@toa.io/extensions.exposition 1.0.0-alpha.31 → 1.0.0-alpha.310

package/components/identity.roles/operations/principal.js

@@ -1,13 +1,33 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.effect = void 0;
-async function effect(input, context) {
-    await context.local.grant({
-        input: {
-            identity: input.id,
-            role: 'system'
+import { quote } from '@toa.io/generic';
+const SYSTEM = 'system';
+/**
+ * The Role is asked for more than once: inception grants it before the reply that mints its
+ * token, and the event fires again on every later change to those credentials.
+ */
+export async function effect(input, context) {
+    if (await granted(input.id, context))
+        return;
+    try {
+        await context.local.grant({
+            input: {
+                identity: input.id,
+                role: SYSTEM
+            }
+        });
+    }
+    catch (error) {
+        // two inceptions of the same credentials race, and the unique index refuses the second
+        if (!(await granted(input.id, context)))
+            throw error;
+    }
+}
+async function granted(identity, context) {
+    const roles = await context.local.list({
+        query: {
+            criteria: `identity==${quote(identity)};role==${quote(SYSTEM)}`,
+            limit: 1
         }
     });
+    return roles.length > 0;
 }
-exports.effect = effect;
-//# sourceMappingURL=principal.js.map
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpbmNpcGFsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3ByaW5jaXBhbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFLdkMsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFBO0FBRXZCOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsTUFBTSxDQUFDLEtBQWUsRUFBRSxPQUFnQjtJQUM1RCxJQUFJLE1BQU0sT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsT0FBTyxDQUFDO1FBQUUsT0FBTTtJQUU1QyxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDO1lBQ3hCLEtBQUssRUFBRTtnQkFDTCxRQUFRLEVBQUUsS0FBSyxDQUFDLEVBQUU7Z0JBQ2xCLElBQUksRUFBRSxNQUFNO2FBQ2I7U0FDRixDQUFDLENBQUE7SUFDSixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLHVGQUF1RjtRQUN2RixJQUFJLENBQUMsQ0FBQyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQUUsTUFBTSxLQUFLLENBQUE7SUFDdEQsQ0FBQztBQUNILENBQUM7QUFFRCxLQUFLLFVBQVUsT0FBTyxDQUFDLFFBQWdCLEVBQUUsT0FBZ0I7SUFDdkQsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQztRQUNyQyxLQUFLLEVBQUU7WUFDTCxRQUFRLEVBQUUsYUFBYSxLQUFLLENBQUMsUUFBUSxDQUFDLFVBQVUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQy9ELEtBQUssRUFBRSxDQUFDO1NBQ1Q7S0FDRixDQUFDLENBQUE7SUFFRixPQUFPLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFBO0FBQ3pCLENBQUMifQ==

package/components/identity.roles/receivers/identity.federation.principal.js

@@ -0,0 +1,4 @@
+/**
+ * @param {{ identity: string }} payload
+ */
+export const request = (payload) => ({ input: { id: payload.identity } })

package/components/identity.roles/source/grant.ts

@@ -1,13 +1,15 @@
-import { Err } from 'error-value'
-import type { Entity } from './lib/Entity'
+import type { Entity } from './lib/Entity.ts'
 
-export async function transition (input: Input, object: Entity): Promise<Entity | Error> {
-  if (input.grantor === undefined)
-    return Object.assign(object, input)
+export async function transition(input: Input, object: Entity): Promise<Entity | Error> {
+  if (input.grantor === undefined) return Object.assign(object, input)
 
-  if (!within('system:identity:roles', input.grantor.roles) &&
-    !within(input.role, input.grantor.roles))
-    return ERR_OUT_OF_SCOPE
+  // a manager grants any role; a delegate grants within its own scopes, and never the
+  // right to grant
+  if (
+    !within(MANAGEMENT, input.grantor.roles) &&
+    (!within(input.role, input.grantor.roles) || within(input.role, [MANAGEMENT]))
+  )
+    return ERR_INACCESSIBLE_SCOPE
 
   object.role = input.role
   object.identity = input.identity
@@ -16,11 +18,15 @@ export async function transition (input: Input, object: Entity): Promise<Entity
   return object
 }
 
-function within (role: string, scopes: string[]): boolean {
+function within(role: string, scopes: string[]): boolean {
   return scopes.some((scope) => role === scope || role.startsWith(scope + ':'))
 }
 
-const ERR_OUT_OF_SCOPE = Err('OUT_OF_SCOPE')
+const MANAGEMENT = 'system:identity:roles'
+
+const ERR_INACCESSIBLE_SCOPE = new (class InaccessibleScopeError extends Error {
+  public readonly code = 'INACCESSIBLE_SCOPE'
+})()
 
 export interface Input {
   identity: string

package/components/identity.roles/source/list.ts

@@ -1,5 +1,5 @@
-import type { Entity } from './lib/Entity'
+import type { Entity } from './lib/Entity.ts'
 
-export function observation (_: unknown, objects: Entity[]): string[] {
+export function observation(_: unknown, objects: Entity[]): string[] {
   return objects.map(({ role }) => role)
 }

package/components/identity.roles/source/principal.ts

@@ -1,14 +1,39 @@
-import type { Entity } from './lib/Entity'
-import type { Call } from '@toa.io/types'
-import type { Input as GrantInput } from './grant'
+import { quote } from '@toa.io/generic'
+import type { Entity } from './lib/Entity.ts'
+import type { Call, Query } from '@toa.io/core/types'
+import type { Input as GrantInput } from './grant.ts'
 
-export async function effect (input: Identity, context: Context): Promise<void> {
-  await context.local.grant({
-    input: {
-      identity: input.id,
-      role: 'system'
+const SYSTEM = 'system'
+
+/**
+ * The Role is asked for more than once: inception grants it before the reply that mints its
+ * token, and the event fires again on every later change to those credentials.
+ */
+export async function effect(input: Identity, context: Context): Promise<void> {
+  if (await granted(input.id, context)) return
+
+  try {
+    await context.local.grant({
+      input: {
+        identity: input.id,
+        role: SYSTEM
+      }
+    })
+  } catch (error) {
+    // two inceptions of the same credentials race, and the unique index refuses the second
+    if (!(await granted(input.id, context))) throw error
+  }
+}
+
+async function granted(identity: string, context: Context): Promise<boolean> {
+  const roles = await context.local.list({
+    query: {
+      criteria: `identity==${quote(identity)};role==${quote(SYSTEM)}`,
+      limit: 1
     }
   })
+
+  return roles.length > 0
 }
 
 interface Identity {
@@ -18,5 +43,6 @@ interface Identity {
 export interface Context {
   local: {
     grant: Call<Entity, GrantInput>
+    list: (request: { query: Query }) => Promise<string[]>
   }
 }

package/components/identity.roles/tsconfig.json

@@ -1,7 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../../../tsconfig.component.json",
   "compilerOptions": {
     "outDir": "./operations",
+    "rootDir": "./source"
   },
   "include": [
     "source"

package/components/identity.roles/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.

package/components/identity.roles/types/toa.d.ts

@@ -0,0 +1,44 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, Query, RemoteError } from '@toa.io/core/types'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  grantor?: string
+  identity: string
+  role: string
+  id: string
+  VERSION: number
+  CREATED: number
+  UPDATED: number
+  DELETED: number | null
+  REGION: number
+}
+
+export type GrantInput = {
+  grantor?: {
+    id?: string
+    roles?: string[]
+  }
+  identity: string
+  role: string
+}
+
+export type ListOutput = string[]
+
+export type PrincipalInput = {
+  id?: string
+}
+
+export interface Component {
+  grant: (request: { input: GrantInput, task?: boolean }, options?: Options) => Promise<unknown | RemoteError<"INACCESSIBLE_SCOPE">>
+  list: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<ListOutput>
+  principal: (request: { input: PrincipalInput, task?: boolean }, options?: Options) => Promise<unknown>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+}

package/components/identity.tokens/manifest.toa.yaml

@@ -2,35 +2,187 @@ namespace: identity
 name: tokens
 
 entity:
-  schema:
-    revokedAt: integer # timestamp
   associated: true
+  properties:
+    revokedAt:
+      type: integer
 
 operations:
   encrypt:
     input:
-      authority*: string
-      identity*: &identity
-        id: string
-        ...: true
-      lifetime: integer[0,) # seconds
-    output: string
+      properties:
+        lifetime:
+          type: number
+          minimum: 0
+        scopes:
+          type: array
+          items:
+            type: string
+        permissions:
+          type: object
+          patternProperties:
+            ^.*$:
+              type: array
+              items:
+                type: string
+        audience:
+          description: Resource URIs this token may be presented at (RFC 8707)
+          type: array
+          items:
+            type: string
+        key:
+          type: object
+          properties:
+            id:
+              type: string
+            key:
+              type: string
+          required:
+            - id
+            - key
+        authority:
+          type: string
+        identity:
+          required: [id, roles]
+          properties:
+            id:
+              type: string
+            roles:
+              type: array
+              items:
+                type: string
+          additionalProperties: true
+          type: object
+      type: object
+      required:
+        - authority
+        - identity
+    output:
+      type: string
+    errors:
+      - INACCESSIBLE_SCOPE
   decrypt:
-    input: string
+    input:
+      type: string
     output:
-      authority: string
-      identity: *identity
-      iat: string
-      exp: string
-      refresh: boolean
+      required: [iss, iat, identity, refresh, custom]
+      properties:
+        iss:
+          description: The authority the token names as its issuer
+          type: string
+        identity:
+          required: [id, roles]
+          properties:
+            id:
+              type: string
+            roles:
+              type: array
+              items:
+                type: string
+          additionalProperties: true
+          type: object
+        iat:
+          type: string
+        exp:
+          type: string
+        aud:
+          description: Resource URIs this token may be presented at
+          type: [string, array]
+        custom:
+          type: boolean
+        refresh:
+          type: boolean
+      type: object
+    errors:
+      - INVALID_TOKEN
+      - INVALID_KEY
+      - FORGED_KEY
+      - REVOKED_KEY
   authenticate:
     input:
-      authority*: string
-      credentials*: string
+      properties:
+        authority:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - credentials
     output:
-      identity: *identity
-      refresh: boolean
+      required: [identity, refresh]
+      properties:
+        identity:
+          required: [id, roles]
+          properties:
+            id:
+              type: string
+            roles:
+              type: array
+              items:
+                type: string
+          additionalProperties: true
+          type: object
+        refresh:
+          type: boolean
+      type: object
+    errors:
+      - UNRECOGNIZED
+      - AUTHORITY_MISMATCH
+      - TOKEN_REVOKED
+      # what `decrypt` refuses with, passed on
+      - INVALID_TOKEN
+      - INVALID_KEY
+      - FORGED_KEY
+      - REVOKED_KEY
+  issue:
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+        lifetime:
+          type: number
+          minimum: 0
+        scopes:
+          type: array
+          items:
+            type: string
+        permissions:
+          type: object
+          additionalProperties:
+            type: array
+            items:
+              type: string
+        audience:
+          description: Resource URIs this token may be presented at (RFC 8707)
+          type: array
+          items:
+            type: string
+        label:
+          type: string
+          minLength: 1
+          maxLength: 64
+      required:
+        - authority
+        - identity
+        - label
+    output:
+      required: [kid, token]
+      properties:
+        kid:
+          type: string
+        exp:
+          type: number
+        token:
+          type: string
+      type: object
+    errors:
+      - INACCESSIBLE_SCOPE
   revoke:
+    output: { type: 'null' }
     concurrency: retry
 
 receivers:
@@ -38,17 +190,71 @@ receivers:
   identity.bans.updated: revoke
 
 configuration:
-  key0*: string
-  key1: string
-  lifetime: 2592000 # seconds, 30 days
-  refresh: 600      # seconds, 10 minutes
+  schema:
+    type: object
+    properties:
+      keys:
+        type: array
+        minItems: 1
+        # at least one key issues, which a `paseto` one does not
+        contains:
+          not:
+            properties:
+              format:
+                const: paseto
+            required: [format]
+        items:
+          type: object
+          properties:
+            id:
+              type: string
+              minLength: 1
+            key:
+              type: string
+              format: secret
+            format:
+              # a key that does not say is a JWE, which is what the component reads it as
+              type: string
+              enum:
+                - jwe
+                - paseto
+          required:
+            - id
+            - key
+          additionalProperties: false
+      lifetime:
+        description: Token expiration time in seconds (default 30 days)
+        type: integer
+      refresh:
+        description: Token refresh time in seconds (default 10 minutes)
+        type: integer
+      cache:
+        description: Custom token keys LRU cache configuration
+        properties:
+          max:
+            type: integer
+          ttl:
+            type: integer
+        required: [max, ttl]
+    required:
+      - keys
+      - lifetime
+      - refresh
+      - cache
+
+  defaults:
+    lifetime: 2592000
+    refresh: 600
+    cache:
+      max: 1024
+      ttl: 600000
 
 exposition:
-  /:
+  /:identity:
+    auth:id: identity
+    auth:role: system:identity:tokens
     POST:
-      auth:scheme: token
-      auth:delegate: identity
-      io:output: true # string
-      vary:embed:
-        authority: authority
-      endpoint: encrypt
+      map:authority: authority
+      io:input: [lifetime, label, scopes, permissions]
+      io:output: [kid, exp, token, label]
+      endpoint: issue

package/components/identity.tokens/operations/authenticate.js

@@ -1,38 +1,52 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Computation = void 0;
-class Computation {
+import { form } from './lib/index.js';
+export class Computation {
     refresh = 0;
-    decrypt = undefined;
-    observe = undefined;
+    decrypt;
+    observe;
     mount(context) {
         this.refresh = context.configuration.refresh * 1000;
         this.decrypt = context.local.decrypt;
         this.observe = context.local.observe;
     }
     async execute(input) {
-        const claim = await this.decrypt({ input: input.credentials });
-        if (claim instanceof Error)
-            return claim;
-        if (claim.authority !== input.authority)
+        // `Bearer` is presented by an OpenID id_token too, and the gateway asks each provider
+        // in turn: a credential this component did not issue is declined, not rejected
+        if (form(input.credentials) === null)
+            return ERR_UNRECOGNIZED;
+        const claims = await this.decrypt({ input: input.credentials });
+        if (claims instanceof Error)
+            return claims;
+        if (claims.iss !== input.authority)
             return ERR_AUTHORITY;
-        const identity = claim.identity;
-        const iat = new Date(claim.iat).getTime();
-        const transient = claim.exp !== undefined;
-        const stale = transient && (iat + this.refresh < Date.now());
-        if (stale) {
+        const identity = claims.identity;
+        const iat = new Date(claims.iat).getTime();
+        const transient = claims.exp !== undefined;
+        const aged = transient && iat + this.refresh < Date.now();
+        if (aged) {
             const revocation = await this.observe({ query: { id: identity.id } });
             if (revocation?.revokedAt !== undefined && iat < revocation.revokedAt)
                 return ERR_TOKEN_REVOKED;
         }
-        const refresh = stale || claim.refresh;
+        // a custom token is invalidated by deleting its key, not replaced
+        const refresh = (aged && !claims.custom) || claims.refresh;
         return {
-            identity,
+            identity: claims.aud === undefined ? identity : { ...identity, aud: list(claims.aud) },
             refresh
         };
     }
 }
-exports.Computation = Computation;
-const ERR_AUTHORITY = new Error('AUTHORITY_MISMATCH');
-const ERR_TOKEN_REVOKED = new Error('TOKEN_REVOKED');
-//# sourceMappingURL=authenticate.js.map
+function list(aud) {
+    if (typeof aud === 'string')
+        return [aud];
+    return aud.filter((value) => typeof value === 'string');
+}
+const ERR_UNRECOGNIZED = new (class UnrecognizedError extends Error {
+    code = 'UNRECOGNIZED';
+})();
+const ERR_AUTHORITY = new (class AuthorityMismatchError extends Error {
+    code = 'AUTHORITY_MISMATCH';
+})();
+const ERR_TOKEN_REVOKED = new (class TokenRevokedError extends Error {
+    code = 'TOKEN_REVOKED';
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aGVudGljYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2F1dGhlbnRpY2F0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsSUFBSSxFQUFFLE1BQU0sZ0JBQWdCLENBQUE7QUFHckMsTUFBTSxPQUFPLFdBQVc7SUFDZCxPQUFPLEdBQVcsQ0FBQyxDQUFBO0lBQ25CLE9BQU8sQ0FBOEI7SUFDckMsT0FBTyxDQUE4QjtJQUV0QyxLQUFLLENBQUMsT0FBZ0I7UUFDM0IsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsYUFBYSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUE7UUFDbkQsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQTtRQUNwQyxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFBO0lBQ3RDLENBQUM7SUFFTSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQXdCO1FBQzNDLHNGQUFzRjtRQUN0RiwrRUFBK0U7UUFDL0UsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxLQUFLLElBQUk7WUFBRSxPQUFPLGdCQUFnQixDQUFBO1FBRTdELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQTtRQUUvRCxJQUFJLE1BQU0sWUFBWSxLQUFLO1lBQUUsT0FBTyxNQUFNLENBQUE7UUFFMUMsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLEtBQUssQ0FBQyxTQUFTO1lBQUUsT0FBTyxhQUFhLENBQUE7UUFFeEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQTtRQUNoQyxNQUFNLEdBQUcsR0FBRyxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUE7UUFDMUMsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTLENBQUE7UUFDMUMsTUFBTSxJQUFJLEdBQUcsU0FBUyxJQUFJLEdBQUcsR0FBRyxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQTtRQUV6RCxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ1QsTUFBTSxVQUFVLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFFBQVEsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUE7WUFFckUsSUFBSSxVQUFVLEVBQUUsU0FBUyxLQUFLLFNBQVMsSUFBSSxHQUFHLEdBQUcsVUFBVSxDQUFDLFNBQVM7Z0JBQ25FLE9BQU8saUJBQWlCLENBQUE7UUFDNUIsQ0FBQztRQUVELGtFQUFrRTtRQUNsRSxNQUFNLE9BQU8sR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFBO1FBRTFELE9BQU87WUFDTCxRQUFRLEVBQUUsTUFBTSxDQUFDLEdBQUcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLFFBQVEsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRTtZQUN0RixPQUFPO1NBQ1IsQ0FBQTtJQUNILENBQUM7Q0FDRjtBQUVELFNBQVMsSUFBSSxDQUFDLEdBQXVCO0lBQ25DLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtRQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUV6QyxPQUFPLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQW1CLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQTtBQUMxRSxDQUFDO0FBRUQsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsTUFBTSxpQkFBa0IsU0FBUSxLQUFLO0lBQ2pELElBQUksR0FBRyxjQUFjLENBQUE7Q0FDdEMsQ0FBQyxFQUFFLENBQUE7QUFFSixNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsTUFBTSxzQkFBdUIsU0FBUSxLQUFLO0lBQ25ELElBQUksR0FBRyxvQkFBb0IsQ0FBQTtDQUM1QyxDQUFDLEVBQUUsQ0FBQTtBQUVKLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxDQUFDLE1BQU0saUJBQWtCLFNBQVEsS0FBSztJQUNsRCxJQUFJLEdBQUcsZUFBZSxDQUFBO0NBQ3ZDLENBQUMsRUFBRSxDQUFBIn0=