@malloy-publisher/server 0.0.235 → 0.0.236

package/src/stream_helpers.ts

@@ -1,162 +0,0 @@
-/**
- * Helpers for streaming the ad-hoc connection SQL endpoints
- * (`/environments/.../connections/.../sqlQuery`) so the publisher
- * process never has to hold a whole result set in memory before
- * returning it.
- *
- * The Step 1 row cap (`PUBLISHER_MAX_QUERY_ROWS`) is necessary but
- * not sufficient: row count is a poor proxy for memory pressure
- * because a single 10 MB JSON column blows past the 100k-row cap's
- * safe envelope. The byte cap (`PUBLISHER_MAX_RESPONSE_BYTES`) is
- * the actual memory bound, and bytes can only be enforced by
- * iterating row-at-a-time on `runSQLStream` — `runSQL` returns a
- * fully-buffered result, so by the time we'd count bytes the
- * connector has already done the damage.
- *
- * On streaming-capable connections (Postgres, DuckDB, ...) the
- * controller routes here. On other connections it stays on the
- * Step 1 path; client-side byte counting after the fact would be
- * security theatre.
- */
-
-import type {
-   Connection,
-   MalloyQueryData,
-   QueryRecord,
-   RunSQLOptions,
-   StreamingConnection,
-} from "@malloydata/malloy";
-
-import { PayloadTooLargeError } from "./errors";
-import { recordQueryCapExceeded } from "./query_cap_metrics";
-
-/**
- * Runtime check + type narrow for streaming-capable connections.
- * `Connection.canStream` is declared as `this is StreamingConnection`
- * by the Malloy SDK, so a positive result is enough to safely call
- * `runSQLStream`.
- */
-export function isStreamingConnection(
-   connection: Connection,
-): connection is StreamingConnection {
-   return (
-      typeof (connection as { canStream?: () => boolean }).canStream ===
-         "function" && (connection as StreamingConnection).canStream()
-   );
-}
-
-export interface StreamBudget {
-   /**
-    * Maximum number of rows to return. A value of `0` disables the
-    * row cap (the caller-supplied `rowLimit` in `runSQLOptions` may
-    * still bound the stream, but the helper will not raise on
-    * overflow).
-    */
-   maxRows: number;
-   /**
-    * Maximum aggregate JSON-serialized byte size of returned rows.
-    * `0` disables the byte cap. Measured as the sum of
-    * `Buffer.byteLength(JSON.stringify(row))` for each yielded row
-    * — the same bytes the eventual response will contain inside
-    * `result.rows`.
-    */
-   maxBytes: number;
-}
-
-/**
- * Drain `runSQLStream` into a `MalloyQueryData`-shaped buffer,
- * enforcing both a row cap and a byte cap. Aborts the underlying
- * iterator via an internal `AbortController` the moment either cap
- * is breached so the driver stops producing rows immediately
- * (Postgres' `pg-query-stream` and DuckDB's streaming iterator both
- * honor `abortSignal`).
- *
- * The row cap is detected by the `cap + 1` sentinel pattern: the
- * controller has already clamped `runSQLOptions.rowLimit` to
- * `min(callerLimit, cap + 1)`, so receiving `cap + 1` rows
- * unambiguously means the request would have overflowed. This
- * matches the non-streaming path's overflow detection so behavior
- * is identical regardless of which connector served the request.
- *
- * On overflow the helper throws `PayloadTooLargeError` directly —
- * the message includes the relevant env-var name so the operator
- * sees a self-contained tuning hint without having to cross-
- * reference the controller.
- */
-export async function streamSqlWithBudget(
-   connection: StreamingConnection,
-   sql: string,
-   runSQLOptions: RunSQLOptions,
-   budget: StreamBudget,
-): Promise<MalloyQueryData> {
-   const { maxRows, maxBytes } = budget;
-   const capAc = new AbortController();
-   const rows: QueryRecord[] = [];
-   let byteTotal = 0;
-   let overflowMessage: string | undefined;
-
-   // Compose two abort sources so a caller-supplied signal (the
-   // publisher's query timeout) and the internal cap-abort signal
-   // *both* cancel the underlying iterator:
-   //
-   //   - If the caller's signal fires first, the controller's
-   //     `runWithQueryTimeout` will throw `QueryTimeoutError` → 504.
-   //   - If the cap-abort fires first, we throw
-   //     `PayloadTooLargeError` → 413.
-   //
-   // Without composition the streaming branch would silently drop
-   // the caller's signal — historically the only way to abort here
-   // was the cap, so the legacy controller cleared
-   // `runSQLOptions.abortSignal`. Step 5 reverses that: the caller's
-   // signal is now authoritative.
-   //
-   // `AbortSignal.any` is widely available (Node 20+); guard with a
-   // typeof check so a stale runtime falls back to the legacy
-   // cap-only behavior instead of crashing at module load.
-   const externalSignal = runSQLOptions.abortSignal;
-   const composedSignal: AbortSignal =
-      externalSignal && typeof AbortSignal.any === "function"
-         ? AbortSignal.any([externalSignal, capAc.signal])
-         : capAc.signal;
-
-   try {
-      for await (const row of connection.runSQLStream(sql, {
-         ...runSQLOptions,
-         abortSignal: composedSignal,
-      })) {
-         rows.push(row);
-         if (maxBytes > 0) {
-            // Measure exactly what the eventual response body will
-            // contain for this row. O(rowSize) per row, duplicated
-            // against the final `JSON.stringify(result)` — the
-            // early-abort win on overflow dwarfs the bookkeeping
-            // cost in the bounded-success case.
-            byteTotal += Buffer.byteLength(JSON.stringify(row), "utf8");
-            if (byteTotal > maxBytes) {
-               recordQueryCapExceeded("bytes", "connection_sql");
-               overflowMessage = `Query response exceeded ${maxBytes} bytes (had at least ${byteTotal}). Refine the query (project fewer columns, add a LIMIT, or filter wide values) or raise PUBLISHER_MAX_RESPONSE_BYTES.`;
-               capAc.abort();
-               break;
-            }
-         }
-         if (maxRows > 0 && rows.length > maxRows) {
-            recordQueryCapExceeded("rows", "connection_sql");
-            overflowMessage = `Query returned more than ${maxRows} rows. Refine the query (add a LIMIT or more selective WHERE) or raise PUBLISHER_MAX_QUERY_ROWS.`;
-            capAc.abort();
-            break;
-         }
-      }
-   } catch (err) {
-      // `pg-query-stream` surfaces `query.destroy()` (which our
-      // abort handler triggers) as a synthetic error in some
-      // versions. Swallow it iff we triggered the abort ourselves —
-      // otherwise it's a real connection error (or the caller's
-      // timeout, which the controller's runWithQueryTimeout will
-      // surface as a 504) that the controller must see.
-      if (!overflowMessage) throw err;
-   }
-
-   if (overflowMessage) throw new PayloadTooLargeError(overflowMessage);
-
-   return { rows, totalRows: rows.length };
-}

package/src/telemetry.ts

@@ -1,20 +0,0 @@
-import { metrics, type Meter } from "@opentelemetry/api";
-
-/**
- * Single source of truth for the OpenTelemetry meter name. Every
- * publisher-emitted metric registers under this name so a typo can't
- * silently split a metric onto a second meter and drop it from the
- * Prometheus scrape.
- */
-export const METER_NAME = "publisher";
-
-/**
- * The shared publisher meter. Resolves lazily through the OTel global
- * provider (a `ProxyMeter`), so modules may call this at import time;
- * the real provider can be installed afterward (the production SDK in
- * `instrumentation.ts`, or the in-memory test harness) and instruments
- * still route to it.
- */
-export function publisherMeter(): Meter {
-   return metrics.getMeter(METER_NAME);
-}

package/src/test_helpers/metrics_harness.ts

@@ -1,166 +0,0 @@
-/**
- * Test helper: spin up an in-memory OpenTelemetry MeterProvider so
- * unit tests can assert that the new guardrails (admission gate,
- * query timeout, query concurrency, heap check) emit the expected
- * counters and gauges.
- *
- * Usage:
- *
- *   const harness = await startMetricsHarness();
- *   // ... exercise production code ...
- *   const sums = await harness.collectCounter("publisher_query_timeout_total");
- *   expect(sums).toBe(1);
- *   await harness.shutdown();
- *
- * The OTel JS API resolves `metrics.getMeter(name)` lazily through a
- * `ProxyMeter`, so registering the MeterProvider here AFTER the
- * production modules have already cached their meter handles works
- * — subsequent `.add()` / observable callbacks route to this
- * harness's provider.
- *
- * The harness drains all of the provider's metrics via
- * `MetricReader.collect()` and reads the cumulative data points
- * directly, bypassing the exporter pipeline so test code doesn't
- * have to thread async callbacks.
- */
-
-import { metrics } from "@opentelemetry/api";
-import { MeterProvider, MetricReader } from "@opentelemetry/sdk-metrics";
-
-/**
- * The simplest possible MetricReader implementation: a no-op that
- * exists only so the `MeterProvider` has a reader to satisfy its
- * collection invariants. Tests call `collect()` directly via the
- * harness; the reader never pushes anywhere.
- */
-class CollectingMetricReader extends MetricReader {
-   protected override async onForceFlush(): Promise<void> {
-      // no-op; tests pull via `collect()` on demand
-   }
-   protected override async onShutdown(): Promise<void> {
-      // no-op
-   }
-}
-
-export interface MetricsHarness {
-   readonly provider: MeterProvider;
-   /**
-    * Force a collection cycle and return the cumulative sum of all
-    * data points for the named counter. Returns 0 when the counter
-    * has not been emitted yet.
-    *
-    * `attributeFilter` lets a test scope the sum to a single label
-    * set (e.g. only the `environment: "test-env"` data point).
-    */
-   collectCounter(
-      name: string,
-      attributeFilter?: Record<string, string | number | boolean>,
-   ): Promise<number>;
-   /**
-    * Force a collection cycle and return the most-recently observed
-    * value of the named gauge, or `undefined` if no callback has
-    * fired for this gauge yet.
-    */
-   collectGauge(name: string): Promise<number | undefined>;
-   /**
-    * Force a collection cycle and return the aggregate `count`/`sum` across all
-    * data points for the named histogram (optionally scoped to one label set).
-    * `count` is 0 when the histogram has not been emitted yet.
-    */
-   collectHistogram(
-      name: string,
-      attributeFilter?: Record<string, string | number | boolean>,
-   ): Promise<{ count: number; sum: number; boundaries: number[] }>;
-   shutdown(): Promise<void>;
-}
-
-export async function startMetricsHarness(): Promise<MetricsHarness> {
-   const reader = new CollectingMetricReader();
-   const provider = new MeterProvider({ readers: [reader] });
-   // OTel JS's `setGlobalMeterProvider` silently refuses to
-   // overwrite an existing global (`registerGlobal` returns false).
-   // Tests that run back-to-back would otherwise route their
-   // metrics into a dead provider from the previous test. Disable
-   // first to clear the slot.
-   metrics.disable();
-   metrics.setGlobalMeterProvider(provider);
-
-   return {
-      provider,
-      async collectCounter(
-         name: string,
-         attributeFilter?: Record<string, string | number | boolean>,
-      ): Promise<number> {
-         const result = await reader.collect();
-         let total = 0;
-         for (const rm of result.resourceMetrics.scopeMetrics) {
-            for (const metric of rm.metrics) {
-               if (metric.descriptor.name !== name) continue;
-               for (const dp of metric.dataPoints) {
-                  if (attributeFilter) {
-                     const allMatch = Object.entries(attributeFilter).every(
-                        ([k, v]) => dp.attributes?.[k] === v,
-                     );
-                     if (!allMatch) continue;
-                  }
-                  total += dp.value as number;
-               }
-            }
-         }
-         return total;
-      },
-      async collectHistogram(
-         name: string,
-         attributeFilter?: Record<string, string | number | boolean>,
-      ): Promise<{ count: number; sum: number; boundaries: number[] }> {
-         const result = await reader.collect();
-         let count = 0;
-         let sum = 0;
-         let boundaries: number[] = [];
-         for (const rm of result.resourceMetrics.scopeMetrics) {
-            for (const metric of rm.metrics) {
-               if (metric.descriptor.name !== name) continue;
-               for (const dp of metric.dataPoints) {
-                  if (attributeFilter) {
-                     const allMatch = Object.entries(attributeFilter).every(
-                        ([k, v]) => dp.attributes?.[k] === v,
-                     );
-                     if (!allMatch) continue;
-                  }
-                  const point = dp.value as {
-                     count: number;
-                     sum?: number;
-                     buckets?: { boundaries: number[] };
-                  };
-                  count += point.count;
-                  sum += point.sum ?? 0;
-                  if (point.buckets) boundaries = point.buckets.boundaries;
-               }
-            }
-         }
-         return { count, sum, boundaries };
-      },
-      async collectGauge(name: string): Promise<number | undefined> {
-         const result = await reader.collect();
-         for (const rm of result.resourceMetrics.scopeMetrics) {
-            for (const metric of rm.metrics) {
-               if (metric.descriptor.name !== name) continue;
-               // Observable gauges yield one data point per
-               // attribute set per collection. Return the last
-               // observed value across all data points so unlabeled
-               // gauges (the common case in this code base) just
-               // work without attribute plumbing.
-               const last = metric.dataPoints[metric.dataPoints.length - 1];
-               return last?.value as number | undefined;
-            }
-         }
-         return undefined;
-      },
-      async shutdown(): Promise<void> {
-         await reader.shutdown();
-         // Clear the global so the next harness's
-         // `setGlobalMeterProvider` is accepted.
-         metrics.disable();
-      },
-   };
-}

package/src/theme_key_parity.spec.ts

@@ -1,57 +0,0 @@
-import { describe, expect, it } from "bun:test";
-import { readFileSync } from "fs";
-import { resolve } from "path";
-import { PER_MODE_COLOR_KEYS } from "./config";
-
-/**
- * The per-mode palette key list is hand-copied in three places: this server
- * copy (config.ts), the SDK copy (packages/sdk/src/theme/keys.ts), and the
- * api-doc.yaml Theme.palette schema. The server and the SDK are intentionally
- * decoupled (neither imports the other), and api-doc.yaml is their only shared
- * contract, so nothing but this test keeps the three in step. A silent drift
- * drops a colour: the server sanitizer or the SDK resolver ignores a key that
- * is not in its own copy.
- */
-
-function extractTsArray(source: string, constName: string): string[] {
-   const decl = source.indexOf(`${constName} = [`);
-   if (decl === -1) throw new Error(`${constName} array not found`);
-   const open = source.indexOf("[", decl);
-   const close = source.indexOf("]", open);
-   return [...source.slice(open + 1, close).matchAll(/"([^"]+)"/g)].map(
-      (m) => m[1],
-   );
-}
-
-function extractApiDocPaletteKeys(apiDoc: string): string[] {
-   const start = apiDoc.indexOf("\n        palette:");
-   if (start === -1) throw new Error("palette block not found in api-doc.yaml");
-   const end = apiDoc.indexOf("\n        font:", start);
-   const block = apiDoc.slice(start, end === -1 ? undefined : end);
-   // Direct children of `palette.properties` sit at 12-space indentation;
-   // deeper keys (type, properties, light, dark) are more indented and skipped.
-   return [...block.matchAll(/^ {12}(\w+):$/gm)].map((m) => m[1]);
-}
-
-describe("per-mode palette key parity", () => {
-   const serverKeys = [...PER_MODE_COLOR_KEYS];
-
-   it("server config.ts matches the SDK keys.ts copy", () => {
-      const sdk = readFileSync(
-         resolve(import.meta.dir, "../../sdk/src/theme/keys.ts"),
-         "utf8",
-      );
-      expect(extractTsArray(sdk, "PER_MODE_COLOR_KEYS")).toEqual(serverKeys);
-   });
-
-   it("server config.ts matches the api-doc.yaml Theme.palette schema", () => {
-      const apiDoc = readFileSync(
-         resolve(import.meta.dir, "../../../api-doc.yaml"),
-         "utf8",
-      );
-      // palette also declares `series` (a shared array, not a per-mode object).
-      expect(new Set(extractApiDocPaletteKeys(apiDoc))).toEqual(
-         new Set([...serverKeys, "series"]),
-      );
-   });
-});

package/src/utils.ts

@@ -1,29 +0,0 @@
-import { URLReader } from "@malloydata/malloy";
-import * as fs from "fs";
-import * as path from "path";
-import { fileURLToPath } from "url";
-
-export const URL_READER: URLReader = {
-   readURL: (url: URL) => {
-      let path = url.toString();
-      if (url.protocol == "file:") {
-         path = fileURLToPath(url);
-      }
-      return fs.promises.readFile(path, "utf8");
-   },
-};
-
-/**
- * Skip dotfiles/dotdirs (.vscode, .git, .DS_Store, etc.) when walking a
- * package tree. These come from editors/VCS, never contain Malloy models
- * or databases, and have been a source of spurious ENOENTs when their
- * contents disappear mid-scan.
- */
-export function ignoreDotfiles(file: string): boolean {
-   return path.basename(file).startsWith(".");
-}
-
-/** The message of a thrown value, stringifying non-Error throws. */
-export function errMessage(err: unknown): string {
-   return err instanceof Error ? err.message : String(err);
-}

package/tests/fixtures/authorize-compile/model.malloy

@@ -1,9 +0,0 @@
-##! experimental.givens
-
-given:
-  ROLE :: string
-
-#(authorize) "$ROLE = 'analyst'"
-source: gated is duckdb.sql("SELECT 1 as x") extend { measure: c is count() }
-
-source: open_src is duckdb.sql("SELECT 1 as x") extend { measure: c is count() }

package/tests/fixtures/authorize-compile/publisher.json

@@ -1,4 +0,0 @@
-{
-   "name": "authorize-compile",
-   "description": "Fixture: a gated source for the /compile authorize HTTP integration test."
-}

package/tests/fixtures/html-pages-nopublic/model.malloy

@@ -1 +0,0 @@
-source: nums is duckdb.sql("SELECT 1 as n")

package/tests/fixtures/html-pages-nopublic/publisher.json

@@ -1,5 +0,0 @@
-{
-  "name": "html-pages-nopublic",
-  "version": "0.0.1",
-  "description": "Package with no public/ directory; static file requests return 404."
-}

package/tests/fixtures/html-pages-test/data.csv

@@ -1,3 +0,0 @@
-id,name
-1,alpha
-2,beta

package/tests/fixtures/html-pages-test/public/assets/app.css

@@ -1,3 +0,0 @@
-body {
-   font-family: system-ui, sans-serif;
-}

package/tests/fixtures/html-pages-test/public/barehtml.html

@@ -1,4 +0,0 @@
-<!doctype html>
-<title>Bare HTML</title>
-<!-- example only, must NOT opt in: <meta name="publisher:fit" content="viewport"> -->
-<h1>No head or body tags; the tag appears only in a comment.</h1>

package/tests/fixtures/html-pages-test/public/bodymeta.html

@@ -1,8 +0,0 @@
-<!doctype html>
-<html>
-   <title>Body Meta</title>
-   <body>
-      <meta name="publisher:fit" content="viewport" />
-      <h1>A real fit meta in &lt;body&gt;; the head-only scan means no opt-in.</h1>
-   </body>
-</html>

package/tests/fixtures/html-pages-test/public/data.json

@@ -1 +0,0 @@
-{ "ok": true }

package/tests/fixtures/html-pages-test/public/fitcomment.html

@@ -1,11 +0,0 @@
-<!doctype html>
-<html>
-   <head>
-      <!-- this deck does <body> styling tricks; the literal must not truncate the scan -->
-      <meta name="publisher:fit" content="viewport" />
-      <title>Fit After Comment</title>
-   </head>
-   <body style="height: 100vh; margin: 0; overflow: hidden">
-      <section style="height: 100%">A full-screen slide</section>
-   </body>
-</html>

package/tests/fixtures/html-pages-test/public/index.html

@@ -1,9 +0,0 @@
-<!doctype html>
-<html>
-   <head>
-      <title>Carrier Dashboard</title>
-   </head>
-   <body>
-      <h1>Hello from the in-package data app</h1>
-   </body>
-</html>

package/tests/fixtures/html-pages-test/public/nohead.html

@@ -1,8 +0,0 @@
-<!doctype html>
-<html>
-   <title>No Head Close Tag</title>
-   <body>
-      <h1>Omits the optional &lt;/head&gt; end tag</h1>
-      <!-- shown in body, must NOT opt in: <meta name="publisher:fit" content="viewport"> -->
-   </body>
-</html>

package/tests/fixtures/html-pages-test/public/notfit.html

@@ -1,13 +0,0 @@
-<!doctype html>
-<html>
-   <head>
-      <meta charset="utf-8" />
-      <meta name="viewport" content="width=device-width, initial-scale=1" />
-      <meta data-name="publisher:fit" content="viewport" />
-      <title>Tall Dashboard</title>
-   </head>
-   <body>
-      <h1>A normal dashboard that hugs its content</h1>
-      <!-- shown in body, must NOT opt in: <meta name="publisher:fit" content="viewport"> -->
-   </body>
-</html>

package/tests/fixtures/html-pages-test/public/slides.html

@@ -1,12 +0,0 @@
-<!doctype html>
-<html>
-   <head>
-      <meta charset="utf-8" />
-      <meta name="viewport" content="width=device-width, initial-scale=1" />
-      <meta name="publisher:fit" content="viewport" />
-      <title>FY27 Slide Deck</title>
-   </head>
-   <body style="height: 100vh; margin: 0; overflow: hidden">
-      <section style="height: 100%">A full-screen slide</section>
-   </body>
-</html>

package/tests/fixtures/html-pages-test/public/sub/page2.html

@@ -1,9 +0,0 @@
-<!doctype html>
-<html>
-   <head>
-      <title>Second Page</title>
-   </head>
-   <body>
-      <p>A page in a subdirectory.</p>
-   </body>
-</html>

package/tests/fixtures/html-pages-test/public/unterminated.html

@@ -1,10 +0,0 @@
-<!doctype html>
-<html>
-   <head>
-      <title>Unterminated Comment</title>
-      <!-- never closed, must NOT opt in: <meta name="publisher:fit" content="viewport">
-   </head>
-   <body>
-      <h1>An unterminated comment swallows the tag.</h1>
-   </body>
-</html>

package/tests/fixtures/html-pages-test/publisher.json

@@ -1,5 +0,0 @@
-{
-  "name": "html-pages-test",
-  "version": "1.0.0",
-  "description": "Fixture for in-package HTML static-file serving + /pages + /events"
-}

package/tests/fixtures/html-pages-test/report.malloy

@@ -1 +0,0 @@
-source: report is duckdb.sql("SELECT 1 as n")

package/tests/fixtures/persist-multi-level/data/orders.csv

@@ -1,5 +0,0 @@
-category,amount
-electronics,100
-clothing,50
-electronics,200
-clothing,75

package/tests/fixtures/persist-multi-level/multi_level.malloy

@@ -1,18 +0,0 @@
-##! experimental.persistence
-
-source: raw_orders is duckdb.table('data/orders.csv')
-
-// Upstream persist source: an aggregate over the base CSV.
-#@ persist name="orders_base"
-source: orders_base is raw_orders -> {
-  group_by: category
-  aggregate: total_amount is amount.sum()
-}
-
-// Downstream persist source: references the persist upstream `orders_base`.
-// A per-unit build of `orders_rollup` alone must REFERENCE orders_base's
-// materialized table (via referenceManifest) rather than recompute it live.
-#@ persist name="orders_rollup"
-source: orders_rollup is orders_base -> {
-  aggregate: category_count is count()
-}

package/tests/fixtures/persist-multi-level/publisher.json

@@ -1,5 +0,0 @@
-{
-  "name": "persist-multi-level",
-  "version": "1.0.0",
-  "description": "DuckDB two-level persist DAG fixture (orders_base -> orders_rollup)"
-}

package/tests/fixtures/persist-schedule-test/data/orders.csv

@@ -1,5 +0,0 @@
-category,amount
-electronics,100
-clothing,50
-electronics,200
-clothing,75

package/tests/fixtures/persist-schedule-test/persist_schedule_test.malloy

@@ -1,11 +0,0 @@
-##! experimental.persistence
-
-source: raw_orders is duckdb.table('data/orders.csv')
-
-#@ persist name="order_summary"
-source: order_summary is raw_orders -> {
-  group_by: category
-  aggregate:
-    total_orders is count()
-    total_revenue is amount.sum()
-}

package/tests/fixtures/persist-schedule-test/publisher.json

@@ -1,7 +0,0 @@
-{
-  "name": "persist-schedule-test",
-  "version": "1.0.0",
-  "description": "DuckDB persist fixture with a version-scoped materialization schedule",
-  "scope": "version",
-  "materialization": { "schedule": "0 6 * * *" }
-}

package/tests/fixtures/persist-schedule-warn-test/data/orders.csv

@@ -1,5 +0,0 @@
-category,amount
-electronics,100
-clothing,50
-electronics,200
-clothing,75