@oneuptime/common 14.0.13 → 14.0.14

package/build/dist/Types/SSO/OidcProviderDefaults.js

@@ -0,0 +1,189 @@
+import URL from "../API/URL";
+import { fillSsoProviderDescription, isBlankSsoValue, } from "./SsoProviderDefaults";
+/*
+ * WHAT AN OPENID CONNECT PROVIDER IS GIVEN, AND WHAT IS WORKED OUT FROM IT.
+ *
+ * Adding an OIDC provider - for a project, a status page or the whole
+ * instance - asked for eleven things over four steps. Only three come from
+ * the identity provider and differ from one setup to the next: the issuer,
+ * the client ID and the client secret. The rest has an answer:
+ *
+ *   - the discovery URL is the issuer followed by
+ *     /.well-known/openid-configuration (OpenID Connect Discovery 1.0,
+ *     section 4: any trailing "/" of the issuer is dropped first), so it is
+ *     worked out from the issuer;
+ *   - the scopes, and the claims that hold the email address and the name,
+ *     are "openid email profile", "email" and "name" for nearly every
+ *     provider;
+ *   - the description is "Sign in with <name>" (SsoProviderDefaults).
+ *
+ * The services (ProjectOidcService, StatusPageOidcService,
+ * GlobalOidcService) fill these in when a provider is created without them,
+ * before the required-field check runs, so the columns stay required and
+ * the API and Terraform keep their contract while a caller may leave them
+ * out. The forms show the same values, so what a form shows is what is
+ * saved. A provider that already exists keeps what it has.
+ *
+ * Nothing here fetches anything: the discovery document is read when
+ * someone signs in, as before, through the OIDC egress guard.
+ *
+ * React-free and server-safe: the API, the Dashboard, the Admin Dashboard
+ * and their tests all read it.
+ */
+export const OIDC_DISCOVERY_PATH = "/.well-known/openid-configuration";
+export const DEFAULT_OIDC_SCOPES = "openid email profile";
+export const DEFAULT_OIDC_EMAIL_CLAIM_NAME = "email";
+export const DEFAULT_OIDC_NAME_CLAIM_NAME = "name";
+// The scope every OpenID Connect sign-in has to ask for.
+export const REQUIRED_OIDC_SCOPE = "openid";
+/*
+ * An issuer is an https URL (OpenID Connect Core 1.0, section 1.2); an
+ * identity provider on the installation's own network may be plain http.
+ */
+const ISSUER_SCHEME = /^https?:\/\/\S+/i;
+/*
+ * A discovery URL: something, then /.well-known/openid-configuration, then
+ * at most a "/" and a query. Some providers need the query (Azure AD B2C
+ * names its sign-in policy in ?p=), so it is kept; a fragment never reaches
+ * a server and is dropped.
+ */
+const DISCOVERY_URL = /^(.+?)\/\.well-known\/openid-configuration\/?(\?[^#]*)?(#.*)?$/i;
+/**
+ * When a value is a discovery URL rather than an issuer (it ends in
+ * /.well-known/openid-configuration, perhaps with a query), the issuer in
+ * front of it and the URL itself. Null for anything else, an issuer
+ * included.
+ */
+export const splitOidcDiscoveryUrl = (value) => {
+    if (typeof value !== "string") {
+        return null;
+    }
+    const match = value.trim().match(DISCOVERY_URL);
+    const issuerURL = (match === null || match === void 0 ? void 0 : match[1]) || "";
+    if (!match || !issuerURL.replace(/\/+$/, "")) {
+        return null;
+    }
+    return {
+        issuerURL,
+        discoveryURL: `${issuerURL.replace(/\/+$/, "")}${OIDC_DISCOVERY_PATH}${match[2] || ""}`,
+    };
+};
+/**
+ * The issuer a value names: the value itself, trimmed - or, for a discovery
+ * URL pasted where the issuer goes, the issuer in front of it.
+ */
+export const getOidcIssuerFromValue = (value) => {
+    const split = splitOidcDiscoveryUrl(value);
+    if (split) {
+        return split.issuerURL;
+    }
+    return typeof value === "string" ? value.trim() : "";
+};
+/**
+ * The discovery URL of an issuer: the issuer without a trailing "/", then
+ * /.well-known/openid-configuration. Empty for a blank issuer; a discovery
+ * URL given as the issuer is its own.
+ */
+export const getOidcDiscoveryUrl = (issuer) => {
+    const split = splitOidcDiscoveryUrl(issuer);
+    if (split) {
+        return split.discoveryURL;
+    }
+    const trimmed = typeof issuer === "string" ? issuer.trim() : "";
+    if (!trimmed) {
+        return "";
+    }
+    return trimmed.replace(/\/+$/, "") + OIDC_DISCOVERY_PATH;
+};
+/**
+ * Whether a discovery URL is the one the issuer gives (or none at all): it
+ * then follows the issuer when the issuer changes. One set by hand, for a
+ * provider that publishes its discovery document somewhere else, stays.
+ */
+export const isDefaultOidcDiscoveryUrl = (data) => {
+    if (isBlankSsoValue(data.discoveryURL)) {
+        return true;
+    }
+    const derived = getOidcDiscoveryUrl(data.issuerURL);
+    return (Boolean(derived) &&
+        normalizeUrlText(String(data.discoveryURL)) === normalizeUrlText(derived));
+};
+/*
+ * The URL type writes a URL back the way it parsed it, which may differ from
+ * how it was typed in ways that do not matter here: the case of the scheme
+ * and of the host, and a trailing "/".
+ */
+const normalizeUrlText = (value) => {
+    const trimmed = value.trim().replace(/\/+$/, "");
+    const match = trimmed.match(/^([a-z][a-z0-9+.-]*:\/\/)([^/?#]*)(.*)$/i);
+    if (!match) {
+        return trimmed;
+    }
+    return `${(match[1] || "").toLowerCase()}${(match[2] || "").toLowerCase()}${match[3] || ""}`;
+};
+// Whether an issuer is written as an http(s) URL.
+export const isOidcIssuerUrl = (value) => {
+    return typeof value === "string" && ISSUER_SCHEME.test(value.trim());
+};
+// The scopes, one by one.
+export const getOidcScopeList = (scopes) => {
+    if (typeof scopes !== "string") {
+        return [];
+    }
+    return scopes.split(/\s+/).filter((scope) => {
+        return scope.length > 0;
+    });
+};
+// Whether the scopes ask for openid, which every OIDC sign-in needs.
+export const includesRequiredOidcScope = (scopes) => {
+    return getOidcScopeList(scopes).includes(REQUIRED_OIDC_SCOPE);
+};
+/**
+ * What a provider created without them gets, in place:
+ *
+ *   - an issuer given as a discovery URL becomes the issuer in front of it
+ *     (and the URL its discovery URL, unless one was given);
+ *   - a missing discovery URL is worked out from the issuer;
+ *   - missing scopes and claim names are the usual ones;
+ *   - a missing description is "Sign in with <name>".
+ *
+ * Whatever the caller sent is kept. A value that cannot be worked out (no
+ * issuer, or one that is not a URL) is left missing, so the required-field
+ * check names it.
+ */
+export const fillOidcProviderDefaults = (provider) => {
+    if (typeof provider.issuerURL === "string") {
+        const split = splitOidcDiscoveryUrl(provider.issuerURL);
+        provider.issuerURL = split ? split.issuerURL : provider.issuerURL.trim();
+        if (split && isBlankSsoValue(provider.discoveryURL)) {
+            provider.discoveryURL = toUrl(split.discoveryURL);
+        }
+    }
+    if (isBlankSsoValue(provider.discoveryURL) &&
+        isOidcIssuerUrl(provider.issuerURL)) {
+        provider.discoveryURL = toUrl(getOidcDiscoveryUrl(provider.issuerURL));
+    }
+    if (isBlankSsoValue(provider.scopes)) {
+        provider.scopes = DEFAULT_OIDC_SCOPES;
+    }
+    if (isBlankSsoValue(provider.emailClaimName)) {
+        provider.emailClaimName = DEFAULT_OIDC_EMAIL_CLAIM_NAME;
+    }
+    if (isBlankSsoValue(provider.nameClaimName)) {
+        provider.nameClaimName = DEFAULT_OIDC_NAME_CLAIM_NAME;
+    }
+    fillSsoProviderDescription(provider);
+};
+// A URL the column can hold, or nothing when the text does not parse.
+const toUrl = (value) => {
+    if (!value) {
+        return undefined;
+    }
+    try {
+        return URL.fromString(value);
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+//# sourceMappingURL=OidcProviderDefaults.js.map

package/build/dist/Types/SSO/OidcProviderDefaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OidcProviderDefaults.js","sourceRoot":"","sources":["../../../../Types/SSO/OidcProviderDefaults.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,YAAY,CAAC;AAC7B,OAAO,EAEL,0BAA0B,EAC1B,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAW,mCAAmC,CAAC;AAE/E,MAAM,CAAC,MAAM,mBAAmB,GAAW,sBAAsB,CAAC;AAElE,MAAM,CAAC,MAAM,6BAA6B,GAAW,OAAO,CAAC;AAE7D,MAAM,CAAC,MAAM,4BAA4B,GAAW,MAAM,CAAC;AAE3D,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAW,QAAQ,CAAC;AAEpD;;;GAGG;AACH,MAAM,aAAa,GAAW,kBAAkB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,aAAa,GACjB,iEAAiE,CAAC;AAOpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAEJ,CAC5B,KAAgC,EACR,EAAE;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAA4B,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzE,MAAM,SAAS,GAAW,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,KAAI,EAAE,CAAC;IAE3C,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS;QACT,YAAY,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mBAAmB,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;KACxF,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAErB,CAAC,KAAgC,EAAU,EAAE;IACzD,MAAM,KAAK,GAA2B,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEnE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAElB,CAAC,MAAiC,EAAU,EAAE;IAC1D,MAAM,KAAK,GAA2B,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEpE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAW,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC;AAC3D,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAGtB,CAAC,IAGhB,EAAW,EAAE;IACZ,IAAI,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAW,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE5D,OAAO,CACL,OAAO,CAAC,OAAO,CAAC;QAChB,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAC1E,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAA8B,CAAC,KAAa,EAAU,EAAE;IAC5E,MAAM,OAAO,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAA4B,OAAO,CAAC,KAAK,CAClD,0CAA0C,CAC3C,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/F,CAAC,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAkD,CAC5E,KAAgC,EACvB,EAAE;IACX,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF,0BAA0B;AAC1B,MAAM,CAAC,MAAM,gBAAgB,GAER,CAAC,MAAiC,EAAiB,EAAE;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE;QAC3D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAEvB,CAAC,MAAiC,EAAW,EAAE;IAC5D,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAChE,CAAC,CAAC;AAeF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAEzB,CAAC,QAAmC,EAAQ,EAAE;IACxD,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,KAAK,GAA2B,qBAAqB,CACzD,QAAQ,CAAC,SAAS,CACnB,CAAC;QAEF,QAAQ,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAEzE,IAAI,KAAK,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACpD,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,IACE,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,EACnC,CAAC;QACD,QAAQ,CAAC,YAAY,GAAG,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,MAAM,GAAG,mBAAmB,CAAC;IACxC,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,QAAQ,CAAC,cAAc,GAAG,6BAA6B,CAAC;IAC1D,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,aAAa,GAAG,4BAA4B,CAAC;IACxD,CAAC;IAED,0BAA0B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,KAAK,GAAuC,CAChD,KAAa,EACI,EAAE;IACnB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC"}

package/build/dist/Types/SSO/SamlProviderDefaults.js

@@ -0,0 +1,55 @@
+import DigestMethod from "./DigestMethod";
+import SignatureMethod from "./SignatureMethod";
+import { fillSsoProviderDescription, isBlankSsoValue, } from "./SsoProviderDefaults";
+/*
+ * WHAT A SAML PROVIDER IS GIVEN, AND WHAT IS FILLED IN.
+ *
+ * Adding a SAML provider - for a project, a status page or the whole
+ * instance - walked four steps and asked for a description and for two
+ * required dropdowns that started empty, the signature and digest methods,
+ * whose help said "If you do not know what this is, please leave this to
+ * RSA-SHA256" (and "SHA256"). What only the identity provider can give is
+ * its sign-on URL, its issuer and its certificate. The rest has an answer:
+ *
+ *   - the signature method is RSA-SHA256 and the digest method SHA256, what
+ *     nearly every identity provider uses. They are recorded with the
+ *     provider and shown on its page; signing in verifies a response against
+ *     the provider's certificate with the algorithm the signed response names
+ *     (App/FeatureSet/Identity/Utils/SSO), so these two are not something a
+ *     newcomer has to get right;
+ *   - the description is "Sign in with <name>" (SsoProviderDefaults).
+ *
+ * The services (ProjectSsoService, StatusPageSsoService, GlobalSsoService)
+ * fill these in when a provider is created without them, before the
+ * required-field check runs, so the columns stay required and the API and
+ * Terraform keep their contract while a caller may leave them out. The forms
+ * start on the same values (Common/UI/Components/Sso/SamlProviderFormFields),
+ * so what a form shows is what is saved. A provider that already exists keeps
+ * what it has.
+ *
+ * React-free and server-safe: the API, the Dashboard, the Admin Dashboard
+ * and their tests all read it.
+ */
+export const DEFAULT_SAML_SIGNATURE_METHOD = SignatureMethod.SHA256;
+export const DEFAULT_SAML_DIGEST_METHOD = DigestMethod.SHA256;
+/**
+ * What a provider created without them gets, in place:
+ *
+ *   - a missing signature method is RSA-SHA256;
+ *   - a missing digest method is SHA256;
+ *   - a missing description is "Sign in with <name>".
+ *
+ * Whatever the caller sent is kept. Nothing else is touched: the sign-on
+ * URL, the issuer and the certificate come from the identity provider, so
+ * the required-field check names any of them that is missing.
+ */
+export const fillSamlProviderDefaults = (provider) => {
+    if (isBlankSsoValue(provider.signatureMethod)) {
+        provider.signatureMethod = DEFAULT_SAML_SIGNATURE_METHOD;
+    }
+    if (isBlankSsoValue(provider.digestMethod)) {
+        provider.digestMethod = DEFAULT_SAML_DIGEST_METHOD;
+    }
+    fillSsoProviderDescription(provider);
+};
+//# sourceMappingURL=SamlProviderDefaults.js.map

package/build/dist/Types/SSO/SamlProviderDefaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SamlProviderDefaults.js","sourceRoot":"","sources":["../../../../Types/SSO/SamlProviderDefaults.ts"],"names":[],"mappings":"AAAA,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAC1C,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAEL,0BAA0B,EAC1B,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GACxC,eAAe,CAAC,MAAM,CAAC;AAEzB,MAAM,CAAC,MAAM,0BAA0B,GAAiB,YAAY,CAAC,MAAM,CAAC;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAEzB,CAAC,QAAmC,EAAQ,EAAE;IACxD,IAAI,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,eAAe,GAAG,6BAA6B,CAAC;IAC3D,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,YAAY,GAAG,0BAA0B,CAAC;IACrD,CAAC;IAED,0BAA0B,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC,CAAC"}

package/build/dist/Types/SSO/SsoProviderDefaults.js

@@ -0,0 +1,67 @@
+/*
+ * What a single sign-on provider is described as when nobody describes it.
+ *
+ * A provider's description is shown under its name wherever people pick a
+ * provider to sign in with: the Accounts "Sign in with SSO" list and a
+ * private status page's sign-in page. Every provider form asked for one, as
+ * a required field, although almost everyone wrote the same thing. A
+ * provider created without one is now described as "Sign in with <name>"
+ * (the services fill it in before the required-field check, so the column
+ * stays required and the API and Terraform keep their contract), and the
+ * forms fill the same text in as the name is typed, so what the form shows is
+ * what is saved.
+ *
+ * Shared by SAML and OpenID Connect providers, for projects, status pages and
+ * the whole instance. React-free and server-safe: the API, the Dashboard, the
+ * Admin Dashboard and their tests all read it.
+ */
+const DESCRIPTION_PREFIX = "Sign in with";
+/*
+ * Nothing written: undefined, null, or text that is only spaces. Anything
+ * else (a URL object, say) is read through its text.
+ */
+export const isBlankSsoValue = (value) => {
+    if (value === undefined || value === null) {
+        return true;
+    }
+    return String(value).trim().length === 0;
+};
+/**
+ * The description a provider gets from its name: "Sign in with Okta". Empty
+ * while the name is.
+ */
+export const getDefaultSsoProviderDescription = (name) => {
+    const trimmed = typeof name === "string" ? name.trim() : "";
+    if (!trimmed) {
+        return "";
+    }
+    return `${DESCRIPTION_PREFIX} ${trimmed}`;
+};
+/**
+ * Whether a description is the one the name gives (or none at all): it then
+ * follows the name when the name changes, on a create form and an edit form
+ * alike. A description somebody wrote is theirs and stays.
+ */
+export const isDefaultSsoProviderDescription = (data) => {
+    if (isBlankSsoValue(data.description)) {
+        return true;
+    }
+    return (String(data.description).trim() ===
+        getDefaultSsoProviderDescription(data.name));
+};
+/**
+ * Gives a provider about to be created the description its name gives, when
+ * it was created without one. Changes nothing else, and nothing when the
+ * provider has no name either (the required-field check then says the name
+ * is missing).
+ */
+export const fillSsoProviderDescription = (provider) => {
+    if (!isBlankSsoValue(provider.description)) {
+        return;
+    }
+    const description = getDefaultSsoProviderDescription(provider.name);
+    if (description) {
+        provider.description = description;
+    }
+};
+//# sourceMappingURL=SsoProviderDefaults.js.map

package/build/dist/Types/SSO/SsoProviderDefaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SsoProviderDefaults.js","sourceRoot":"","sources":["../../../../Types/SSO/SsoProviderDefaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,kBAAkB,GAAW,cAAc,CAAC;AAIlD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,KAAc,EAAW,EAAE;IAC1E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAE/B,CAAC,IAA+B,EAAU,EAAE;IACxD,MAAM,OAAO,GAAW,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,GAAG,kBAAkB,IAAI,OAAO,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAG5B,CAAC,IAGhB,EAAW,EAAE;IACZ,IAAI,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;QAC/B,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5C,CAAC;AACJ,CAAC,CAAC;AAYF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAE3B,CAAC,QAAsC,EAAQ,EAAE;IAC3D,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAW,gCAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE5E,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;IACrC,CAAC;AACH,CAAC,CAAC"}

package/build/dist/Types/StatusPage/StatusPageAccess.js

@@ -0,0 +1,132 @@
+/*
+ * Who can see a status page: one choice of three.
+ *
+ *   Anyone with the link      the page is public.
+ *   Only people who sign in   private users, and people the page's SSO or
+ *                             OIDC provider lets in, sign in first.
+ *   Anyone with the password  visitors enter one shared password.
+ *
+ * The choice is stored in three columns, which the API and Terraform read
+ * and write as they always have: isPublicStatusPage (on by default),
+ * enableMasterPassword (off by default) and masterPassword (a hash). The
+ * server asks for the password only on a page that is not public and has a
+ * password set (StatusPageService.hasReadAccess); anything else with
+ * enableMasterPassword on is a sign-in page, or a public one. So:
+ *
+ *   isPublicStatusPage on                                 -> Anyone
+ *   off, enableMasterPassword on and a password set       -> Password
+ *   off, otherwise                                        -> Sign in
+ *
+ * That rule lives here, once, and everything that has to agree on it reads
+ * it from here: the server's read check, the status page app's "does this
+ * page ask for a password?" (the master-page answer), and the dashboard's
+ * Access page, which shows the choice and writes it.
+ *
+ * Writing a choice writes only the columns whose value changes
+ * (getStatusPageAccessChanges): isPublicStatusPage needs the Growth plan to
+ * change on OneUptime Cloud, and a write that carries it - changed or not -
+ * is refused below Growth, so moving between the two private choices must
+ * leave it out.
+ */
+export var StatusPageAccess;
+(function (StatusPageAccess) {
+    StatusPageAccess["Anyone"] = "Anyone";
+    StatusPageAccess["SignIn"] = "SignIn";
+    StatusPageAccess["Password"] = "Password";
+})(StatusPageAccess || (StatusPageAccess = {}));
+// The order the choices are offered in.
+export const STATUS_PAGE_ACCESS_CHOICES = [
+    StatusPageAccess.Anyone,
+    StatusPageAccess.SignIn,
+    StatusPageAccess.Password,
+];
+export const STATUS_PAGE_ACCESS_COLUMNS = {
+    [StatusPageAccess.Anyone]: {
+        isPublicStatusPage: true,
+        /*
+         * A public page never asks for the password, so the switch did nothing
+         * while it was on. Turning it off means making the page private later
+         * never brings back a password nobody remembers asking for.
+         */
+        enableMasterPassword: false,
+    },
+    [StatusPageAccess.SignIn]: {
+        isPublicStatusPage: false,
+        enableMasterPassword: false,
+    },
+    [StatusPageAccess.Password]: {
+        isPublicStatusPage: false,
+        enableMasterPassword: true,
+    },
+};
+export const STATUS_PAGE_ACCESS_COLUMN_NAMES = ["isPublicStatusPage", "enableMasterPassword"];
+// The column the password is written to, beside the choice's columns.
+export const STATUS_PAGE_MASTER_PASSWORD_COLUMN = "masterPassword";
+const isPublic = (state) => {
+    return state.isPublicStatusPage !== false;
+};
+const isMasterPasswordSwitchOn = (state) => {
+    return state.enableMasterPassword === true;
+};
+/*
+ * Whether visitors have to enter the master password: the page is not
+ * public, the switch is on and a password is set. The one rule the server
+ * enforces (StatusPageService.hasReadAccess) and tells the status page app
+ * (the master-page answer's enableMasterPassword).
+ */
+export const isStatusPageMasterPasswordRequired = (state) => {
+    return (!isPublic(state) &&
+        isMasterPasswordSwitchOn(state) &&
+        state.hasMasterPassword);
+};
+// Who can see the page now, by the rule the server enforces.
+export const getStatusPageAccess = (state) => {
+    if (isPublic(state)) {
+        return StatusPageAccess.Anyone;
+    }
+    if (isStatusPageMasterPasswordRequired(state)) {
+        return StatusPageAccess.Password;
+    }
+    return StatusPageAccess.SignIn;
+};
+/*
+ * The columns to write to move a page to a choice: only those whose stored
+ * value differs from what the choice stores. Empty when nothing changes -
+ * the page already holds it, or (to Password) only the password is missing.
+ */
+export const getStatusPageAccessChanges = (data) => {
+    const target = STATUS_PAGE_ACCESS_COLUMNS[data.to];
+    const changes = {};
+    if (isPublic(data.from) !== target.isPublicStatusPage) {
+        changes.isPublicStatusPage = target.isPublicStatusPage;
+    }
+    if (isMasterPasswordSwitchOn(data.from) !== target.enableMasterPassword) {
+        changes.enableMasterPassword = target.enableMasterPassword;
+    }
+    return changes;
+};
+// The columns a move to a choice writes (see getStatusPageAccessChanges).
+export const getStatusPageAccessColumnsWritten = (data) => {
+    const changes = getStatusPageAccessChanges(data);
+    return STATUS_PAGE_ACCESS_COLUMN_NAMES.filter((column) => {
+        return changes[column] !== undefined;
+    });
+};
+/*
+ * Whether moving to a choice has to ask for a password: Password, on a page
+ * with none stored. Without one the server would not ask visitors for it,
+ * and the page would be a sign-in page that only looks like it is protected
+ * by a password.
+ */
+export const isStatusPagePasswordNeededFor = (data) => {
+    return data.to === StatusPageAccess.Password && !data.from.hasMasterPassword;
+};
+/*
+ * The page as it is once a move is written, password included when one is
+ * entered with it: what the server then enforces is getStatusPageAccess of
+ * this, which is the choice made.
+ */
+export const getStatusPageAccessStateAfter = (data) => {
+    return Object.assign(Object.assign(Object.assign({}, data.from), getStatusPageAccessChanges({ from: data.from, to: data.to })), { hasMasterPassword: data.from.hasMasterPassword || data.isPasswordEntered });
+};
+//# sourceMappingURL=StatusPageAccess.js.map

package/build/dist/Types/StatusPage/StatusPageAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatusPageAccess.js","sourceRoot":"","sources":["../../../../Types/StatusPage/StatusPageAccess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;IACjB,yCAAqB,CAAA;AACvB,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,wCAAwC;AACxC,MAAM,CAAC,MAAM,0BAA0B,GAAoC;IACzE,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,MAAM;IACvB,gBAAgB,CAAC,QAAQ;CAC1B,CAAC;AAkBF,MAAM,CAAC,MAAM,0BAA0B,GAGnC;IACF,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE;QACzB,kBAAkB,EAAE,IAAI;QACxB;;;;WAIG;QACH,oBAAoB,EAAE,KAAK;KAC5B;IACD,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE;QACzB,kBAAkB,EAAE,KAAK;QACzB,oBAAoB,EAAE,KAAK;KAC5B;IACD,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE;QAC3B,kBAAkB,EAAE,KAAK;QACzB,oBAAoB,EAAE,IAAI;KAC3B;CACF,CAAC;AAKF,MAAM,CAAC,MAAM,+BAA+B,GAC1C,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,kCAAkC,GAAW,gBAAgB,CAAC;AAE3E,MAAM,QAAQ,GAA8C,CAC1D,KAA4B,EACnB,EAAE;IACX,OAAO,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAA8C,CAC1E,KAA4B,EACnB,EAAE;IACX,OAAO,KAAK,CAAC,oBAAoB,KAAK,IAAI,CAAC;AAC7C,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAEhC,CAAC,KAA4B,EAAW,EAAE;IACvD,OAAO,CACL,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,wBAAwB,CAAC,KAAK,CAAC;QAC/B,KAAK,CAAC,iBAAiB,CACxB,CAAC;AACJ,CAAC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAER,CAAC,KAA4B,EAAoB,EAAE;IACzE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,gBAAgB,CAAC,MAAM,CAAC;IACjC,CAAC;IAED,IAAI,kCAAkC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,gBAAgB,CAAC,QAAQ,CAAC;IACnC,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,CAAC;AACjC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAGE,CAAC,IAGzC,EAAoC,EAAE;IACrC,MAAM,MAAM,GAA4B,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAqC,EAAE,CAAC;IAErD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACtD,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IACzD,CAAC;IAED,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACxE,OAAO,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAC7D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iCAAiC,GAGR,CAAC,IAGtC,EAAiC,EAAE;IAClC,MAAM,OAAO,GACX,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,+BAA+B,CAAC,MAAM,CAC3C,CAAC,MAA8B,EAAW,EAAE;QAC1C,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;IACvC,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAG1B,CAAC,IAGhB,EAAW,EAAE;IACZ,OAAO,IAAI,CAAC,EAAE,KAAK,gBAAgB,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;AAC/E,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAIZ,CAAC,IAI9B,EAAyB,EAAE;IAC1B,qDACK,IAAI,CAAC,IAAI,GACT,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAC/D,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,IACxE;AACJ,CAAC,CAAC"}

package/build/dist/Types/StatusPage/StatusPagesListingMonitors.js

@@ -0,0 +1,84 @@
+import StatusPageEventType from "./StatusPageEventType";
+class StatusPagesListingMonitors {
+    static isEventType(value) {
+        return (typeof value === "string" &&
+            this.eventTypes.includes(value));
+    }
+    /*
+     * The server's answer as the dashboard receives it. Read defensively: the
+     * suggestion is advisory, and a field that is missing or of the wrong type
+     * must read as "nothing to suggest" rather than break the form it sits
+     * on. A page without an id is dropped, and so is a second mention of one.
+     */
+    static fromJSON(json) {
+        const items = Array.isArray(json["statusPages"])
+            ? json["statusPages"]
+            : [];
+        const statusPages = [];
+        for (const item of items) {
+            if (!item || typeof item !== "object" || Array.isArray(item)) {
+                continue;
+            }
+            const record = item;
+            const statusPageId = String(record["statusPageId"] || "")
+                .trim()
+                .toLowerCase();
+            if (!statusPageId ||
+                statusPages.some((existing) => {
+                    return existing.statusPageId === statusPageId;
+                })) {
+                continue;
+            }
+            statusPages.push({
+                statusPageId: statusPageId,
+                name: String(record["name"] || "").trim(),
+            });
+        }
+        return { statusPages: statusPages };
+    }
+    static toJSON(result) {
+        return {
+            statusPages: result.statusPages.map((statusPage) => {
+                return {
+                    statusPageId: statusPage.statusPageId,
+                    name: statusPage.name,
+                };
+            }),
+        };
+    }
+    /*
+     * The order the server answers in: by name, the way people read a list of
+     * names - case-insensitive, and "Site 2" before "Site 10" - with a page
+     * without a name last. It has no reader's language to go by; the dashboard
+     * orders the suggestions again in the reader's.
+     */
+    static compareByName(a, b) {
+        const aName = a.name.trim();
+        const bName = b.name.trim();
+        if (!aName || !bName) {
+            return (Number(!aName) - Number(!bName) ||
+                a.statusPageId.localeCompare(b.statusPageId));
+        }
+        return (aName.localeCompare(bName, "en", {
+            sensitivity: "base",
+            numeric: true,
+        }) || a.statusPageId.localeCompare(b.statusPageId));
+    }
+}
+// The route, under the API's base URL.
+StatusPagesListingMonitors.apiPath = "/status-page/listing-monitors";
+// How many monitors one request may name.
+StatusPagesListingMonitors.maxIdsPerRequest = 1000;
+/*
+ * The kinds of event a request may ask about. A page that does not show
+ * that kind of event (StatusPage.showScheduledMaintenanceEventsOnStatusPage,
+ * showAnnouncementsOnStatusPage) is not suggested for it. Incidents are not
+ * here: an incident already reaches every page that lists its monitors, and
+ * picking pages for one only narrows that (IncidentStatusPageScope).
+ */
+StatusPagesListingMonitors.eventTypes = [
+    StatusPageEventType.ScheduledEvent,
+    StatusPageEventType.Announcement,
+];
+export default StatusPagesListingMonitors;
+//# sourceMappingURL=StatusPagesListingMonitors.js.map

package/build/dist/Types/StatusPage/StatusPagesListingMonitors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatusPagesListingMonitors.js","sourceRoot":"","sources":["../../../../Types/StatusPage/StatusPagesListingMonitors.ts"],"names":[],"mappings":"AACA,OAAO,mBAAmB,MAAM,uBAAuB,CAAC;AAwCxD,MAAqB,0BAA0B;IAmBtC,MAAM,CAAC,WAAW,CAAC,KAAc;QACtC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACxB,IAAI,CAAC,UAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,QAAQ,CAAC,IAAgB;QACrC,MAAM,KAAK,GAAmB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9D,CAAC,CAAE,IAAI,CAAC,aAAa,CAAoB;YACzC,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,WAAW,GAAqC,EAAE,CAAC;QAEzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAe,IAAkB,CAAC;YAE9C,MAAM,YAAY,GAAW,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;iBAC9D,IAAI,EAAE;iBACN,WAAW,EAAE,CAAC;YAEjB,IACE,CAAC,YAAY;gBACb,WAAW,CAAC,IAAI,CAAC,CAAC,QAAmC,EAAW,EAAE;oBAChE,OAAO,QAAQ,CAAC,YAAY,KAAK,YAAY,CAAC;gBAChD,CAAC,CAAC,EACF,CAAC;gBACD,SAAS;YACX,CAAC;YAED,WAAW,CAAC,IAAI,CAAC;gBACf,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;IACtC,CAAC;IAEM,MAAM,CAAC,MAAM,CAAC,MAAwC;QAC3D,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CACjC,CAAC,UAAqC,EAAc,EAAE;gBACpD,OAAO;oBACL,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,IAAI,EAAE,UAAU,CAAC,IAAI;iBACtB,CAAC;YACJ,CAAC,CACF;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,aAAa,CACzB,CAA4B,EAC5B,CAA4B;QAE5B,MAAM,KAAK,GAAW,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAW,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CACL,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC;gBAC/B,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,CACL,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,WAAW,EAAE,MAAM;YACnB,OAAO,EAAE,IAAI;SACd,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CACnD,CAAC;IACJ,CAAC;;AA1GD,uCAAuC;AAChB,kCAAO,GAAW,+BAA+B,CAAC;AAEzE,0CAA0C;AACnB,2CAAgB,GAAW,IAAI,CAAC;AAEvD;;;;;;GAMG;AACoB,qCAAU,GAAuC;IACtE,mBAAmB,CAAC,cAAc;IAClC,mBAAmB,CAAC,YAAY;CACjC,CAAC;eAjBiB,0BAA0B"}