@usequeek/app-sdk 0.4.0

package/dist/store.d.ts

@@ -0,0 +1,278 @@
+import { Pool } from "pg";
+/**
+ * The app database holds INSTALLATIONS ONLY (decision
+ * 2026-09-23-queek-apps-separate-ts-hono-codebase-public-surface-only).
+ * Business data lives in Queek (product metafields,
+ * orders.integrator_metadata) — never here.
+ *
+ * S1 (SDK 0.2.0): no store-callable credential crosses the install handoff
+ * any more, so there is no `api_key` column. The app mints short-lived
+ * installation tokens with its asymmetric app key and caches ONE token per
+ * installation here (`token_enc` + `token_expires_at` + `token_kid`);
+ * `webhook_secret` AND the whole `settings` blob stay encrypted at rest
+ * (AES-256-GCM via node:crypto, key from `APP_ENCRYPTION_KEY`): manifests
+ * may declare `secret` settings (API keys, webhook secrets) and the backend
+ * encrypts those too, so the SDK must not be weaker. NOTHING secret is ever
+ * logged: only ids and the store p_id may appear in logs.
+ */
+export interface InstallationRecord {
+    /** Queek installation id (string form of the backend UUID). */
+    installationId: string;
+    /** Queek installation p_id (short public id, safe to log). */
+    installationPid: string;
+    /** Vendor id (backend UUID, string form). */
+    vendorId: string;
+    /** Store p_id (safe to log). */
+    storePid: string | null;
+    /** Store name (safe to log). */
+    storeName: string;
+    /** Merchant API base handed over at install. */
+    apiBase: string;
+    /**
+     * Cached installation token — plaintext in memory only, persisted as
+     * `token_enc`, null when nothing is cached (fresh install, expiry,
+     * explicit drop, kill switch). Never logged.
+     */
+    token: string | null;
+    /** ISO-8601 expiry of the cached token, null when none is cached. */
+    tokenExpiresAt: string | null;
+    /** `kid` the cached token was minted under, null when none is cached. */
+    tokenKid: string | null;
+    /**
+     * True while Queek last answered 409 `app_installation_pending` for this
+     * installation (persisted column, survives restarts — the in-process-only
+     * mark could not). `GET installations` lists active installations only,
+     * so resync's purge-absent step keeps rows flagged here. Cleared when
+     * the installation is seen active (resync 202/redelivery) or its mint
+     * succeeds; the row's deletion (404 `app_installation_gone`) drops the
+     * flag with the row.
+     */
+    pending: boolean;
+    scopes: string[];
+    settings: Record<string, unknown>;
+    /** Plaintext per-installation webhook secret — memory only. */
+    webhookSecret: string | null;
+    /**
+     * Plaintext per-installation proxy secret — memory only, persisted as
+     * `proxy_secret_enc`, null when the app has no proxy. Signs
+     * slot-claims (booking app); never logged (the logger redacts
+     * secret-named keys).
+     */
+    proxySecret: string | null;
+    /**
+     * Plaintext per-installation embed secret (`embsec_…`) — memory only,
+     * persisted as `embed_secret_enc`, null when the app has no merchant
+     * page. Verifies dashboard session tokens; never logged.
+     */
+    embedSecret?: string | null;
+    /** The app's own id as Queek signs it into session tokens (`app_id`); not a secret. */
+    appId?: string | null;
+    webhookUrl: string | null;
+    webhookTopics: string[];
+    installedAt: string;
+    updatedAt: string;
+}
+export interface WebhookSecretCandidate {
+    installationId: string;
+    secret: string;
+}
+export interface InstallationStore {
+    saveInstallation(record: InstallationRecord): Promise<void> | void;
+    getInstallation(installationId: string): Promise<InstallationRecord | null> | InstallationRecord | null;
+    deleteInstallation(installationId: string): Promise<void> | void;
+    /** Every stored installation, ordered by id — resync and cron iterate this. */
+    listInstallations(): Promise<InstallationRecord[]> | InstallationRecord[];
+    /**
+     * Forget one installation's cached token (expiry, token-refusal re-mint,
+     * resync) while keeping the installation row: the next `acquireToken`
+     * mints fresh.
+     */
+    clearCachedToken(installationId: string): Promise<void> | void;
+    /** Forget EVERY cached token (kill switch) while keeping the rows. */
+    clearAllCachedTokens(): Promise<void> | void;
+    /**
+     * Persist the 409 `app_installation_pending` mark: Queek refused this
+     * installation as not-yet-active. The flag survives restarts (plain
+     * column, NOT NULL DEFAULT false) so a restart between the 409 and the
+     * next resync can never purge the in-flight row the active-only list
+     * omits. Idempotent.
+     */
+    markInstallationPending(installationId: string): Promise<void> | void;
+    /**
+     * Clear the pending mark: the installation answered active again
+     * (resync 202/redelivery) or its mint succeeded.
+     */
+    clearInstallationPending(installationId: string): Promise<void> | void;
+    /** True when the row carries the persisted pending mark (false when the row is missing). */
+    isKnownPending(installationId: string): Promise<boolean> | boolean;
+    /** Secrets only (no tokens) for webhook sender identification. */
+    listWebhookSecrets(): Promise<WebhookSecretCandidate[]> | WebhookSecretCandidate[];
+    /** Replay guard: true when this webhook-id was already processed. */
+    hasSeenWebhookId(webhookId: string): Promise<boolean> | boolean;
+    /** Record a processed webhook-id (entries expire after 24h). */
+    markWebhookSeen(webhookId: string): Promise<void> | void;
+    /**
+     * Atomically claim a webhook-id: records it and returns true only if no
+     * unexpired claim exists. Handlers claim BEFORE running the callback so
+     * two concurrent same-id deliveries cannot both execute; on callback
+     * failure they `releaseWebhookId` so a Queek retry can still land.
+     */
+    claimWebhookId(webhookId: string): Promise<boolean> | boolean;
+    /** Release a claim (callback failed; a retry may re-run). */
+    releaseWebhookId(webhookId: string): Promise<void> | void;
+}
+export interface SqliteStoreOptions {
+    /** Path to the sqlite file. Use `:memory:` for tests. */
+    path: string;
+    /** Raw `APP_ENCRYPTION_KEY` value (base64 or hex of 32 bytes). */
+    storeKey: string;
+}
+/**
+ * Default local/dev/test `InstallationStore`: SQLite through the Node 22
+ * built-in `node:sqlite` (`DatabaseSync` — synchronous, file-backed, WAL
+ * mode).
+ *
+ * Why not better-sqlite3: its prebuilt binary segfaults on the project's
+ * Node 22.12 runtime (observed, not theorised), and building from source
+ * would force a C++ toolchain into every environment — dev Macs, CI, and
+ * the slim alpine app images. `node:sqlite` is dependency-free with an
+ * identical synchronous shape.
+ *
+ * `node:sqlite` needs no flag since Node 22.13.0 (pinned runtime 22.23.3;
+ * an ExperimentalWarning on stderr remains — Stability 1.1). Devs on an
+ * older 22 minor set `NODE_OPTIONS=--experimental-sqlite` in their shell.
+ * Revisit when the apps run on a Node line where it is fully stable — the
+ * swap is contained here, behind `InstallationStore`.
+ *
+ * 0.1.x → 0.2.0 upgrade: databases created by SDK 0.1.x carry a legacy
+ * `api_key_enc` column (the handoff no longer delivers that key, so its
+ * value is dead — minted tokens replace it; resync restores connectivity).
+ * Opening such a database adds the token-cache columns and drops
+ * `api_key_enc`; the legacy ciphertext is discarded, never decrypted.
+ */
+export declare class SqliteInstallationStore implements InstallationStore {
+    private readonly db;
+    private readonly key;
+    constructor(options: SqliteStoreOptions);
+    private migrateFromApiKeySchema;
+    saveInstallation(record: InstallationRecord): void;
+    getInstallation(installationId: string): InstallationRecord | null;
+    listInstallations(): InstallationRecord[];
+    clearCachedToken(installationId: string): void;
+    clearAllCachedTokens(): void;
+    deleteInstallation(installationId: string): void;
+    markInstallationPending(installationId: string): void;
+    clearInstallationPending(installationId: string): void;
+    isKnownPending(installationId: string): boolean;
+    listWebhookSecrets(): WebhookSecretCandidate[];
+    hasSeenWebhookId(webhookId: string): boolean;
+    markWebhookSeen(webhookId: string): void;
+    claimWebhookId(webhookId: string): boolean;
+    releaseWebhookId(webhookId: string): void;
+    private pruneSeenIds;
+    close(): void;
+}
+/**
+ * Current schema revision, stored as exactly one row in `schema_version`
+ * (Postgres) and enforced by column-presence migration (SQLite).
+ * v2 adds the persisted 409-pending mark (`pending`, NOT NULL DEFAULT
+ * false on both drivers); v3 the proxy secret; v4 the embed secret and
+ * app id that verify dashboard session tokens (all nullable).
+ */
+export declare const INSTALLATION_SCHEMA_VERSION = 4;
+export interface PostgresStoreOptions {
+    /**
+     * Postgres connection string (usually `DATABASE_URL`). Required unless
+     * `pool` is given (shared-pool wiring passes the pool instead).
+     */
+    connectionString?: string;
+    /** Raw `APP_ENCRYPTION_KEY` value (base64 or hex of 32 bytes). */
+    storeKey: string;
+    /**
+     * Pool ceiling when the store owns its pool (default 2). Apps that share one
+     * pool per process (`createPostgresPool`) size it there: each app role has
+     * CONNECTION LIMIT 10, so replicas × pool max must stay under it.
+     */
+    poolMax?: number;
+    /**
+     * An existing pool to run queries on (one shared `pg` Pool per process
+     * between the SDK store and the app's own store — see
+     * `createPostgresPool`). When given, the store never ends it: `close()`
+     * is a no-op and the pool owner shuts it down. Ignores `poolMax` and
+     * `connectionString`.
+     */
+    pool?: Pool;
+}
+/**
+ * Build one shared `pg` Pool for a process (the SDK store and the app's
+ * own store both run on it — total connections per app stay small: one
+ * pool of N per process instead of one pool per store). Attaches the same
+ * idle-client error guard the store constructors use, so a dropped idle
+ * connection never surfaces as an uncaught exception.
+ */
+export declare function createPostgresPool(connectionString: string, max?: number): Pool;
+/**
+ * Production `InstallationStore`: Postgres through `pg` (`Pool`, max 2).
+ *
+ * Schema safety when two containers boot together: the first statement of
+ * `ensureSchema()` takes a Postgres advisory lock, then creates the tables
+ * plus exactly one `schema_version` row, then releases the lock — so
+ * concurrent boots serialize instead of racing DDL. Every store method
+ * awaits the same cached init promise, so no query runs before the schema
+ * exists. The AES-256-GCM envelope is byte-identical to the SQLite store
+ * (same `encryptSecret`/`decryptSecret`, same `APP_ENCRYPTION_KEY`).
+ */
+export declare class PostgresInstallationStore implements InstallationStore {
+    private readonly pool;
+    private readonly ownsPool;
+    private readonly key;
+    private readonly ready;
+    constructor(options: PostgresStoreOptions);
+    private ensureSchema;
+    saveInstallation(record: InstallationRecord): Promise<void>;
+    getInstallation(installationId: string): Promise<InstallationRecord | null>;
+    listInstallations(): Promise<InstallationRecord[]>;
+    clearCachedToken(installationId: string): Promise<void>;
+    clearAllCachedTokens(): Promise<void>;
+    deleteInstallation(installationId: string): Promise<void>;
+    markInstallationPending(installationId: string): Promise<void>;
+    clearInstallationPending(installationId: string): Promise<void>;
+    isKnownPending(installationId: string): Promise<boolean>;
+    listWebhookSecrets(): Promise<WebhookSecretCandidate[]>;
+    hasSeenWebhookId(webhookId: string): Promise<boolean>;
+    markWebhookSeen(webhookId: string): Promise<void>;
+    claimWebhookId(webhookId: string): Promise<boolean>;
+    releaseWebhookId(webhookId: string): Promise<void>;
+    private pruneSeenIds;
+    /**
+     * Drain the pool (tests and graceful shutdown). A no-op when the store
+     * runs on a shared pool it does not own — the pool owner ends it.
+     */
+    close(): Promise<void>;
+}
+export interface InstallationStoreSelector {
+    /** Raw `APP_ENCRYPTION_KEY` value (base64 or hex of 32 bytes). */
+    storeKey: string;
+    /**
+     * Postgres connection string. Defaults to `DATABASE_URL`; when set (and
+     * non-blank) the Postgres store wins, otherwise SQLite.
+     */
+    databaseUrl?: string;
+    /** SQLite file path. Defaults to `QUEEK_DB_PATH`, else `./data/installations.db`. */
+    sqlitePath?: string;
+    /** Postgres pool ceiling (default 2). */
+    poolMax?: number;
+    /**
+     * A shared pool from `createPostgresPool`. When given, Postgres wins
+     * regardless of `DATABASE_URL` (the pool already carries the DSN).
+     */
+    pool?: Pool;
+}
+/**
+ * Pick the installation store: `DATABASE_URL` set (or a shared `pool`
+ * given) → Postgres; otherwise SQLite — which production REFUSES (fail
+ * fast with a clear message: a live app must never run on a
+ * container-local database).
+ */
+export declare function createInstallationStore(options: InstallationStoreSelector): InstallationStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAG1B;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,eAAe,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qEAAqE;IACrE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;;;;;;;OAQG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,+DAA+D;IAC/D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnE,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,kBAAkB,GAAG,IAAI,CAAC;IACxG,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACjE,+EAA+E;IAC/E,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC;IAC1E;;;;OAIG;IACH,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/D,sEAAsE;IACtE,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtE;;;OAGG;IACH,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvE,4FAA4F;IAC5F,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACnE,kEAAkE;IAClE,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC,GAAG,sBAAsB,EAAE,CAAC;IACnF,qEAAqE;IACrE,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAChE,gEAAgE;IAChE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD;;;;;OAKG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC9D,6DAA6D;IAC7D,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC3D;AAED,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAiCD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAe;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEjB,OAAO,EAAE,kBAAkB;IAQvC,OAAO,CAAC,uBAAuB;IAwC/B,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IA2DlD,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAQlE,iBAAiB,IAAI,kBAAkB,EAAE;IAOzC,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAS9C,oBAAoB,IAAI,IAAI;IAM5B,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAIhD,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAIrD,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAItD,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAQ/C,kBAAkB,IAAI,sBAAsB,EAAE;IAY9C,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAQ5C,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMxC,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAQ1C,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIzC,OAAO,CAAC,YAAY;IAMpB,KAAK,IAAI,IAAI;CAGd;AAiDD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,IAAI,CAS1E;AAID;;;;;;;;;;GAUG;AACH,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;gBAE1B,OAAO,EAAE,oBAAoB;YAkB3B,YAAY;IAmEpB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2D3D,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAU3E,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAMlD,gBAAgB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvD,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOrC,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzD,uBAAuB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAWvD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASrD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWnD,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAK1C,YAAY;IAM1B;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAsDD,MAAM,WAAW,yBAAyB;IACxC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,yBAAyB,GAAG,iBAAiB,CAsB7F"}