@sellable/install 0.1.362-phase111.20260720123904 → 0.1.362

package/bin/sellable-agent-host-bootstrap.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+
+import { lstatSync, readFileSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { bootstrapAgentHost } from "../lib/sellable-agent/host-bootstrap.mjs";
+
+function configPath(argv) {
+  if (argv.length !== 2 || argv[0] !== "--config" || !isAbsolute(argv[1])) {
+    throw new Error("usage: --config /absolute/path");
+  }
+  const link = lstatSync(argv[1]);
+  if (link.isSymbolicLink() || !link.isFile() || (link.mode & 0o777) !== 0o600 || link.uid !== 0 || link.gid !== 0) {
+    throw new Error("host bootstrap config rejected");
+  }
+  return argv[1];
+}
+
+try {
+  if (process.getuid?.() !== 0 || process.getgid?.() !== 0) throw new Error("host bootstrap requires root");
+  const pathValue = configPath(process.argv.slice(2));
+  const result = bootstrapAgentHost({ config: JSON.parse(readFileSync(pathValue, "utf8")) });
+  process.stdout.write(`${JSON.stringify(result.receipt)}\n`);
+} catch {
+  process.stderr.write("sellable-agent host bootstrap failed closed\n");
+  process.exitCode = 1;
+}

package/bin/sellable-install.mjs

@@ -3712,7 +3712,8 @@ function upsertCodexMcpServerConfig(content, opts) {
       content,
       "mcp_servers.sellable",
       `[mcp_servers.sellable]
-url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}`
+url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}
+default_tools_approval_mode = "approve"`
     );
     content = removeTomlSection(content, "mcp_servers.sellable.env");
     return content;
@@ -3724,7 +3725,8 @@ url = ${quoteToml(withHostedWatchModeDriver(opts.hostedUrl, "codex"))}`
     "mcp_servers.sellable",
     `[mcp_servers.sellable]
 command = ${quoteToml(command)}
-args = ${tomlArray(args)}`
+args = ${tomlArray(args)}
+default_tools_approval_mode = "approve"`
   );
   content = upsertTomlTable(
     content,
@@ -3738,6 +3740,9 @@ ${tomlEnvTable("codex", opts)}`
 function codexMcpServerMatches(content, opts) {
   const server = readTomlTable(content, "mcp_servers.sellable");
   if (!server) return false;
+  if (!server.includes('default_tools_approval_mode = "approve"')) {
+    return false;
+  }
   if (opts.server === "hosted") {
     return (
       server.includes(

package/container/Dockerfile

@@ -0,0 +1,41 @@
+ARG HERMES_IMAGE=ghcr.io/hostinger/hvps-hermes-agent@sha256:f048663be9ba564de795df5f2a8184f32b92561a1f053c179dca3b45fa5bc8b9
+FROM ${HERMES_IMAGE}
+
+USER root
+
+ARG INSTALLER_PACKAGE=@sellable/install@0.1.362
+ARG MCP_PACKAGE=@sellable/mcp@0.1.620
+ARG INSTALLER_INTEGRITY
+ARG MCP_INTEGRITY=sha512-N+2clnLHWAlvoXCjX10HaeEUMPLqZQHIX+x/2e1CSJbqb56CU1SAtVdwmhXyha7+MQT0DZF7pm2+WnoZKFEzOw==
+
+RUN test "${INSTALLER_PACKAGE}" = "@sellable/install@0.1.362" \
+    && test "${MCP_PACKAGE}" = "@sellable/mcp@0.1.620" \
+    && test -n "${INSTALLER_INTEGRITY}" \
+    && test "$(npm view "${INSTALLER_PACKAGE}" dist.integrity)" = "${INSTALLER_INTEGRITY}" \
+    && test "$(npm view "${MCP_PACKAGE}" dist.integrity)" = "${MCP_INTEGRITY}" \
+    && apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+      bubblewrap \
+      ca-certificates \
+      nftables \
+      sudo \
+    && rm -rf /var/lib/apt/lists/* \
+    && mkdir -p /opt/sellable-agent/install-root /opt/sellable-agent/mcp-root \
+    && npm install --prefix /opt/sellable-agent/install-root --omit=dev --ignore-scripts --no-audit --no-fund "${INSTALLER_PACKAGE}" \
+    && npm install --prefix /opt/sellable-agent/mcp-root --omit=dev --ignore-scripts --no-audit --no-fund "${MCP_PACKAGE}" \
+    && node --input-type=module -e "import { readFileSync } from 'node:fs'; const install = JSON.parse(readFileSync('/opt/sellable-agent/install-root/node_modules/@sellable/install/package.json')); const mcp = JSON.parse(readFileSync('/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp/package.json')); if (install.name !== '@sellable/install' || install.version !== '0.1.362' || mcp.name !== '@sellable/mcp' || mcp.version !== '0.1.620') throw new Error('package identity rejected');" \
+    && node --input-type=module -e "import { buildExternalRuntimeClosure } from '/opt/sellable-agent/install-root/node_modules/@sellable/install/lib/sellable-agent/external-runtime-builder.mjs'; const built = buildExternalRuntimeClosure({ mcpPackageRoot: '/opt/sellable-agent/mcp-root/node_modules/@sellable/mcp', mcpNodeModulesRoot: '/opt/sellable-agent/mcp-root/node_modules', hermesSourceRoot: '/opt/hermes', ownerUid: 0, ownerGid: 0 }); if (!built.closureDigest) throw new Error('runtime closure rejected');" \
+    && node --input-type=module -e "import { chmodSync, writeFileSync } from 'node:fs'; const release = { installerPackage: '@sellable/install@0.1.362', installerIntegrity: process.argv[1], mcpPackage: '@sellable/mcp@0.1.620', mcpIntegrity: process.argv[2] }; writeFileSync('/opt/sellable-agent/release.json', JSON.stringify(release) + '\\n', { mode: 0o444 }); chmodSync('/opt/sellable-agent/release.json', 0o444);" "${INSTALLER_INTEGRITY}" "${MCP_INTEGRITY}" \
+    && npm cache clean --force
+
+COPY entrypoint.sh /usr/local/bin/sellable-agent-container-entrypoint
+RUN test -x /usr/local/bin/node \
+    && test ! -e /usr/bin/node \
+    && ln -s /usr/local/bin/node /usr/bin/node \
+    && test "$(readlink -f /usr/bin/node)" = "/usr/local/bin/node" \
+    && chmod 0555 /usr/local/bin/sellable-agent-container-entrypoint
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD /command/s6-svstat /etc/services.d/sellable-agent-host-worker | grep -q '^up' || exit 1
+
+ENTRYPOINT ["/usr/local/bin/sellable-agent-container-entrypoint"]

package/container/README.md

@@ -0,0 +1,15 @@
+# Sellable Agent host container
+
+This image is a dedicated Agent worker/runtime boundary beside an existing Hermes dashboard. It never replaces or reconfigures the dashboard container.
+
+Build from this directory after `@sellable/install@0.1.362` is published:
+
+```sh
+docker build --platform linux/amd64 \
+  --build-arg INSTALLER_INTEGRITY='sha512-…' \
+  --tag sellable-agent-host:0.1.362 .
+```
+
+Create a private `bootstrap/` directory owned by root with mode `0700`. It must contain `bootstrap.json`, `provider-auth`, and `slack-app`, each owned by root with mode `0600`. `bootstrap.json` contains only non-secret identities, hashes, package integrities, and the control-plane URL. The other two files contain the provider JSON and global Slack app token whose hashes are pinned by `bootstrap.json`.
+
+Set `SELLABLE_AGENT_IMAGE` to the exact built image digest and start `compose.yaml`. The container bootstraps idempotently, writes `bootstrap/registration-receipt.json`, and starts the worker and isolated runtime under s6. Do not mount a Docker socket.

package/container/compose.yaml

@@ -0,0 +1,22 @@
+services:
+  sellable-agent-host:
+    image: ${SELLABLE_AGENT_IMAGE:?set exact Sellable Agent image}
+    container_name: ${SELLABLE_AGENT_CONTAINER_NAME:-sellable-agent-host-11201}
+    hostname: ${SELLABLE_AGENT_HOSTNAME:-hermes-hostinger-1807396}
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - SYS_ADMIN
+    cgroup: host
+    pid: host
+    volumes:
+      - ./bootstrap:/var/lib/sellable-agent-bootstrap:rw
+      - sellable-agent-worker:/var/lib/sellable-agent-worker
+      - sellable-agent-runtime:/var/lib/sellable-agent-runtime
+      - sellable-agent-profiles:/var/lib/sellable-agent-profiles
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+
+volumes:
+  sellable-agent-worker:
+  sellable-agent-runtime:
+  sellable-agent-profiles:

package/container/entrypoint.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+set -eu
+
+PATH="/command:${PATH}"
+export PATH
+
+BOOTSTRAP_CONFIG=/var/lib/sellable-agent-bootstrap/bootstrap.json
+BOOTSTRAP_BIN=/opt/sellable-agent/install-root/node_modules/.bin/sellable-agent-host-bootstrap
+
+test "$(id -u)" = "0"
+test "$(id -g)" = "0"
+install -d -m 0755 -o root -g root /run/s6/container_environment
+test -x "${BOOTSTRAP_BIN}"
+test -f "${BOOTSTRAP_CONFIG}"
+
+"${BOOTSTRAP_BIN}" --config "${BOOTSTRAP_CONFIG}"
+exec /command/s6-svscan /etc/services.d

package/lib/sellable-agent/external-runtime-builder.mjs

@@ -0,0 +1,272 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  chownSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import {
+  HERMES_AGENT_BRIDGE_CONTRACT,
+  installHermesAgentBridge,
+  verifyHermesAgentBridge,
+} from "./hermes-bridge.mjs";
+import {
+  EXTERNAL_HERMES_ENTRYPOINT,
+  EXTERNAL_MCP_ENTRYPOINT,
+  EXTERNAL_RUNTIME_CLOSURE_ROOT,
+  EXTERNAL_RUNTIME_MANIFEST_PATH,
+  observeExternalRuntimeClosure,
+} from "./runtime-helper.mjs";
+
+const MANIFEST_VERSION = "sellable-agent-external-runtime-closure/v1";
+const MCP_PACKAGE = "@sellable/mcp";
+const MCP_VERSION = "0.1.620";
+const SAFE_COMPONENT = /^[A-Za-z0-9@._+-]+$/;
+const HERMES_EXCLUDES = new Set([".git", ".playwright", "node_modules"]);
+
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+
+function mapped(pathRoot, absolutePath) {
+  const root = realpathSync(resolve(pathRoot));
+  const target = root === "/"
+    ? resolve(absolutePath)
+    : join(root, absolutePath.replace(/^\/+/, ""));
+  const confined = relative(root, target);
+  if (!isAbsolute(absolutePath) || confined.startsWith("..") || isAbsolute(confined)) {
+    throw new Error("external runtime build target rejected");
+  }
+  return target;
+}
+
+function trustedDirectory(pathValue) {
+  const resolved = realpathSync(resolve(pathValue));
+  const link = lstatSync(resolved);
+  if (
+    link.isSymbolicLink() || !link.isDirectory() || (link.mode & 0o022) !== 0
+  ) throw new Error("external runtime source rejected");
+  return resolved;
+}
+
+function copyFile(source, target, transform = (bytes) => bytes) {
+  const link = lstatSync(source);
+  if (!link.isFile() || link.isSymbolicLink()) throw new Error("external runtime source file rejected");
+  const bytes = transform(readFileSync(source));
+  const mode = (link.mode & 0o111) === 0 ? 0o644 : 0o755;
+  writeFileSync(target, bytes, { flag: "wx", mode });
+  chmodSync(target, mode);
+}
+
+function hermesScript(bytes) {
+  const source = bytes.toString("utf8");
+  const newline = source.indexOf("\n");
+  const first = newline < 0 ? source : source.slice(0, newline);
+  if (!first.startsWith("#!/opt/hermes/.venv/bin/python")) return bytes;
+  const rest = newline < 0 ? "" : source.slice(newline);
+  return Buffer.from(`#!${EXTERNAL_RUNTIME_CLOSURE_ROOT}/hermes/venv/bin/python3${rest}`);
+}
+
+function copyTree({ sourceRoot, targetRoot, kind, logicalRoot = "" }) {
+  for (const name of readdirSync(sourceRoot).sort()) {
+    if (!SAFE_COMPONENT.test(name)) throw new Error("external runtime source name rejected");
+    if (kind === "hermes" && HERMES_EXCLUDES.has(name)) continue;
+    if (kind === "mcp-dependencies" && [".bin", ".package-lock.json"].includes(name)) continue;
+    if (kind === "mcp-dependencies" && logicalRoot === "" && name === "@sellable") {
+      const scopedSource = join(sourceRoot, name);
+      const scopedTarget = join(targetRoot, name);
+      mkdirSync(scopedTarget, { mode: 0o755 });
+      for (const scopedName of readdirSync(scopedSource).sort()) {
+        if (scopedName === "mcp" || scopedName === "install") continue;
+        if (!SAFE_COMPONENT.test(scopedName)) throw new Error("external runtime source name rejected");
+        const nestedSource = join(scopedSource, scopedName);
+        const nestedTarget = join(scopedTarget, scopedName);
+        const nested = lstatSync(nestedSource);
+        if (!nested.isDirectory() || nested.isSymbolicLink()) {
+          throw new Error("external runtime dependency rejected");
+        }
+        mkdirSync(nestedTarget, { mode: 0o755 });
+        copyTree({
+          sourceRoot: nestedSource,
+          targetRoot: nestedTarget,
+          kind,
+          logicalRoot: `${name}/${scopedName}`,
+        });
+      }
+      if (readdirSync(scopedTarget).length === 0) rmSync(scopedTarget, { recursive: true });
+      continue;
+    }
+    const outputName = kind === "hermes" && logicalRoot === "" && name === ".venv"
+      ? "venv"
+      : name;
+    const source = join(sourceRoot, name);
+    const target = join(targetRoot, outputName);
+    const logicalPath = logicalRoot ? `${logicalRoot}/${outputName}` : outputName;
+    const link = lstatSync(source);
+    if (link.isSymbolicLink()) {
+      if (kind !== "hermes") throw new Error("external runtime dependency symlink rejected");
+      if (logicalPath === "venv/lib64") continue;
+      if (!["venv/bin/python", "venv/bin/python3", "venv/bin/python3.13"].includes(logicalPath)) {
+        throw new Error("external Hermes symlink rejected");
+      }
+      copyFile(realpathSync(source), target);
+      continue;
+    }
+    if (link.isDirectory()) {
+      mkdirSync(target, { mode: 0o755 });
+      copyTree({ sourceRoot: source, targetRoot: target, kind, logicalRoot: logicalPath });
+      continue;
+    }
+    if (!link.isFile()) throw new Error("external runtime special source rejected");
+    copyFile(source, target, kind === "hermes" && logicalPath.startsWith("venv/bin/")
+      ? hermesScript
+      : undefined);
+  }
+}
+
+function normalizeTree(root, ownerUid, ownerGid) {
+  const directories = [];
+  const files = [];
+  const visit = (directory, logicalDirectory) => {
+    for (const name of readdirSync(directory).sort()) {
+      const pathValue = join(directory, name);
+      const logicalPath = logicalDirectory ? `${logicalDirectory}/${name}` : name;
+      const link = lstatSync(pathValue);
+      if (link.isSymbolicLink()) throw new Error("external runtime output symlink rejected");
+      if (link.isDirectory()) {
+        visit(pathValue, logicalPath);
+        chmodSync(pathValue, 0o555);
+        chownSync(pathValue, ownerUid, ownerGid);
+        directories.push({ path: logicalPath, mode: 0o555 });
+      } else if (link.isFile()) {
+        const mode = (link.mode & 0o111) === 0 ? 0o444 : 0o555;
+        chmodSync(pathValue, mode);
+        chownSync(pathValue, ownerUid, ownerGid);
+        files.push({ path: logicalPath, mode, digest: sha256(readFileSync(pathValue)) });
+      } else {
+        throw new Error("external runtime output special file rejected");
+      }
+    }
+  };
+  visit(root, "");
+  chmodSync(root, 0o555);
+  chownSync(root, ownerUid, ownerGid);
+  return {
+    directories: directories.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0),
+    files: files.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0),
+  };
+}
+
+function packageIdentity(root) {
+  const parsed = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+  if (parsed?.name !== MCP_PACKAGE || parsed.version !== MCP_VERSION) {
+    throw new Error("external MCP package identity rejected");
+  }
+}
+
+function bridgeContract(input) {
+  return input.disposableFixture === true && input.hermesBridgeContract
+    ? input.hermesBridgeContract
+    : HERMES_AGENT_BRIDGE_CONTRACT;
+}
+
+function currentClosure(input, pathRoot, ownerUid, ownerGid) {
+  const observed = observeExternalRuntimeClosure({
+    pathRoot,
+    manifestPath: EXTERNAL_RUNTIME_MANIFEST_PATH,
+    expectedClosureRoot: EXTERNAL_RUNTIME_CLOSURE_ROOT,
+    trustRoot: dirname(EXTERNAL_RUNTIME_CLOSURE_ROOT),
+    ownerUid,
+    ownerGid,
+    expectedEntrypoints: { mcp: EXTERNAL_MCP_ENTRYPOINT, hermes: EXTERNAL_HERMES_ENTRYPOINT },
+  });
+  const root = mapped(pathRoot, EXTERNAL_RUNTIME_CLOSURE_ROOT);
+  packageIdentity(join(root, "mcp"));
+  verifyHermesAgentBridge({
+    sourceRoot: join(root, "hermes"),
+    contract: bridgeContract(input),
+  });
+  return { ...observed, reused: true };
+}
+
+export function buildExternalRuntimeClosure(input = {}) {
+  const pathRoot = resolve(input.pathRoot ?? "/");
+  if (!isAbsolute(pathRoot) || !existsSync(pathRoot)) throw new Error("external runtime path root rejected");
+  if (pathRoot !== "/" && input.disposableFixture !== true) {
+    throw new Error("external runtime live root rejected");
+  }
+  const ownerUid = input.ownerUid ?? process.getuid?.() ?? 0;
+  const ownerGid = input.ownerGid ?? process.getgid?.() ?? 0;
+  if (!Number.isSafeInteger(ownerUid) || ownerUid < 0 || !Number.isSafeInteger(ownerGid) || ownerGid < 0) {
+    throw new Error("external runtime owner rejected");
+  }
+  const mcpPackageRoot = trustedDirectory(input.mcpPackageRoot);
+  const mcpNodeModulesRoot = trustedDirectory(input.mcpNodeModulesRoot);
+  const hermesSourceRoot = trustedDirectory(input.hermesSourceRoot);
+  packageIdentity(mcpPackageRoot);
+  const target = mapped(pathRoot, EXTERNAL_RUNTIME_CLOSURE_ROOT);
+  if (existsSync(target)) return currentClosure(input, pathRoot, ownerUid, ownerGid);
+
+  const trustRoot = dirname(target);
+  if (!existsSync(trustRoot)) mkdirSync(trustRoot, { recursive: true, mode: 0o755 });
+  const staging = join(trustRoot, `.external-runtime-${randomUUID()}`);
+  mkdirSync(staging, { mode: 0o755 });
+  try {
+    const mcpRoot = join(staging, "mcp");
+    const dependencyRoot = join(mcpRoot, "node_modules");
+    const hermesRoot = join(staging, "hermes");
+    mkdirSync(mcpRoot, { mode: 0o755 });
+    mkdirSync(dependencyRoot, { mode: 0o755 });
+    mkdirSync(hermesRoot, { mode: 0o755 });
+    copyTree({ sourceRoot: mcpPackageRoot, targetRoot: mcpRoot, kind: "mcp" });
+    copyTree({ sourceRoot: mcpNodeModulesRoot, targetRoot: dependencyRoot, kind: "mcp-dependencies" });
+    mkdirSync(join(mcpRoot, "bin"), { mode: 0o755 });
+    writeFileSync(
+      join(mcpRoot, "bin", "sellable-mcp"),
+      `#!/bin/sh\nexec /usr/bin/node '${EXTERNAL_RUNTIME_CLOSURE_ROOT}/mcp/dist/index.js' "$@"\n`,
+      { mode: 0o755, flag: "wx" },
+    );
+    copyTree({ sourceRoot: hermesSourceRoot, targetRoot: hermesRoot, kind: "hermes" });
+    installHermesAgentBridge({ sourceRoot: hermesRoot, contract: bridgeContract(input) });
+
+    const mcp = normalizeTree(mcpRoot, ownerUid, ownerGid);
+    const hermes = normalizeTree(hermesRoot, ownerUid, ownerGid);
+    const manifest = {
+      version: MANIFEST_VERSION,
+      closureRoot: EXTERNAL_RUNTIME_CLOSURE_ROOT,
+      roots: [
+        { kind: "mcp", entrypoint: "bin/sellable-mcp", rootMode: 0o555, ...mcp },
+        { kind: "hermes", entrypoint: "venv/bin/hermes", rootMode: 0o555, ...hermes },
+      ],
+    };
+    writeFileSync(join(staging, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, {
+      mode: 0o444,
+      flag: "wx",
+    });
+    chmodSync(join(staging, "manifest.json"), 0o444);
+    chownSync(join(staging, "manifest.json"), ownerUid, ownerGid);
+    chownSync(staging, ownerUid, ownerGid);
+    renameSync(staging, target);
+    chmodSync(target, 0o555);
+    return { ...currentClosure(input, pathRoot, ownerUid, ownerGid), reused: false };
+  } catch (error) {
+    if (existsSync(staging)) {
+      const makeWritable = (pathValue) => {
+        const link = lstatSync(pathValue);
+        if (link.isDirectory()) {
+          chmodSync(pathValue, 0o755);
+          for (const name of readdirSync(pathValue)) makeWritable(join(pathValue, name));
+        } else if (link.isFile()) chmodSync(pathValue, 0o644);
+      };
+      makeWritable(staging);
+      rmSync(staging, { recursive: true });
+    }
+    throw error;
+  }
+}

package/lib/sellable-agent/hermes-bridge.mjs

@@ -285,14 +285,14 @@ export const HERMES_AGENT_BRIDGE_CONTRACT = normalizeContract({
     {
       path: "plugins/platforms/slack/adapter.py",
       patchKind: "slack-adapter",
-      sourceSha256: "a84f1f15368d8d93341a1c2449c45ca13ebe92938049e92d80ce5cab0e1a6294",
-      patchedSha256: "4ba3b1f5b443abf970b8888de3c1b21ab7f043645aba6304432453c1dc643f55",
+      sourceSha256: "20b12d9bbff0f5b280e0be8e795c7327f4089c3fa8b04d7a6d346dabae591f2a",
+      patchedSha256: "548ab70f515e22830cbcbf6b0691768272dd708fd0118f7c601e1e1232bb016b",
     },
     {
       path: "tools/mcp_tool.py",
       patchKind: "mcp-tool",
-      sourceSha256: "ee453ede1c72c90b28155e292a352bfba96eb1793c47eb8667d16fe79beb181e",
-      patchedSha256: "c0923d8c88d507a766121dab9f0f36e99963f85a9124cbef2908ee7176d56e07",
+      sourceSha256: "1bcceccaeb8ec8894c83819d389a64258517f4b48db1c8fea5c486633e56fe8b",
+      patchedSha256: "44bf5dfeca47bf91fc5e68ecd6455c33f41afd2b04fa16d213f59115ddb38f21",
     },
   ],
 });