@oneuptime/common 13.0.4 → 13.0.5

package/Tests/Server/Infrastructure/E2EClickHouseFixtureAccess.test.ts

@@ -0,0 +1,240 @@
+import { describe, expect, test } from "@jest/globals";
+import fs from "fs";
+import path from "path";
+import yaml from "js-yaml";
+
+/*
+ * E2E/Tests/Dashboard/ExceptionDetailPages.spec.ts seeds an exception
+ * occurrence by writing straight to ClickHouse over HTTP
+ * (E2E/Tests/Dashboard/Helpers/ExceptionOccurrenceFixture.ts), because the
+ * public API deliberately cannot write ExceptionInstance.retentionDate.
+ *
+ * That write works only while four places agree, and none of them fails on its
+ * own when they drift: the suite just reports ECONNREFUSED in jobs that run
+ * after merge. It shipped exactly that way - the e2e service ran with
+ * network_mode: host and no ClickHouse settings, the stacks CI starts publish
+ * no ClickHouse port, and every e2e job on master failed in beforeAll. So:
+ *
+ *  - production compose files publish no ClickHouse port at all;
+ *  - the test-only overlay publishes ClickHouse HTTP on loopback only, on the
+ *    host port docker-compose.dev.yml uses and the fixture maps to;
+ *  - the host-networked e2e service receives the connection settings;
+ *  - every workflow job that runs the e2e service starts its stack with the
+ *    overlay (the release workflow is where a partial fix would slip through,
+ *    since it only runs when a release is cut).
+ */
+
+const REPO_ROOT: string = path.resolve(__dirname, "../../../..");
+const WORKFLOWS_DIRECTORY: string = path.join(
+  REPO_ROOT,
+  ".github",
+  "workflows",
+);
+const OVERLAY_FILE_NAME: string = "docker-compose.e2e-clickhouse.yml";
+const FIXTURE_PATH: string = path.join(
+  REPO_ROOT,
+  "E2E",
+  "Tests",
+  "Dashboard",
+  "Helpers",
+  "ExceptionOccurrenceFixture.ts",
+);
+
+const PRODUCTION_COMPOSE_FILES: Array<string> = [
+  "docker-compose.base.yml",
+  "docker-compose.yml",
+  "docker-compose.billing.yml",
+];
+
+const CLICKHOUSE_CONNECTION_SETTINGS: Array<string> = [
+  "CLICKHOUSE_USER",
+  "CLICKHOUSE_PASSWORD",
+  "CLICKHOUSE_DATABASE",
+  "CLICKHOUSE_HOST",
+  "CLICKHOUSE_PORT",
+];
+
+const CLICKHOUSE_HTTP_CONTAINER_PORT: string = "8123";
+
+// The step that runs the suite: `docker compose -f docker-compose.dev.yml up ... e2e`.
+const RUNS_E2E_SERVICE: RegExp =
+  /docker compose\s[^\n]*-f docker-compose\.(?:dev|e2e)\.yml\s+up\b[^\n]*\se2e\b/;
+const UP_SUBCOMMAND: RegExp = /\sup(?:\s|$)/;
+const WORKFLOW_FILE: RegExp = /\.ya?ml$/;
+const FIXTURE_LOCAL_PORT: RegExp =
+  /LOCAL_CLICKHOUSE_HTTP_PORT: string = "(\d+)"/;
+
+interface ComposeService {
+  ports?: Array<string>;
+  network_mode?: string;
+  environment?: Record<string, string>;
+}
+
+interface ComposeFile {
+  services?: Record<string, ComposeService>;
+  "x-common-variables"?: Record<string, string>;
+}
+
+interface WorkflowStep {
+  run?: string;
+}
+
+interface WorkflowJob {
+  steps?: Array<WorkflowStep>;
+}
+
+interface WorkflowFile {
+  jobs?: Record<string, WorkflowJob>;
+}
+
+interface PublishedPort {
+  hostIp: string;
+  hostPort: string;
+  containerPort: string;
+}
+
+function readYaml<T>(filePath: string): T {
+  return yaml.load(fs.readFileSync(filePath, "utf8")) as T;
+}
+
+function readCompose(fileName: string): ComposeFile {
+  return readYaml<ComposeFile>(path.join(REPO_ROOT, fileName));
+}
+
+// Compose short syntax: "HOST_IP:HOST_PORT:CONTAINER_PORT" or "HOST_PORT:CONTAINER_PORT".
+function parsePort(entry: string): PublishedPort {
+  const parts: Array<string> = entry.split(":");
+
+  if (parts.length === 3) {
+    return {
+      hostIp: parts[0]!,
+      hostPort: parts[1]!,
+      containerPort: parts[2]!,
+    };
+  }
+
+  if (parts.length === 2) {
+    return { hostIp: "", hostPort: parts[0]!, containerPort: parts[1]! };
+  }
+
+  throw new Error(`Unsupported compose port syntax: ${entry}`);
+}
+
+function clickHouseHttpHostPort(compose: ComposeFile): string | undefined {
+  return (compose.services?.["clickhouse"]?.ports || [])
+    .map(parsePort)
+    .find((port: PublishedPort) => {
+      return port.containerPort === CLICKHOUSE_HTTP_CONTAINER_PORT;
+    })?.hostPort;
+}
+
+function startsStackWithOverlay(runText: string): boolean {
+  return runText.split("\n").some((line: string) => {
+    return (
+      line.includes("docker compose") &&
+      line.includes(`-f ${OVERLAY_FILE_NAME}`) &&
+      UP_SUBCOMMAND.test(line)
+    );
+  });
+}
+
+describe("E2E ClickHouse fixture access", () => {
+  test.each(PRODUCTION_COMPOSE_FILES)(
+    "%s publishes no ClickHouse port",
+    (fileName: string) => {
+      const compose: ComposeFile = readCompose(fileName);
+
+      expect(compose.services?.["clickhouse"]).toBeDefined();
+      expect(compose.services?.["clickhouse"]?.ports).toBeUndefined();
+    },
+  );
+
+  test("the overlay publishes only ClickHouse HTTP, and only on loopback", () => {
+    const overlay: ComposeFile = readCompose(OVERLAY_FILE_NAME);
+
+    expect(Object.keys(overlay.services || {})).toEqual(["clickhouse"]);
+    expect(Object.keys(overlay.services!["clickhouse"]!)).toEqual(["ports"]);
+
+    const ports: Array<PublishedPort> =
+      overlay.services!["clickhouse"]!.ports!.map(parsePort);
+
+    expect(ports.length).toBeGreaterThan(0);
+    for (const port of ports) {
+      expect(port.hostIp).toBe("127.0.0.1");
+      expect(port.containerPort).toBe(CLICKHOUSE_HTTP_CONTAINER_PORT);
+    }
+  });
+
+  test("the overlay, the dev stack and the fixture agree on the host port", () => {
+    const fixturePort: string | undefined = fs
+      .readFileSync(FIXTURE_PATH, "utf8")
+      .match(FIXTURE_LOCAL_PORT)?.[1];
+
+    expect(fixturePort).toBeDefined();
+    expect(clickHouseHttpHostPort(readCompose(OVERLAY_FILE_NAME))).toBe(
+      fixturePort,
+    );
+    expect(clickHouseHttpHostPort(readCompose("docker-compose.dev.yml"))).toBe(
+      fixturePort,
+    );
+  });
+
+  test("the host-networked e2e service receives the fixture's ClickHouse settings", () => {
+    const base: ComposeFile = readCompose("docker-compose.base.yml");
+    const e2e: ComposeService = base.services!["e2e"]!;
+
+    expect(e2e.network_mode).toBe("host");
+    for (const name of CLICKHOUSE_CONNECTION_SETTINGS) {
+      expect(e2e.environment?.[name]).toBe(`\${${name}}`);
+    }
+    expect(e2e.environment?.["E2E_CLICKHOUSE_URL"]).toBe(
+      "${E2E_CLICKHOUSE_URL:-}",
+    );
+
+    // Passed to e2e alone, never through the variables every service shares.
+    expect(base["x-common-variables"]).not.toHaveProperty(
+      "CLICKHOUSE_PASSWORD",
+    );
+  });
+
+  test("every workflow job that runs the e2e service starts its stack with the overlay", () => {
+    const e2eJobs: Array<string> = [];
+    const jobsWithoutOverlay: Array<string> = [];
+
+    for (const fileName of fs.readdirSync(WORKFLOWS_DIRECTORY).sort()) {
+      if (!WORKFLOW_FILE.test(fileName)) {
+        continue;
+      }
+
+      const workflow: WorkflowFile = readYaml<WorkflowFile>(
+        path.join(WORKFLOWS_DIRECTORY, fileName),
+      );
+
+      for (const [jobName, job] of Object.entries(workflow.jobs || {})) {
+        const runText: string = (job.steps || [])
+          .map((step: WorkflowStep) => {
+            return step.run || "";
+          })
+          .join("\n");
+
+        if (!RUNS_E2E_SERVICE.test(runText)) {
+          continue;
+        }
+
+        e2eJobs.push(`${fileName}#${jobName}`);
+        if (!startsStackWithOverlay(runText)) {
+          jobsWithoutOverlay.push(`${fileName}#${jobName}`);
+        }
+      }
+    }
+
+    // The scan must see the master and release suites, or it proves nothing.
+    expect(e2eJobs).toEqual(
+      expect.arrayContaining([
+        expect.stringMatching(/^test-release\.yaml#/),
+        expect.stringMatching(/^release\.yml#/),
+      ]),
+    );
+    expect(jobsWithoutOverlay).toEqual([]);
+  });
+});

package/Tests/Server/Middleware/TelemetryIngestBrowserKey.test.ts

@@ -23,6 +23,10 @@ import TelemetryIngestionKeyPolicy, {
   DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE,
 } from "../../../Types/Telemetry/TelemetryIngestionKeyPolicy";
 import TelemetryIngestionKeyType from "../../../Types/Telemetry/TelemetryIngestionKeyType";
+import {
+  SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER,
+  SESSION_REPLAY_RECORDER_KIND_HEADER,
+} from "../../../Types/Rum/SessionReplay";
 import TelemetryIngestSurface, {
   BROWSER_ALLOWED_INGEST_SURFACES,
   getIngestSurfaceReadableName,
@@ -754,6 +758,231 @@ describe("TelemetryIngest browser ingestion key guard", () => {
     });
   });
 
+  describe("native session replay identity", () => {
+    const MOBILE_APP_IDENTIFIER: string = "com.example.checkout";
+    const MOBILE_APP_ORIGIN: string = `app://${MOBILE_APP_IDENTIFIER}`;
+
+    function mobileHeaders(
+      overrides?: Record<string, string>,
+    ): Record<string, string> {
+      return tokenHeaders({
+        [SESSION_REPLAY_RECORDER_KIND_HEADER]: "rn-view-tree",
+        [SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER]: MOBILE_APP_IDENTIFIER,
+        ...(overrides || {}),
+      });
+    }
+
+    test("an origin-less native replay request matches its exact app:// allowlist entry", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders(),
+      );
+
+      expect(Response.sendErrorResponse as MockFn).not.toHaveBeenCalled();
+      expect(result.next).toHaveBeenCalledTimes(1);
+      expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe(
+        MOBILE_APP_ORIGIN,
+      );
+    });
+
+    test("the synthesized app:// identity is trimmed and lowercased once for both authorization layers", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders({
+          [SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER]:
+            "  COM.Example.Checkout  ",
+        }),
+      );
+
+      expect(result.next).toHaveBeenCalledTimes(1);
+      expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe(
+        MOBILE_APP_ORIGIN,
+      );
+    });
+
+    test("a sibling mobile app is refused by an exact app:// entry", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders({
+          [SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER]: "com.example.attacker",
+        }),
+      );
+
+      expect(result.next).not.toHaveBeenCalled();
+      const error: Error = refusal();
+      expect(error).toBeInstanceOf(NotAuthorizedException);
+      expect(error.message).toContain("app://com.example.attacker");
+    });
+
+    test("an app:// wildcard cannot authorize a mobile sibling", async () => {
+      resolveTo(
+        buildBrowserPolicy({ allowedOrigins: ["app://*.example.checkout"] }),
+      );
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders(),
+      );
+
+      expect(result.next).not.toHaveBeenCalled();
+      expect(refusal()).toBeInstanceOf(NotAuthorizedException);
+    });
+
+    test.each([
+      ["missing recorder kind", {}],
+      ["the legacy dom kind", { [SESSION_REPLAY_RECORDER_KIND_HEADER]: "dom" }],
+      [
+        "an unknown recorder kind",
+        { [SESSION_REPLAY_RECORDER_KIND_HEADER]: "RN-VIEW-TREE" },
+      ],
+      [
+        "a whitespace-padded recorder kind",
+        { [SESSION_REPLAY_RECORDER_KIND_HEADER]: " rn-view-tree " },
+      ],
+      [
+        "a missing mobile identifier",
+        { [SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER]: "" },
+      ],
+      [
+        "a malformed mobile identifier",
+        { [SESSION_REPLAY_MOBILE_APP_IDENTIFIER_HEADER]: "../checkout" },
+      ],
+    ])(
+      "does not synthesize an app origin for %s",
+      async (_name: string, overrides: Record<string, string>) => {
+        resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+        const headers: Record<string, string> = mobileHeaders(overrides);
+
+        if (_name === "missing recorder kind") {
+          delete headers[SESSION_REPLAY_RECORDER_KIND_HEADER];
+        }
+
+        const result: RunResult = await run(
+          TelemetryIngestSurface.SessionReplay,
+          headers,
+        );
+
+        expect(result.next).not.toHaveBeenCalled();
+        expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe(
+          undefined,
+        );
+        expect(refusal().message).toContain("did not send an Origin header");
+      },
+    );
+
+    test("mobile headers never create an identity on a non-replay ingest surface", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.OtelTraces,
+        mobileHeaders(),
+      );
+
+      expect(result.next).not.toHaveBeenCalled();
+      expect(refusal().message).toContain("did not send an Origin header");
+    });
+
+    test.each([
+      TelemetryIngestSurface.OtelLogs,
+      TelemetryIngestSurface.OtelMetrics,
+      TelemetryIngestSurface.OtelTraces,
+    ])(
+      "a caller-supplied app origin cannot authorize %s",
+      async (surface: TelemetryIngestSurface) => {
+        resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+        const result: RunResult = await run(
+          surface,
+          tokenHeaders({ origin: MOBILE_APP_ORIGIN }),
+        );
+
+        expect(result.next).not.toHaveBeenCalled();
+        expect(refusal()).toBeInstanceOf(NotAuthorizedException);
+        expect(refusal().message).toContain("did not send an Origin header");
+        expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe("");
+      },
+    );
+
+    test("a caller-supplied app origin cannot authorize a DOM replay", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        tokenHeaders({ origin: "APP://COM.EXAMPLE.CHECKOUT/" }),
+      );
+
+      expect(result.next).not.toHaveBeenCalled();
+      expect(refusal()).toBeInstanceOf(NotAuthorizedException);
+      expect(refusal().message).toContain("did not send an Origin header");
+      expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe("");
+    });
+
+    test("server keys never synthesize a public mobile identity", async () => {
+      resolveTo(buildPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders(),
+      );
+
+      expect(Response.sendErrorResponse as MockFn).not.toHaveBeenCalled();
+      expect(result.next).toHaveBeenCalledTimes(1);
+      expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe(
+        undefined,
+      );
+    });
+
+    test("a real browser Origin always wins over otherwise-valid mobile headers", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [ALLOWED_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders({ origin: ALLOWED_ORIGIN }),
+      );
+
+      expect(result.next).toHaveBeenCalledTimes(1);
+      expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe(
+        ALLOWED_ORIGIN,
+      );
+    });
+
+    test("a browser page cannot select the mobile identity path when its real Origin is disallowed", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const realBrowserOrigin: string = "https://attacker.example.net";
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders({ origin: realBrowserOrigin }),
+      );
+
+      expect(result.next).not.toHaveBeenCalled();
+      expect(refusal().message).toContain(realBrowserOrigin);
+      expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe(
+        realBrowserOrigin,
+      );
+    });
+
+    test("a blank but present Origin is not replaced by the mobile identity fallback", async () => {
+      resolveTo(buildBrowserPolicy({ allowedOrigins: [MOBILE_APP_ORIGIN] }));
+
+      const result: RunResult = await run(
+        TelemetryIngestSurface.SessionReplay,
+        mobileHeaders({ origin: "" }),
+      );
+
+      expect(result.next).not.toHaveBeenCalled();
+      expect(refusal().message).toContain("did not send an Origin header");
+      expect((result.req as TelemetryRequest).resolvedClientOrigin).toBe("");
+    });
+  });
+
   describe("per-key rate limit", () => {
     test("a browser key with no configured limit is held to the shipped browser default", async () => {
       resolveTo(buildBrowserPolicy({ requestsPerMinuteLimit: null }));

package/Tests/Server/Services/InventoryItemDisplayName.test.ts

@@ -337,3 +337,69 @@ describe("existing InventoryItem display-name convergence", () => {
     );
   });
 });
+
+describe("InventoryItemService.deriveDisplayName for inferred dependencies", () => {
+  test("a database reads as its namespace, then its host, then its engine", () => {
+    expect(
+      InventoryItemService.deriveDisplayName(
+        entity({
+          entityType: EntityType.Database,
+          identifyingAttributes: {
+            "db.system.name": "postgresql",
+            "server.address": "db.internal",
+            "db.namespace": "orders",
+          },
+        }),
+      ),
+    ).toBe("orders");
+    expect(
+      InventoryItemService.deriveDisplayName(
+        entity({
+          entityType: EntityType.Database,
+          identifyingAttributes: {
+            "db.system.name": "redis",
+            "server.address": "cache.internal",
+          },
+        }),
+      ),
+    ).toBe("cache.internal");
+    expect(
+      InventoryItemService.deriveDisplayName(
+        entity({
+          entityType: EntityType.Database,
+          identifyingAttributes: { "db.system.name": "sqlite" },
+        }),
+      ),
+    ).toBe("sqlite");
+  });
+
+  test("a remote service reads as the name callers gave it, then its host", () => {
+    expect(
+      InventoryItemService.deriveDisplayName(
+        entity({
+          entityType: EntityType.RemoteService,
+          identifyingAttributes: { "peer.service": "stripe" },
+        }),
+      ),
+    ).toBe("stripe");
+    expect(
+      InventoryItemService.deriveDisplayName(
+        entity({
+          entityType: EntityType.RemoteService,
+          identifyingAttributes: {
+            "messaging.system": "kafka",
+            "server.address": "kafka-0.kafka",
+          },
+        }),
+      ),
+    ).toBe("kafka-0.kafka");
+    expect(
+      InventoryItemService.deriveDisplayName(
+        entity({
+          entityType: EntityType.RemoteService,
+          identifyingAttributes: { "rpc.service": "acme.ledger.v1.ledger" },
+        }),
+      ),
+    ).toBe("acme.ledger.v1.ledger");
+  });
+});

package/Tests/Server/Services/OpenTelemetryResourceRetentionMemo.test.ts

@@ -35,6 +35,7 @@ import IoTFleetService from "../../../Server/Services/IoTFleetService";
 import ServerlessFunctionService from "../../../Server/Services/ServerlessFunctionService";
 import CloudResourceService from "../../../Server/Services/CloudResourceService";
 import RumApplicationService from "../../../Server/Services/RumApplicationService";
+import TelemetryRetentionConfig from "../../../Types/Telemetry/TelemetryRetentionConfig";
 import ServiceType from "../../../Types/Telemetry/ServiceType";
 import ObjectID from "../../../Types/ObjectID";
 import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
@@ -137,6 +138,12 @@ const RETENTION_CASES: Array<RetentionCase> = [
 ];
 
 const PROJECT_DEFAULT_RETENTION_DAYS: number = 15;
+const RESOURCE_RETENTION_CONFIG: TelemetryRetentionConfig = {
+  logs: { default: 45 },
+  traces: { default: 60 },
+  metrics: { default: 90 },
+  profiles: { default: 30 },
+};
 
 let nowMs: number;
 
@@ -181,7 +188,7 @@ describe.each(RETENTION_CASES)(
       findOneById = jest.spyOn(service, "findOneById") as jest.SpyInstance;
       findOneById.mockResolvedValue({
         retainTelemetryDataForDays: 30,
-        telemetryRetentionConfig: null,
+        telemetryRetentionConfig: RESOURCE_RETENTION_CONFIG,
       });
     });
 
@@ -204,6 +211,22 @@ describe.each(RETENTION_CASES)(
       expect(findOneById).toHaveBeenCalledTimes(1);
     });
 
+    test("requests both the default and per-pillar retention fields", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+      const resourceId: ObjectID = ObjectID.generate();
+
+      await build({ serviceType, resourceId, projectId });
+
+      expect(findOneById).toHaveBeenCalledWith({
+        id: resourceId,
+        select: {
+          retainTelemetryDataForDays: true,
+          telemetryRetentionConfig: true,
+        },
+        props: { isRoot: true },
+      });
+    });
+
     test("the memoed build carries the same retention as the resolving one", async () => {
       const projectId: ObjectID = ObjectID.generate();
       const resourceId: ObjectID = ObjectID.generate();
@@ -220,8 +243,12 @@ describe.each(RETENTION_CASES)(
       });
 
       expect(first.serviceRetentionInDays).toBe(30);
+      expect(first.serviceRetentionConfig).toEqual(RESOURCE_RETENTION_CONFIG);
       expect(first.dataRententionInDays).toBe(30);
       expect(second.serviceRetentionInDays).toBe(first.serviceRetentionInDays);
+      expect(second.serviceRetentionConfig).toEqual(
+        first.serviceRetentionConfig,
+      );
       expect(second.dataRententionInDays).toBe(first.dataRententionInDays);
     });