@kya-os/mcp-i-cloudflare 1.5.10-canary.9 → 1.6.1

package/README.md

@@ -16,6 +16,8 @@ This package provides a Next.js-style architecture for building MCP-I agents on
 - ✅ **Session Management**: Stateless sessions with nonce protection
 - ✅ **KV Storage**: Use Workers KV for nonce cache and identity
 - ✅ **Audit Logging**: Track all operations with configurable logging
+- ✅ **CSRF Protection**: Secure OAuth state validation with server-side storage
+- ✅ **Security Event Logging**: Comprehensive observability for security events
 
 ## Quick Start
 
@@ -306,6 +308,134 @@ Admin endpoints for cache management (optional, requires `admin.enabled: true`).
 
 OAuth callback handler for delegation flow.
 
+## Security Features
+
+### CSRF Protection for OAuth Flows
+
+The framework includes built-in CSRF (Cross-Site Request Forgery) protection for OAuth authorization flows. This prevents attackers from tricking users into authorizing unintended actions.
+
+#### How It Works
+
+1. **State Generation**: When initiating an OAuth flow, the framework generates a cryptographically secure random state value (32 bytes).
+
+2. **Secure Storage**: The state value and associated OAuth parameters (project ID, agent DID, session ID, etc.) are stored securely in KV storage with a 10-minute TTL.
+
+3. **State Validation**: On OAuth callback, the framework retrieves and validates the state from secure storage before processing the authorization code.
+
+4. **One-Time Use**: State values are deleted immediately after retrieval, preventing replay attacks.
+
+5. **CSRF Detection**: If the state is missing, expired, or invalid, the callback is rejected with a clear error message indicating a potential CSRF attack.
+
+#### Configuration
+
+CSRF protection is automatically enabled when `DELEGATION_STORAGE` KV namespace is configured. Optional token encryption can be enabled by setting `OAUTH_ENCRYPTION_SECRET`:
+
+```bash
+# wrangler.toml
+[env.production.vars]
+OAUTH_ENCRYPTION_SECRET = "your-encryption-secret-here"
+```
+
+#### Backward Compatibility
+
+If `OAuthSecurityService` is not available (e.g., `DELEGATION_STORAGE` not configured), the framework falls back to base64-encoded state parameters. This maintains backward compatibility but provides less security. **For production deployments, always configure `DELEGATION_STORAGE`.**
+
+#### Example
+
+```typescript
+// OAuth URL generation (automatic CSRF protection)
+const oauthUrl = await consentService.buildOAuthUrl(
+  projectId,
+  agentDid,
+  sessionId,
+  scopes,
+  serverUrl,
+  oauthSecurityService // Automatically created if DELEGATION_STORAGE is configured
+);
+
+// OAuth callback (automatic CSRF validation)
+const handler = createOAuthCallbackHandler({
+  agentShieldApiUrl: env.AGENTSHIELD_API_URL,
+  delegationStorage: env.DELEGATION_STORAGE,
+  oauthSecurityService, // Automatically created if DELEGATION_STORAGE is configured
+});
+```
+
+### Security Event Logging
+
+All security-critical events are logged with structured data for monitoring and observability. Security events are prefixed with `🔒 SECURITY EVENT:` for easy filtering.
+
+#### Logged Events
+
+- **OAuth Provider Errors**: Errors returned by OAuth providers
+- **CSRF Protection**: State validation success/failure, expired states, invalid states
+- **OAuth Code Exchange**: Token exchange start, success, and failure
+- **Delegation Storage**: Token storage events (user+agent scoped, legacy, session cache)
+- **OAuth Identity Linking**: User DID linking with OAuth identities
+- **Storage Errors**: Non-fatal storage errors that don't block operations
+
+#### Log Format
+
+All security events include:
+
+```typescript
+{
+  timestamp: string;        // ISO timestamp
+  eventType: string;       // Event type identifier (e.g., 'csrf_protection_failed')
+  severity?: 'error' | 'warning' | 'info';
+  // ... event-specific fields
+}
+```
+
+#### Example Logs
+
+```javascript
+// CSRF protection success
+[OAuth] 🔒 SECURITY EVENT: State validated successfully: {
+  projectId: 'project-123',
+  agentDid: 'did:key:z6Mk...',
+  sessionId: 'session-123...',
+  timestamp: '2025-01-21T10:30:00.000Z',
+  eventType: 'csrf_protection_success'
+}
+
+// CSRF attack detected
+[OAuth] 🔒 SECURITY EVENT: State validation failed - state not found or expired: {
+  stateParam: 'invalid-state-value...',
+  timestamp: '2025-01-21T10:30:00.000Z',
+  eventType: 'csrf_protection_failed',
+  reason: 'state_not_found_or_expired'
+}
+
+// Delegation token stored
+[OAuth] 🔒 SECURITY EVENT: Delegation token stored with user+agent DID: {
+  key: 'delegation:user:did:key:z6Mk...',
+  ttl: 604800,
+  agentDid: 'did:key:z6Mk...',
+  userDid: 'did:key:z6Mk...',
+  timestamp: '2025-01-21T10:30:00.000Z',
+  eventType: 'delegation_token_stored',
+  storageType: 'user_agent_scoped'
+}
+```
+
+#### Monitoring
+
+Security events can be monitored using:
+
+- **Cloudflare Workers Logs**: View logs in real-time with `wrangler tail`
+- **Log Aggregation**: Forward logs to external services (Datadog, Splunk, etc.)
+- **Alerting**: Set up alerts for critical security events (CSRF failures, token exchange failures)
+
+#### Privacy
+
+All security logs redact sensitive information:
+
+- DIDs are truncated (first 20 characters + "...")
+- Tokens are never logged in full
+- OAuth subjects are hashed or truncated
+- PII is redacted before logging
+
 ## Migration from v1.x
 
 If you're upgrading from v1.x, see the migration guide below.

package/dist/__tests__/e2e/test-config.d.ts

@@ -0,0 +1,37 @@
+/**
+ * E2E Test Configuration
+ *
+ * This file contains configuration for end-to-end tests that use real AgentShield API.
+ * Set these environment variables before running E2E tests:
+ *
+ * ```bash
+ * export E2E_AGENTSHIELD_API_KEY="sk_test_..."
+ * export E2E_AGENTSHIELD_PROJECT_ID="test-project-id"
+ * export E2E_AGENTSHIELD_API_URL="https://kya.vouched.id"  # Optional, defaults to production
+ * ```
+ *
+ * Or create a `.env.e2e` file in the package root:
+ * ```
+ * E2E_AGENTSHIELD_API_KEY=sk_test_...
+ * E2E_AGENTSHIELD_PROJECT_ID=test-project-id
+ * ```
+ */
+export interface E2ETestConfig {
+    apiKey: string;
+    projectId: string;
+    apiUrl: string;
+    enabled: boolean;
+}
+/**
+ * Load E2E test configuration from environment variables
+ */
+export declare function loadE2EConfig(): E2ETestConfig | null;
+/**
+ * Check if E2E tests should run
+ */
+export declare function shouldRunE2ETests(): boolean;
+/**
+ * Get E2E test configuration or throw if not configured
+ */
+export declare function getE2EConfig(): E2ETestConfig;
+//# sourceMappingURL=test-config.d.ts.map

package/dist/__tests__/e2e/test-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-config.d.ts","sourceRoot":"","sources":["../../../src/__tests__/e2e/test-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAWH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,aAAa,GAAG,IAAI,CAyBpD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,aAAa,CAU5C"}

package/dist/__tests__/e2e/test-config.js

@@ -0,0 +1,62 @@
+/**
+ * E2E Test Configuration
+ *
+ * This file contains configuration for end-to-end tests that use real AgentShield API.
+ * Set these environment variables before running E2E tests:
+ *
+ * ```bash
+ * export E2E_AGENTSHIELD_API_KEY="sk_test_..."
+ * export E2E_AGENTSHIELD_PROJECT_ID="test-project-id"
+ * export E2E_AGENTSHIELD_API_URL="https://kya.vouched.id"  # Optional, defaults to production
+ * ```
+ *
+ * Or create a `.env.e2e` file in the package root:
+ * ```
+ * E2E_AGENTSHIELD_API_KEY=sk_test_...
+ * E2E_AGENTSHIELD_PROJECT_ID=test-project-id
+ * ```
+ */
+/**
+ * Load E2E test configuration from environment variables
+ */
+export function loadE2EConfig() {
+    // Access environment variables - works in Node.js (vitest) environment
+    const apiKey = typeof process !== "undefined" && process.env
+        ? process.env.E2E_AGENTSHIELD_API_KEY
+        : undefined;
+    const projectId = typeof process !== "undefined" && process.env
+        ? process.env.E2E_AGENTSHIELD_PROJECT_ID
+        : undefined;
+    const apiUrl = typeof process !== "undefined" && process.env
+        ? process.env.E2E_AGENTSHIELD_API_URL || "https://kya.vouched.id"
+        : "https://kya.vouched.id";
+    if (!apiKey || !projectId) {
+        return null;
+    }
+    return {
+        apiKey,
+        projectId,
+        apiUrl,
+        enabled: true,
+    };
+}
+/**
+ * Check if E2E tests should run
+ */
+export function shouldRunE2ETests() {
+    const config = loadE2EConfig();
+    return config !== null && config.enabled;
+}
+/**
+ * Get E2E test configuration or throw if not configured
+ */
+export function getE2EConfig() {
+    const config = loadE2EConfig();
+    if (!config) {
+        throw new Error("E2E tests require E2E_AGENTSHIELD_API_KEY and E2E_AGENTSHIELD_PROJECT_ID environment variables.\n" +
+            "Set them in your environment or create a .env.e2e file.\n" +
+            "See packages/mcp-i-cloudflare/src/__tests__/e2e/test-config.ts for details.");
+    }
+    return config;
+}
+//# sourceMappingURL=test-config.js.map

package/dist/__tests__/e2e/test-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-config.js","sourceRoot":"","sources":["../../../src/__tests__/e2e/test-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkBH;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,uEAAuE;IACvE,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG;QAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG;QAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,MAAM,GACV,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG;QAC3C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,wBAAwB;QACjE,CAAC,CAAC,wBAAwB,CAAC;IAE/B,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS;QACT,MAAM;QACN,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,mGAAmG;YACjG,2DAA2D;YAC3D,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/adapter.d.ts

@@ -18,12 +18,41 @@ export interface ToolDefinition {
     inputSchema: any;
     handler: (args: any) => Promise<any>;
 }
+/**
+ * Configuration for creating an MCP-I Cloudflare adapter
+ *
+ * @property envPrefix - Optional prefix for KV bindings (e.g., "_17429" or "MYAPP").
+ *   If provided, KV bindings will be mapped from `{prefix}_NONCE_CACHE` to `NONCE_CACHE`.
+ *   If not provided, auto-detection will attempt to find the prefix.
+ *   Use this when deploying multiple agents in the same Cloudflare account to avoid KV namespace conflicts.
+ */
 export interface MCPICloudflareAdapterConfig extends MCPICloudflareConfig {
     serverInfo?: {
         name: string;
         version: string;
     };
     tools?: ToolDefinition[];
+    /**
+     * Optional prefix for KV bindings to support multi-agent deployments
+     *
+     * When multiple MCP-I agents are deployed in the same Cloudflare account,
+     * KV namespace bindings must be unique. Use a prefix to namespace your bindings:
+     *
+     * @example
+     * ```typescript
+     * // wrangler.toml
+     * [[kv_namespaces]]
+     * binding = "_17429_NONCE_CACHE"
+     *
+     * // src/index.ts
+     * const adapter = createMCPICloudflareAdapter({
+     *   env,
+     *   envPrefix: "_17429", // Maps _17429_NONCE_CACHE → NONCE_CACHE
+     *   // ...
+     * });
+     * ```
+     */
+    envPrefix?: string;
 }
 interface RequestMeta {
     fingerprint?: string;
@@ -31,7 +60,6 @@ interface RequestMeta {
     ip?: string;
     cfRay?: string;
     request?: Request;
-    serverOrigin?: string;
 }
 interface JsonRpcRequest {
     jsonrpc: string;
@@ -79,6 +107,19 @@ declare class CloudflareMCPServer {
      * @returns OAuthIdentity or null
      */
     private extractOAuthIdentityFromRequest;
+    /**
+     * Validate OAuth identity format and content
+     *
+     * Ensures:
+     * - Provider is non-empty string (1-50 chars)
+     * - Subject is non-empty string (1-255 chars)
+     * - Provider matches expected format (alphanumeric, hyphens, underscores)
+     * - Subject matches expected format (non-empty, reasonable length)
+     *
+     * @param identity - Parsed OAuth identity object
+     * @returns Validation result
+     */
+    private validateOAuthIdentity;
 }
 /**
  * Create a complete MCP-I handler for Cloudflare Workers
@@ -86,6 +127,8 @@ declare class CloudflareMCPServer {
  *
  * Supports SSE (Server-Sent Events) and HTTP JSON-RPC transports for compatibility
  * with Claude Desktop, Cursor, MCP Inspector, and other MCP clients.
+ *
+ * Automatically handles prefixed KV bindings via `envPrefix` parameter or auto-detection.
  */
 export declare function createMCPICloudflareAdapter(config: MCPICloudflareAdapterConfig): {
     server: CloudflareMCPServer;

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAM1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAU7D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,GAAG,CAAC;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,UAAU,WAAW;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAWD;;GAEG;AACH,cAAM,mBAAmB;IACvB,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAc;IACxC,OAAO,CAAC,kBAAkB,CAAiC;gBAGzD,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAC7C,KAAK,GAAE,cAAc,EAAO,EAC5B,YAAY,CAAC,EAAE,cAAc,EAC7B,iBAAiB,CAAC,EAAE,WAAW;IAUjC;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC;IAqZ1D,OAAO,CAAC,sBAAsB;IAwB9B,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,uBAAuB;IAmC/B,OAAO,CAAC,gBAAgB;IAuDxB,OAAO,CAAC,mBAAmB;IA2C3B,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;CA+BxC;AAkCD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B;;;mBAkCZ,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;EA+YnD"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAiB,MAAM,SAAS,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAM1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAW7D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,GAAG,CAAC;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACtC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,WAAW;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAWD;;GAEG;AACH,cAAM,mBAAmB;IACvB,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,UAAU,CAAoC;IACtD,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAc;IACxC,OAAO,CAAC,kBAAkB,CAAiC;gBAGzD,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAC7C,KAAK,GAAE,cAAc,EAAO,EAC5B,YAAY,CAAC,EAAE,cAAc,EAC7B,iBAAiB,CAAC,EAAE,WAAW;IAUjC;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAItC;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC;IAqhC1D,OAAO,CAAC,sBAAsB;IAwB9B,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,uBAAuB;IAS/B,OAAO,CAAC,uBAAuB;IAmC/B,OAAO,CAAC,gBAAgB;IAuDxB,OAAO,CAAC,mBAAmB;IA2C3B,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACH,OAAO,CAAC,+BAA+B;IAwCvC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,qBAAqB;CAsH9B;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B;;;mBAgDZ,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;EAsanD"}