@open-everywhere/core 0.1.0

package/dist/scripts/operator-store-connect.js

@@ -0,0 +1,218 @@
+// OPERATOR-SIDE STORE WIRING (OPE-408 phase 1) — open the SAME operational store the deployed
+// instance uses, from a local process, so `oe secret set` / the ops-MCP `secret_*` tools write rows
+// the deployment will actually read.
+//
+// 🔴 WHY THIS LIVES IN scripts/ AND NOT UNDER agent/. It constructs a vendor DRIVER. Core may import
+// no vendor SDK (boundary-test.ts rule 1), which the name-as-variable dynamic import evades — but
+// that same runtime-assembled specifier is the OPE-391 incident class that `lint:hosted-externals`
+// fails on inside `packages/core/agent` (a computed specifier is invisible to the bundler; the
+// hosted function then dies ERR_MODULE_NOT_FOUND). `scripts/` is never traced into a hosted
+// function, so the migrate-operational.ts recipe is safe here and nowhere else. The ops MCP server
+// reaches this module by a lazy relative import for exactly that reason.
+//
+// THE RESOLUTION IS THE RUNTIME'S OWN (`resolveOperationalSelection`), NOT A SECOND RULE. If the
+// operator's env would give the deployed app sqlite, this writes to sqlite too. Guessing "they
+// surely meant hosted Postgres" from a bare DATABASE_URL would write the secret into a store the app
+// never reads — a silent, success-shaped failure. The resolved target is RETURNED so every skin can
+// print it: the one line that makes a wrong-store write visible immediately.
+//
+// NEVER echoes DATABASE_URL, the AES key, or any secret value.
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { SECRET_STORE_ENV_KEYS } from "../agent/credentials/operator-secrets.js";
+import { registerDeploymentIdentity } from "../agent/identity/deployment-identity.js";
+import { registerOperationalPgliteLazy } from "../agent/operational/pglite-client.js";
+import { initOperationalSchema } from "../agent/operational/postgres.js";
+import { registerOperationalPostgres, requireArmedOperationalFloor, resetOperationalStore, resolveOperationalSelection, } from "../agent/operational/provider.js";
+let connected = null;
+/**
+ * Load the root-of-trust env from a `.env` file into `process.env` — ONLY the
+ * {@link SECRET_STORE_ENV_KEYS} allowlist, and only for keys not already set in the process (an
+ * explicitly exported var always wins, so `DATABASE_URL=… oe secret set` behaves as typed).
+ *
+ * This exists because the operator's `DATABASE_URL` + `OE_CREDENTIAL_ENCRYPTION_KEY` normally sit in
+ * an untracked `.env.local` rather than the shell — and an MCP server started by an agent inherits
+ * neither. Copying the WHOLE file would re-create the env-as-secret-home this ticket deletes, so the
+ * allowlist is the mechanism, not a convenience.
+ *
+ * Returns the names it set (never values). Missing file ⇒ empty list, no error.
+ */
+export function loadRootOfTrustEnv(path) {
+    if (!existsSync(path))
+        return [];
+    const applied = [];
+    for (const raw of readFileSync(path, "utf8").split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line.length === 0 || line.startsWith("#"))
+            continue;
+        const body = line.startsWith("export ") ? line.slice("export ".length).trim() : line;
+        const eq = body.indexOf("=");
+        if (eq <= 0)
+            continue;
+        const name = body.slice(0, eq).trim();
+        if (!SECRET_STORE_ENV_KEYS.includes(name))
+            continue;
+        if (process.env[name] !== undefined && process.env[name] !== "")
+            continue;
+        let value = body.slice(eq + 1).trim();
+        if (value.length >= 2 && ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")))) {
+            value = value.slice(1, -1);
+        }
+        process.env[name] = value;
+        applied.push(name);
+    }
+    return applied;
+}
+/**
+ * Wire the operational store for THIS process and return what was wired. Idempotent — the second
+ * call returns the first call's target without re-opening anything (the ops MCP server calls it on
+ * every tool invocation).
+ *
+ * Postgres (hosted) is reached with the same `@neondatabase/serverless` pool the deployed adapter
+ * builds, imported name-as-variable so core stays install-safe without the driver. `initOperationalSchema`
+ * runs on that client: it is idempotent `CREATE TABLE IF NOT EXISTS` DDL and it makes the day-0 story
+ * work — an operator can load secrets BEFORE the app has ever booted. Under a non-owner runtime role
+ * it skips DDL and verifies instead (the schema init is role-aware), so pointing this at a two-role
+ * deployment's runtime URL is safe.
+ *
+ * 🔴 `readOnly` SKIPS that schema init, and a command that only READS must pass it (OPE-1636).
+ * Under an OWNER credential `initOperationalSchema` is not passive: it drops unexpected policies
+ * and triggers, re-applies the DDL, and appends an `audit.integrity` row. A verifier that
+ * connected that way would repair the posture it was asked to inspect and write into the chain it
+ * was asked to walk. Idempotence is not the question — a read command must not act at all.
+ *
+ * The flag reaches BOTH store branches. The embedded floor defers the same `initOperationalSchema`
+ * to its lazy client's first query, so a floor branch that ignored `readOnly` would write exactly
+ * what the hosted branch is careful not to. What no branch can promise is an untouched file: the
+ * floor still takes its single-writer lock and opens the data dir. `readOnly` means "appends no
+ * row and changes no posture".
+ */
+export async function connectOperatorStore(opts = {}) {
+    if (connected)
+        return connected;
+    const selection = resolveOperationalSelection();
+    if (selection.floor === "pglite") {
+        // 🔴 `readOnly` REACHES THE FLOOR TOO (OPE-1636 review). This branch used to return before the
+        // flag was read, and the lazy client runs owner-mode DDL on its first query, so on a self-host
+        // or local floor the audit-chain verifier repaired the posture it was inspecting and appended
+        // an `audit.integrity` row into the chain it was walking — while both the CLI header and the
+        // security doc said it writes nothing.
+        registerOperationalPgliteLazy(undefined, undefined, { readOnly: opts.readOnly === true });
+        // The registration is only authoritative once the memoized selection is dropped: a store
+        // resolved earlier in this process (an import that read one at module load) would otherwise
+        // outlive this call and keep every write on the sqlite stand-in (OPE-1428). The refusal that
+        // follows is a defensive assertion over the line above, not a live control — the floor is armed
+        // by then. See requireArmedOperationalFloor for the invariant it pins.
+        resetOperationalStore();
+        requireArmedOperationalFloor();
+        connected = { id: "postgres", label: "embedded Postgres floor (PGlite, local data dir)" };
+        return connected;
+    }
+    if (selection.id === "postgres") {
+        const url = process.env.DATABASE_URL?.trim();
+        if (!url) {
+            throw new Error('OE_OPERATIONAL_PROVIDER="postgres" but DATABASE_URL is not set — the operator-side secret commands open the ' +
+                "deployment's own store directly, so they need the same connection string the deployment holds " +
+                // 🔴 `--root-env`, NEVER `--env-file`: node 24 parses `--env-file` out of the argv even after
+                // the script path, so it never reaches any of these commands (oe-secret.ts's header measures
+                // it). This message is what an operator follows, so the wrong name here costs them a run.
+                "(put it in .env.local, or pass --root-env PATH).");
+        }
+        const client = await neonClient(url);
+        if (!opts.readOnly)
+            await initOperationalSchema(client);
+        registerOperationalPostgres(client);
+        resetOperationalStore(); // same reason as the floor branch above — the new client must win.
+        connected = { id: "postgres", label: "hosted Postgres (DATABASE_URL)" };
+        return connected;
+    }
+    // sqlite: the synchronous legacy floor needs no wiring — getOperationalStore() resolves it.
+    connected = { id: selection.id, label: "sqlite file (DEPRECATED floor — see docs/deploy/database-graduation.md)" };
+    return connected;
+}
+/**
+ * The one line an operator CLI runs before its FIRST read or write: lift the allowlisted
+ * root-of-trust keys out of `.env.local` (or `--root-env PATH`), then open the store the RUNTIME's
+ * own rule selects. Returns the target so the CLI can print its label in its header.
+ *
+ * 🔴 A READ NEEDS THIS AS MUCH AS A WRITE (OPE-1434). `readAudit`, `listAllRoutines` and the spend
+ * views all resolve the store lazily, so a CLI that never connects reads whatever
+ * `getOperationalStore()` falls back to. Measured on the default env (nothing set): the configured
+ * store is the embedded Postgres floor, the floor is never armed in these processes, and the fallback
+ * is the synchronous sqlite stand-in. The operator then gets a confident, empty answer about a
+ * deployment whose rows live somewhere else — and an empty audit log during an incident reads as
+ * "nothing happened".
+ */
+export async function connectOperatorStoreForCli(argv = process.argv, opts = {}) {
+    const flag = argv.indexOf("--root-env");
+    loadRootOfTrustEnv(resolve(flag >= 0 ? (argv[flag + 1] ?? ".env.local") : ".env.local"));
+    const orgFlag = argv.indexOf("--org");
+    declareOperatorOrg(orgFlag >= 0 ? argv[orgFlag + 1] : undefined);
+    return await connectOperatorStore(opts);
+}
+/**
+ * Declare the org THIS operator process acts for, before it opens the store.
+ *
+ * 🔴 AN OPERATOR PROCESS NEVER LOADS THE DEPLOYMENT'S CONFIG, so it cannot learn the org by itself
+ * (OPE-1545). The org is a tracked literal in the app's `agent/identity/surfaces.ts`, and a core
+ * script may not import an app module — the whole point of the core/app split. Every operator CLI
+ * therefore resolves `deploymentOrg()` to the shipped `"default"` unless the operator names the org
+ * on the command line.
+ *
+ * That is not cosmetic. `connectOperatorStore()` runs `initOperationalSchema`, which writes the
+ * `audit.integrity` row through `deploymentOrg()` (operational/postgres.ts). On a deployment whose
+ * declaration is NOT `"default"`, an undeclared operator process would file that row in a partition
+ * the running agent never queries and chain-link it into the wrong chain — the OPE-1438 split
+ * exactly. Registering here keeps the ONE spelling: `deploymentOrg()` answers the same string for
+ * the integrity row, the reads, and the rows a skin writes.
+ *
+ * An absent or blank value leaves the register alone, so `"default"` deployments type nothing.
+ */
+export function declareOperatorOrg(org) {
+    // A bare trailing `--org` names nothing, and `--org --json` would register the next FLAG as the
+    // tenant — a silently wrong partition is worse than an ignored flag, so both are no-ops.
+    if (org === undefined || org.trim().length === 0 || org.startsWith("-"))
+        return;
+    registerDeploymentIdentity({ org });
+}
+/** Test seam: forget the wired target so a later call re-resolves, and drop the floor refusal. */
+export function resetOperatorStoreConnection() {
+    connected = null;
+    requireArmedOperationalFloor(false);
+}
+async function neonClient(connectionString) {
+    // Dynamic, name-as-variable import → no static module resolution, so core stays install-safe until
+    // @neondatabase/serverless is present (the migrate-operational.ts / neon.ts boundary lock).
+    const pkg = "@neondatabase/serverless";
+    let Pool;
+    try {
+        ({ Pool } = (await import(pkg)));
+    }
+    catch (err) {
+        throw new Error(`cannot open hosted Postgres: the ${pkg} driver is not installed in this checkout (${String(err instanceof Error ? err.message : err)}). ` +
+            "Run the secret commands from the Open Everywhere repo root after `npm install`.");
+    }
+    const pool = new Pool({ connectionString });
+    return {
+        query: (text, params) => pool.query(text, params),
+        // Same pinning seam the deployed adapter gives the app (OPE-1636). An operator process that
+        // appends an audit row — the epoch seal, the `audit.integrity` row initOperationalSchema can
+        // write — must take the same per-org lock the running instances take, or it forks the chain
+        // it is there to repair.
+        withConnection: async (fn) => {
+            const conn = await pool.connect();
+            try {
+                const result = await fn({ query: (text, params) => conn.query(text, params) });
+                conn.release();
+                return result;
+            }
+            catch (err) {
+                // `release(err)` DESTROYS the connection rather than returning a possibly
+                // still-in-transaction one to the pool — see neon.ts for the full reasoning.
+                conn.release(err);
+                throw err;
+            }
+        },
+    };
+}
+//# sourceMappingURL=operator-store-connect.js.map

package/dist/scripts/operator-store-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-store-connect.js","sourceRoot":"","sources":["../../scripts/operator-store-connect.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,oGAAoG;AACpG,qCAAqC;AACrC,EAAE;AACF,qGAAqG;AACrG,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,4FAA4F;AAC5F,mGAAmG;AACnG,yEAAyE;AACzE,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,qGAAqG;AACrG,oGAAoG;AACpG,6EAA6E;AAC7E,EAAE;AACF,+DAA+D;AAE/D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAiB,MAAM,kCAAkC,CAAC;AACxF,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,GAC5B,MAAM,kCAAkC,CAAC;AAgB1C,IAAI,SAAS,GAA+B,IAAI,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrF,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QAC1E,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5H,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAI,GAAsB,EAAE;IACrE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,SAAS,GAAG,2BAA2B,EAAE,CAAC;IAEhD,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjC,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,uCAAuC;QACvC,6BAA6B,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1F,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,uEAAuE;QACvE,qBAAqB,EAAE,CAAC;QACxB,4BAA4B,EAAE,CAAC;QAC/B,SAAS,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,8GAA8G;gBAC5G,gGAAgG;gBAChG,8FAA8F;gBAC9F,6FAA6F;gBAC7F,0FAA0F;gBAC1F,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACxD,2BAA2B,CAAC,MAAM,CAAC,CAAC;QACpC,qBAAqB,EAAE,CAAC,CAAC,mEAAmE;QAC5F,SAAS,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,4FAA4F;IAC5F,SAAS,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,yEAAyE,EAAE,CAAC;IACnH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAI,GAAsB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAsB,EAAE;IACnH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,kBAAkB,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,kBAAkB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,gGAAgG;IAChG,yFAAyF;IACzF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAChF,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,4BAA4B;IAC1C,SAAS,GAAG,IAAI,CAAC;IACjB,4BAA4B,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,gBAAwB;IAChD,mGAAmG;IACnG,4FAA4F;IAC5F,MAAM,GAAG,GAAG,0BAA0B,CAAC;IAMvC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAuB,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,8CAA8C,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK;YACxI,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5C,OAAO;QACL,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;QACjD,4FAA4F;QAC5F,6FAA6F;QAC7F,4FAA4F;QAC5F,yBAAyB;QACzB,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,6EAA6E;gBAC7E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClB,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}