granny-devops 0.18.0__tar.gz → 0.18.1__tar.gz

{granny_devops-0.18.0 → granny_devops-0.18.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: granny-devops
-Version: 0.18.0
+Version: 0.18.1
 Summary: Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation
 Author-email: Martin Wieser <martin.wieser@pseekoo.com>
 License: MIT License
@@ -220,6 +220,7 @@ Common keys:
 | Hetzner | `HETZNER_S3_ACCESS_KEY`, `HETZNER_S3_SECRET_KEY`, `HETZNER_DNS_API_TOKEN` |
 | Scaleway | `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`, `SCW_DEFAULT_PROJECT_ID` |
 | Knative FaaS API | `OBACHAN_API_KEY`, `OBACHAN_API_BASE_URL` |
+| Obachan OpenBao | `OBACHAN_BAO_ADDR`, `OBACHAN_BAO_TOKEN` |
 | Mailjet | `MAILJET_API_KEY`, `MAILJET_SECRET_KEY` |
 | deSEC | `DESEC_API_TOKEN` |
 | ClouDNS | `CLOUDNS_AUTH_ID`/`_PASSWORD` (or `_SUB_AUTH_ID`/`_SUB_AUTH_USER`) |
@@ -235,6 +236,12 @@ what's configured at any time.
 ```shell
 granny --help                          # see every command group
 granny <group> --help                  # drill into one
+
+# Provision mail/calendar OAuth clients to a dashboard env and Obachan OpenBao
+granny oauth provision-productivity --env-file ../dashboard/.deploy.env \
+  --obachan-env staging --obachan-app dashboard \
+  --google-client-json client_secret.json \
+  --azure-client-id "$AZURE_CLIENT_ID" --azure-client-secret "$AZURE_CLIENT_SECRET"
 ```
 
 The CLI is organized by capability, not by provider. You pick the
@@ -413,6 +420,7 @@ granny indexing google https://example.com/job-posting --action URL_UPDATED
 | Observability admin | Elasticsearch / Kibana native-user management |
 | Azure ops | Identity, subscriptions, ARM deployments, Cognitive Services (Azure OpenAI), App Service, VM sizes, VM inventory/deallocate/delete, RBAC role assignment, compute quota |
 | Search indexing | IndexNow (Bing/Yandex/Seznam/Naver/Yep), Google Indexing API |
+| Productivity OAuth | Google Cloud and Microsoft Entra mail/calendar client provisioning |
 
 ## As a library
 
@@ -456,6 +464,7 @@ granny/
   email/        Mailjet, WorkMail, SES forwarding
   indexing/     IndexNow + Google Indexing API
   knative/      Knative FaaS control API client
+  oauth/        Google/Microsoft productivity OAuth provisioning
   serverless/   Scaleway FaaS
   storage/      Object storage (AWS / Bunny / Hetzner)
 ```

{granny_devops-0.18.0 → granny_devops-0.18.1}/README.md

@@ -86,6 +86,7 @@ Common keys:
 | Hetzner | `HETZNER_S3_ACCESS_KEY`, `HETZNER_S3_SECRET_KEY`, `HETZNER_DNS_API_TOKEN` |
 | Scaleway | `SCW_ACCESS_KEY`, `SCW_SECRET_KEY`, `SCW_DEFAULT_PROJECT_ID` |
 | Knative FaaS API | `OBACHAN_API_KEY`, `OBACHAN_API_BASE_URL` |
+| Obachan OpenBao | `OBACHAN_BAO_ADDR`, `OBACHAN_BAO_TOKEN` |
 | Mailjet | `MAILJET_API_KEY`, `MAILJET_SECRET_KEY` |
 | deSEC | `DESEC_API_TOKEN` |
 | ClouDNS | `CLOUDNS_AUTH_ID`/`_PASSWORD` (or `_SUB_AUTH_ID`/`_SUB_AUTH_USER`) |
@@ -101,6 +102,12 @@ what's configured at any time.
 ```shell
 granny --help                          # see every command group
 granny <group> --help                  # drill into one
+
+# Provision mail/calendar OAuth clients to a dashboard env and Obachan OpenBao
+granny oauth provision-productivity --env-file ../dashboard/.deploy.env \
+  --obachan-env staging --obachan-app dashboard \
+  --google-client-json client_secret.json \
+  --azure-client-id "$AZURE_CLIENT_ID" --azure-client-secret "$AZURE_CLIENT_SECRET"
 ```
 
 The CLI is organized by capability, not by provider. You pick the
@@ -279,6 +286,7 @@ granny indexing google https://example.com/job-posting --action URL_UPDATED
 | Observability admin | Elasticsearch / Kibana native-user management |
 | Azure ops | Identity, subscriptions, ARM deployments, Cognitive Services (Azure OpenAI), App Service, VM sizes, VM inventory/deallocate/delete, RBAC role assignment, compute quota |
 | Search indexing | IndexNow (Bing/Yandex/Seznam/Naver/Yep), Google Indexing API |
+| Productivity OAuth | Google Cloud and Microsoft Entra mail/calendar client provisioning |
 
 ## As a library
 
@@ -322,6 +330,7 @@ granny/
   email/        Mailjet, WorkMail, SES forwarding
   indexing/     IndexNow + Google Indexing API
   knative/      Knative FaaS control API client
+  oauth/        Google/Microsoft productivity OAuth provisioning
   serverless/   Scaleway FaaS
   storage/      Object storage (AWS / Bunny / Hetzner)
 ```

{granny_devops-0.18.0 → granny_devops-0.18.1}/granny/__init__.py

@@ -1,6 +1,6 @@
 """Granny -- Cloud tools collection for AWS infrastructure and DevOps automation."""
 
-__version__ = "0.18.0"
+__version__ = "0.18.1"
 __all__ = [
     "get_secret",
     "load_secrets_into_env",

granny_devops-0.18.1/granny/cli/oauth.py

@@ -0,0 +1,164 @@
+"""OAuth provisioning commands."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import click
+
+from granny.oauth import (
+    ProductivityOAuthCredentials,
+    load_google_client_json,
+    provision_productivity_oauth,
+    update_env_file,
+)
+
+
+@click.group()
+def oauth() -> None:
+    """Provision OAuth clients for applications."""
+
+
+@oauth.command("provision-productivity")
+@click.option(
+    "--env-file",
+    type=click.Path(path_type=Path),
+    default=None,
+    help="Dashboard dotenv file to update.",
+)
+@click.option(
+    "--obachan-env",
+    default=None,
+    help="Obachan environment whose OpenBao application secret is updated.",
+)
+@click.option(
+    "--obachan-app",
+    default="dashboard",
+    show_default=True,
+    help="Application name used in the Obachan secret path.",
+)
+@click.option(
+    "--google-client-json",
+    type=click.Path(exists=True, dir_okay=False, path_type=Path),
+    default=None,
+    help="OAuth client JSON downloaded from Google Cloud.",
+)
+@click.option("--google-client-id", default=None, help="Google OAuth client ID.")
+@click.option(
+    "--google-client-secret",
+    default=None,
+    help="Google OAuth client secret (not echoed).",
+)
+@click.option("--azure-client-id", default=None, help="Microsoft Entra client ID.")
+@click.option(
+    "--azure-client-secret",
+    default=None,
+    help="Microsoft Entra client secret (not echoed).",
+)
+@click.option(
+    "--dry-run", is_flag=True, help="Validate and show destinations without writing."
+)
+def provision_productivity(
+    env_file: Path | None,
+    obachan_env: str | None,
+    obachan_app: str,
+    google_client_json: Path | None,
+    google_client_id: str | None,
+    google_client_secret: str | None,
+    azure_client_id: str | None,
+    azure_client_secret: str | None,
+    dry_run: bool,
+) -> None:
+    """Add Google and Microsoft mail/calendar OAuth clients.
+
+    Set OBACHAN_BAO_ADDR and OBACHAN_BAO_TOKEN when --obachan-env is used.
+    Google Cloud OAuth client downloads can be passed with --google-client-json.
+    """
+    if google_client_json:
+        if google_client_id or google_client_secret:
+            raise click.UsageError(
+                "Use --google-client-json or explicit Google values, not both."
+            )
+        try:
+            google_client_id, google_client_secret = load_google_client_json(
+                google_client_json
+            )
+        except ValueError as exc:
+            raise click.ClickException(str(exc)) from exc
+
+    credentials = ProductivityOAuthCredentials(
+        google_client_id=google_client_id,
+        google_client_secret=google_client_secret,
+        azure_client_id=azure_client_id,
+        azure_client_secret=azure_client_secret,
+    )
+    try:
+        result = provision_productivity_oauth(
+            credentials,
+            env_file=env_file,
+            obachan_env=obachan_env,
+            obachan_app=obachan_app,
+            dry_run=dry_run,
+        )
+    except (ValueError, RuntimeError) as exc:
+        raise click.ClickException(str(exc)) from exc
+
+    for key in result.keys:
+        click.echo(f"would set {key}" if dry_run else f"set {key}")
+    if result.env_file:
+        action = "Would update" if dry_run else "Updated"
+        click.echo(f"{action} {result.env_file}")
+    if result.obachan_path:
+        action = "Would update" if dry_run else "Updated"
+        click.echo(f"{action} OpenBao path {result.obachan_path}")
+    if dry_run:
+        click.echo("Dry run; no destinations written.")
+
+
+@oauth.command("configure-productivity-local")
+@click.option(
+    "--env-file",
+    type=click.Path(path_type=Path),
+    default=Path(".deploy.env"),
+    show_default=True,
+)
+@click.option("--google-client-id", default=None)
+@click.option("--google-client-secret", default=None)
+@click.option("--azure-client-id", default=None)
+@click.option("--azure-client-secret", default=None)
+@click.option("--dry-run", is_flag=True, help="Validate without writing the env file.")
+def configure_productivity_local(
+    env_file: Path,
+    google_client_id: str | None,
+    google_client_secret: str | None,
+    azure_client_id: str | None,
+    azure_client_secret: str | None,
+    dry_run: bool,
+) -> None:
+    """Configure a local dashboard (compatibility alias)."""
+    credentials = ProductivityOAuthCredentials(
+        google_client_id=google_client_id,
+        google_client_secret=google_client_secret,
+        azure_client_id=azure_client_id,
+        azure_client_secret=azure_client_secret,
+    )
+    values = credentials.as_env()
+    if not values:
+        raise click.UsageError("Provide at least one client id or secret value.")
+    if not dry_run:
+        update_env_file(env_file, values)
+    click.echo(f"Env file: {env_file}")
+    for key in sorted(values):
+        value = values[key]
+        display = _mask(value) if key.endswith("SECRET") else value
+        click.echo(f"  set {key}={display}")
+    if dry_run:
+        click.echo("Dry run; no file written.")
+    else:
+        click.echo("Updated local OAuth configuration.")
+
+
+def _mask(value: str) -> str:
+    if len(value) <= 8:
+        return "****"
+    return f"{value[:4]}…{value[-4:]}"

{granny_devops-0.18.0 → granny_devops-0.18.1}/granny/credentials/secrets.py

@@ -193,6 +193,7 @@ SECRET_MAP: dict[str, str] = {
     # Knative FaaS control API. The base URL is vault-distributed configuration.
     "OBACHAN_API_KEY": "obachan-api-key",
     "OBACHAN_API_BASE_URL": "obachan-api-base-url",
+    "OBACHAN_BAO_TOKEN": "obachan-bao-token",
 }
 
 # Module-level cache so vault is only contacted once per process

granny_devops-0.18.1/granny/oauth/__init__.py

@@ -0,0 +1,19 @@
+"""OAuth client provisioning helpers."""
+
+from granny.oauth.productivity import (
+    ObachanSecretClient,
+    ProductivityOAuthCredentials,
+    ProvisionResult,
+    load_google_client_json,
+    provision_productivity_oauth,
+    update_env_file,
+)
+
+__all__ = [
+    "ObachanSecretClient",
+    "ProductivityOAuthCredentials",
+    "ProvisionResult",
+    "load_google_client_json",
+    "provision_productivity_oauth",
+    "update_env_file",
+]

granny_devops-0.18.1/granny/oauth/productivity.py

@@ -0,0 +1,237 @@
+"""Provision Google and Microsoft productivity OAuth client credentials.
+
+Credentials can be written to an application's local dotenv file and to an
+Obachan OpenBao KV v2 path. Provider-side application registration remains a
+cloud-admin operation; Google client JSON downloaded from Google Cloud is
+accepted directly.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+from urllib.parse import quote
+
+import requests
+
+from granny.credentials import get_secret
+
+_SEGMENT_RE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9._-]*$")
+
+
+@dataclass(frozen=True)
+class ProductivityOAuthCredentials:
+    """Google and Microsoft OAuth client credentials."""
+
+    google_client_id: str | None = None
+    google_client_secret: str | None = None
+    azure_client_id: str | None = None
+    azure_client_secret: str | None = None
+
+    def as_env(self) -> dict[str, str]:
+        """Return configured values using dashboard runtime variable names."""
+        values = {
+            "GOOGLE_CLIENT_ID": self.google_client_id,
+            "GOOGLE_CLIENT_SECRET": self.google_client_secret,
+            "AZURE_CLIENT_ID": self.azure_client_id,
+            "AZURE_CLIENT_SECRET": self.azure_client_secret,
+        }
+        return {key: value for key, value in values.items() if value}
+
+    def validate(self) -> None:
+        """Require complete client ID/secret pairs for each selected provider."""
+        values = self.as_env()
+        if not values:
+            raise ValueError("At least one Google or Azure OAuth client is required")
+        for provider in ("GOOGLE", "AZURE"):
+            client_id = values.get(f"{provider}_CLIENT_ID")
+            client_secret = values.get(f"{provider}_CLIENT_SECRET")
+            if bool(client_id) != bool(client_secret):
+                raise ValueError(
+                    f"{provider}_CLIENT_ID and {provider}_CLIENT_SECRET must be provided together"
+                )
+
+
+@dataclass(frozen=True)
+class ProvisionResult:
+    """Locations updated by a productivity OAuth provisioning run."""
+
+    keys: tuple[str, ...]
+    env_file: Path | None = None
+    obachan_path: str | None = None
+
+
+def load_google_client_json(path: Path) -> tuple[str, str]:
+    """Read a Google Cloud OAuth client download and return ID and secret."""
+    try:
+        document = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise ValueError(f"Cannot read Google OAuth client JSON {path}: {exc}") from exc
+
+    config = document.get("web") or document.get("installed") or document
+    if not isinstance(config, dict):
+        raise ValueError(f"Invalid Google OAuth client JSON: {path}")
+    client_id = config.get("client_id")
+    client_secret = config.get("client_secret")
+    if not isinstance(client_id, str) or not isinstance(client_secret, str):
+        raise ValueError(
+            f"Google OAuth client JSON has no client_id/client_secret: {path}"
+        )
+    return client_id, client_secret
+
+
+class ObachanSecretClient:
+    """Small OpenBao KV v2 client for Obachan application secrets."""
+
+    def __init__(
+        self,
+        base_url: str | None = None,
+        token: str | None = None,
+        *,
+        mount: str = "kv",
+    ) -> None:
+        self.base_url = (base_url or os.environ.get("OBACHAN_BAO_ADDR") or "").rstrip(
+            "/"
+        )
+        self.token = token or get_secret("OBACHAN_BAO_TOKEN")
+        self.mount = mount.strip("/")
+
+    def _url(self, path: str) -> str:
+        if not self.base_url:
+            raise ValueError("OBACHAN_BAO_ADDR is not set")
+        if not self.token:
+            raise ValueError("OBACHAN_BAO_TOKEN is not set (env or vault)")
+        encoded = "/".join(quote(segment, safe="") for segment in path.split("/"))
+        return f"{self.base_url}/v1/{quote(self.mount, safe='')}/data/{encoded}"
+
+    def merge(self, path: str, values: dict[str, str]) -> None:
+        """Merge fields into one Obachan OpenBao KV v2 secret using CAS."""
+        url = self._url(path)
+        headers = {"X-Vault-Token": self.token or ""}
+        try:
+            response = requests.get(url, headers=headers, timeout=30)
+        except requests.RequestException as exc:
+            raise RuntimeError(f"Obachan OpenBao GET {path} failed: {exc}") from exc
+
+        version = 0
+        if response.status_code == 404:
+            existing: dict[str, Any] = {}
+        elif response.status_code == 200:
+            try:
+                body = response.json()
+                data = body.get("data", {})
+                existing = data.get("data", {})
+                metadata = data.get("metadata", {})
+                version = metadata.get("version", 0)
+            except (AttributeError, TypeError, ValueError) as exc:
+                raise RuntimeError(
+                    f"Obachan OpenBao GET {path} returned invalid KV v2 JSON"
+                ) from exc
+            if not isinstance(existing, dict) or not isinstance(version, int):
+                raise RuntimeError(
+                    f"Obachan OpenBao GET {path} returned invalid KV v2 data"
+                )
+        else:
+            _raise_bao_error("GET", path, response)
+
+        try:
+            response = requests.post(
+                url,
+                headers={**headers, "Content-Type": "application/json"},
+                json={
+                    "data": {**existing, **values},
+                    "options": {"cas": version},
+                },
+                timeout=30,
+            )
+        except requests.RequestException as exc:
+            raise RuntimeError(f"Obachan OpenBao POST {path} failed: {exc}") from exc
+        if response.status_code not in (200, 204):
+            _raise_bao_error("POST", path, response)
+
+
+def provision_productivity_oauth(
+    credentials: ProductivityOAuthCredentials,
+    *,
+    env_file: Path | None = None,
+    obachan_env: str | None = None,
+    obachan_app: str = "dashboard",
+    obachan_client: ObachanSecretClient | None = None,
+    dry_run: bool = False,
+) -> ProvisionResult:
+    """Validate and provision OAuth credentials to selected destinations."""
+    credentials.validate()
+    values = credentials.as_env()
+
+    if env_file is None and obachan_env is None:
+        raise ValueError("Select an env_file or obachan_env destination")
+
+    if env_file is not None and not dry_run:
+        update_env_file(env_file, values)
+
+    obachan_path = None
+    if obachan_env is not None:
+        _validate_segment("Obachan environment", obachan_env)
+        _validate_segment("Obachan application", obachan_app)
+        obachan_path = f"obachan/{obachan_env}/apps/{obachan_app}/productivity-oauth"
+        if not dry_run:
+            (obachan_client or ObachanSecretClient()).merge(obachan_path, values)
+
+    return ProvisionResult(
+        keys=tuple(sorted(values)), env_file=env_file, obachan_path=obachan_path
+    )
+
+
+def update_env_file(path: Path, updates: dict[str, str]) -> None:
+    """Update dotenv assignments while preserving comments and unrelated lines."""
+    lines = path.read_text(encoding="utf-8").splitlines() if path.exists() else []
+    remaining = dict(updates)
+    replaced: set[str] = set()
+    output: list[str] = []
+    assignment = re.compile(r"^(\s*)(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=")
+    for line in lines:
+        match = assignment.match(line)
+        key = match.group(3) if match else None
+        if key in updates:
+            if key not in replaced:
+                prefix = f"{match.group(1)}{match.group(2) or ''}"
+                output.append(f"{prefix}{key}={_quote_env(updates[key])}")
+                replaced.add(key)
+                remaining.pop(key, None)
+            continue
+        output.append(line)
+    if output and remaining and output[-1]:
+        output.append("")
+    output.extend(
+        f"{key}={_quote_env(value)}" for key, value in sorted(remaining.items())
+    )
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text("\n".join(output) + "\n", encoding="utf-8")
+
+
+def _validate_segment(label: str, value: str) -> None:
+    if not _SEGMENT_RE.fullmatch(value):
+        raise ValueError(
+            f"{label} must contain only letters, digits, '.', '_', and '-'"
+        )
+
+
+def _quote_env(value: str) -> str:
+    if (
+        not value
+        or any(ch.isspace() for ch in value)
+        or any(ch in value for ch in "\"'#$")
+    ):
+        return f'"{value.replace(chr(34), chr(92) + chr(34))}"'
+    return value
+
+
+def _raise_bao_error(method: str, path: str, response: requests.Response) -> None:
+    raise RuntimeError(
+        f"Obachan OpenBao {method} {path} failed: "
+        f"{response.status_code} {response.text[:1000]}"
+    )

{granny_devops-0.18.0 → granny_devops-0.18.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "granny-devops"
-version = "0.18.0"
+version = "0.18.1"
 description = "Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation"
 readme = "README.md"
 license = { file = "LICENSE" }

granny_devops-0.18.0/granny/cli/oauth.py

@@ -1,96 +0,0 @@
-"""OAuth configuration commands."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import click
-
-
-@click.group()
-def oauth() -> None:
-    """Configure OAuth client settings for local apps."""
-
-
-@oauth.command("configure-productivity-local")
-@click.option(
-    "--env-file",
-    type=click.Path(path_type=Path),
-    default=Path(".deploy.env"),
-    show_default=True,
-    help="Env file to update in the current project.",
-)
-@click.option("--google-client-id", default=None, help="Google OAuth client ID.")
-@click.option("--google-client-secret", default=None, help="Google OAuth client secret (optional; not echoed).")
-@click.option("--azure-client-id", default=None, help="Microsoft Entra application/client ID.")
-@click.option("--azure-client-secret", default=None, help="Microsoft Entra client secret (optional; not echoed).")
-@click.option("--dry-run", is_flag=True, help="Print planned keys without writing the env file.")
-def configure_productivity_local(
-    env_file: Path,
-    google_client_id: str | None,
-    google_client_secret: str | None,
-    azure_client_id: str | None,
-    azure_client_secret: str | None,
-    dry_run: bool,
-) -> None:
-    """Write real Google/Microsoft OAuth IDs into a local dashboard env file.
-
-    Provider application creation is intentionally not automated here: Google
-    Cloud OAuth consent screens and Microsoft Entra app registrations require
-    tenant-admin policy choices. Use this after real provider apps exist.
-    """
-    updates = {
-        "GOOGLE_CLIENT_ID": google_client_id,
-        "GOOGLE_CLIENT_SECRET": google_client_secret,
-        "AZURE_CLIENT_ID": azure_client_id,
-        "AZURE_CLIENT_SECRET": azure_client_secret,
-    }
-    updates = {key: value for key, value in updates.items() if value}
-    if not updates:
-        raise click.UsageError("Provide at least one client id or secret value.")
-
-    existing = _read_env(env_file)
-    merged = {**existing, **updates}
-
-    click.echo(f"Env file: {env_file}")
-    for key in sorted(updates):
-        display = _mask(updates[key]) if key.endswith("SECRET") else updates[key]
-        click.echo(f"  set {key}={display}")
-
-    if dry_run:
-        click.echo("Dry run; no file written.")
-        return
-
-    _write_env(env_file, merged)
-    click.echo("Updated local OAuth configuration.")
-
-
-def _read_env(path: Path) -> dict[str, str]:
-    if not path.exists():
-        return {}
-    values: dict[str, str] = {}
-    for line in path.read_text(encoding="utf-8").splitlines():
-        stripped = line.strip()
-        if not stripped or stripped.startswith("#") or "=" not in stripped:
-            continue
-        key, value = stripped.split("=", 1)
-        values[key.strip()] = value.strip().strip('"').strip("'")
-    return values
-
-
-def _write_env(path: Path, values: dict[str, str]) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    lines = [f"{key}={_quote_env(value)}" for key, value in sorted(values.items())]
-    path.write_text("\n".join(lines) + "\n", encoding="utf-8")
-
-
-def _quote_env(value: str) -> str:
-    if not value or any(ch.isspace() for ch in value) or any(ch in value for ch in '"\'#$'):
-        return f'"{value.replace(chr(34), chr(92) + chr(34))}"'
-    return value
-
-
-def _mask(value: str) -> str:
-    if len(value) <= 8:
-        return "****"
-    return f"{value[:4]}…{value[-4:]}"