@indigoai-us/hq-cli 5.345.152 → 5.345.154

package/dist/lib/mesh/live/flush.js

@@ -262,6 +262,7 @@ export async function flushSessionEvents(inputDeps) {
             pendingRestore.delete(event);
         };
         const loggedProject404 = new Set();
+        const heldUidCache = new Map();
         sessionLoop: for (const [sessionId, items] of bySession) {
             if (deps.signal?.aborted)
                 break sessionLoop;
@@ -283,7 +284,8 @@ export async function flushSessionEvents(inputDeps) {
             if (leaveResult.abort)
                 continue;
             const remainingItems = leaveResult.items;
-            state = bindHeldCompanyIfResolved(sessionId, remainingItems, state, deps, now);
+            const heldBinding = bindHeldCompanyIfResolved(sessionId, remainingItems, state, deps, now, heldUidCache);
+            state = heldBinding instanceof Promise ? await heldBinding : heldBinding;
             if (state?.companyConfidence === "device_default" &&
                 deps.authorizeDeviceDefaultTenant) {
                 const allowed = await deps.authorizeDeviceDefaultTenant(state);
@@ -646,12 +648,12 @@ const SESSION_EVENT_HARNESSES = new Set([
     "agent-box",
     "agents-v2",
 ]);
-function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
+function resolveHeldCompany(sessionId, items, state, deps) {
     if (state?.companyUid)
-        return state;
+        return null;
     const sample = items[0]?.event;
     if (!sample)
-        return state;
+        return null;
     const cwd = eventText(sample, "cwd");
     const hqRoot = eventText(sample, "hqRoot");
     const remoteOwnerSlug = cwd
@@ -675,14 +677,16 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
         remoteOwnerSlug,
         repoIdentityKey,
     });
-    if (resolution.status !== "resolved" || !resolution.company.uid)
-        return state;
+    if (resolution.status !== "resolved")
+        return null;
     if (resolution.company.source === "trusted_explicit" &&
         !eventText(sample, "companySlug")) {
-        return state;
+        return null;
     }
-    const uid = resolution.company.uid;
-    const slug = resolution.company.slug;
+    return resolution.company;
+}
+function writeHeldCompanyBinding(sessionId, state, company, deps, now) {
+    const { uid, slug } = company;
     const nowIso = now().toISOString();
     const next = updateSessionState(sessionId, deps.workContextRoot, (current) => {
         const base = current ?? state;
@@ -703,7 +707,7 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
             contractVersion: base.contractVersion ?? 1,
             companyUid: uid,
             ...(slug ? { companySlug: slug } : {}),
-            ...(resolution.company.source === "device_default"
+            ...(company.source === "device_default"
                 ? { companyConfidence: "device_default" }
                 : {}),
             contextStatus,
@@ -712,6 +716,45 @@ function bindHeldCompanyIfResolved(sessionId, items, state, deps, now) {
     });
     return next ?? readSessionState(sessionId, deps.workContextRoot) ?? state;
 }
+/**
+ * Bind a held session to a company. Local evidence with a uid binds directly.
+ * Local evidence that only names a slug (session meta, cwd, git remote) needs
+ * a membership-validated slug -> uid lookup; without it the session would stay
+ * NEEDS_COMPANY on every retry (Shepherd 2361).
+ */
+function bindHeldCompanyIfResolved(sessionId, items, state, deps, now, uidCache) {
+    // Stay synchronous unless a uid lookup is needed: the flush loop's
+    // microtask ordering is relied on by retry/back-pressure timing.
+    const company = resolveHeldCompany(sessionId, items, state, deps);
+    if (!company)
+        return state;
+    if (company.uid) {
+        return writeHeldCompanyBinding(sessionId, state, { uid: company.uid, slug: company.slug, source: company.source }, deps, now);
+    }
+    const slug = company.slug?.trim().toLowerCase();
+    if (!slug || !deps.resolveCompanyUid || company.source === "device_default")
+        return state;
+    let pending = uidCache.get(slug);
+    if (!pending) {
+        const resolver = deps.resolveCompanyUid;
+        pending = (async () => {
+            try {
+                const uid = await resolver(slug);
+                return typeof uid === "string" && uid.trim() ? uid.trim() : null;
+            }
+            catch (err) {
+                deps.log?.(`held company uid lookup failed for slug=${slug}: ${(err instanceof Error ? err.message : String(err)).slice(0, 120)}`);
+                return null;
+            }
+        })();
+        uidCache.set(slug, pending);
+    }
+    return pending.then((uid) => {
+        if (!uid)
+            return state;
+        return writeHeldCompanyBinding(sessionId, state, { uid, slug: company.slug, source: company.source }, deps, now);
+    });
+}
 function applySessionMetaCompanyRebind(sessionId, items, state, deps, now) {
     if (!state)
         return state;

package/dist/lib/registry/registry.js

@@ -90,6 +90,12 @@ export function pathKey(dir) {
 export function canonicalDir(dir) {
     const abs = path.resolve(dir);
     try {
+        // macOS volumes are case-insensitive by default: /x/CaseRepo and
+        // /x/caserepo are one folder, but the JS realpath keeps the caller's
+        // spelling, so the same repo produced two registry keys. realpath(3)
+        // returns the on-disk spelling. Other platforms keep the JS realpath.
+        if (process.platform === "darwin")
+            return fs.realpathSync.native(abs);
         return fs.realpathSync(abs);
     }
     catch {

package/dist/lib/scan-packages/index.js

@@ -4,7 +4,7 @@ import * as path from 'node:path';
 import * as yaml from 'js-yaml';
 import { contributionLinks } from '../../utils/pack-contribution-links.js';
 import { CONTRIBUTION_TABLE } from '../../utils/contribution-table.js';
-import { isExcludedWorkerDirectory } from '../workers-registry/index.js';
+import { isExcludedWorkerDirectory, isNestedWorkerCheckout } from '../workers-registry/index.js';
 function isDirectory(target) { try {
     return fs.statSync(target).isDirectory();
 }
@@ -77,8 +77,9 @@ function allWorkerYamlFiles(root, relative) {
     const output = [];
     const walk = (next, seen) => {
         // Prune exactly what the worker registry prunes (tenant repos/ checkouts,
-        // _template, _overrides). A worker.yaml the registry never indexes cannot
-        // collide with a pack worker, and walking source checkouts is slow.
+        // nested git checkouts, _template, _overrides). A worker.yaml the registry
+        // never indexes cannot collide with a pack worker, and walking source
+        // checkouts is slow.
         if (isExcludedWorkerDirectory(next))
             return;
         const absolute = path.join(root, next);
@@ -101,7 +102,10 @@ function allWorkerYamlFiles(root, relative) {
         catch {
             return;
         }
+        const checkout = isNestedWorkerCheckout(relative, next, names);
         for (const name of names) {
+            if (checkout && name !== 'worker.yaml')
+                continue;
             const child = path.join(next, name);
             const childAbsolute = path.join(root, child);
             if (name === 'worker.yaml' && (() => { try {

package/dist/lib/sync/read-only-local-only.d.ts

@@ -0,0 +1,45 @@
+export type VaultGrant = {
+    path: string;
+    permission: string;
+};
+export type VaultAccessCompany = {
+    role?: string;
+    enforced?: boolean;
+    grants?: VaultGrant[];
+};
+export type VaultAccessManifest = {
+    version?: number;
+    companies?: Record<string, VaultAccessCompany>;
+};
+/** bypass | unknown | admin | write | read | none */
+export type EffectivePermission = "bypass" | "unknown" | "admin" | "write" | "read" | "none";
+export declare function readVaultAccessManifest(hqRoot: string): VaultAccessManifest | null;
+/** Whether the manifest entry is one the write hook enforces grants for. */
+export declare function isGrantEnforced(company: VaultAccessCompany | undefined): boolean;
+export declare function effectivePermission(company: VaultAccessCompany | undefined, rel: string): EffectivePermission;
+export type ReadOnlyLocalOnlyFile = {
+    path: string;
+    permission: "read" | "none";
+};
+export type ReadOnlyLocalOnlyResult = {
+    files: ReadOnlyLocalOnlyFile[];
+    total: number;
+};
+export type FindReadOnlyLocalOnlyOptions = {
+    hqRoot: string;
+    slug: string;
+    company: VaultAccessCompany;
+    /** Company-relative keys already in the sync journal (live or tombstoned). */
+    journalKeys: ReadonlySet<string>;
+    /** Engine ignore filter over absolute paths; true = would sync. */
+    shouldSync?: (absPath: string, isDir?: boolean) => boolean;
+    /** Max paths returned; `total` still counts every match. */
+    limit?: number;
+};
+/**
+ * Walk `companies/<slug>/` and return files that are not in the journal and
+ * whose effective permission is read or none. Returns an empty result for
+ * roles the hook does not enforce (owner/admin/unknown, enforced=false).
+ */
+export declare function findReadOnlyLocalOnly(opts: FindReadOnlyLocalOnlyOptions): ReadOnlyLocalOnlyResult;
+//# sourceMappingURL=read-only-local-only.d.ts.map

package/dist/lib/sync/read-only-local-only.js

@@ -0,0 +1,122 @@
+/**
+ * Local-only files under read-only vault prefixes (feedback_510661bc, Shepherd #2813).
+ *
+ * A teammate with a read-only share can still hold local files under that
+ * prefix — for example files written before the enforce-vault-write-access
+ * hook existed. Push will never upload them, so `hq sync status` lists them.
+ *
+ * Read-only and network-free: the access data is the local manifest at
+ * `<hqRoot>/.hq/vault-access.json` (written by refresh-vault-access), and the
+ * "already synced" set is the company's sync journal the caller already has.
+ * Permission resolution mirrors `effective_permission` in
+ * `.claude/hooks/enforce-vault-write-access.sh`.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function readVaultAccessManifest(hqRoot) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(hqRoot, ".hq", "vault-access.json"), "utf-8"));
+        return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : null;
+    }
+    catch {
+        return null;
+    }
+}
+function rank(permission) {
+    if (permission === "admin")
+        return 3;
+    if (permission === "write")
+        return 2;
+    if (permission === "read")
+        return 1;
+    return 0;
+}
+function grantMatches(grant, rel) {
+    const p = grant.path;
+    if (typeof p !== "string")
+        return false;
+    if (p === "*" || p === rel)
+        return true;
+    if (p.endsWith("/*")) {
+        return rel.startsWith(p.slice(0, -1)) || rel === p.slice(0, -2);
+    }
+    if (p.endsWith("/") && (grant.permission === "write" || grant.permission === "admin") && rel.startsWith(p)) {
+        const child = rel.slice(p.length);
+        return child.length > 0 && !child.includes("/");
+    }
+    return false;
+}
+/** Whether the manifest entry is one the write hook enforces grants for. */
+export function isGrantEnforced(company) {
+    if (!company)
+        return false;
+    const role = company.role ?? "unknown";
+    if (role !== "member" && role !== "guest")
+        return false;
+    return company.enforced !== false;
+}
+export function effectivePermission(company, rel) {
+    if (!company)
+        return "unknown";
+    const role = company.role ?? "unknown";
+    if (role === "owner" || role === "admin")
+        return "bypass";
+    if (company.enforced === false)
+        return "bypass";
+    if (role !== "member" && role !== "guest")
+        return "unknown";
+    const matches = (company.grants ?? []).filter((g) => g && grantMatches(g, rel));
+    if (matches.length === 0)
+        return "none";
+    matches.sort((a, b) => a.path.length - b.path.length || rank(a.permission) - rank(b.permission));
+    const best = matches[matches.length - 1].permission;
+    return best === "admin" || best === "write" || best === "read" ? best : "none";
+}
+/**
+ * Walk `companies/<slug>/` and return files that are not in the journal and
+ * whose effective permission is read or none. Returns an empty result for
+ * roles the hook does not enforce (owner/admin/unknown, enforced=false).
+ */
+export function findReadOnlyLocalOnly(opts) {
+    if (!isGrantEnforced(opts.company))
+        return { files: [], total: 0 };
+    const found = [];
+    const root = path.join(opts.hqRoot, "companies", opts.slug);
+    const limit = opts.limit ?? 20;
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const abs = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (entry.name === ".git" || entry.name === "node_modules")
+                    continue;
+                if (opts.shouldSync && !opts.shouldSync(abs, true))
+                    continue;
+                stack.push(abs);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (opts.shouldSync && !opts.shouldSync(abs, false))
+                continue;
+            const rel = path.relative(root, abs).split(path.sep).join("/");
+            if (opts.journalKeys.has(rel))
+                continue;
+            const permission = effectivePermission(opts.company, rel);
+            if (permission !== "read" && permission !== "none")
+                continue;
+            found.push({ path: rel, permission });
+        }
+    }
+    found.sort((a, b) => a.path.localeCompare(b.path));
+    return { files: found.slice(0, limit), total: found.length };
+}
+//# sourceMappingURL=read-only-local-only.js.map

package/dist/lib/work-context/organize.d.ts

@@ -92,6 +92,8 @@ export declare function prepareOrganizeDecision(input: {
     /** Skip network; leave unresolved without candidates. */
     offline?: boolean;
 }): Promise<OrganizeListResult>;
+/** True when a local decision's server window has passed (or is unparsable). */
+export declare function isLocalDecisionExpired(expiresAt: string | undefined, now?: Date): boolean;
 export declare function formatOrganizeList(result: OrganizeListResult): string[];
 /**
  * Mark that the ask was cancelled / timed out / surface incapable.

package/dist/lib/work-context/organize.js

@@ -114,8 +114,17 @@ export async function prepareOrganizeDecision(input) {
             reason: state.contextStatus,
         };
     }
-    // Ask-once: an existing decision is never replaced or re-armed.
-    if (state.decision?.decisionId) {
+    // Ask-once: an existing decision is never replaced or re-armed — unless its
+    // server decision window has expired. The server stamps a fresh window only
+    // when candidates are listed, so returning the stale decision would make
+    // every later organize fail with DECISION_EXPIRED / DECISION_WINDOW_MISSING.
+    const refreshExpired = Boolean(state.decision?.decisionId) &&
+        state.decision?.askAfter === true &&
+        isLocalDecisionExpired(state.decision?.expiresAt, nowFn()) &&
+        Boolean(state.companyUid) &&
+        !input.offline &&
+        Boolean(input.fetchCandidates);
+    if (state.decision?.decisionId && !refreshExpired) {
         return {
             sessionId: input.sessionId,
             contextStatus: state.contextStatus,
@@ -124,7 +133,7 @@ export async function prepareOrganizeDecision(input) {
             reason: state.decision.askAfter ? "pending_ask" : "ask_already_settled",
         };
     }
-    const ready = shouldAskAfter({
+    const ready = refreshExpired || shouldAskAfter({
         toolWrites: state.toolWrites,
         startedAt: state.startedAt,
         hasTurn: state.hasTurn,
@@ -168,9 +177,18 @@ export async function prepareOrganizeDecision(input) {
         contextStatus: next.contextStatus,
         pending: true,
         decision,
-        reason: "ask_prepared",
+        reason: refreshExpired ? "ask_refreshed" : "ask_prepared",
     };
 }
+/** True when a local decision's server window has passed (or is unparsable). */
+export function isLocalDecisionExpired(expiresAt, now = new Date()) {
+    if (!expiresAt)
+        return false;
+    const ms = Date.parse(expiresAt);
+    if (!Number.isFinite(ms))
+        return true;
+    return now.getTime() >= ms;
+}
 export function formatOrganizeList(result) {
     const lines = [
         `session ${result.sessionId} status=${result.contextStatus}` +

package/dist/lib/workers-registry/index.d.ts

@@ -28,9 +28,20 @@ export interface GenerateWorkersRegistryResult {
  * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
  * nested HQ root under a company project. Those copies land in the registry as
  * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
- * `hq lanes create` then fails with `worker_tenancy_unresolved`.
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`. HQ's own
+ * `workspace/worktrees/<name>/` is the same shape.
+ *
+ * `node_modules` and `.git` never hold workers and are large, so they are
+ * skipped wherever they appear. Any other checkout (a directory holding `.git`)
+ * is caught by the walk itself, because only the filesystem can tell.
  */
 export declare function isExcludedWorkerDirectory(relativeDirectory: string): boolean;
+/**
+ * True when `relativeDirectory`, found while walking `scanRoot`, is a separate
+ * git checkout (its listing `names` holds `.git`). The caller may still take a
+ * `worker.yaml` directly inside it, but must not descend any further.
+ */
+export declare function isNestedWorkerCheckout(scanRoot: string, relativeDirectory: string, names: readonly string[]): boolean;
 /**
  * Generate core/workers/registry.yaml from worker.yaml files. Invalid workers
  * are quarantined but do not prevent all valid workers from being registered.

package/dist/lib/workers-registry/index.js

@@ -59,7 +59,13 @@ function workerYamlFiles(root, relativeRoot) {
             return;
         }
         entries.sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
+        // A `.git` file (linked worktree) or folder (clone) below the scan root marks
+        // a separate checkout. Its worker.yaml files belong to that checkout, so the
+        // walk stops there. A checkout that is itself one worker keeps its own entry.
+        const isNestedCheckout = isNestedWorkerCheckout(relativeRoot, relative, entries.map((entry) => entry.name));
         for (const entry of entries) {
+            if (isNestedCheckout && entry.name !== 'worker.yaml')
+                continue;
             const childRelative = path.join(relative, entry.name);
             const child = path.join(root, childRelative);
             if (entry.name === 'worker.yaml' && (entry.isFile() || isFile(child))) {
@@ -162,12 +168,21 @@ function withoutTimestamp(content) {
  * (`.codex/worktrees/<name>/`) are the same trap in a different folder: a
  * nested HQ root under a company project. Those copies land in the registry as
  * `companies/<slug>/…/.claude/worktrees/…` or `.codex/worktrees/…` paths, so
- * `hq lanes create` then fails with `worker_tenancy_unresolved`.
+ * `hq lanes create` then fails with `worker_tenancy_unresolved`. HQ's own
+ * `workspace/worktrees/<name>/` is the same shape.
+ *
+ * `node_modules` and `.git` never hold workers and are large, so they are
+ * skipped wherever they appear. Any other checkout (a directory holding `.git`)
+ * is caught by the walk itself, because only the filesystem can tell.
  */
 export function isExcludedWorkerDirectory(relativeDirectory) {
     const normalized = relativeDirectory.replaceAll('\\', '/');
     if (/(?:^|\/)\.(?:claude|codex)\/worktrees(?:\/|$)/.test(normalized))
         return true;
+    if (/(?:^|\/)workspace\/worktrees(?:\/|$)/.test(normalized))
+        return true;
+    if (/(?:^|\/)(?:node_modules|\.git)(?:\/|$)/.test(normalized))
+        return true;
     const [root, tenant, nested] = normalized.split('/');
     if (root !== 'companies')
         return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
@@ -177,6 +192,29 @@ export function isExcludedWorkerDirectory(relativeDirectory) {
         return true;
     return /(?:^|\/)_overrides(?:\/|$)/.test(normalized);
 }
+/**
+ * Directories that may be git repositories without being a nested checkout.
+ *
+ * An operator can keep a whole tenant (`companies/<slug>`) or a tenant's
+ * `workers` folder in its own repository. Treating either as a checkout would
+ * drop every real worker in that tenant.
+ */
+function isCheckoutBoundaryExempt(relativeDirectory) {
+    const parts = relativeDirectory.replaceAll('\\', '/').split('/');
+    if (parts[0] !== 'companies')
+        return false;
+    return parts.length === 2 || (parts.length === 3 && parts[2] === 'workers');
+}
+/**
+ * True when `relativeDirectory`, found while walking `scanRoot`, is a separate
+ * git checkout (its listing `names` holds `.git`). The caller may still take a
+ * `worker.yaml` directly inside it, but must not descend any further.
+ */
+export function isNestedWorkerCheckout(scanRoot, relativeDirectory, names) {
+    return relativeDirectory !== scanRoot
+        && !isCheckoutBoundaryExempt(relativeDirectory)
+        && names.includes('.git');
+}
 /**
  * Every exclusion is a property of the directory holding the `worker.yaml`, so
  * the file rule is the directory rule applied to its parent. Deriving it keeps

package/dist/utils/cognito-session.d.ts

@@ -294,7 +294,10 @@ export declare function buildVaultConfig(authToken: string): VaultServiceConfig;
  * means no valid session could be ensured non-interactively; the caller gets a
  * reason string and can decide what to do next. Never opens a browser.
  */
-type MachineRefreshOptions = Pick<EnsureCognitoTokenOptions, "tokenSource"> & MachineTokenValidityOptions;
+type MachineRefreshOptions = Pick<EnsureCognitoTokenOptions, "tokenSource"> & MachineTokenValidityOptions & {
+    /** Refresh the person session even when the cached token is still valid. */
+    force?: boolean;
+};
 export declare function refreshCachedSession(options?: MachineRefreshOptions): Promise<{
     refreshed: boolean;
     reason?: string;

package/dist/utils/cognito-session.js

@@ -1158,6 +1158,15 @@ export function buildVaultConfig(authToken) {
         clientInfo: CLI_CLIENT_INFO,
     };
 }
+/** Person sessions renew below this many seconds of validity by default. */
+const PERSON_REFRESH_DEFAULT_SECONDS = 120;
+/** Person tokens last one hour; a caller minimum above this would always refresh. */
+const MAX_PERSON_MIN_VALIDITY_SECONDS = 1800;
+function personRefreshThresholdSeconds(minValiditySeconds) {
+    if (minValiditySeconds === undefined)
+        return PERSON_REFRESH_DEFAULT_SECONDS;
+    return Math.max(PERSON_REFRESH_DEFAULT_SECONDS, Math.min(minValiditySeconds, MAX_PERSON_MIN_VALIDITY_SECONDS));
+}
 export async function refreshCachedSession(options = {}) {
     if (wantsMachineCognitoTokens(options))
         return refreshCachedSessionUnserialized(options);
@@ -1198,7 +1207,8 @@ async function refreshCachedSessionUnserialized(options) {
         }
         return { refreshed: false, reason: "no cached session" };
     }
-    if (!isExpiring(cached, 120)) {
+    if (!options.force &&
+        !isExpiring(cached, personRefreshThresholdSeconds(options.minValiditySeconds))) {
         return { refreshed: true };
     }
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.152",
+  "version": "5.345.154",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {
@@ -114,11 +114,11 @@
     "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}": "eslint --cache --no-error-on-unmatched-pattern"
   },
   "optionalDependencies": {
-    "@indigoai-us/hq-hook-win32-x64": "5.345.152",
-    "@indigoai-us/hq-hook-win32-arm64": "5.345.152",
-    "@indigoai-us/hq-hook-darwin-x64": "5.345.152",
-    "@indigoai-us/hq-hook-darwin-arm64": "5.345.152",
-    "@indigoai-us/hq-hook-linux-x64": "5.345.152",
-    "@indigoai-us/hq-hook-linux-arm64": "5.345.152"
+    "@indigoai-us/hq-hook-win32-x64": "5.345.154",
+    "@indigoai-us/hq-hook-win32-arm64": "5.345.154",
+    "@indigoai-us/hq-hook-darwin-x64": "5.345.154",
+    "@indigoai-us/hq-hook-darwin-arm64": "5.345.154",
+    "@indigoai-us/hq-hook-linux-x64": "5.345.154",
+    "@indigoai-us/hq-hook-linux-arm64": "5.345.154"
   }
 }