@nacre.work/core 0.5.2 → 0.5.5

package/dist/migrations/0023_oauth_consent.sql

@@ -0,0 +1,179 @@
+-- 0023 — an authorization server, and an owner for a service account.
+--
+-- Until now this product was a resource server and said so: it verifies tokens
+-- and issues none through OAuth. That was honest and it left a hole an operator
+-- fell into on day one — an MCP client's whole connect flow is discover, do the
+-- OAuth dance, get a token, and the documented alternative was "make a service
+-- account by hand, copy its key, paste it into a config file".
+--
+-- What is built here is deliberately not the usual answer. A consent screen
+-- normally mints a token that acts **as the person who signed in**, and that is
+-- the opposite of what this product sells: an agent is a principal of its own,
+-- with its own grants, and "which documents may this agent read" is a different
+-- question from "which documents may you read". So the code issued here is
+-- exchanged for a token bound to a **service account**, and the consent screen
+-- is where a person chooses or creates one.
+--
+-- Three tables and one column.
+
+-- ─────────────────────────── who made an agent ───────────────────────────
+
+-- A service account has never had an owner. `grants.created_by` records who
+-- issued a grant; nothing recorded who created the principal it names, because
+-- only an `org_admin` could and there were few of them.
+--
+-- Consent changes that: anyone who may issue a grant may now stand one up, and
+-- without an owner an organization accumulates `laptop-agent`, `laptop-agent-2`
+-- and nobody able to say whose is whose or to revoke their own.
+--
+-- Nullable, and that is not laziness: every account that already exists was
+-- created before this column and by `init` or by an administrator through the
+-- API, so there is no owner to recover. Inventing one — the first
+-- administrator, say — would be a record that reads as fact and is a guess.
+--
+-- ON DELETE SET NULL rather than CASCADE. Deleting a person must not delete the
+-- agents they set up; those are the organization's, and their access is decided
+-- by grants that outlive whoever created them. (`users` are disabled rather
+-- than deleted today, so this is a guard rather than a live path.)
+ALTER TABLE service_accounts
+  ADD COLUMN created_by uuid REFERENCES users(id) ON DELETE SET NULL;
+
+-- "My agents", which is the whole reason the column exists.
+CREATE INDEX ON service_accounts (org_id, created_by) WHERE revoked_at IS NULL;
+
+-- ────────────────────────── registered clients ──────────────────────────
+
+-- A client registers **before anybody has signed in**, so this row carries no
+-- tenant data and gets no `org_id` and no RLS. That is the honest shape rather
+-- than a shortcut: a client_id is not access to anything. Authority is created
+-- only by a consent a signed-in person completes, and that lives in the table
+-- below, which is tenant data and is policed like every other.
+--
+-- Registration is open, which is what RFC 7591 is for and what an MCP client
+-- expects to be able to do. The exposure is bounded by that same fact — a row
+-- here permits nothing — plus the rate limiter, and a client is displayed to
+-- the person consenting with its redirect URI beside its name, because the name
+-- is self-asserted and the redirect URI is the thing that actually decides
+-- where a code goes.
+CREATE TABLE oauth_clients (
+    id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    client_id     text NOT NULL UNIQUE,
+    client_name   text NOT NULL,
+    -- Exact strings, compared exactly. No wildcards and no prefix matching:
+    -- a redirect URI is where an authorization code is delivered, and every
+    -- relaxation of that comparison is a way to deliver it somewhere else.
+    redirect_uris text[] NOT NULL,
+    created_at    timestamptz NOT NULL DEFAULT now(),
+    CHECK (cardinality(redirect_uris) > 0)
+);
+
+-- ─────────────────────── an authorization in flight ───────────────────────
+
+-- Post-consent, and therefore tenant data: it names a service account, which
+-- belongs to an organization.
+--
+-- The pre-consent half of the flow is deliberately **not** stored. An
+-- authorization request that nobody has approved is a set of query parameters
+-- the browser is already carrying; writing it down would add a table an
+-- unauthenticated caller can fill. The parameters are carried through the
+-- consent screen and validated when the consent is posted.
+-- The composite key the reference below needs, and the reason it is composite:
+-- a plain `REFERENCES service_accounts(id)` would let an authorization in one
+-- organization name an agent in another, and the database would allow it. This
+-- is the rule every cross-tenant foreign key here follows.
+ALTER TABLE service_accounts ADD CONSTRAINT service_accounts_id_org_key UNIQUE (id, org_id);
+
+CREATE TABLE oauth_authorizations (
+    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    org_id             uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    client_id          text NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+
+    -- Who the token will act as. Composite so the database refuses an agent
+    -- from another organization, rather than the code that writes the insert.
+    service_account_id uuid NOT NULL,
+
+    -- Who approved it. An audit answer to "why does this agent have a token",
+    -- and the reason a person can be shown their own consents.
+    approved_by        uuid NOT NULL REFERENCES users(id),
+
+    -- The code, hashed. Same rule as a service account key and for the same
+    -- reason: a readable authorization code in a backup is a token nobody
+    -- revoked. Unique so a hash collision is a constraint violation rather than
+    -- two authorizations answering to one code.
+    code_hash          text NOT NULL UNIQUE,
+
+    -- PKCE. S256 only — `plain` is in the RFC and defeats the mechanism, so it
+    -- is refused at the endpoint and cannot be represented here.
+    code_challenge     text NOT NULL,
+
+    -- Compared exactly against the one presented at the token endpoint. RFC
+    -- 6749 requires it and it is what stops a code being redeemed through a
+    -- different registered client's redirect.
+    redirect_uri       text NOT NULL,
+
+    -- RFC 8707. The resource the token is bound to, so an audience-bound token
+    -- minted for this installation cannot be replayed at another.
+    resource           text,
+
+    -- Short. A code is a bearer capability that exists only long enough to be
+    -- exchanged, and the exchange happens within a second of the redirect.
+    expires_at         timestamptz NOT NULL,
+    -- Set on first exchange. A second attempt is refused **and** is a signal:
+    -- either the code leaked or the client is retrying, and neither should
+    -- produce a second token.
+    consumed_at        timestamptz,
+    created_at         timestamptz NOT NULL DEFAULT now(),
+
+    FOREIGN KEY (service_account_id, org_id) REFERENCES service_accounts (id, org_id) ON DELETE CASCADE
+);
+
+-- The lookup the token endpoint makes, and the sweep the worker makes.
+CREATE INDEX ON oauth_authorizations (expires_at) WHERE consumed_at IS NULL;
+CREATE INDEX ON oauth_authorizations (org_id, approved_by, created_at DESC);
+
+ALTER TABLE oauth_authorizations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE oauth_authorizations FORCE  ROW LEVEL SECURITY;
+
+-- The same two-policy shape migration 0008 gave `service_accounts`, and for the
+-- identical reason: an authorization code is a credential, and a credential is
+-- what says which organization it belongs to. The token endpoint is handed a
+-- code and nothing else, so it cannot scope the lookup before it has done it.
+--
+-- `CASE` and not `AND`: without the guard Postgres may evaluate the org-scoped
+-- expression anyway and raise `unrecognized configuration parameter` before the
+-- second policy is consulted. Left raising in every other case on purpose — a
+-- query that forgot `withOrg` should fail loudly rather than quietly return
+-- nothing.
+CREATE POLICY org_isolation ON oauth_authorizations
+  USING (
+      CASE
+          WHEN current_setting('app.authenticating', true) = 'on' THEN false
+          ELSE org_id = current_setting('app.current_org')::uuid
+      END
+  );
+
+-- **SELECT only**, which is the load-bearing half. The cross-tenant path reads
+-- the code to learn which organization it belongs to and stops there; marking
+-- it consumed happens afterwards inside `withOrg`, under that organization,
+-- where the `consumed_at IS NULL` predicate in the UPDATE is what makes a
+-- second exchange return no rows.
+--
+-- Splitting it that way is not a weakening. The lookup decides nothing — the
+-- UPDATE does, atomically, and a replay loses the race against it. What the
+-- split buys is that the one path in this system which spans tenants stays
+-- unable to write, which is the property migration 0008 established and which
+-- an UPDATE here would have quietly ended.
+CREATE POLICY authenticating_lookup ON oauth_authorizations
+  FOR SELECT
+  USING (current_setting('app.authenticating', true) = 'on');
+
+-- The application role reads and writes both, and can never rewrite a code that
+-- has already been issued: `UPDATE` is granted because consumption sets one
+-- column, and the endpoint sets only that one.
+GRANT SELECT, INSERT ON oauth_clients TO nacre_app;
+GRANT SELECT, INSERT, UPDATE, DELETE ON oauth_authorizations TO nacre_app;
+
+-- The worker sweeps expired authorizations, the same way it prunes refresh
+-- tokens: a code nobody exchanged is inert, and a table that only grows is a
+-- table somebody eventually finds full.
+GRANT SELECT, DELETE ON oauth_authorizations TO nacre_worker;

package/dist/migrations/0024_oauth_consents.sql

@@ -0,0 +1,130 @@
+-- 0024 — a connection you can see, and end.
+--
+-- 0023 built the flow and stopped one step short. It recorded an authorization
+-- *code* — a thing that lives for ninety seconds and is consumed — and nothing
+-- that outlives it. So after the exchange there was no record that an
+-- application was connected at all, no screen could list one, and **the token
+-- could not be taken back**: it is a JWT verified locally against a key, so it
+-- is valid until it expires and nothing consults a table.
+--
+-- That is the gap this closes, and it closes it the way the product already
+-- solves the same problem for a person's own session rather than by inventing a
+-- second mechanism: a short access token, a long refresh token that is stored
+-- and rotated, and revocation that kills the refresh token. The access token
+-- then survives at most its own TTL, which is bounded and stated rather than
+-- indefinite.
+--
+-- A denylist of live JWTs was the alternative and is rejected on the same
+-- grounds the effective-principals cache was accepted: this one would put a
+-- lookup on every single request to undo something that happens once, and a
+-- verification that needs a database is no longer local verification.
+
+-- ───────────────────────── the standing connection ─────────────────────────
+
+CREATE TABLE oauth_consents (
+    id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    org_id             uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    client_id          text NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+
+    -- What the application acts as. Composite, so the database refuses an agent
+    -- from another organization rather than the code that writes the insert.
+    service_account_id uuid NOT NULL,
+
+    -- Who approved it, and therefore who is shown it as theirs. Not a
+    -- permission — an `org_admin` sees every connection in the organization,
+    -- because an agent is the organization's and somebody has to be able to end
+    -- one whose approver has left.
+    approved_by        uuid NOT NULL REFERENCES users(id),
+
+    created_at         timestamptz NOT NULL DEFAULT now(),
+    -- Moved when a refresh is exchanged, which is the only signal available:
+    -- an access token is verified locally and its use touches nothing. So this
+    -- is "last seen renewing" and the column name says so rather than implying
+    -- a precision it does not have.
+    last_refreshed_at  timestamptz,
+    revoked_at         timestamptz,
+
+    -- One connection per application per agent. Approving twice is the same
+    -- connection, not a second one — otherwise a screen fills with duplicates
+    -- and ending one leaves the others working.
+    UNIQUE (org_id, client_id, service_account_id),
+    FOREIGN KEY (service_account_id, org_id) REFERENCES service_accounts (id, org_id) ON DELETE CASCADE
+);
+
+CREATE INDEX ON oauth_consents (org_id, approved_by, created_at DESC);
+
+ALTER TABLE oauth_consents ENABLE ROW LEVEL SECURITY;
+ALTER TABLE oauth_consents FORCE  ROW LEVEL SECURITY;
+CREATE POLICY org_isolation ON oauth_consents
+  USING (org_id = current_setting('app.current_org')::uuid);
+
+-- The code now points at the connection it belongs to, so the exchange knows
+-- which one to hang a refresh token on. Nullable because 0023's rows predate
+-- it, and they are all consumed or expired by now — a code lives ninety
+-- seconds.
+ALTER TABLE oauth_authorizations
+  ADD COLUMN consent_id uuid REFERENCES oauth_consents(id) ON DELETE CASCADE;
+
+-- ────────────────────────── the refresh token ──────────────────────────
+
+-- Deliberately **not** the `refresh_tokens` table sign-in uses. That one
+-- references `users(id)` and is about a person's browser session; this is about
+-- an application acting as an agent. Sharing a table would mean a nullable
+-- `user_id`, a nullable `consent_id` and a CHECK to say exactly one is set —
+-- three ways to describe one relationship, and a revocation query that has to
+-- remember which shape it is looking at.
+--
+-- The rotation rule is the same and is the part worth copying: a used token
+-- replays as an attack, because the legitimate holder has already exchanged it
+-- and there is no way to tell which of the two holders is genuine. Replaying
+-- one ends the whole family.
+CREATE TABLE oauth_refresh_tokens (
+    id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    org_id      uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
+    consent_id  uuid NOT NULL REFERENCES oauth_consents(id) ON DELETE CASCADE,
+    -- Hashed. Same rule as a service account key and an authorization code: a
+    -- readable long-lived credential in a backup is one nobody revoked.
+    token_hash  text NOT NULL UNIQUE,
+    -- Every token descended from one authorization shares this. Replaying a
+    -- spent token kills the family, not just the token.
+    family_id   uuid NOT NULL,
+    expires_at  timestamptz NOT NULL,
+    used_at     timestamptz,
+    created_at  timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX ON oauth_refresh_tokens (consent_id) WHERE used_at IS NULL;
+CREATE INDEX ON oauth_refresh_tokens (expires_at);
+
+ALTER TABLE oauth_refresh_tokens ENABLE ROW LEVEL SECURITY;
+ALTER TABLE oauth_refresh_tokens FORCE  ROW LEVEL SECURITY;
+
+-- The same two-policy shape as `oauth_authorizations` and, before it,
+-- `service_accounts`: a refresh token is a credential, and a credential is what
+-- says which organization it belongs to. The token endpoint is handed one and
+-- nothing else.
+CREATE POLICY org_isolation ON oauth_refresh_tokens
+  USING (
+      CASE
+          WHEN current_setting('app.authenticating', true) = 'on' THEN false
+          ELSE org_id = current_setting('app.current_org')::uuid
+      END
+  );
+
+-- SELECT only, and this is the property that must not erode: the one path in
+-- this system that reads across tenants stays unable to write. The lookup finds
+-- which organization a token belongs to and stops; rotating it happens inside
+-- `withOrg`, where the `used_at IS NULL` predicate in the UPDATE is what makes
+-- a replay lose the race.
+CREATE POLICY authenticating_lookup ON oauth_refresh_tokens
+  FOR SELECT
+  USING (current_setting('app.authenticating', true) = 'on');
+
+GRANT SELECT, INSERT, UPDATE ON oauth_consents TO nacre_app;
+GRANT SELECT, INSERT, UPDATE, DELETE ON oauth_refresh_tokens TO nacre_app;
+
+-- The worker prunes expired refresh tokens the same way it prunes the ones
+-- sign-in issues: a table that only grows is one somebody eventually finds
+-- full. Consents are not swept — a revoked connection is a record of something
+-- that happened, and the screen showing it is the point.
+GRANT SELECT, DELETE ON oauth_refresh_tokens TO nacre_worker;

package/dist/oauth.d.ts

@@ -15,17 +15,20 @@
  * `/v1/auth/login` is email and password, and a service account key is a random
  * string matched against a hash — neither is an OAuth grant.
  *
- * So `authorization_servers` is **absent unless an operator names one**. The
- * field is optional in RFC 9728, and an installation that has not put an
- * identity provider in front of Nacre has no authorization server to name.
- * Pointing the field at ourselves would be the same lie the 404 was, one
- * redirect further along: a client would fetch our metadata, learn we are our
- * own issuer, ask us for a token endpoint, and find nothing again.
+ * `authorization_servers` names one, and which one is a deployment's choice:
+ * an identity provider if it has configured one, and otherwise this
+ * installation's own API, which since the consent flow landed *is* an
+ * authorization server.
  *
- * What the document is still worth without that field is the part clients
- * actually need first: the canonical resource identifier every token must be
- * audience-bound to, and where to read about the credential that does work
- * today.
+ * This field used to be absent by default, on the argument that pointing a
+ * client at a token endpoint that did not exist would be the same dead end the
+ * missing document was, one redirect further along. That argument was correct
+ * and it is not what changed — the endpoint changed. It exists now, and it
+ * mints a token bound to a **service account** rather than to the person who
+ * approved it, which is the part worth knowing before reading the flow.
+ *
+ * A deployment that wants neither sets `NACRE_OAUTH_AUTHORIZATION_SERVER` to
+ * its own provider; the field then names that and nothing here is consulted.
  */
 export interface ProtectedResourceMetadata {
     readonly resource: string;

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClD,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,0CAA0C,CAAA;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,2BAA2B,CAAA;AAEjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACtC,GAAG,yBAAyB,CAoB5B"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClD,QAAQ,CAAC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAA;IACpD,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,0CAA0C,CAAA;AAE9E;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,2BAA2B,CAAA;AAEjD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACtC,GAAG,yBAAyB,CAoB5B"}

package/dist/oauth.js

@@ -15,17 +15,20 @@
  * `/v1/auth/login` is email and password, and a service account key is a random
  * string matched against a hash — neither is an OAuth grant.
  *
- * So `authorization_servers` is **absent unless an operator names one**. The
- * field is optional in RFC 9728, and an installation that has not put an
- * identity provider in front of Nacre has no authorization server to name.
- * Pointing the field at ourselves would be the same lie the 404 was, one
- * redirect further along: a client would fetch our metadata, learn we are our
- * own issuer, ask us for a token endpoint, and find nothing again.
+ * `authorization_servers` names one, and which one is a deployment's choice:
+ * an identity provider if it has configured one, and otherwise this
+ * installation's own API, which since the consent flow landed *is* an
+ * authorization server.
  *
- * What the document is still worth without that field is the part clients
- * actually need first: the canonical resource identifier every token must be
- * audience-bound to, and where to read about the credential that does work
- * today.
+ * This field used to be absent by default, on the argument that pointing a
+ * client at a token endpoint that did not exist would be the same dead end the
+ * missing document was, one redirect further along. That argument was correct
+ * and it is not what changed — the endpoint changed. It exists now, and it
+ * mints a token bound to a **service account** rather than to the person who
+ * approved it, which is the part worth knowing before reading the flow.
+ *
+ * A deployment that wants neither sets `NACRE_OAUTH_AUTHORIZATION_SERVER` to
+ * its own provider; the field then names that and nothing here is consulted.
  */
 /** The path RFC 9728 fixes, and the one the `WWW-Authenticate` header names. */
 export const PROTECTED_RESOURCE_PATH = '/.well-known/oauth-protected-resource';

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,uCAAuC,CAAA;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAA;AAEjD,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,OAAO;QACL,0EAA0E;QAC1E,4EAA4E;QAC5E,0DAA0D;QAC1D,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/E,wEAAwE;QACxE,4EAA4E;QAC5E,sEAAsE;QACtE,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,sBAAsB,EAAE,2DAA2D;QACnF,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,oDAAoD;QACpD,gBAAgB,EAAE,EAAE;KACrB,CAAA;AACH,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAUH,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,uCAAuC,CAAA;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,wBAAwB,CAAA;AAEjD,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,OAAO;QACL,0EAA0E;QAC1E,4EAA4E;QAC5E,0DAA0D;QAC1D,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/E,wEAAwE;QACxE,4EAA4E;QAC5E,sEAAsE;QACtE,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,sBAAsB,EAAE,2DAA2D;QACnF,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,oDAAoD;QACpD,gBAAgB,EAAE,EAAE;KACrB,CAAA;AACH,CAAC"}