@12-apps/mcp 1.19.0 → 2.0.0

package/src/oauth/index.ts

@@ -0,0 +1,117 @@
+/**
+ * `@12-apps/mcp/oauth` — the OAuth 2.1 authorization server behind an MCP surface
+ * (12-23): register / authorize / token, the JWKS, and the two `.well-known`
+ * discovery documents, plus the primitives under them (stateless codes, ES256
+ * access tokens, PKCE, hashed rotating refresh tokens with replay revocation).
+ *
+ * Its own subpath because this half is Node-only — `jose`, `node:crypto` — and the
+ * package root is also imported by browsers through `@12-apps/mcp/react`. A barrel
+ * is evaluated whole by Node's ESM loader, so mixing the two would drag key
+ * material handling into a bundle that has no business with it.
+ */
+export {
+  createApiMcpOauth,
+  type ApiMcpOauth,
+  type McpOauthHandlers,
+  type McpOauthRoute,
+} from "./create-api-mcp-oauth";
+export {
+  DEFAULT_OAUTH_PATHS,
+  resolveMcpOauthConfig,
+  type McpConnectionRecording,
+  type McpOauthConfig,
+  type McpOauthContext,
+  type McpOauthPaths,
+  type McpOauthSession,
+} from "./context";
+export {
+  DEFAULT_MCP_RESOURCE_PATH,
+  MCP_SUPPORTED_SCOPES,
+  issuer,
+  originFromRequest,
+  resolveTrustedOrigin,
+  resourceAudience,
+  trustedOriginsFromEnv,
+  type McpScope,
+} from "./config";
+export {
+  ACCESS_TOKEN_TTL_SECONDS,
+  AccessTokenError,
+  signAccessToken,
+  verifyAccessToken,
+  type AccessTokenErrorCode,
+  type SignAccessTokenInput,
+  type VerifiedAccessToken,
+  type VerifyAccessTokenOptions,
+} from "./access-token";
+export {
+  AUTHORIZATION_CODE_AUDIENCE,
+  AUTHORIZATION_CODE_TTL_SECONDS,
+  AuthorizationCodeError,
+  mintCode,
+  verifyCode,
+  type AuthorizationCodeErrorCode,
+  type MintCodeInput,
+  type VerifiedAuthorizationCode,
+  type VerifyCodeOptions,
+} from "./authorization-code";
+export {
+  SUPPORTED_CHALLENGE_METHOD,
+  UnsupportedChallengeMethodError,
+  computeChallenge,
+  verifyChallenge,
+  type CodeChallengeMethod,
+} from "./pkce";
+export {
+  DEFAULT_SIGNING_KEY_ENV,
+  DEFAULT_SIGNING_KEY_ID_ENV,
+  SIGNING_ALG,
+  loadSigningKeyFromEnv,
+  signingKeyProvider,
+  type McpSigningKey,
+  type McpSigningKeyProvider,
+  type PublicSigningJwk,
+} from "./keys";
+export {
+  DEFAULT_PROVIDER_ROOTS,
+  hashSecret,
+  matchesRedirectUri,
+  providerFromRedirectUris,
+  registerClient,
+  type ProviderAttributionRule,
+  type RegisterClientInput,
+  type RegisteredClient,
+} from "./clients";
+export {
+  REFRESH_TOKEN_TTL_MS,
+  RefreshTokenError,
+  getRefreshTokenIdentity,
+  hashToken,
+  issueRefreshToken,
+  rotateRefreshToken,
+  type IssuedRefreshToken,
+  type RefreshTokenContext,
+  type RefreshTokenErrorCode,
+  type RefreshTokenIdentity,
+} from "./refresh";
+export {
+  inProcessCodeReplayStore,
+  type CodeReplayStore,
+} from "./code-replay";
+export {
+  createPrismaMcpStores,
+  type McpOauthPrisma,
+  type McpOauthPrismaProvider,
+} from "./prisma-stores";
+export type {
+  McpConnectionStore,
+  McpOauthStores,
+  NewOAuthClient,
+  NewRefreshToken,
+  OAuthClientStore,
+  RefreshTokenStore,
+  StoredMcpConnection,
+  StoredOAuthClient,
+  StoredRefreshToken,
+  TokenEndpointAuthMethod,
+} from "./stores";

package/src/oauth/keys.ts

@@ -0,0 +1,107 @@
+import { exportJWK, importPKCS8, type CryptoKey, type JWK } from "jose";
+
+/**
+ * Signing-key / JWK loading for the OAuth authorization server (12-23, ported
+ * from future-pay's `lib/mcp/oauth/keys.ts`).
+ *
+ * ES256 (P-256) from PEM material, the published public JWK (with `kid` for
+ * rotation), and a safe-by-default absence signal (`null`) when no key is
+ * configured — callers then refuse to issue tokens and serve the JWKS as 503
+ * rather than falling back to a weaker mode while the surface is mounted.
+ *
+ * WHERE the PEM comes from is the host's business: `loadSigningKeyFromEnv` keeps
+ * future-pay's env-var wiring, and any other provider (a secrets manager, a KMS
+ * export) satisfies the same `McpSigningKeyProvider` shape.
+ */
+
+/** JWS algorithm for the signing key pair (asymmetric, self-validated via JWKS). */
+export const SIGNING_ALG = "ES256";
+
+/** A public JWK safe to publish at the JWKS endpoint (never carries `d`). */
+export interface PublicSigningJwk extends JWK {
+  kid: string;
+  kty: "EC";
+  crv: "P-256";
+  alg: typeof SIGNING_ALG;
+  use: "sig";
+}
+
+/** The loaded signing material: the private key for signing + its public JWK. */
+export interface McpSigningKey {
+  privateKey: CryptoKey;
+  publicJwk: PublicSigningJwk;
+  kid: string;
+}
+
+/**
+ * How the surface obtains signing material. Returning `null` means "not
+ * provisioned": the AS then mints nothing and the JWKS answers 503.
+ */
+export type McpSigningKeyProvider = () => Promise<McpSigningKey | null>;
+
+async function parseSigningKey(pem: string, kid: string): Promise<McpSigningKey> {
+  // `extractable: true` is required so `exportJWK` can derive the public JWK;
+  // jose imports keys as non-extractable by default, which blocks the export.
+  const privateKey = await importPKCS8(pem, SIGNING_ALG, { extractable: true });
+  const jwk = await exportJWK(privateKey);
+  // Strip the private component; publish only the public half.
+  const { d: _private, ...publicHalf } = jwk;
+  void _private;
+
+  const publicJwk: PublicSigningJwk = {
+    ...publicHalf,
+    kty: "EC",
+    crv: "P-256",
+    alg: SIGNING_ALG,
+    use: "sig",
+    kid,
+  };
+
+  return { privateKey, publicJwk, kid };
+}
+
+/**
+ * Build a provider over a PKCS#8 PEM + `kid` pair, with a per-process cache.
+ *
+ * Parsing PKCS#8 and exporting the JWK is pure for a given (pem, kid), so the
+ * promise is cached keyed on the material itself. A rotated key (different pem or
+ * kid) produces a different cache key and re-parses — the cache never masks a
+ * rotation.
+ *
+ * Rotation is BY `kid`: each key is published in the JWKS and selected by the
+ * `kid` header on issued JWTs, so publishing old + new during an overlap window
+ * lets both verify.
+ */
+export function signingKeyProvider(
+  read: () => { pem: string | undefined; kid: string | undefined },
+): McpSigningKeyProvider {
+  let cache: { key: string; promise: Promise<McpSigningKey> } | null = null;
+  return async () => {
+    const { pem, kid } = read();
+    if (!pem || !kid) return null;
+    const cacheKey = `${kid} ${pem}`;
+    if (cache?.key === cacheKey) return cache.promise;
+    const promise = parseSigningKey(pem, kid);
+    cache = { key: cacheKey, promise };
+    return promise;
+  };
+}
+
+/** Env var carrying the ES256 private key as a PKCS#8 PEM (future-pay's name). */
+export const DEFAULT_SIGNING_KEY_ENV = "MCP_OAUTH_SIGNING_KEY";
+/** Env var carrying the key id (`kid`) used to select the key during rotation. */
+export const DEFAULT_SIGNING_KEY_ID_ENV = "MCP_OAUTH_SIGNING_KEY_ID";
+
+/**
+ * The env-backed provider — future-pay's wiring, kept identical, with the
+ * variable names as arguments so the package states no host's vocabulary.
+ */
+export function loadSigningKeyFromEnv(
+  keyEnv: string = DEFAULT_SIGNING_KEY_ENV,
+  kidEnv: string = DEFAULT_SIGNING_KEY_ID_ENV,
+): McpSigningKeyProvider {
+  return signingKeyProvider(() => ({
+    pem: typeof process === "undefined" ? undefined : process.env?.[keyEnv],
+    kid: typeof process === "undefined" ? undefined : process.env?.[kidEnv],
+  }));
+}

package/src/oauth/pkce.ts

@@ -0,0 +1,93 @@
+/**
+ * PKCE (RFC 7636) S256 challenge helpers for the OAuth authorization server
+ * (12-23, ported verbatim from future-pay's `lib/mcp/oauth/pkce.ts`).
+ *
+ * OAuth 2.1 mandates the `S256` code-challenge method and forbids `plain`, so
+ * this module computes `BASE64URL(SHA-256(code_verifier))` and compares it to
+ * the stored `code_challenge` in constant time. The authorization endpoint
+ * binds a `code_challenge` into the stateless authorization code; the token
+ * endpoint calls {@link verifyChallenge} with the presented `code_verifier` to
+ * prove the redeeming client is the one that started the flow.
+ *
+ * `plain` is refused (throws {@link UnsupportedChallengeMethodError}) rather
+ * than silently accepted: `plain` offers no protection against an intercepted
+ * authorization code, which is the exact threat PKCE exists to close.
+ */
+
+/** The only PKCE method this server accepts (OAuth 2.1 requires S256). */
+export const SUPPORTED_CHALLENGE_METHOD = "S256";
+
+/**
+ * PKCE code-challenge methods, including the rejected legacy `plain`.
+ *
+ * @public exported because it is a parameter type of the exported
+ * {@link verifyChallenge}.
+ */
+export type CodeChallengeMethod = "S256" | "plain";
+
+/** Thrown when a caller supplies a challenge method other than `S256`. */
+export class UnsupportedChallengeMethodError extends Error {
+  readonly method: string;
+
+  constructor(method: string) {
+    super(
+      `unsupported code_challenge_method '${method}' — only ${SUPPORTED_CHALLENGE_METHOD} is allowed`,
+    );
+    this.name = "UnsupportedChallengeMethodError";
+    this.method = method;
+  }
+}
+
+/** Encode raw bytes as unpadded base64url (RFC 7636 challenge encoding). */
+function base64UrlEncode(bytes: Uint8Array): string {
+  // Buffer.toString("base64url") emits the URL-safe alphabet with no padding.
+  return Buffer.from(bytes).toString("base64url");
+}
+
+/**
+ * Compute the RFC 7636 S256 challenge for a `code_verifier`:
+ * `BASE64URL(SHA-256(ASCII(verifier)))`.
+ */
+export async function computeChallenge(verifier: string): Promise<string> {
+  const data = new TextEncoder().encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return base64UrlEncode(new Uint8Array(digest));
+}
+
+/**
+ * Constant-time string comparison over the base64url challenge bytes.
+ *
+ * Returns `false` immediately on a length mismatch (lengths are not secret);
+ * for equal-length inputs every byte is compared so the timing does not reveal
+ * how many leading characters matched.
+ */
+function constantTimeEquals(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+
+/**
+ * Verify a presented `code_verifier` against a stored `code_challenge`.
+ *
+ * Recomputes the S256 challenge from `verifier` and constant-time-compares it
+ * to `storedChallenge`. Returns `true` on a match, `false` on a mismatch (or an
+ * empty stored challenge). Any method other than `S256` throws
+ * {@link UnsupportedChallengeMethodError} — `plain` is never accepted.
+ */
+export async function verifyChallenge(
+  verifier: string,
+  storedChallenge: string,
+  method: CodeChallengeMethod | string = SUPPORTED_CHALLENGE_METHOD,
+): Promise<boolean> {
+  if (method !== SUPPORTED_CHALLENGE_METHOD) {
+    throw new UnsupportedChallengeMethodError(method);
+  }
+  if (!storedChallenge) return false;
+
+  const computed = await computeChallenge(verifier);
+  return constantTimeEquals(computed, storedChallenge);
+}

package/src/oauth/prisma-stores.ts

@@ -0,0 +1,306 @@
+import type {
+  McpConnectionStore,
+  McpOauthStores,
+  NewOAuthClient,
+  NewRefreshToken,
+  OAuthClientStore,
+  RefreshTokenStore,
+  StoredMcpConnection,
+  StoredOAuthClient,
+  StoredRefreshToken,
+} from "./stores";
+
+/**
+ * The ports of `./stores.ts`, filled by Prisma (12-23).
+ *
+ * The package owns the three models (`prisma/mcp.prisma`), so their delegate
+ * shapes are known and this adapter can be exact. A host with Prisma therefore
+ * writes ONE line —
+ *
+ *   stores: createPrismaMcpStores(async () => getPrismaClient() as unknown as McpOauthPrisma)
+ *
+ * — and no host code at all beyond it. The client is duck-typed (only the
+ * delegates used, only the arguments used) so this file never imports a project's
+ * generated client, and a non-Prisma host fills the ports directly instead.
+ */
+
+/** A `where` on the composite unique of `mcp_connections`. */
+interface ConnectionKey {
+  userId_oauthClientId: { userId: string; oauthClientId: string };
+}
+
+/** The minimal Prisma surface the AS needs. Every field is one the surface writes. */
+export interface McpOauthPrisma {
+  oAuthClient: {
+    create(args: { data: NewOAuthClient }): Promise<StoredOAuthClient>;
+    findUnique(args: { where: { clientId: string } }): Promise<StoredOAuthClient | null>;
+  };
+  oAuthRefreshToken: {
+    create(args: { data: NewRefreshToken }): Promise<unknown>;
+    findUnique(args: { where: { tokenHash: string } }): Promise<StoredRefreshToken | null>;
+    findFirst(args: { where: { rotatedFrom: string } }): Promise<{ tokenHash: string } | null>;
+    findMany(args: {
+      where: { userEmail: string; clientId: string };
+    }): Promise<StoredRefreshToken[]>;
+    // No single-row `update`: the rotation used to revoke its parent with one and
+    // that was the bug (unconditional, so two concurrent rotations both won). Every
+    // revoke here is now an `updateMany` with a predicate that says WHICH rows may
+    // move, which is also why this delegate list stays honest about what is written.
+    updateMany(args: {
+      where:
+        | { tokenHash: { in: string[] } }
+        | { userEmail: string; clientId: string; revokedAt: null };
+      data: { revokedAt: Date };
+    }): Promise<{ count: number }>;
+  };
+  mcpConnection: {
+    findUnique(args: {
+      where: ConnectionKey;
+      select: { lastActiveAt: true };
+    }): Promise<{ lastActiveAt: Date } | null>;
+    findFirst(args: {
+      where: { userId: string; revokedAt: null; host: null };
+      orderBy: { lastActiveAt: "desc" };
+      select: { id: true };
+    }): Promise<{ id: string } | null>;
+    findMany(args: {
+      where: { userId: string; revokedAt: null; host?: string | null };
+      orderBy?: { lastActiveAt: "desc" };
+      select: Record<string, true>;
+    }): Promise<Record<string, unknown>[]>;
+    upsert(args: {
+      where: ConnectionKey;
+      create: Record<string, unknown>;
+      update: Record<string, unknown>;
+    }): Promise<unknown>;
+    update(args: { where: { id: string }; data: Record<string, unknown> }): Promise<unknown>;
+    updateMany(args: {
+      where: { id: { in: string[] } } | { userId: string; revokedAt: null; host: string };
+      data: Record<string, unknown>;
+    }): Promise<{ count: number }>;
+  };
+  /**
+   * Prisma's INTERACTIVE transaction, used for the rotation's claim + write. The
+   * callback form (not the array form) is required: the successor may only be
+   * created once the conditional revoke has reported that it, and not a concurrent
+   * sibling, claimed the parent — see `RefreshTokenStore.rotate`.
+   */
+  $transaction<T>(fn: (tx: McpOauthTx) => Promise<T>): Promise<T>;
+}
+
+/**
+ * The delegate subset used INSIDE the rotation transaction. Not exported: it is
+ * reachable structurally through `McpOauthPrisma.$transaction`, so no host ever
+ * needs to name it, and exporting a type nobody imports is what knip flags.
+ */
+interface McpOauthTx {
+  oAuthRefreshToken: {
+    create(args: { data: NewRefreshToken }): Promise<unknown>;
+    updateMany(args: {
+      where: { tokenHash: string; revokedAt: null };
+      data: { revokedAt: Date };
+    }): Promise<{ count: number }>;
+  };
+}
+
+/** A lazily-resolved client, so a host's singleton is awaited per call. */
+export type McpOauthPrismaProvider = () => Promise<McpOauthPrisma>;
+
+function clientStore(getPrisma: McpOauthPrismaProvider): OAuthClientStore {
+  return {
+    async create(client: NewOAuthClient) {
+      const prisma = await getPrisma();
+      return prisma.oAuthClient.create({ data: client });
+    },
+    async findByClientId(clientId: string) {
+      const prisma = await getPrisma();
+      return prisma.oAuthClient.findUnique({ where: { clientId } });
+    },
+  };
+}
+
+function refreshTokenStore(getPrisma: McpOauthPrismaProvider): RefreshTokenStore {
+  return {
+    async create(token) {
+      const prisma = await getPrisma();
+      await prisma.oAuthRefreshToken.create({ data: token });
+    },
+    async findByHash(tokenHash) {
+      const prisma = await getPrisma();
+      return prisma.oAuthRefreshToken.findUnique({ where: { tokenHash } });
+    },
+    async hasSuccessor(tokenHash) {
+      const prisma = await getPrisma();
+      const successor = await prisma.oAuthRefreshToken.findFirst({
+        where: { rotatedFrom: tokenHash },
+      });
+      return successor !== null;
+    },
+    async listFamily(userEmail, clientId) {
+      const prisma = await getPrisma();
+      return prisma.oAuthRefreshToken.findMany({ where: { userEmail, clientId } });
+    },
+    async revokeHashes(tokenHashes, at) {
+      if (tokenHashes.length === 0) return;
+      const prisma = await getPrisma();
+      await prisma.oAuthRefreshToken.updateMany({
+        where: { tokenHash: { in: [...tokenHashes] } },
+        data: { revokedAt: at },
+      });
+    },
+    async rotate(successor, parentHash, at) {
+      const prisma = await getPrisma();
+      return prisma.$transaction(async (tx) => {
+        // CLAIM-ONCE. The `revokedAt: null` predicate is what makes this safe under
+        // concurrency, and it is load-bearing rather than defensive: on Postgres's
+        // default READ COMMITTED, a second transaction's `updateMany` blocks on the
+        // row lock, then re-evaluates this WHERE against the COMMITTED row — which
+        // now has a `revokedAt` — and reports 0 rows. So exactly one caller can ever
+        // see count 1, and it is the only one that goes on to create a successor.
+        // An unconditional `update` would let both through: two live successors of
+        // one parent, and replay detection silently defeated (it waits for a third
+        // use of the parent that now never comes).
+        const { count } = await tx.oAuthRefreshToken.updateMany({
+          where: { tokenHash: parentHash, revokedAt: null },
+          data: { revokedAt: at },
+        });
+        // Lost the claim: write NOTHING. The zero-row update commits as the no-op
+        // it is, so there is nothing to roll back.
+        if (count !== 1) return false;
+        // Same transaction as the claim, so a crash cannot leave a live parent AND
+        // a live child either.
+        await tx.oAuthRefreshToken.create({ data: successor });
+        return true;
+      });
+    },
+    async revokeLiveForClient(userEmail, clientId) {
+      const prisma = await getPrisma();
+      const { count } = await prisma.oAuthRefreshToken.updateMany({
+        where: { userEmail, clientId, revokedAt: null },
+        data: { revokedAt: new Date() },
+      });
+      return count;
+    },
+  };
+}
+
+/** The connection columns the account surface reads. */
+const CONNECTION_SELECT = {
+  oauthClientId: true,
+  clientName: true,
+  host: true,
+  connectedAt: true,
+  lastActiveAt: true,
+} as const;
+
+function connectionStore(getPrisma: McpOauthPrismaProvider): McpConnectionStore {
+  return {
+    async lastActiveAt(userId, oauthClientId) {
+      const prisma = await getPrisma();
+      const row = await prisma.mcpConnection.findUnique({
+        where: { userId_oauthClientId: { userId, oauthClientId } },
+        select: { lastActiveAt: true },
+      });
+      return row?.lastActiveAt ?? null;
+    },
+    async recordActivity({ userId, oauthClientId, clientName, host, at }) {
+      const prisma = await getPrisma();
+      await prisma.mcpConnection.upsert({
+        where: { userId_oauthClientId: { userId, oauthClientId } },
+        create: { userId, oauthClientId, clientName, host, connectedAt: at, lastActiveAt: at },
+        // Never blank a known host on refresh — keep the existing attribution
+        // when this grant cannot derive one.
+        update: {
+          clientName,
+          lastActiveAt: at,
+          revokedAt: null,
+          ...(host ? { host } : {}),
+        },
+      });
+    },
+    async listActive(userId) {
+      const prisma = await getPrisma();
+      const rows = await prisma.mcpConnection.findMany({
+        where: { userId, revokedAt: null },
+        orderBy: { lastActiveAt: "desc" },
+        select: { ...CONNECTION_SELECT },
+      });
+      return rows as unknown as StoredMcpConnection[];
+    },
+    revokeByHost: (userId, host) => revokeByHost(getPrisma, userId, host),
+    announce: (userId, host) => announce(getPrisma, userId, host),
+  };
+}
+
+/**
+ * Disconnect one provider's connections — and ONLY that provider's.
+ *
+ * Every read and write is scoped by `userId`: a connection is per-user (an MCP
+ * bearer is not tenant-scoped), so the user id IS the isolation here, and the
+ * `id` list passed to the update comes from a query that already applied it.
+ */
+async function revokeByHost(
+  getPrisma: McpOauthPrismaProvider,
+  userId: string,
+  host: string,
+): Promise<string[]> {
+  const prisma = await getPrisma();
+  const attributed = await prisma.mcpConnection.findMany({
+    where: { userId, revokedAt: null, host },
+    select: { id: true, oauthClientId: true },
+  });
+  // A legacy `host = null` row is claimed only when the provider has no row of
+  // its own: pre-attribution connections must stay disconnectable, but a provider
+  // that DID attribute can never revoke another assistant's row.
+  const targets =
+    attributed.length > 0
+      ? attributed
+      : await prisma.mcpConnection.findMany({
+          where: { userId, revokedAt: null, host: null },
+          select: { id: true, oauthClientId: true },
+        });
+  if (targets.length === 0) return [];
+  await prisma.mcpConnection.updateMany({
+    where: { id: { in: targets.map((row) => String(row.id)) } },
+    data: { revokedAt: new Date() },
+  });
+  return targets.map((row) => String(row.oauthClientId));
+}
+
+/** A provider's self-report: refresh its own row, or claim the unattributed one. */
+async function announce(
+  getPrisma: McpOauthPrismaProvider,
+  userId: string,
+  host: string,
+): Promise<number> {
+  const prisma = await getPrisma();
+  const now = new Date();
+  const refreshed = await prisma.mcpConnection.updateMany({
+    where: { userId, revokedAt: null, host },
+    data: { lastActiveAt: now, revokedAt: null },
+  });
+  if (refreshed.count > 0) return refreshed.count;
+
+  // No row for this provider yet — attribute the just-connected one. Scoped by
+  // user, so a self-report can never reach another account's connection.
+  const candidate = await prisma.mcpConnection.findFirst({
+    where: { userId, revokedAt: null, host: null },
+    orderBy: { lastActiveAt: "desc" },
+    select: { id: true },
+  });
+  if (!candidate) return 0;
+  await prisma.mcpConnection.update({
+    where: { id: candidate.id },
+    data: { host, lastActiveAt: now, revokedAt: null },
+  });
+  return 1;
+}
+
+/** Every port, over one lazily-resolved Prisma client. */
+export function createPrismaMcpStores(getPrisma: McpOauthPrismaProvider): McpOauthStores {
+  return {
+    clients: clientStore(getPrisma),
+    refreshTokens: refreshTokenStore(getPrisma),
+    connections: connectionStore(getPrisma),
+  };
+}