@dotdo/postgres 0.1.0

package/dist/rls/policy.d.ts

@@ -0,0 +1,116 @@
+/**
+ * RLS Policy Type Definitions
+ */
+/**
+ * Supported RLS policy operations
+ */
+export type PolicyOperation = 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE' | 'ALL';
+/**
+ * Policy type: permissive (default) or restrictive
+ */
+export type PolicyType = 'permissive' | 'restrictive';
+/**
+ * Column type for tenant isolation
+ */
+export type TenantColumnType = 'uuid' | 'integer' | 'text';
+/**
+ * RLS Policy definition
+ */
+export interface RLSPolicy {
+    name: string;
+    table: string;
+    operation: PolicyOperation;
+    using?: string | undefined;
+    check?: string | undefined;
+    roles: string[];
+    type: PolicyType;
+}
+/**
+ * Options for creating a policy
+ */
+export interface CreatePolicyOptions {
+    name: string;
+    table: string;
+    operation: PolicyOperation;
+    using?: string | undefined;
+    check?: string | undefined;
+    roles?: string[] | undefined;
+    type?: PolicyType | undefined;
+}
+/**
+ * Options for enabling RLS
+ */
+export interface EnableRLSOptions {
+    force?: boolean;
+}
+/**
+ * Options for disabling RLS
+ */
+export interface DisableRLSOptions {
+    removeForce?: boolean;
+}
+/**
+ * Options for applying a policy
+ */
+export interface ApplyPolicyOptions {
+    replace?: boolean;
+    ifNotExists?: boolean;
+}
+/**
+ * Options for tenant policy creation
+ */
+export interface TenantPolicyOptions {
+    sessionVariable?: string;
+    policyName?: string;
+    operation?: PolicyOperation;
+    operations?: PolicyOperation[];
+    columnType?: TenantColumnType;
+    allowNull?: boolean;
+    superTenantBypass?: string;
+}
+/**
+ * Options for setting tenant context
+ */
+export interface SetTenantContextOptions {
+    sessionVariable?: string;
+    local?: boolean;
+}
+/**
+ * Policy validation result
+ */
+export interface PolicyValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+}
+/**
+ * Validation options
+ */
+export interface ValidationOptions {
+    requireTenantIsolation?: boolean;
+    tenantColumn?: string;
+}
+/**
+ * Options for dropping a policy
+ */
+export interface DropPolicyOptions {
+    ifExists?: boolean;
+}
+/**
+ * PGlite-like interface for database operations
+ */
+export interface PGliteLike {
+    exec: (sql: string) => Promise<unknown>;
+    query: <T = unknown>(sql: string) => Promise<{
+        rows: T[];
+    }>;
+}
+/**
+ * Create an RLS policy definition
+ */
+export declare function createPolicy(options: CreatePolicyOptions): RLSPolicy;
+/**
+ * Create a tenant isolation policy
+ */
+export declare function createTenantPolicy(table: string, tenantColumn: string, options?: TenantPolicyOptions): RLSPolicy | RLSPolicy[];
+//# sourceMappingURL=policy.d.ts.map

package/dist/rls/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/rls/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAA;AAE/E;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,aAAa,CAAA;AAErD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;AAE1D;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,eAAe,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,IAAI,EAAE,UAAU,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,eAAe,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAC5B,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAA;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACvC,KAAK,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAC5D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,SAAS,CAyBpE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,SAAS,GAAG,SAAS,EAAE,CAkDzB"}

package/dist/rls/policy.js

@@ -0,0 +1,77 @@
+/**
+ * RLS Policy Type Definitions
+ */
+/**
+ * Create an RLS policy definition
+ */
+export function createPolicy(options) {
+    const policy = {
+        name: options.name,
+        table: options.table,
+        operation: options.operation,
+        using: options.using,
+        check: options.check,
+        roles: options.roles ?? ['public'],
+        type: options.type ?? 'permissive',
+    };
+    // If type was explicitly provided, include it in enumerable properties
+    // Otherwise, make it non-enumerable so toEqual doesn't see it
+    // but it's still accessible via policy.type
+    if (options.type === undefined) {
+        const typeValue = 'permissive';
+        Object.defineProperty(policy, 'type', {
+            value: typeValue,
+            enumerable: false,
+            writable: true,
+            configurable: true,
+        });
+    }
+    return policy;
+}
+/**
+ * Create a tenant isolation policy
+ */
+export function createTenantPolicy(table, tenantColumn, options) {
+    const sessionVariable = options?.sessionVariable ?? 'app.tenant_id';
+    const columnType = options?.columnType ?? 'text';
+    const allowNull = options?.allowNull ?? false;
+    const superTenantBypass = options?.superTenantBypass;
+    // Build the type cast suffix
+    const typeCast = columnType === 'text' ? '' : `::${columnType}`;
+    // Build the base condition
+    let baseCondition = `${tenantColumn} = current_setting('${sessionVariable}')${typeCast}`;
+    // Add null allowance if specified
+    if (allowNull) {
+        baseCondition = `(${tenantColumn} IS NULL OR ${baseCondition})`;
+    }
+    // Add super-tenant bypass if specified
+    if (superTenantBypass) {
+        baseCondition = `(current_setting('${sessionVariable}') = '${superTenantBypass}' OR ${baseCondition})`;
+    }
+    // Handle multiple operations
+    if (options?.operations) {
+        return options.operations.map((op) => {
+            const needsCheck = op === 'INSERT' || op === 'UPDATE' || op === 'ALL';
+            const needsUsing = op !== 'INSERT';
+            return createPolicy({
+                name: options?.policyName ?? `${table}_tenant_isolation_${op.toLowerCase()}`,
+                table,
+                operation: op,
+                using: needsUsing ? baseCondition : undefined,
+                check: needsCheck ? baseCondition : undefined,
+            });
+        });
+    }
+    // Single operation or ALL
+    const operation = options?.operation ?? 'ALL';
+    const needsCheck = operation === 'INSERT' || operation === 'UPDATE' || operation === 'ALL';
+    const needsUsing = operation !== 'INSERT';
+    return createPolicy({
+        name: options?.policyName ?? `${table}_tenant_isolation`,
+        table,
+        operation,
+        using: needsUsing ? baseCondition : undefined,
+        check: needsCheck ? baseCondition : undefined,
+    });
+}
+//# sourceMappingURL=policy.js.map

package/dist/rls/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/rls/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsHH;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAClC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,YAAY;KACnC,CAAA;IAED,uEAAuE;IACvE,8DAA8D;IAC9D,4CAA4C;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,YAA0B,CAAA;QAC5C,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACpC,KAAK,EAAE,SAAS;YAChB,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,YAAoB,EACpB,OAA6B;IAE7B,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,eAAe,CAAA;IACnE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAA;IAChD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAA;IAC7C,MAAM,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAA;IAEpD,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAA;IAE/D,2BAA2B;IAC3B,IAAI,aAAa,GAAG,GAAG,YAAY,uBAAuB,eAAe,KAAK,QAAQ,EAAE,CAAA;IAExF,kCAAkC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,aAAa,GAAG,IAAI,YAAY,eAAe,aAAa,GAAG,CAAA;IACjE,CAAC;IAED,uCAAuC;IACvC,IAAI,iBAAiB,EAAE,CAAC;QACtB,aAAa,GAAG,qBAAqB,eAAe,SAAS,iBAAiB,QAAQ,aAAa,GAAG,CAAA;IACxG,CAAC;IAED,6BAA6B;IAC7B,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YACnC,MAAM,UAAU,GAAG,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,KAAK,CAAA;YACrE,MAAM,UAAU,GAAG,EAAE,KAAK,QAAQ,CAAA;YAElC,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC,WAAW,EAAE,EAAE;gBAC5E,KAAK;gBACL,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBAC7C,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;aAC9C,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,0BAA0B;IAC1B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAA;IAC7C,MAAM,UAAU,GAAG,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,KAAK,CAAA;IAC1F,MAAM,UAAU,GAAG,SAAS,KAAK,QAAQ,CAAA;IAEzC,OAAO,YAAY,CAAC;QAClB,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,GAAG,KAAK,mBAAmB;QACxD,KAAK;QACL,SAAS;QACT,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC7C,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC,CAAA;AACJ,CAAC"}

package/dist/rls/validator.d.ts

@@ -0,0 +1,155 @@
+/**
+ * RLS Policy Validator
+ *
+ * SECURITY CRITICAL: This module validates Row-Level Security policies to prevent:
+ * - SQL injection attacks via policy names, table names, role names, and expressions
+ * - Privilege escalation through malicious policy expressions
+ * - Denial of service through dangerous function calls
+ * - Information disclosure via system catalog access
+ * - Unicode-based attacks (homoglyphs, zero-width, RTL override)
+ *
+ * All user-provided input MUST be validated through this module before being
+ * used to construct SQL statements for RLS policy creation or modification.
+ *
+ * @module rls/validator
+ */
+import type { RLSPolicy, PolicyValidationResult, ValidationOptions, PGliteLike } from './policy';
+/**
+ * Validates a PostgreSQL identifier for correctness.
+ *
+ * Checks if an identifier follows PostgreSQL naming rules:
+ * - Must start with a letter (a-z, A-Z) or underscore (_)
+ * - Subsequent characters can be letters, digits, or underscores
+ * - Schema-qualified names (schema.table) are allowed
+ *
+ * Note: This validates the format only, not SQL injection safety.
+ * For security validation, use validateTableName() or validatePolicy().
+ *
+ * @param identifier - The identifier to validate
+ * @returns true if the identifier is valid, false otherwise
+ */
+export declare function isValidIdentifier(identifier: string): boolean;
+/**
+ * Determines if an identifier requires double-quoting in SQL.
+ *
+ * PostgreSQL requires quoting for identifiers that:
+ * - Contain characters other than letters, digits, underscores
+ * - Start with a digit
+ * - Are reserved keywords (handled separately)
+ *
+ * @param identifier - The identifier to check
+ * @returns true if quoting is required, false otherwise
+ */
+export declare function needsQuoting(identifier: string): boolean;
+/**
+ * Wraps an identifier in double quotes if necessary for SQL safety.
+ *
+ * Use this function when constructing SQL statements with user-provided
+ * identifiers. Already-valid identifiers are returned unchanged.
+ *
+ * WARNING: This function only adds quotes for format compliance, not
+ * security. Always validate identifiers with validateTableName() or
+ * validatePolicy() before using in SQL.
+ *
+ * @param identifier - The identifier to potentially quote
+ * @returns The identifier, quoted if necessary
+ */
+export declare function quoteIdentifier(identifier: string): string;
+/**
+ * Validates a table name for SQL safety.
+ *
+ * SECURITY CRITICAL: Table names are directly interpolated into SQL
+ * statements. This function ensures the name is safe from injection.
+ *
+ * Validation rules:
+ * 1. No SQL injection patterns (semicolons, comments, DDL keywords)
+ * 2. Must match valid table name format (letters, digits, underscores,
+ *    optional hyphens, optional schema prefix)
+ *
+ * @param table - The table name to validate
+ * @returns true if the table name is safe, false otherwise
+ */
+export declare function validateTableName(table: string): boolean;
+/**
+ * Validates an RLS policy definition for security and correctness.
+ *
+ * SECURITY CRITICAL: This is the primary entry point for validating RLS policies
+ * before they are applied to the database. All user-provided policy definitions
+ * MUST pass through this function.
+ *
+ * ## Security Checks Performed
+ *
+ * ### On Policy Names:
+ * - SQL injection patterns (semicolons, comments, DDL keywords)
+ * - Unicode attacks (null bytes, zero-width, RTL override, homoglyphs)
+ * - Length limits (PostgreSQL max 63 characters)
+ * - Format validation (must start with letter or underscore)
+ *
+ * ### On Table Names:
+ * - SQL injection patterns
+ * - Unicode attacks
+ * - Reserved keyword warnings
+ *
+ * ### On Role Names:
+ * - SQL injection patterns
+ * - Valid identifier format
+ * - Unicode attacks
+ *
+ * ### On USING/CHECK Expressions:
+ * - Dangerous function blocklist (pg_sleep, pg_read_file, dblink, etc.)
+ * - DDL privilege escalation (GRANT, CREATE USER, etc.)
+ * - Unicode attacks
+ * - Bypass pattern warnings (1=1, OR 'x'='x')
+ * - Subquery performance warnings
+ *
+ * ### Semantic Validation:
+ * - SELECT/DELETE require USING clause
+ * - INSERT requires WITH CHECK clause
+ * - Multi-tenant isolation checks (optional)
+ *
+ * @param policy - The RLS policy definition to validate
+ * @param options - Optional validation configuration
+ * @returns Validation result with valid flag, errors array, and warnings array
+ */
+export declare function validatePolicy(policy: RLSPolicy, options?: ValidationOptions): PolicyValidationResult;
+/**
+ * Validates SQL expression syntax using the PostgreSQL database.
+ *
+ * This function performs two levels of validation:
+ *
+ * 1. **Syntax Check**: Attempts to parse the expression by wrapping it in a
+ *    SELECT statement. This catches malformed SQL before it reaches production.
+ *
+ * 2. **Type Check**: Verifies the expression returns a boolean type, which is
+ *    required for RLS policy expressions. Non-boolean expressions (like
+ *    arithmetic operations) will cause policies to fail at runtime.
+ *
+ * @param pglite - PGlite-compatible database connection
+ * @param expression - SQL expression to validate
+ * @returns Promise resolving to validation result
+ */
+export declare function validatePolicySyntax(pglite: PGliteLike, expression: string): Promise<PolicyValidationResult>;
+/**
+ * Validates a tenant ID for safe use in multi-tenant RLS policies.
+ *
+ * SECURITY CRITICAL: Tenant IDs are often interpolated into SQL expressions
+ * for multi-tenant row-level security. This function ensures tenant IDs
+ * cannot be exploited for SQL injection.
+ *
+ * ## Allowed Characters
+ * - Letters (a-z, A-Z)
+ * - Digits (0-9)
+ * - Hyphens (-)
+ * - Underscores (_)
+ *
+ * ## Rejected Patterns
+ * - Empty strings
+ * - Whitespace
+ * - SQL special characters (quotes, semicolons, comments)
+ * - Unicode characters (to prevent homoglyph attacks)
+ *
+ * @param tenantId - The tenant ID to validate
+ * @returns true if the tenant ID is safe, false otherwise
+ */
+export declare function validateTenantId(tenantId: string): boolean;
+//# sourceMappingURL=validator.d.ts.map

package/dist/rls/validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../src/rls/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,SAAS,EACT,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACX,MAAM,UAAU,CAAA;AAqdjB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAK7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKxD;AAwHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,sBAAsB,CAqExB;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC,CAyCjC;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D"}