clickwrap 0.0.0 → 0.1.0

data/lib/clickwrap/models/event_document.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # The exact document version bound to one statement in one event, with the
+  # digests as they stood at capture.
+  #
+  # The digests are copied here rather than only referenced, so that verification
+  # can detect a document version row that was edited in place instead of
+  # trusting the current value of a column it is supposed to be checking.
+  class EventDocument < ApplicationRecord
+    self.table_name = "clickwrap_event_documents"
+    self.record_timestamps = false
+
+    belongs_to :event, class_name: "Clickwrap::Event", inverse_of: :documents
+    belongs_to :document_version,
+               class_name: "Clickwrap::DocumentVersion",
+               optional: true,
+               inverse_of: :event_documents
+
+    validates :statement_key, :document_key, :version_label, :locale, :source_content_digest,
+              presence: true
+
+    before_update :refuse_change
+    before_destroy :refuse_destroy
+
+    # True when the stored document version still carries the digest this event
+    # recorded. A false says the document row changed after capture — which is
+    # a finding, not a crash, so verification reports it with a stable error
+    # rather than raising into an export.
+    def still_matches_stored_version?
+      return false if document_version.nil?
+
+      Digest.secure_compare?(document_version.content_digest, source_content_digest) &&
+        Digest.secure_compare?(
+          document_version.rendered_content_digest.presence || document_version.content_digest,
+          rendered_content_digest
+        ) && document_version.media_type == source_media_type &&
+        (document_version.rendered_media_type.presence || document_version.media_type) == rendered_media_type &&
+        document_version.renderer_name.to_s == renderer_name.to_s &&
+        document_version.renderer_version.to_s == renderer_version.to_s &&
+        document_version.sanitizer_name.to_s == sanitizer_name.to_s &&
+        document_version.sanitizer_version.to_s == sanitizer_version.to_s
+    end
+
+    def canonical_fragment
+      {
+        "statement" => statement_key,
+        "key" => document_key,
+        "version" => version_label,
+        "locale" => locale,
+        "source_media_type" => source_media_type,
+        "source_digest" => source_content_digest,
+        "rendered_media_type" => rendered_media_type,
+        "rendered_digest" => rendered_content_digest,
+        "renderer" => {
+          "name" => renderer_name,
+          "version" => renderer_version,
+          "sanitizer_name" => sanitizer_name,
+          "sanitizer_version" => sanitizer_version
+        }.compact.presence,
+        "ordinal" => ordinal
+      }.compact
+    end
+
+    def to_s = "#{document_key} #{version_label} (#{locale})"
+
+    private
+
+    def refuse_change
+      raise EventWriteFailed,
+            "Document binding #{self} on event #{event_id} is an immutable snapshot."
+    end
+
+    def refuse_destroy
+      raise EventWriteFailed,
+            "Document binding #{self} on event #{event_id} cannot be destroyed."
+    end
+  end
+end

data/lib/clickwrap/models/event_statement.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # One act inside one event: the assertion in the server-generated offer and
+  # what the submitted answer said about it.
+  #
+  # `assertion_text` is the resolved sentence, not an I18n key. Storing the key
+  # would be a false economy — its meaning can change in a later deploy, and
+  # then the receipt no longer says what assertion the application recorded.
+  class EventStatement < ApplicationRecord
+    self.table_name = "clickwrap_event_statements"
+    self.record_timestamps = false
+
+    belongs_to :event, class_name: "Clickwrap::Event", inverse_of: :statements
+
+    has_many :event_documents,
+             ->(statement) { where(statement_key: statement.statement_key) },
+             class_name: "Clickwrap::EventDocument",
+             foreign_key: :event_id,
+             primary_key: :event_id,
+             inverse_of: false,
+             dependent: nil
+
+    validates :statement_key, :assertion_text, :assertion_locale, presence: true
+    validates :kind, inclusion: { in: Vocabulary::KINDS }
+    validate :action_belongs_to_kind
+
+    before_update :refuse_change
+    before_destroy :refuse_destroy
+
+    scope :of_kind, ->(kind) { where(kind: kind.to_s) }
+    scope :answered, -> { where(answered: true) }
+
+    def expired?(at = Clickwrap.now) = expires_at.present? && expires_at <= at
+
+    # An optional control left unselected creates no grant. The receipt can show
+    # that the option was offered and not taken, but it does not call silence an
+    # affirmative refusal — those are different facts and only one of them
+    # actually happened.
+    def offered_and_not_taken? = optional? && !answered?
+
+    def canonical_fragment
+      {
+        "statement" => statement_key,
+        "kind" => kind,
+        "action" => action,
+        "assertion" => assertion_text,
+        "locale" => assertion_locale,
+        "label" => label_text,
+        "link_labels" => link_labels.presence,
+        "choices" => choices.presence,
+        "required" => required?,
+        "optional" => optional?,
+        "answered" => answered?,
+        "answer" => answer.presence,
+        "purpose" => purpose_key,
+        "withdrawal_path" => withdrawal_path,
+        "valid_from" => Receipt.format_time(valid_from),
+        "expires_at" => Receipt.format_time(expires_at),
+        "one_time" => one_time? || nil,
+        "requires" => Array(requires).presence,
+        "subject_fingerprint" => subject_fingerprint
+      }.compact
+    end
+
+    def to_s = "#{kind} #{statement_key} (#{action})"
+
+    private
+
+    def action_belongs_to_kind
+      return if kind.blank? || action.blank?
+      return if Vocabulary::ACTIONS_FOR_KIND.fetch(kind, []).include?(action)
+
+      errors.add(
+        :action,
+        "#{action.inspect} is not something a #{kind} can record. A #{kind} can be: " \
+        "#{Vocabulary::ACTIONS_FOR_KIND.fetch(kind, []).join(", ")}."
+      )
+    end
+
+    def refuse_change
+      raise EventWriteFailed,
+            "Statement #{statement_key} on event #{event_id} is an immutable snapshot of what " \
+            "was offered and answered. Record a correction, withdrawal, or supersession instead."
+    end
+
+    def refuse_destroy
+      raise EventWriteFailed,
+            "Statement #{statement_key} on event #{event_id} cannot be destroyed."
+    end
+  end
+end

data/lib/clickwrap/models/external_action.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # The outbox row for an action Clickwrap cannot make atomic.
+  #
+  # Stripe, an identity provider, a timestamp authority: none of them can join
+  # your database transaction, and pretending otherwise is how a provider
+  # timeout becomes either a fictional success or a second debit. So the local
+  # transaction commits a pending authorization and an idempotency key, the
+  # provider is called outside it, and the outcome is appended back
+  # idempotently.
+  #
+  # `unknown` is a first-class state, not an error state. A timeout is not a
+  # failure — it is an absence of information — and the reconciliation task
+  # exists precisely to resolve those later rather than guessing now.
+  class ExternalAction < ApplicationRecord
+    self.table_name = "clickwrap_external_actions"
+
+    STATES = %w[pending succeeded failed unknown].freeze
+
+    belongs_to :event, class_name: "Clickwrap::Event", inverse_of: :external_action
+
+    validates :policy_key, :idempotency_key, :requested_at, presence: true
+    validates :idempotency_key, uniqueness: true
+    validates :state, inclusion: { in: STATES }
+
+    before_update :refuse_ordinary_update
+    before_destroy :refuse_destroy, prepend: true
+
+    scope :pending, -> { where(state: "pending") }
+    scope :unresolved, -> { where(state: %w[pending unknown]) }
+    scope :needing_reconciliation, lambda { |older_than = 15.minutes.ago|
+      unresolved.where(requested_at: ...older_than)
+    }
+
+    def pending? = state == "pending"
+    def resolved? = %w[succeeded failed].include?(state)
+
+    # Each resolution is one idempotent local transaction. Calling it twice with
+    # the same outcome is a no-op; calling it with a different outcome after the
+    # action already resolved raises, because silently overwriting "succeeded"
+    # with "failed" would rewrite the record of what the provider told us.
+    def record_provider_success_and_consume!(provider_receipt = nil)
+      resolve!("succeeded", provider_receipt: provider_receipt) do
+        Lifecycle.consume_authorization!(event: event, because: "External action succeeded")
+      end
+    end
+
+    def record_provider_failure!(reason:, provider_receipt: nil)
+      resolve!("failed", provider_receipt: provider_receipt, failure_reason: reason)
+    end
+
+    # For the genuinely ambiguous case: the request may or may not have been
+    # carried out, and the honest record says so rather than picking one.
+    def record_provider_outcome_unknown!(reason:)
+      resolve!("unknown", failure_reason: reason, resolved: false)
+    end
+
+    def to_s = "external action #{idempotency_key} (#{state})"
+
+    private
+
+    def resolve!(new_state, provider_receipt: nil, failure_reason: nil, resolved: true)
+      transaction do
+        reload.lock!
+
+        if state == new_state
+          return self if same_provider_resolution?(
+            provider_receipt: provider_receipt,
+            failure_reason: failure_reason
+          )
+
+          # Unknown is an observation, not a terminal result. A later
+          # reconciliation attempt may still be unknown for a different
+          # documented reason; append that attempt instead of erasing the first.
+          unless new_state == "unknown"
+            raise ExternalActionAlreadyResolved,
+                  "External action #{idempotency_key} is already #{state}, but the repeated provider " \
+                  "result carries different evidence. The original outcome is not silently overwritten."
+          end
+        end
+
+        if resolved? && new_state != state
+          raise ExternalActionAlreadyResolved,
+                "External action #{idempotency_key} already resolved as #{state}; it cannot " \
+                "become #{new_state}. Appending a new event is the way to record a later change."
+        end
+
+        update_columns(
+          state: new_state,
+          provider_receipt: provider_receipt || self.provider_receipt,
+          failure_reason: failure_reason,
+          attempt_count: attempt_count + 1,
+          resolved_at: resolved ? Clickwrap.now : nil,
+          updated_at: Clickwrap.now
+        )
+
+        Lifecycle.append_lifecycle_event!(
+          event: event,
+          event_type: "provider_outcome",
+          reason: provider_outcome_reason(new_state, failure_reason),
+          extra: {
+            protected_outcome: {
+              "external_action" => {
+                "external_action_id" => id.to_s,
+                "idempotency_key" => idempotency_key,
+                "provider_name" => provider_name,
+                "state" => new_state,
+                "provider_receipt" => provider_receipt,
+                "failure_reason" => failure_reason
+              }.compact
+            }
+          }
+        )
+
+        yield if block_given?
+      end
+
+      self
+    end
+
+    def provider_outcome_reason(new_state, failure_reason)
+      ["External action was recorded as #{new_state}.", failure_reason].compact.join(" ")
+    end
+
+    def same_provider_resolution?(provider_receipt:, failure_reason:)
+      receipt_matches = provider_receipt.nil? ||
+                        canonical_value(provider_receipt) == canonical_value(self.provider_receipt)
+      reason_matches = failure_reason.to_s == self.failure_reason.to_s
+
+      receipt_matches && reason_matches
+    end
+
+    def canonical_value(value)
+      CanonicalJson.generate(value)
+    rescue CanonicalJson::SerializationError
+      value
+    end
+
+    def refuse_ordinary_update
+      raise ImmutableEvidenceError,
+            "External action outcomes are changed only through the named provider-result methods."
+    end
+
+    def refuse_destroy
+      raise ImmutableEvidenceError,
+            "External actions are durable outbox records and cannot be destroyed."
+    end
+  end
+end

data/lib/clickwrap/models/integrity_attestation.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # One immutable result from an optional external integrity adapter. Merely
+  # configuring an adapter is not evidence; this row records what was actually
+  # submitted, what the provider returned, and whether its verifier checked the
+  # exact event digest.
+  class IntegrityAttestation < ApplicationRecord
+    self.table_name = "clickwrap_integrity_attestations"
+    self.record_timestamps = false
+
+    KINDS = %w[event_anchor third_party_timestamp].freeze
+    STATES = %w[verified issued_unverified unavailable failed].freeze
+
+    belongs_to :event, class_name: "Clickwrap::Event", inverse_of: :integrity_attestations
+
+    validates :kind, inclusion: { in: KINDS }
+    validates :state, inclusion: { in: STATES }
+    validates :event_id, :provider_name, :subject_digest, :attempted_at, :attestation_digest,
+              presence: true
+
+    before_validation :assign_attestation_digest, on: :create
+    before_update :refuse_update
+    before_destroy :refuse_destroy, prepend: true
+
+    scope :verified, -> { where(state: "verified") }
+
+    def verified?
+      state == "verified" && verification.to_h["checked"] == true &&
+        verification.to_h["verified"] == true && digest_verified?
+    end
+
+    def verified_for?(source_event)
+      verified? && event_id.to_s == source_event.id.to_s &&
+        subject_digest.to_s == source_event.event_digest.to_s &&
+        (kind != "event_anchor" ||
+          (chain_scope.to_s == source_event.chain_scope.to_s && chain_sequence == source_event.chain_sequence))
+    end
+
+    def digest_verified?
+      Digest.secure_compare?(attestation_digest.to_s, compute_attestation_digest)
+    end
+
+    def canonical_fragment
+      canonical_body.merge(
+        "attestation_digest" => attestation_digest
+      )
+    end
+
+    def canonical_body
+      {
+        "event_id" => event_id,
+        "kind" => kind,
+        "state" => state,
+        "provider_name" => provider_name,
+        "subject_digest" => subject_digest,
+        "chain_scope" => chain_scope,
+        "chain_sequence" => chain_sequence,
+        "provider_reference" => provider_reference,
+        "provider_result" => provider_result.presence,
+        "verification" => verification.presence,
+        "adapter_capabilities" => adapter_capabilities.presence,
+        "attempted_at" => Receipt.format_time(attempted_at),
+        "provider_reported_at" => Receipt.format_time(provider_reported_at),
+        "created_at" => Receipt.format_time(created_at)
+      }.compact
+    end
+
+    private
+
+    def assign_attestation_digest
+      self.attestation_digest ||= compute_attestation_digest
+    end
+
+    def compute_attestation_digest
+      Digest.digest_canonical(canonical_body)
+    end
+
+    def refuse_update
+      raise ImmutableEvidenceError,
+            "Integrity attestations cannot be updated through Clickwrap. " \
+            "Re-check a provider by recording a new attestation."
+    end
+
+    def refuse_destroy
+      raise ImmutableEvidenceError,
+            "Integrity attestations cannot be destroyed through Clickwrap."
+    end
+  end
+end

data/lib/clickwrap/models/legal_hold.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # A legal hold pauses scheduled disposition for an event, an actor, or a
+  # policy.
+  #
+  # It requires a reason, an owner, and a review date. That is not bureaucracy:
+  # an indefinite hold with no owner is exactly how "we'll delete it later"
+  # becomes "we kept everything forever", and a retention policy that can be
+  # suspended invisibly is not a retention policy. Placement and release append
+  # linked lifecycle events; this row is the current operational projection and
+  # changes only through the named `release!` transition.
+  class LegalHold < ApplicationRecord
+    self.table_name = "clickwrap_legal_holds"
+    self.record_timestamps = false
+
+    SCOPES = %w[event actor policy].freeze
+
+    belongs_to :event, class_name: "Clickwrap::Event", optional: true, inverse_of: :legal_holds
+
+    validates :reason, :placed_by_reference, :placed_at, :review_at, presence: true
+    validates :hold_scope, inclusion: { in: SCOPES }
+    validate :scope_has_its_target
+    validate :review_follows_placement
+    before_update :refuse_ordinary_update
+    before_destroy :refuse_destroy, prepend: true
+
+    scope :in_effect, -> { where(released_at: nil) }
+    scope :due_for_review, ->(at = Clickwrap.now) { in_effect.where(review_at: ..at) }
+    scope :for_event, ->(id) { where(event_id: id) }
+    scope :for_actor, ->(reference) { where(actor_reference: reference) }
+
+    def released? = released_at.present?
+    def in_effect? = !released?
+
+    def release!(because:, released_by:)
+      raise LegalHoldInEffect, "Releasing a legal hold needs a `because:` explaining why." if because.to_s.strip.empty?
+      raise LegalHoldInEffect, "Legal hold #{id} was already released at #{released_at}." if released?
+
+      update_columns(
+        released_at: Clickwrap.now,
+        released_by_reference: Reference.actor(released_by),
+        release_reason: because
+      )
+      self
+    end
+
+    def to_s = "legal hold on #{hold_scope} (#{reason})"
+
+    private
+
+    def refuse_ordinary_update
+      raise ImmutableEvidenceError,
+            "Legal holds refuse ordinary updates. Release one through " \
+            "`release!(because:, released_by:)`, which records the named transition."
+    end
+
+    def refuse_destroy
+      raise ImmutableEvidenceError,
+            "Legal holds cannot be destroyed; release one through the named transition so its history remains."
+    end
+
+    def scope_has_its_target
+      target = case hold_scope
+               when "event" then event_id
+               when "actor" then actor_reference
+               when "policy" then policy_key
+               end
+
+      return if target.present?
+
+      errors.add(:base, "A #{hold_scope}-scoped legal hold must name the #{hold_scope} it holds.")
+    end
+
+    def review_follows_placement
+      return if placed_at.nil? || review_at.nil? || review_at > placed_at
+
+      errors.add(:review_at, "must be after the hold was placed")
+    end
+  end
+end

data/lib/clickwrap/models/policy_revision.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # A frozen snapshot of one compiled policy.
+  #
+  # Policies are written in Ruby because that is what a reviewer can read in a
+  # pull request. But an export has to stay intelligible after the source has
+  # moved on, so the first time a revision is offered or captured its compiled
+  # form is written here and never changed. An event points at the revision it
+  # was captured under, so a receipt explains itself without a checkout of the
+  # application at the right commit.
+  #
+  # The revision digest covers declared structure and copy. Host callables —
+  # subject fingerprints, protected-outcome recorders — are recorded as present
+  # rather than serialized, because a lambda's body cannot be canonicalized.
+  # That boundary is stated in the receipt rather than papered over.
+  class PolicyRevision < ApplicationRecord
+    self.table_name = "clickwrap_policy_revisions"
+
+    has_many :events,
+             class_name: "Clickwrap::Event",
+             foreign_key: :policy_revision_id,
+             inverse_of: :policy_revision,
+             dependent: :restrict_with_error
+
+    has_many :presentations,
+             class_name: "Clickwrap::Presentation",
+             foreign_key: :policy_revision_id,
+             inverse_of: :policy_revision,
+             dependent: :restrict_with_error
+
+    validates :policy_key, :revision_digest, :canonical_schema_version, :gem_version, presence: true
+    validates :revision_digest, uniqueness: { scope: :policy_key }
+
+    before_update :refuse_change
+
+    scope :for_policy, ->(key) { where(policy_key: key.to_s) }
+
+    # Finds or freezes the revision for a compiled policy. Called on the first
+    # presentation and again at capture; both are races that the unique index
+    # settles, so a lost race just reads the row the winner wrote.
+    def self.freeze_for(policy)
+      existing = find_by(policy_key: policy.key, revision_digest: policy.revision)
+      return existing if existing
+
+      create!(
+        policy_key: policy.key,
+        revision_digest: policy.revision,
+        compiled_snapshot: policy.snapshot,
+        retention_class_key: policy.retention_class_key,
+        canonical_schema_version: Clickwrap::CANONICAL_SCHEMA_VERSION,
+        gem_version: Clickwrap::VERSION,
+        compiled_at: Clickwrap.now,
+        created_at: Clickwrap.now
+      )
+    rescue ActiveRecord::RecordNotUnique
+      find_by!(policy_key: policy.key, revision_digest: policy.revision)
+    end
+
+    # Freezes the semantics of a legacy mapping without pretending the old act
+    # used the policy revision loaded today. The snapshot names only what the
+    # importer actually knows: source, mapped statements, known facts, and
+    # unknown facts. It intentionally cannot match `policy.revision`, so
+    # `require_current_revision: true` always asks for a modern presentation.
+    def self.freeze_legacy_import_for(policy, source:, statements:, known:, unknown:)
+      snapshot = {
+        "schema" => Clickwrap::CANONICAL_SCHEMA_VERSION,
+        "policy" => policy.key,
+        "revision_kind" => "legacy_import_mapping",
+        "source" => source.presence,
+        "statements" => statements.map { |statement| { "key" => statement.key, "kind" => statement.kind } },
+        "known" => known,
+        "unknown" => unknown,
+        "retention_class" => policy.retention_class_key
+      }.compact
+      digest = Digest.digest_canonical(snapshot)
+      existing = find_by(policy_key: policy.key, revision_digest: digest)
+      return existing if existing
+
+      create!(
+        policy_key: policy.key,
+        revision_digest: digest,
+        compiled_snapshot: snapshot,
+        retention_class_key: policy.retention_class_key,
+        canonical_schema_version: Clickwrap::CANONICAL_SCHEMA_VERSION,
+        gem_version: Clickwrap::VERSION,
+        compiled_at: Clickwrap.now,
+        created_at: Clickwrap.now
+      )
+    rescue ActiveRecord::RecordNotUnique
+      find_by!(policy_key: policy.key, revision_digest: digest)
+    end
+
+    # True when the currently loaded policy compiles to this same revision. A
+    # false is not an error — it means the policy has been edited since, which
+    # is exactly why the snapshot is here.
+    def matches_loaded_policy?
+      Clickwrap.policies[policy_key]&.revision == revision_digest
+    end
+
+    def statement_snapshot(statement_key)
+      Array(compiled_snapshot["statements"]).find { |s| s["key"] == statement_key.to_s }
+    end
+
+    def to_s = "#{policy_key}@#{revision_digest}"
+
+    private
+
+    def refuse_change
+      raise EventWriteFailed,
+            "Policy revision #{self} is frozen. Editing the policy in Ruby produces a new " \
+            "revision; it does not change what earlier events were captured under."
+    end
+  end
+end

data/lib/clickwrap/models/presentation.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Clickwrap
+  # A record of one presentation manifest.
+  #
+  # Most presentations never become rows. The default path signs the manifest
+  # into a short-lived token and writes nothing on GET, because a render is not
+  # evidence and a row per page view is both slower and more personal data than
+  # the job needs.
+  #
+  # Rows appear in two cases. A policy can explicitly retain pre-submit
+  # presentations for a documented reason, which some high-assurance flows want
+  # so that display attempts are visible. And every successful capture persists
+  # the manifest it accepted, because that one is part of the evidence.
+  #
+  # The `state` vocabulary is deliberately careful. `presented_by_server` means
+  # the server generated and offered this manifest — not that anyone saw it, not
+  # that anyone read it, and certainly not that anyone accepted it.
+  class Presentation < ApplicationRecord
+    self.table_name = "clickwrap_presentations"
+
+    STATES = %w[presented_by_server accepted rejected expired].freeze
+
+    belongs_to :policy_revision, class_name: "Clickwrap::PolicyRevision", inverse_of: :presentations
+    belongs_to :actor, polymorphic: true, optional: true
+    belongs_to :subject, polymorphic: true, optional: true
+    belongs_to :represented_party, polymorphic: true, optional: true
+
+    has_many :events,
+             class_name: "Clickwrap::Event",
+             foreign_key: :presentation_id,
+             inverse_of: :presentation,
+             dependent: :restrict_with_error
+
+    validates :policy_key, :nonce, :manifest_digest, :issued_at, :expires_at, presence: true
+    validates :nonce, uniqueness: true
+    validates :state, inclusion: { in: STATES }
+    validates :capture_channel, inclusion: { in: Vocabulary::CAPTURE_CHANNELS }
+
+    scope :pending, -> { where(state: "presented_by_server") }
+    scope :expired_at, ->(moment = Clickwrap.now) { where(expires_at: ..moment) }
+    scope :due_for_disposition, lambda { |at = Clickwrap.now|
+      where.not(retain_until: nil).where(retain_until: ..at)
+    }
+
+    def expired?(at = Clickwrap.now) = expires_at <= at
+    def accepted? = state == "accepted"
+
+    def mark_accepted!(at: Clickwrap.now)
+      update!(state: "accepted", submitted_at: at)
+    end
+
+    def mark_rejected!(at: Clickwrap.now)
+      update!(state: "rejected", submitted_at: at)
+    end
+
+    def to_s = "presentation #{nonce} for #{policy_key}"
+  end
+end