@samebase/identity-broker 0.0.0-stage → 0.2.0

package/dist/component/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/component/crypto.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;SACxD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC"}

package/dist/component/lifecycle.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Deletes what has run out: expired requests, codes and registration tokens, preview clients
+ * nobody used for `previewClientMaxAgeMs`, audit rows older than `signInRetentionMs`, and email send
+ * rows outside the send window. The host calls this from a cron; production and development clients
+ * are never touched.
+ */
+export declare const cleanup: import("convex/server").RegisteredMutation<"public", {
+    now: number;
+    previewClientMaxAgeMs: number;
+    signInRetentionMs: number;
+}, Promise<{
+    authRequests: number;
+    authorizationCodes: number;
+    registrationTokens: number;
+    previewClients: number;
+    signIns: number;
+    emailSends: number;
+}>>;

package/dist/component/lifecycle.js

@@ -0,0 +1,79 @@
+import { v } from "convex/values";
+import { mutation } from "./_generated/server";
+import { EMAIL_SEND_WINDOW_MS } from "./authRequests";
+const { number, object } = v;
+/** How many documents one run deletes per table, so a run stays well inside one transaction. */
+const BATCH = 200;
+/**
+ * Deletes what has run out: expired requests, codes and registration tokens, preview clients
+ * nobody used for `previewClientMaxAgeMs`, audit rows older than `signInRetentionMs`, and email send
+ * rows outside the send window. The host calls this from a cron; production and development clients
+ * are never touched.
+ */
+export const cleanup = mutation({
+    args: { now: number(), previewClientMaxAgeMs: number(), signInRetentionMs: number() },
+    returns: object({
+        authRequests: number(),
+        authorizationCodes: number(),
+        registrationTokens: number(),
+        previewClients: number(),
+        signIns: number(),
+        emailSends: number(),
+    }),
+    handler: async (ctx, args) => {
+        const requests = await ctx.db
+            .query("authRequests")
+            .withIndex("by_expires_at", (q) => q.lt("expiresAt", args.now))
+            .take(BATCH);
+        for (const request of requests) {
+            await ctx.db.delete("authRequests", request._id);
+        }
+        const codes = await ctx.db
+            .query("authorizationCodes")
+            .withIndex("by_expires_at", (q) => q.lt("expiresAt", args.now))
+            .take(BATCH);
+        for (const code of codes) {
+            await ctx.db.delete("authorizationCodes", code._id);
+        }
+        const tokens = await ctx.db
+            .query("registrationTokens")
+            .withIndex("by_expires_at", (q) => q.lt("expiresAt", args.now))
+            .take(BATCH);
+        for (const token of tokens) {
+            await ctx.db.delete("registrationTokens", token._id);
+        }
+        const previewCutoff = args.now - args.previewClientMaxAgeMs;
+        const previewClients = (await ctx.db
+            .query("clients")
+            .withIndex("by_deployment_type", (q) => q.eq("deploymentType", "preview"))
+            .collect())
+            .filter((client) => (client.lastSignInAt ?? client.createdAt) < previewCutoff)
+            .slice(0, BATCH);
+        for (const client of previewClients) {
+            await ctx.db.delete("clients", client._id);
+        }
+        const signIns = await ctx.db
+            .query("signIns")
+            .withIndex("by_at", (q) => q.lt("at", args.now - args.signInRetentionMs))
+            .take(BATCH);
+        for (const signIn of signIns) {
+            await ctx.db.delete("signIns", signIn._id);
+        }
+        const emailSends = await ctx.db
+            .query("emailSends")
+            .withIndex("by_at", (q) => q.lt("at", args.now - EMAIL_SEND_WINDOW_MS))
+            .take(BATCH);
+        for (const emailSend of emailSends) {
+            await ctx.db.delete("emailSends", emailSend._id);
+        }
+        return {
+            authRequests: requests.length,
+            authorizationCodes: codes.length,
+            registrationTokens: tokens.length,
+            previewClients: previewClients.length,
+            signIns: signIns.length,
+            emailSends: emailSends.length,
+        };
+    },
+});
+//# sourceMappingURL=lifecycle.js.map

package/dist/component/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/component/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAE7B,gGAAgG;AAChG,MAAM,KAAK,GAAG,GAAG,CAAC;AAElB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;IAC9B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE;IACrF,OAAO,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,EAAE;QACtB,kBAAkB,EAAE,MAAM,EAAE;QAC5B,kBAAkB,EAAE,MAAM,EAAE;QAC5B,cAAc,EAAE,MAAM,EAAE;QACxB,OAAO,EAAE,MAAM,EAAE;QACjB,UAAU,EAAE,MAAM,EAAE;KACrB,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE;aAC1B,KAAK,CAAC,cAAc,CAAC;aACrB,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;aAC9D,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;aAC9D,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;aAC9D,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC5D,MAAM,cAAc,GAAG,CACrB,MAAM,GAAG,CAAC,EAAE;aACT,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;aACzE,OAAO,EAAE,CACb;aACE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,aAAa,CAAC;aAC7E,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;aACzB,KAAK,CAAC,SAAS,CAAC;aAChB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;aACxE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE;aAC5B,KAAK,CAAC,YAAY,CAAC;aACnB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;aACtE,IAAI,CAAC,KAAK,CAAC,CAAC;QACf,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,OAAO;YACL,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,kBAAkB,EAAE,KAAK,CAAC,MAAM;YAChC,kBAAkB,EAAE,MAAM,CAAC,MAAM;YACjC,cAAc,EAAE,cAAc,CAAC,MAAM;YACrC,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,UAAU,EAAE,UAAU,CAAC,MAAM;SAC9B,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/component/registration.d.ts

@@ -0,0 +1,29 @@
+/** Stores the hash of an initial access token (RFC 7591 section 3) that registers clients of one app. */
+export declare const mintToken: import("convex/server").RegisteredMutation<"public", {
+    appId: string;
+    createdAt: number;
+    expiresAt: number;
+    tokenHash: string;
+}, Promise<null>>;
+/** The app a live registration token belongs to, or null for an unknown or expired token. */
+export declare const readToken: import("convex/server").RegisteredQuery<"public", {
+    now: number;
+    tokenHash: string;
+}, Promise<{
+    appId: string;
+    name: string;
+    firstParty: boolean;
+    allowedCallbackHosts: string[];
+} | null>>;
+/** The tokens of one app, as hashes: the plaintext is never stored. Oldest first. */
+export declare const listTokens: import("convex/server").RegisteredQuery<"public", {
+    appId: string;
+}, Promise<{
+    tokenHash: string;
+    expiresAt: number;
+    createdAt: number;
+}[]>>;
+/** Deletes a registration token before it expires. Clients it registered stay. */
+export declare const revokeToken: import("convex/server").RegisteredMutation<"public", {
+    tokenHash: string;
+}, Promise<null>>;

package/dist/component/registration.js

@@ -0,0 +1,90 @@
+import { v } from "convex/values";
+import { mutation, query } from "./_generated/server";
+const { array, boolean, number, object, string } = v;
+/** Stores the hash of an initial access token (RFC 7591 section 3) that registers clients of one app. */
+export const mintToken = mutation({
+    args: { tokenHash: string(), appId: string(), expiresAt: number(), createdAt: number() },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const app = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .unique();
+        if (app === null) {
+            throw new Error(`Unknown app "${args.appId}"`);
+        }
+        await ctx.db.insert("registrationTokens", {
+            tokenHash: args.tokenHash,
+            appId: args.appId,
+            expiresAt: args.expiresAt,
+            createdAt: args.createdAt,
+        });
+        return null;
+    },
+});
+/** The app a live registration token belongs to, or null for an unknown or expired token. */
+export const readToken = query({
+    args: { tokenHash: string(), now: number() },
+    returns: v.union(object({
+        appId: string(),
+        name: string(),
+        firstParty: boolean(),
+        allowedCallbackHosts: array(string()),
+    }), v.null()),
+    handler: async (ctx, args) => {
+        const token = await ctx.db
+            .query("registrationTokens")
+            .withIndex("by_token_hash", (q) => q.eq("tokenHash", args.tokenHash))
+            .unique();
+        if (token === null || token.expiresAt <= args.now) {
+            return null;
+        }
+        const app = await ctx.db
+            .query("apps")
+            .withIndex("by_app_id", (q) => q.eq("appId", token.appId))
+            .unique();
+        if (app === null) {
+            return null;
+        }
+        return {
+            appId: app.appId,
+            name: app.name,
+            firstParty: app.firstParty,
+            allowedCallbackHosts: app.allowedCallbackHosts,
+        };
+    },
+});
+/** The tokens of one app, as hashes: the plaintext is never stored. Oldest first. */
+export const listTokens = query({
+    args: { appId: string() },
+    returns: array(object({ tokenHash: string(), expiresAt: number(), createdAt: number() })),
+    handler: async (ctx, args) => {
+        const tokens = await ctx.db
+            .query("registrationTokens")
+            .withIndex("by_app_id", (q) => q.eq("appId", args.appId))
+            .collect();
+        return tokens
+            .map((token) => ({
+            tokenHash: token.tokenHash,
+            expiresAt: token.expiresAt,
+            createdAt: token.createdAt,
+        }))
+            .sort((a, b) => a.createdAt - b.createdAt || a.tokenHash.localeCompare(b.tokenHash));
+    },
+});
+/** Deletes a registration token before it expires. Clients it registered stay. */
+export const revokeToken = mutation({
+    args: { tokenHash: string() },
+    returns: v.null(),
+    handler: async (ctx, args) => {
+        const token = await ctx.db
+            .query("registrationTokens")
+            .withIndex("by_token_hash", (q) => q.eq("tokenHash", args.tokenHash))
+            .unique();
+        if (token !== null) {
+            await ctx.db.delete("registrationTokens", token._id);
+        }
+        return null;
+    },
+});
+//# sourceMappingURL=registration.js.map

package/dist/component/registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.js","sourceRoot":"","sources":["../../src/component/registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAErD,yGAAyG;AACzG,MAAM,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC;IAChC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IACxF,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE;YACxC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;IAC7B,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,MAAM,CAAC;QACL,KAAK,EAAE,MAAM,EAAE;QACf,IAAI,EAAE,MAAM,EAAE;QACd,UAAU,EAAE,OAAO,EAAE;QACrB,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KACtC,CAAC,EACF,CAAC,CAAC,IAAI,EAAE,CACT;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;aACrB,KAAK,CAAC,MAAM,CAAC;aACb,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;aACzD,MAAM,EAAE,CAAC;QACZ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;SAC/C,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;IAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACzB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;aACxB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aACxD,OAAO,EAAE,CAAC;QACb,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACzF,CAAC;CACF,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC;IAClC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE;aACvB,KAAK,CAAC,oBAAoB,CAAC;aAC3B,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;aACpE,MAAM,EAAE,CAAC;QACZ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}