@toa.io/extensions.exposition 1.0.0-alpha.31 → 1.0.0-alpha.310

package/components/identity.basic/source/transit.ts

@@ -1,70 +1,107 @@
-import { genSalt, hash } from 'bcryptjs'
-import { Err } from 'error-value'
-import type { Maybe, Operation } from '@toa.io/types'
-import type { Context, Entity, TransitInput, TransitOutput } from './types'
+import { hash } from '@node-rs/bcrypt'
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type {
+  Context,
+  Entity,
+  Principal,
+  TransitInput,
+  TransitOutput
+} from '../types/index.d.ts'
 
 export class Transition implements Operation {
   private rounds: number = 10
   private pepper: string = ''
-  private principal?: string
+  private principal?: Principal
   private tokens: Tokens = undefined as unknown as Tokens
+  private keys: Keys = undefined as unknown as Keys
   private usernameRx: RegExp[] = []
   private passwordRx: RegExp[] = []
 
-  public mount (context: Context): void {
+  public mount(context: Context): void {
     this.rounds = context.configuration.rounds
-    this.pepper = context.configuration.pepper
+    this.pepper = context.configuration.pepper?.unwrap() ?? ''
     this.principal = context.configuration.principal
     this.tokens = context.remote.identity.tokens
+    this.keys = context.remote.identity.keys
 
     this.usernameRx = toRx(context.configuration.username)
     this.passwordRx = toRx(context.configuration.password)
   }
 
-  public async execute (input: TransitInput, object: Entity): Promise<Maybe<TransitOutput>> {
-    const existent = object._version !== 0
+  private locked(object: Entity): boolean {
+    return (
+      this.principal !== undefined &&
+      object.authority === this.principal.authority &&
+      object.username === this.principal.username
+    )
+  }
 
-    if (existent)
-      await this.tokens.revoke({ query: { id: object.id } })
-    else
+  public async execute(
+    input: TransitInput,
+    object: Entity
+  ): Promise<Maybe<TransitOutput>> {
+    const deleted = object.DELETED !== undefined && object.DELETED !== null
+    const existent = object.VERSION !== 0 && !deleted
+
+    if (existent) {
+      if (input.inception === true) return ERR_EXISTS
+
+      await Promise.all([
+        this.tokens.revoke({ query: { id: object.id } }),
+        this.keys.revoke({ input: { identity: object.id } })
+      ])
+    } else if (input.authority !== undefined)
+      // a record that is new and names no authority is refused by the entity contract
       object.authority = input.authority
 
     if (input.username !== undefined) {
-      if (existent && object.username === this.principal)
-        return ERR_PRINCIPAL_LOCKED
+      if (existent && this.locked(object)) return ERR_PRINCIPAL_LOCKED
 
-      if (invalid(input.username, this.usernameRx))
-        return ERR_INVALID_USERNAME
+      if (invalid(input.username, this.usernameRx)) return ERR_INVALID_USERNAME
 
       object.username = input.username
     }
 
     if (input.password !== undefined) {
-      if (invalid(input.password, this.passwordRx))
-        return ERR_INVALID_PASSWORD
+      if (invalid(input.password, this.passwordRx)) return ERR_INVALID_PASSWORD
 
-      const salt = await genSalt(this.rounds)
       const spicy = input.password + this.pepper
 
-      object.password = await hash(spicy, salt)
+      object.password = await hash(spicy, this.rounds)
     }
 
     return { id: object.id }
   }
 }
 
-function toRx (input: string | string[]): RegExp[] {
-  const expressions = typeof input === 'string' ? [input] : input
-
+function toRx(expressions: string[]): RegExp[] {
   return expressions.map((expression) => new RegExp(expression))
 }
 
-function invalid (value: string, expressions: RegExp[]): boolean {
+function invalid(value: string, expressions: RegExp[]): boolean {
   return expressions.some((expression) => !expression.test(value))
 }
 
-const ERR_PRINCIPAL_LOCKED = Err('PRINCIPAL_LOCKED', 'Principal username cannot be changed.')
-const ERR_INVALID_USERNAME = Err('INVALID_USERNAME', 'Username is not meeting the requirements.')
-const ERR_INVALID_PASSWORD = Err('INVALID_PASSWORD', 'Password is not meeting the requirements.')
+const ERR_PRINCIPAL_LOCKED = new (class PrincipalLockedError extends Error {
+  public readonly code = 'PRINCIPAL_LOCKED'
+  public override readonly message = 'Principal username cannot be changed'
+})()
+
+const ERR_INVALID_USERNAME = new (class InvalidUsernameError extends Error {
+  public readonly code = 'INVALID_USERNAME'
+  public override readonly message = 'Username is not meeting the requirements'
+})()
+
+const ERR_INVALID_PASSWORD = new (class InvalidPasswordError extends Error {
+  public readonly code = 'INVALID_PASSWORD'
+  public override readonly message = 'Password is not meeting the requirements'
+})()
+
+const ERR_EXISTS = new (class ExistsError extends Error {
+  public readonly code = 'EXISTS'
+  public override readonly message = 'Basic credentials already exist'
+})()
 
 type Tokens = Context['remote']['identity']['tokens']
+type Keys = Context['remote']['identity']['keys']

package/components/identity.basic/tsconfig.json

@@ -1,7 +1,8 @@
 {
-  "extends": "../../tsconfig.json",
+  "extends": "../../../../tsconfig.component.json",
   "compilerOptions": {
     "outDir": "./operations",
+    "rootDir": "./source"
   },
   "include": [
     "source"

package/components/identity.basic/types/index.d.ts

@@ -0,0 +1,26 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.
+
+import type { Query, RemoteError } from '@toa.io/core/types'
+import type { Component, Configuration } from './toa.d.ts'
+
+/** Credentials whose Identity is granted the `system` role. */
+export type Principal = NonNullable<Configuration['principal']>
+
+/** What this component is given: its own operations, and the ones it calls. */
+export interface Context {
+  local: Component
+  remote: {
+    identity: {
+      tokens: { revoke: (request: { query: Query }) => Promise<null | RemoteError> }
+      keys: {
+        revoke: (request: { input: { identity: string } }) => Promise<null | RemoteError>
+      }
+      roles: {
+        principal: (request: { input: { id: string } }) => Promise<null | RemoteError>
+      }
+    }
+  }
+  configuration: Configuration
+}

package/components/identity.basic/types/toa.d.ts

@@ -0,0 +1,122 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, Query, RemoteError } from '@toa.io/core/types'
+import type { Secret } from '@toa.io/extensions.configuration'
+import type { FetchInit } from '@toa.io/extensions.fetch'
+import type { Logs, Metrics, Span } from '@toa.io/extensions.telemetry'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  authority: string
+  username: string
+  password: string
+  id: string
+  VERSION: number
+  CREATED: number
+  UPDATED: number
+  DELETED: number | null
+  REGION: number
+}
+
+export type TransitInput = {
+  username?: string
+  password?: string
+  authority?: string
+  /** Whether the credentials are being created rather than changed */
+  inception?: boolean
+}
+
+export type TransitOutput = {
+  id: string
+}
+
+export type CreateInput = {
+  authority: string
+  username: string
+  password: string
+  /** Whether the credentials are being created rather than changed */
+  inception?: boolean
+}
+
+export type CreateOutput = {
+  id: string
+}
+
+export type AddInput = {
+  id: string
+  authority: string
+  username: string
+  password: string
+}
+
+export type InceptInput = {
+  authority: string
+  id: string
+  credentials: string
+}
+
+export type InceptOutput = {
+  id?: string
+}
+
+export type AuthenticateInput = {
+  authority: string
+  credentials: string
+}
+
+export type AuthenticateOutput = {
+  identity?: {
+    id?: string
+  }
+}
+
+export type CheckInput = {
+  username: string
+}
+
+export type CheckOutput = null
+
+export type InfoInput = {
+  authority: string
+  identity: string
+}
+
+export type InfoOutput = {
+  username: string
+} | null
+
+export type DeleteInput = {
+  authority: string
+  identity: string
+}
+
+export interface Component {
+  transit: (request: { input: TransitInput, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<TransitOutput | RemoteError<"PRINCIPAL_LOCKED" | "INVALID_USERNAME" | "INVALID_PASSWORD" | "EXISTS">>
+  create: (request: { input: CreateInput, task?: boolean }, options?: Options) => Promise<CreateOutput | RemoteError<"PRINCIPAL_LOCKED" | "INVALID_USERNAME" | "INVALID_PASSWORD" | "EXISTS">>
+  add: (request: { input: AddInput, task?: boolean }, options?: Options) => Promise<unknown | RemoteError<"PRINCIPAL_LOCKED" | "INVALID_USERNAME" | "INVALID_PASSWORD" | "EXISTS">>
+  incept: (request: { input: InceptInput, task?: boolean }, options?: Options) => Promise<InceptOutput | RemoteError<"INVALID_CREDENTIALS">>
+  authenticate: (request: { input: AuthenticateInput, task?: boolean }, options?: Options) => Promise<AuthenticateOutput | RemoteError<"NOT_FOUND" | "PASSWORD_MISMATCH">>
+  check: (request: { input: CheckInput, task?: boolean }, options?: Options) => Promise<CheckOutput>
+  info: (request: { input: InfoInput, task?: boolean }, options?: Options) => Promise<InfoOutput>
+  delete: (request: { input: DeleteInput, task?: boolean }, options?: Options) => Promise<unknown>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+}
+
+export interface Configuration {
+  rounds: number
+  /** Hashing pepper, a secret */
+  pepper?: Secret
+  /** Basic credentials whose Identity is granted the `system` role */
+  principal?: {
+    authority: string
+    username: string
+  }
+  username: string[]
+  password: string[]
+}

package/components/identity.clients/manifest.toa.yaml

@@ -0,0 +1,239 @@
+namespace: identity
+name: clients
+
+# A registration is addressed by the hash of what it says, so the same metadata is the
+# same client however many times it arrives. `associated` is what lets a transition create
+# the record at an id decided outside the storage.
+entity:
+  associated: true
+  properties:
+    authority:
+      type: string
+    name:
+      description: client_name
+      type: string
+      maxLength: 128
+    uris:
+      description: redirect_uris
+      type: array
+      minItems: 1
+      maxItems: 8
+      items:
+        type: string
+        maxLength: 2048
+    uri:
+      description: client_uri
+      type: string
+      maxLength: 2048
+    logo:
+      description: logo_uri
+      type: string
+      maxLength: 2048
+    scope:
+      type: string
+      maxLength: 512
+    expires:
+      description: When a registration nothing has used is swept
+      type: number
+  required:
+    - authority
+    - uris
+
+operations:
+  transit:
+    concurrency: retry
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        name:
+          type: string
+        uri:
+          type: string
+        logo:
+          type: string
+        scope:
+          type: string
+        uris:
+          type: array
+          items:
+            type: string
+        expires:
+          type: number
+      required:
+        - authority
+        - uris
+
+  register:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        client_name:
+          type: string
+          maxLength: 128
+        client_uri:
+          type: string
+          maxLength: 2048
+        logo_uri:
+          type: string
+          maxLength: 2048
+        redirect_uris:
+          type: array
+          minItems: 1
+          maxItems: 8
+          items:
+            type: string
+            maxLength: 2048
+        scope:
+          type: string
+          maxLength: 512
+        grant_types:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        token_endpoint_auth_method:
+          type: string
+      required:
+        - authority
+        - redirect_uris
+    # RFC 7591 §3.2.2 states a registration error as a body, not as a status of its own
+    output:
+      type: object
+      properties:
+        status:
+          description: Read and removed by `map:status`
+          type: number
+        client_id:
+          type: string
+        client_id_issued_at:
+          type: number
+        client_name:
+          type: string
+        client_uri:
+          type: string
+        logo_uri:
+          type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        grant_types:
+          type: array
+          items:
+            type: string
+        response_types:
+          type: array
+          items:
+            type: string
+        token_endpoint_auth_method:
+          type: string
+        error:
+          type: string
+        error_description:
+          type: string
+
+  describe:
+    query: false
+    input:
+      type: object
+      properties:
+        authority:
+          type: string
+        id:
+          description: client_id, which is an https URL when the client publishes its own metadata
+          type: string
+          maxLength: 2048
+        redirect:
+          description: Asked about together with the client, since only this component may answer it
+          type: string
+          maxLength: 2048
+      required:
+        - authority
+        - id
+    output:
+      type: object
+      properties:
+        client_id:
+          type: string
+        client_name:
+          type: string
+        client_uri:
+          type: string
+        logo_uri:
+          type: string
+        redirect_uris:
+          type: array
+          items:
+            type: string
+        permitted:
+          description: Whether `redirect` is one this client may receive a code at
+          type: boolean
+    errors:
+      - UNKNOWN_CLIENT
+
+configuration:
+  schema:
+    type: object
+    properties:
+      trust:
+        description: Origins whose Client ID Metadata Documents may be read; none are without one
+        type: array
+        items:
+          type: string
+          pattern: ^https://
+      lifetime:
+        description: Seconds a Client ID Metadata Document is held before it is read again
+        type: integer
+        minimum: 1
+      ttl:
+        description: Seconds a registration nothing has used is kept
+        type: integer
+        minimum: 1
+      size:
+        description: Bytes of a Client ID Metadata Document that are read
+        type: integer
+        minimum: 1
+      timeout:
+        description: Milliseconds a Client ID Metadata Document has to arrive
+        type: integer
+        minimum: 1
+  defaults:
+    trust: []
+    lifetime: 3600
+    ttl: 2592000
+    size: 16384
+    timeout: 3000
+
+stash: ~
+
+exposition:
+  isolated: true
+  /:
+    POST:
+      anonymous: true
+      map:authority: authority
+      io:input: [client_name, client_uri, logo_uri, redirect_uris, scope, grant_types, response_types, token_endpoint_auth_method]
+      io:output: true
+      io:throttle:
+        key: ip
+        requests: 10
+        interval: 3600
+      io:status: status
+      cache:exact: no-store
+      endpoint: register
+    /:id:
+      GET:
+        anyone: true
+        map:authority: authority
+        map:segments:
+          id: id
+        io:output: [client_id, client_name, client_uri, logo_uri, redirect_uris]
+        endpoint: describe

package/components/identity.clients/migrations/0002-indexes.yaml

@@ -0,0 +1,4 @@
+- index:
+    name: index_authority
+    keys:
+      authority: asc

package/components/identity.clients/operations/describe.js

@@ -0,0 +1,44 @@
+import { ERR_UNKNOWN_CLIENT, permits, read } from './lib/index.js';
+/**
+ * What a client is, whichever way it came to be known: a `client_id` that is an https URL
+ * publishes its own metadata, and anything else was registered here. The caller is not told
+ * which, and neither mechanism is visible past this operation.
+ *
+ * Whether a redirect is one the client may receive a code at is answered here too. The rule
+ * is this component's — nothing else knows a loopback port is ignored — and asking for it
+ * with the client saves a second call on the path a person is waiting on.
+ */
+export class Computation {
+    context;
+    mount(context) {
+        this.context = context;
+    }
+    async execute(input) {
+        const client = input.id.startsWith(HTTPS)
+            ? await read(input.id, this.context)
+            : await this.registered(input);
+        if (client instanceof Error)
+            return client;
+        return {
+            ...client,
+            ...(input.redirect === undefined
+                ? {}
+                : { permitted: permits(client.redirect_uris, input.redirect) })
+        };
+    }
+    async registered(input) {
+        const entity = await this.context.local.observe({ query: { id: input.id } });
+        // credentials are scoped to an authority, and so is what may act for them
+        if (entity === null || entity.authority !== input.authority)
+            return ERR_UNKNOWN_CLIENT;
+        return {
+            client_id: entity.id,
+            client_name: entity.name,
+            client_uri: entity.uri,
+            logo_uri: entity.logo,
+            redirect_uris: entity.uris
+        };
+    }
+}
+const HTTPS = 'https://';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVzY3JpYmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zb3VyY2UvZGVzY3JpYmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQTtBQUtsRTs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sT0FBTyxXQUFXO0lBQ2QsT0FBTyxDQUFVO0lBRWxCLEtBQUssQ0FBQyxPQUFnQjtRQUMzQixJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQTtJQUN4QixDQUFDO0lBRU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFZO1FBQy9CLE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztZQUN2QyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQ3BDLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFaEMsSUFBSSxNQUFNLFlBQVksS0FBSztZQUFFLE9BQU8sTUFBTSxDQUFBO1FBRTFDLE9BQU87WUFDTCxHQUFHLE1BQU07WUFDVCxHQUFHLENBQUMsS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTO2dCQUM5QixDQUFDLENBQUMsRUFBRTtnQkFDSixDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7U0FDbEUsQ0FBQTtJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQVk7UUFDbkMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQTtRQUU1RSwwRUFBMEU7UUFDMUUsSUFBSSxNQUFNLEtBQUssSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVM7WUFBRSxPQUFPLGtCQUFrQixDQUFBO1FBRXRGLE9BQU87WUFDTCxTQUFTLEVBQUUsTUFBTSxDQUFDLEVBQUU7WUFDcEIsV0FBVyxFQUFFLE1BQU0sQ0FBQyxJQUFJO1lBQ3hCLFVBQVUsRUFBRSxNQUFNLENBQUMsR0FBRztZQUN0QixRQUFRLEVBQUUsTUFBTSxDQUFDLElBQUk7WUFDckIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxJQUFJO1NBQzNCLENBQUE7SUFDSCxDQUFDO0NBQ0Y7QUFFRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUEifQ==

package/components/identity.clients/operations/lib/Context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiQ29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NvdXJjZS9saWIvQ29udGV4dC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/components/identity.clients/operations/lib/Entity.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiRW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9FbnRpdHkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/components/identity.clients/operations/lib/canonical.js

@@ -0,0 +1,24 @@
+import { createHash } from 'node:crypto';
+/**
+ * The id of a registration: a hash of what it says, so identical metadata is one client
+ * however many times it arrives. A client cannot remember that it registered here, and
+ * registers again on every fresh connection; without this the registry only grows.
+ *
+ * Only what is honoured is hashed. A field this component ignores would otherwise mint a
+ * client per release of whoever sends it, and the authority is in there because credentials
+ * are scoped to one.
+ */
+export function identify(authority, metadata) {
+    const canonical = JSON.stringify([
+        authority,
+        metadata.client_name ?? null,
+        metadata.client_uri ?? null,
+        metadata.logo_uri ?? null,
+        metadata.scope ?? null,
+        [...metadata.redirect_uris].sort()
+    ]);
+    return createHash('sha256').update(canonical).digest('hex').slice(0, LENGTH);
+}
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2Fub25pY2FsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc291cmNlL2xpYi9jYW5vbmljYWwudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLGFBQWEsQ0FBQTtBQUd4Qzs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxRQUFRLENBQUMsU0FBaUIsRUFBRSxRQUFrQjtJQUM1RCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQy9CLFNBQVM7UUFDVCxRQUFRLENBQUMsV0FBVyxJQUFJLElBQUk7UUFDNUIsUUFBUSxDQUFDLFVBQVUsSUFBSSxJQUFJO1FBQzNCLFFBQVEsQ0FBQyxRQUFRLElBQUksSUFBSTtRQUN6QixRQUFRLENBQUMsS0FBSyxJQUFJLElBQUk7UUFDdEIsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQyxJQUFJLEVBQUU7S0FDbkMsQ0FBQyxDQUFBO0lBRUYsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0FBQzlFLENBQUM7QUFFRCxrREFBa0Q7QUFDbEQsTUFBTSxNQUFNLEdBQUcsRUFBRSxDQUFBIn0=