fiftyone.pipeline.did 4.5.37 → 4.5.39

package/didClient.js

@@ -21,6 +21,7 @@
  * ********************************************************************* */
 
 const FodId = require('./fodId');
+const layout = require('./internal/layout');
 const IdType = require('./idType');
 const packageVersion = require('./package.json').version;
 
@@ -777,7 +778,7 @@ function ensureEncodedLength (value) {
  * @returns {Date} the moment the envelope says it was created
  */
 function dateOf (fodId) {
-  return new Date(OWID_EPOCH_MS + fodId.dateMinutes * MINUTE_MS);
+  return new Date(OWID_EPOCH_MS + fodId.date * MINUTE_MS);
 }
 
 /**
@@ -794,9 +795,9 @@ function dateOf (fodId) {
  */
 function payloadLengthValid (fodId) {
   const matchKeyLength = fodId.type === IdType.RANDOM
-    ? FodId.GUID_LENGTH
-    : FodId.MATCH_KEY_LENGTH;
-  return fodId.payload.length >= FodId.HEADER_LENGTH + matchKeyLength;
+    ? layout.GUID_LENGTH
+    : layout.MATCH_KEY_LENGTH;
+  return fodId.payload.length >= layout.HEADER_LENGTH + matchKeyLength;
 }
 
 /**

package/examples/fodIdExample.js

@@ -33,7 +33,12 @@
  */
 
 const { webcrypto } = require('crypto');
-const { FodId, IdType } = require('../index');
+const { FodId, IdType, Usage } = require('../index');
+// The payload byte layout is internal to the package, so a consumer
+// never reaches for it. This example builds a sample 51Did to work on,
+// which the cloud would otherwise issue, so it reads the layout from
+// inside the package.
+const layout = require('../internal/layout');
 
 const subtle = webcrypto.subtle;
 const VERSION = 2;
@@ -45,13 +50,17 @@ function uint32LE (v) {
 }
 
 function samplePayload () {
-  const p = new Uint8Array(FodId.PAYLOAD_LENGTH); // Probabilistic (flags 0x00)
-  p[FodId.LICENSE_ID_OFFSET] = 0x78;
-  p[FodId.LICENSE_ID_OFFSET + 1] = 0x56;
-  p[FodId.LICENSE_ID_OFFSET + 2] = 0x34;
-  p[FodId.LICENSE_ID_OFFSET + 3] = 0x12;
-  for (let i = 0; i < FodId.MATCH_KEY_LENGTH; i++) {
-    p[FodId.MATCH_KEY_OFFSET + i] = 0x20 + i;
+  const p = new Uint8Array(layout.PAYLOAD_LENGTH);
+  // Bits 6 and 7 are zero, so the type is Probabilistic. Bits 0 to 2 are
+  // the usage and they are cumulative, so 0b011 grants standard
+  // marketing and, with it, non-marketing use.
+  p[layout.FLAGS_OFFSET] = 0b0000_0011;
+  p[layout.LICENSE_ID_OFFSET] = 0x78;
+  p[layout.LICENSE_ID_OFFSET + 1] = 0x56;
+  p[layout.LICENSE_ID_OFFSET + 2] = 0x34;
+  p[layout.LICENSE_ID_OFFSET + 3] = 0x12;
+  for (let i = 0; i < layout.MATCH_KEY_LENGTH; i++) {
+    p[layout.MATCH_KEY_OFFSET + i] = 0x20 + i;
   }
   return p;
 }
@@ -94,7 +103,8 @@ async function run () {
   console.log('51Did parsed from base64:');
   console.log('  Domain    :', fodId.domain);
   console.log('  Type      :', IdType.name(fodId.type));
-  console.log('  Flags     : 0x' + fodId.flags.toString(16));
+  console.log('  Usage     :', Usage.name(fodId.usage));
+  console.log('  From cons.:', fodId.usageFromConsent);
   console.log('  LicenseId :', fodId.licenseId);
   console.log('  Match key :', Buffer.from(fodId.matchKey).toString('hex'));
   console.log('  Verifies  :', await fodId.verify(publicPem));
@@ -129,7 +139,7 @@ async function run () {
       ', status ' + result.status);
   }
   const shortPayload = await issue(
-    keyPair.privateKey, payload.slice(0, FodId.PAYLOAD_LENGTH - 1), DATE);
+    keyPair.privateKey, payload.slice(0, layout.PAYLOAD_LENGTH - 1), DATE);
   const short = FodId.tryParse(shortPayload);
   console.log('  a payload one byte short -> ok ' + short.ok +
     ', status ' + short.status);

package/fodId.js

@@ -21,7 +21,9 @@
  * ********************************************************************* */
 
 const owid = require('owid');
+const layout = require('./internal/layout');
 const IdType = require('./idType');
+const Usage = require('./usage');
 const FodIdParseError = require('./fodIdParseError');
 
 /**
@@ -82,42 +84,17 @@ const ParseStatus = Object.freeze(Object.assign({}, owid.ParseStatus, {
  * A FodId composes the OWID the OWID library read (holds it and delegates
  * the envelope fields to it). That OWID is frozen and hands out its byte
  * arrays as copies, so nothing a caller holds can change the identifier.
+ *
+ * Every field has a named accessor here, so nothing needs the payload
+ * bytes or their offsets. The byte layout itself is specified once for all
+ * languages, and that specification is the authority rather than this
+ * comment:
+ * https://github.com/51Degrees/specifications/blob/main/did-specification/identifier-layout.md
+ *
+ * What each 51Did package offers on top of that layout is specified at:
+ * https://github.com/51Degrees/specifications/blob/main/did-specification/package-surface.md
  */
 class FodId {
-  static FLAGS_OFFSET = 0;
-  static LICENSE_ID_OFFSET = 1;
-  static LICENSE_ID_LENGTH = 4;
-  /** Byte offset of the match key field within the payload. */
-  static MATCH_KEY_OFFSET = 5;
-  /**
-   * Byte length of the match key field for Probabilistic and HashedEmail
-   * identifiers, being a SHA-256.
-   */
-  static MATCH_KEY_LENGTH = 32;
-  /**
-   * Deprecated alias for {@link FodId.MATCH_KEY_OFFSET}. The stable,
-   * comparable part of a 51Did is now called the match key, mirroring the
-   * Model Terms for Marketing vocabulary. This alias will be removed in a
-   * future release.
-   * @deprecated Renamed to MATCH_KEY_OFFSET. This alias will be removed in
-   * a future release.
-   */
-  static HASH_OFFSET = FodId.MATCH_KEY_OFFSET;
-  /**
-   * Deprecated alias for {@link FodId.MATCH_KEY_LENGTH}. The stable,
-   * comparable part of a 51Did is now called the match key, mirroring the
-   * Model Terms for Marketing vocabulary. This alias will be removed in a
-   * future release.
-   * @deprecated Renamed to MATCH_KEY_LENGTH. This alias will be removed in
-   * a future release.
-   */
-  static HASH_LENGTH = FodId.MATCH_KEY_LENGTH;
-  static HEADER_LENGTH = FodId.MATCH_KEY_OFFSET;
-  /** Byte length of the GUID match key carried by Random identifiers. */
-  static GUID_LENGTH = 16;
-  static RANDOM_PAYLOAD_LENGTH = 21;
-  static PAYLOAD_LENGTH = FodId.MATCH_KEY_OFFSET + FodId.MATCH_KEY_LENGTH;
-
   /**
    * Why a read succeeded or failed, being the OWID library's statuses plus
    * `PAYLOAD_TOO_SHORT` and `INVALID_TYPE_PAYLOAD_LENGTH`. Frozen.
@@ -303,16 +280,31 @@ class FodId {
     return new FodId(owidInstance);
   }
 
-  /** @returns {number} the 1-byte usage flags bit-mask (0-255). */
-  get flags () {
-    return this._flags;
-  }
-
   /** @returns {number} the IdType carried in bits 6-7 of the flags. */
   get type () {
     return IdType.fromFlags(this._flags);
   }
 
+  /**
+   * The Usage carried in bits 0-2 of the flags, as the highest usage
+   * granted. See Usage for why it is read that way.
+   * @returns {number} a Usage value
+   */
+  get usage () {
+    return Usage.fromFlags(this._flags);
+  }
+
+  /**
+   * Whether the usage was derived from an IAB consent string the caller
+   * sent, rather than stated by the caller directly. Bit 3 of the flags.
+   * Both are legitimate ways to arrive at a usage, and this says nothing
+   * about which usage it is.
+   * @returns {boolean}
+   */
+  get usageFromConsent () {
+    return (this._flags & 0b1000) !== 0;
+  }
+
   /**
    * The 4-byte little-endian field at offset 1 of the payload, as an
    * unsigned integer (0-4294967295).
@@ -341,19 +333,6 @@ class FodId {
     return this._matchKey.slice();
   }
 
-  /**
-   * Deprecated alias for {@link FodId#matchKey}. The stable, comparable
-   * part of a 51Did is now called the match key, mirroring the Model Terms
-   * for Marketing vocabulary. This alias will be removed in a future
-   * release.
-   * @deprecated Renamed to matchKey. This alias will be removed in a future
-   * release.
-   * @returns {Uint8Array} the same bytes as {@link FodId#matchKey}
-   */
-  get hash () {
-    return this.matchKey;
-  }
-
   /** @returns {number} the OWID version. */
   get version () {
     return this._owid.version;
@@ -365,24 +344,13 @@ class FodId {
   }
 
   /**
-   * @returns {number} the OWID date as minutes since 2020-01-01 UTC, as an
-   * unsigned 32-bit number, the same value as {@link FodId#dateMinutes}.
-   */
-  get date () {
-    return this._owid.date;
-  }
-
-  /**
-   * The envelope's own date as the unsigned 32-bit count of minutes since
-   * 2020-01-01T00:00:00Z, exactly as the wire carries it. This is the value
-   * the OWID `public-key?date=` parameter takes, and the integer to use when
-   * comparing creation times. The OWID library now reads the field unsigned
-   * too, so {@link FodId#date} agrees with this getter. The getter is kept
-   * because callers were told to use it, and it still forces the unsigned
-   * reading should the field ever arrive signed.
+   * The envelope's own date, being the count of minutes since
+   * 2020-01-01T00:00:00Z exactly as the wire carries it, read as an
+   * unsigned 32-bit number. This is the integer to compare when asking
+   * which of two identifiers was issued first.
    * @returns {number} minutes since 2020-01-01T00:00:00Z
    */
-  get dateMinutes () {
+  get date () {
     return this._owid.date >>> 0;
   }
 
@@ -464,34 +432,34 @@ class FodId {
  */
 function unpack (payload) {
   const length = payload.length;
-  if (length < FodId.HEADER_LENGTH) {
+  if (length < layout.HEADER_LENGTH) {
     return {
       status: ParseStatus.PAYLOAD_TOO_SHORT,
       length,
-      required: FodId.HEADER_LENGTH
+      required: layout.HEADER_LENGTH
     };
   }
-  const flags = payload[FodId.FLAGS_OFFSET];
+  const flags = payload[layout.FLAGS_OFFSET];
   // Little-endian unsigned 32-bit. `>>> 0` forces unsigned so the high bit
   // does not produce a negative number.
   const licenseId = (
-    payload[FodId.LICENSE_ID_OFFSET] |
-    (payload[FodId.LICENSE_ID_OFFSET + 1] << 8) |
-    (payload[FodId.LICENSE_ID_OFFSET + 2] << 16) |
-    (payload[FodId.LICENSE_ID_OFFSET + 3] << 24)
+    payload[layout.LICENSE_ID_OFFSET] |
+    (payload[layout.LICENSE_ID_OFFSET + 1] << 8) |
+    (payload[layout.LICENSE_ID_OFFSET + 2] << 16) |
+    (payload[layout.LICENSE_ID_OFFSET + 3] << 24)
   ) >>> 0;
   const type = IdType.fromFlags(flags);
   let matchKeyLength;
   if (type === IdType.RANDOM) {
-    matchKeyLength = FodId.GUID_LENGTH;
+    matchKeyLength = layout.GUID_LENGTH;
   } else if (type === IdType.RESERVED) {
     // Not yet assigned, so read best-effort, whatever follows the header
     // is the match key.
-    matchKeyLength = length - FodId.HEADER_LENGTH;
+    matchKeyLength = length - layout.HEADER_LENGTH;
   } else {
-    matchKeyLength = FodId.MATCH_KEY_LENGTH;
+    matchKeyLength = layout.MATCH_KEY_LENGTH;
   }
-  const required = FodId.HEADER_LENGTH + matchKeyLength;
+  const required = layout.HEADER_LENGTH + matchKeyLength;
   if (length < required) {
     return {
       status: ParseStatus.INVALID_TYPE_PAYLOAD_LENGTH,
@@ -506,7 +474,7 @@ function unpack (payload) {
     licenseId,
     // slice() copies, so the stored match key is this identifier's own.
     matchKey: payload.slice(
-      FodId.MATCH_KEY_OFFSET, FodId.MATCH_KEY_OFFSET + matchKeyLength),
+      layout.MATCH_KEY_OFFSET, layout.MATCH_KEY_OFFSET + matchKeyLength),
     length,
     required
   };

package/index.js

@@ -23,6 +23,7 @@
 const FodId = require('./fodId');
 const FodIdParseError = require('./fodIdParseError');
 const IdType = require('./idType');
+const Usage = require('./usage');
 const {
   DidClient,
   RedeemResult,
@@ -39,6 +40,7 @@ module.exports = {
   FodId,
   FodIdParseError,
   IdType,
+  Usage,
   DidClient,
   RedeemResult,
   ContextResult,

package/internal/layout.js

@@ -0,0 +1,62 @@
+/* *********************************************************************
+ * This Original Work is copyright of 51 Degrees Mobile Experts Limited.
+ * Copyright 2026 51 Degrees Mobile Experts Limited, Davidson House,
+ * Forbury Square, Reading, Berkshire, United Kingdom RG1 3EU.
+ *
+ * This Original Work is licensed under the European Union Public Licence
+ * (EUPL) v.1.2 and is subject to its terms as set out below.
+ *
+ * If a copy of the EUPL was not distributed with this file, You can obtain
+ * one at https://opensource.org/licenses/EUPL-1.2.
+ *
+ * The 'Compatible Licences' set out in the Appendix to the EUPL (as may be
+ * amended by the European Commission) shall be deemed incompatible for
+ * the purposes of the Work and the provisions of the compatibility
+ * clause in Article 5 of the EUPL shall not apply.
+ *
+ * If using the Work as, or as part of, a network application, by
+ * including the attribution notice(s) required under Article 5 of the EUPL
+ * in the end user terms of the application under an appropriate heading,
+ * such notice(s) shall fulfill the requirements of that article.
+ * ********************************************************************* */
+
+/**
+ * The byte layout of a 51Did payload. Internal to this package, because the
+ * only reason to read the payload by hand is to read a field that already
+ * has a name on FodId, and reading the flags byte by hand is how the usage
+ * comes out backwards. The usage bits are cumulative, so a caller masking
+ * for the non-marketing bit alone reads every marketing identifier as
+ * non-marketing. Use the FodId accessors instead.
+ *
+ * The layout is described once for every language in the 51Did
+ * specification, which is the authority for these numbers:
+ * https://github.com/51Degrees/specifications/blob/main/did-specification/identifier-layout.md
+ *
+ * What each package offers on top of that layout is described in:
+ * https://github.com/51Degrees/specifications/blob/main/did-specification/package-surface.md
+ */
+module.exports = Object.freeze({
+  /** Byte offset of the flags byte within the payload. */
+  FLAGS_OFFSET: 0,
+  /** Byte offset of the licence id field within the payload. */
+  LICENSE_ID_OFFSET: 1,
+  /** Byte length of the licence id field. */
+  LICENSE_ID_LENGTH: 4,
+  /** Byte offset of the match key field within the payload. */
+  MATCH_KEY_OFFSET: 5,
+  /**
+   * Byte length of the match key field for Probabilistic and HashedEmail
+   * identifiers, being a SHA-256.
+   */
+  MATCH_KEY_LENGTH: 32,
+  /** Byte length of the flags and licence id fields together. */
+  HEADER_LENGTH: 5,
+  /** Byte length of the GUID match key carried by Random identifiers. */
+  GUID_LENGTH: 16,
+  /** Least payload length for a Random identifier. */
+  RANDOM_PAYLOAD_LENGTH: 21,
+  /**
+   * Least payload length for a Probabilistic or HashedEmail identifier.
+   */
+  PAYLOAD_LENGTH: 37
+});

package/node_modules/owid/README.md

@@ -22,6 +22,12 @@ public key from their well known end point and verifies the ECDSA signature
 locally. When `crypto.subtle` is not available it falls back to the creator's
 remote verify end point.
 
+Both end points are versioned, `/owid/api/v<version>/creator` and
+`/owid/api/v<version>/verify`, and the version in the path is the version
+byte of the OWID being verified rather than a fixed number, because a
+creator serves each version of the format at its own path and returns 404
+for the others.
+
 The public key is requested for the OWID's own creation date
 (`?date=<minutes>`), so OWIDs signed before a signing-key rotation still
 verify. A creator that does not support the `date` parameter ignores it and
@@ -38,6 +44,12 @@ The headers are sent to every creator domain that a verification touches,
 so only set a credential that all the creators in the tree are meant to
 see.
 
+A custom header makes the key request a non simple cross origin request, so
+the browser sends a `OPTIONS` preflight first and the creator has to answer
+it with `Access-Control-Allow-Headers` naming that header. A creator that
+does not answer the preflight cannot be given a credential this way, and
+the request never leaves the browser.
+
 ## Reading answers instead of throwing
 
 An OWID is read from whatever a caller was handed, which on a public end

package/node_modules/owid/owid.crypto.test.js

@@ -45,6 +45,25 @@ const otherKeyPair = nodeCrypto.generateKeyPairSync('ec', {
 // 2021-04-06 12:59 UTC expressed as minutes since 2020-01-01 00:00 UTC.
 const testDateInMinutes = 664619;
 
+// The version byte every OWID built here is written with. The mocked
+// creator only answers the path for this version, and the expected URL is
+// built from the version the library read back out of the OWID, so the test
+// and the library take the version from the same place and a wrong version
+// in either one fails rather than passing quietly.
+const testVersion = 3;
+
+/**
+ * The creator key URL the library must request for an OWID. The version
+ * segment comes from the OWID's own version byte, which is the value the
+ * library uses, so this expectation cannot drift away from the code.
+ * @param {Object} o - the OWID that was read.
+ * @returns {string} the expected URL.
+ */
+function expectedCreatorUrl(o) {
+    return "//" + o.domain + "/owid/api/v" + o.version +
+        "/creator?date=" + o.date;
+}
+
 /**
  * Reads an OWID that the test expects to be valid, asserting the three facts
  * a read always reports before handing back the OWID itself.
@@ -64,8 +83,9 @@ const wrongKeyDomain = "wrong-key.swan-demo.uk";
 const emptyKeyDomain = "empty-key.swan-demo.uk";
 
 /**
- * Builds the unsigned portion of a version 3 OWID as a byte array in the
- * same form the library serializes for verification.
+ * Builds the unsigned portion of an OWID, at the version named by
+ * testVersion, as a byte array in the same form the library serializes for
+ * verification.
  * @param {string} domain - the creator domain.
  * @param {number} dateInMinutes - minutes since the OWID base date.
  * @param {Buffer} payload - the payload bytes.
@@ -77,7 +97,7 @@ function buildUnsignedOWID(domain, dateInMinutes, payload) {
     var length = Buffer.alloc(4);
     length.writeUInt32LE(payload.length);
     return Buffer.concat([
-        Buffer.from([3]),
+        Buffer.from([testVersion]),
         Buffer.from(domain, 'ascii'),
         Buffer.from([0]),
         date,
@@ -132,7 +152,10 @@ beforeEach(() => {
         }
         var url = new URL(urlString);
 
-        if (url.pathname.endsWith("/creator")) {
+        // A real creator serves each version of the format at its own
+        // path and returns 404 for the others, so answering any version
+        // here would hide a request sent to the wrong one.
+        if (url.pathname === "/owid/api/v" + testVersion + "/creator") {
             // This domain returns a header only PEM with no key body, which
             // exercises the empty public key guard in the library.
             if (url.hostname == emptyKeyDomain) {
@@ -169,8 +192,65 @@ test('crypto verify valid OWID passes', () => {
         // The library must have used the public key path, so the only
         // request is to the creator end point.
         expect(fetch.mock.calls.length).toBe(1);
+        expect(fetch.mock.calls[0][0]).toBe(expectedCreatorUrl(o));
+    });
+});
+
+test('crypto verify asks the end point for the version the OWID carries', () => {
+    // Every other OWID in this suite is version 3, the same value a constant
+    // in the path would give, so this is the test that catches a constant
+    // put back. A version 2 OWID must ask the version 2 end point, which
+    // the mocked creator does not serve, so the key is unavailable and the
+    // one request that was made names the right path.
+    var date = Buffer.alloc(4);
+    date.writeUInt32LE(testDateInMinutes);
+    var payload = Buffer.from("example");
+    var length = Buffer.alloc(4);
+    length.writeUInt32LE(payload.length);
+    var unsigned = Buffer.concat([
+        Buffer.from([2]),
+        Buffer.from(creatorDomain, 'ascii'),
+        Buffer.from([0]),
+        date,
+        length,
+        payload
+    ]);
+    var o = read(signOWID(unsigned, creatorKeyPair.privateKey));
+    expect(o.version).toBe(2);
+
+    return o.checkSignature().then(r => {
+        expect(r.status).toBe(owid.SignatureStatus.KEY_UNAVAILABLE);
+        expect(fetch.mock.calls.length).toBe(1);
         expect(fetch.mock.calls[0][0]).toBe(
-            "//" + creatorDomain + "/owid/api/v1/creator?date=" + testDateInMinutes);
+            "//" + creatorDomain + "/owid/api/v2/creator?date=" +
+            testDateInMinutes);
+    });
+});
+
+// A creator whose domain answers with a redirect does not get the key at
+// the other end trusted as its own. The library asks fetch not to follow,
+// so the answer is the redirect itself, which is not ok and reads as the
+// key being unavailable, and no second request is made. Without this a
+// network attacker able to bend a creator's DNS, or a misconfigured
+// creator, could substitute the key, and the publisher's fetchHeaders
+// credential would travel to wherever the redirect pointed.
+test('crypto verify does not follow a redirect from the creator', () => {
+    var redirectDomain = "redirecting.example";
+    fetchMock.mockResponse(req => {
+        return Promise.resolve({
+            status: 302,
+            headers: { Location: "https://elsewhere.example/key.pem" },
+            body: ""
+        });
+    });
+    var unsigned = buildUnsignedOWID(
+        redirectDomain, testDateInMinutes, Buffer.from("example"));
+    var o = read(signOWID(unsigned, creatorKeyPair.privateKey));
+
+    return o.checkSignature().then(r => {
+        expect(r.status).toBe(owid.SignatureStatus.KEY_UNAVAILABLE);
+        expect(fetch.mock.calls.length).toBe(1);
+        expect(fetch.mock.calls[0][1].redirect).toBe("manual");
     });
 });
 

package/node_modules/owid/owid.interop.test.js

@@ -139,6 +139,18 @@ fixtures.forEach(f => {
     publicKeys[f.domain] = f.publicKeySPKI;
 });
 
+/**
+ * The creator key URL the library must request for an OWID. The version
+ * segment comes from the OWID's own version byte, which is the value the
+ * library uses, so this expectation cannot drift away from the code.
+ * @param {Object} o - the OWID that was read.
+ * @returns {string} the expected URL.
+ */
+function expectedCreatorUrl(o) {
+    return "//" + o.domain + "/owid/api/v" + o.version +
+        "/creator?date=" + o.date;
+}
+
 /**
  * Returns the base 64 string with a single byte changed at the given offset
  * of the decoded byte array.
@@ -164,7 +176,12 @@ beforeEach(() => {
         }
         var url = new URL(urlString);
 
-        if (url.pathname.endsWith("/creator") && publicKeys[url.hostname]) {
+        // Every fixture is a version 3 OWID and a real creator serves each
+        // version of the format at its own path, returning 404 for the
+        // others, so the key is only handed back on the path that names the
+        // version the OWID was written in.
+        if (url.pathname === "/owid/api/v3/creator" &&
+            publicKeys[url.hostname]) {
             return Promise.resolve(JSON.stringify({
                 publicKeySPKI: publicKeys[url.hostname]
             }));
@@ -186,8 +203,8 @@ fixtures.forEach(f => {
             // The library must have used the public key path, so the only
             // request is to the creator end point.
             expect(fetch.mock.calls.length).toBe(1);
-            expect(fetch.mock.calls[0][0]).toBe(
-                "//" + f.domain + "/owid/api/v1/creator?date=" + o.date);
+            expect(fetch.mock.calls[0][0]).toBe(expectedCreatorUrl(o));
+            expect(o.version).toBe(3);
         });
     });