-project': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'to-environment-id': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'secret-name': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'sync-github': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'confirm-production': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tokens/provision.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const node_crypto_1 = require("node:crypto");
+const base_1 = require("../../base");
+const token_provision_1 = require("../../lib/token-provision");
+class TokensProvision extends base_1.BaseCommand {
+    static description = 'Generate an ingest token and deliver it without revealing the secret';
+    static examples = [
+        '<%= config.bin %> tokens provision -p CYRA --name "Self monitoring" --environment-id staging --to-project CYRA --to-environment-id staging --secret-name CLOSEYOURIT_TOKEN',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        name: core_1.Flags.string({ description: 'Human-readable token name', required: true }),
+        'environment-id': core_1.Flags.string({ description: 'Source environment code or id', required: true }),
+        scope: core_1.Flags.string({ description: 'Token scope (repeatable)', multiple: true, options: ['ingest', 'read'] }),
+        'to-project': core_1.Flags.string({ description: 'Destination project id or key', required: true }),
+        'to-environment-id': core_1.Flags.string({ description: 'Destination environment code or id', required: true }),
+        'secret-name': core_1.Flags.string({ description: 'Destination vault variable name', required: true }),
+        'idempotency-key': core_1.Flags.string({ description: 'Stable key for safe request retries' }),
+        'sync-github': core_1.Flags.boolean({ description: 'Synchronize the destination vault to GitHub', default: true, allowNo: true }),
+        'confirm-production': core_1.Flags.boolean({ description: 'Required when source or destination is production' }),
+    };
+    async run() {
+        const { flags } = await this.parse(TokensProvision);
+        const [projectId, destinationProjectId] = await Promise.all([
+            this.resolveProjectId(flags.project),
+            this.resolveProjectId(flags['to-project']),
+        ]);
+        const response = await this.api.post(`/cli/v1/projects/${projectId}/tokens/provisions`, {
+            name: flags.name,
+            environment_id: flags['environment-id'],
+            scopes: flags.scope?.length ? flags.scope : ['ingest'],
+            idempotency_key: flags['idempotency-key'] ?? (0, node_crypto_1.randomUUID)(),
+            sync_github: flags['sync-github'],
+            confirm_production: flags['confirm-production'] ?? false,
+            destination: {
+                project_id: destinationProjectId,
+                environment_id: flags['to-environment-id'],
+                secret_name: flags['secret-name'],
+            },
+        });
+        const safe = (0, token_provision_1.safeTokenProvisionEnvelope)(response);
+        if (!this.jsonEnabled()) {
+            const data = safe.data;
+            this.log('Token generated and delivered without revealing its value.');
+            this.log(`  provision: ${data.provision?.id ?? '-'}`);
+            this.log(`  token:     ${data.token?.id ?? '-'}`);
+            this.log(`  prefix:    ${data.token?.token_prefix ?? '-'}`);
+            this.log(`  status:    ${data.provision?.status ?? '-'}`);
+        }
+        return safe;
+    }
+}
+exports.default = TokensProvision;

package/dist/commands/tokens/provisions/retry.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base';
+export default class TokensProvisionsRetry extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tokens/provisions/retry.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const token_provision_1 = require("../../../lib/token-provision");
+class TokensProvisionsRetry extends base_1.BaseCommand {
+    static description = 'Retry GitHub synchronization without regenerating or revealing the token';
+    static args = {
+        id: core_1.Args.string({ description: 'Provision id', required: true }),
+    };
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TokensProvisionsRetry);
+        const projectId = await this.resolveProjectId(flags.project);
+        const response = await this.api.post(`/cli/v1/projects/${projectId}/tokens/provisions/${args.id}/retry`);
+        const safe = (0, token_provision_1.safeTokenProvisionEnvelope)(response);
+        if (!this.jsonEnabled()) {
+            const provision = safe.data;
+            this.log(`Provision ${provision.id ?? args.id} queued again.`);
+            this.log(`  status: ${provision.status ?? '-'}`);
+        }
+        return safe;
+    }
+}
+exports.default = TokensProvisionsRetry;

package/dist/commands/tokens/provisions/show.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base';
+export default class TokensProvisionsShow extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tokens/provisions/show.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const token_provision_1 = require("../../../lib/token-provision");
+class TokensProvisionsShow extends base_1.BaseCommand {
+    static description = 'Show secret-free token provision status';
+    static args = {
+        id: core_1.Args.string({ description: 'Provision id', required: true }),
+    };
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TokensProvisionsShow);
+        const projectId = await this.resolveProjectId(flags.project);
+        const response = await this.api.get(`/cli/v1/projects/${projectId}/tokens/provisions/${args.id}`);
+        const safe = (0, token_provision_1.safeTokenProvisionEnvelope)(response);
+        if (!this.jsonEnabled()) {
+            const data = safe.data;
+            this.log(`Provision ${data.provision?.id ?? args.id}`);
+            this.log(`  status:      ${data.provision?.status ?? '-'}`);
+            this.log(`  destination: ${data.provision?.destination_project_id ?? '-'} / ${data.provision?.destination_environment_id ?? '-'}`);
+            this.log(`  secret name: ${data.provision?.secret_name ?? '-'}`);
+            if (data.provision?.error_code)
+                this.log(`  error:       ${data.provision.error_code}`);
+        }
+        return safe;
+    }
+}
+exports.default = TokensProvisionsShow;

package/dist/lib/token-provision.d.ts

@@ -0,0 +1,8 @@
+import type { Envelope } from './api';
+type UnknownRecord = Record<string, unknown>;
+/**
+ * Rebuild the backend response from an allow-list. Even if a future backend regression adds a
+ * plaintext field, blind commands cannot return it through oclif's JSON formatter.
+ */
+export declare function safeTokenProvisionEnvelope(response: Envelope<unknown>): Envelope<UnknownRecord>;
+export {};

package/dist/lib/token-provision.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeTokenProvisionEnvelope = safeTokenProvisionEnvelope;
+const tokenKeys = [
+    'id',
+    'name',
+    'environment_id',
+    'token_prefix',
+    'public_key',
+    'scopes',
+    'last_used_at',
+    'revoked_at',
+    'created_at',
+];
+const provisionKeys = [
+    'id',
+    'status',
+    'secret_name',
+    'sync_github',
+    'error_code',
+    'error_message',
+    'synced_at',
+    'created_at',
+    'updated_at',
+    'source_project_id',
+    'source_environment_id',
+    'destination_project_id',
+    'destination_environment_id',
+];
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function pick(source, keys) {
+    const safe = {};
+    for (const key of keys) {
+        if (source[key] !== undefined)
+            safe[key] = source[key];
+    }
+    return safe;
+}
+/**
+ * Rebuild the backend response from an allow-list. Even if a future backend regression adds a
+ * plaintext field, blind commands cannot return it through oclif's JSON formatter.
+ */
+function safeTokenProvisionEnvelope(response) {
+    const data = record(response.data);
+    const safeData = data.provision === undefined
+        ? pick(data, provisionKeys)
+        : {
+            token: pick(record(data.token), tokenKeys),
+            provision: pick(record(data.provision), provisionKeys),
+        };
+    return response.meta ? { data: safeData, meta: response.meta } : { data: safeData };
+}