@absolutejs/auth 0.28.0 → 0.29.0-beta.1

package/dist/oidc/config.d.ts

@@ -1,6 +1,6 @@
 import type { RouteString } from '../types';
 import { type SigningKey } from './keys';
-import type { AuthorizationCodeStore, DeviceAuthorizationStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const DEFAULT_OIDC_ROUTE: RouteString;
 export type OidcProviderConfig<UserType> = {
     accessTokenTtlMs?: number;
@@ -28,6 +28,7 @@ export type OidcProviderConfig<UserType> = {
     idTokenTtlMs?: number;
     issuer: string;
     loginUrl?: string;
+    logoutDeliveryStore?: LogoutDeliveryStore;
     oidcRoute?: RouteString;
     refreshTokenStore: OidcRefreshTokenStore;
     refreshTokenTtlMs?: number;

package/dist/oidc/inMemoryStores.d.ts

@@ -1,5 +1,6 @@
-import type { AuthorizationCodeStore, DeviceAuthorizationStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClient, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const createInMemoryAuthorizationCodeStore: () => AuthorizationCodeStore;
 export declare const createInMemoryDeviceAuthorizationStore: () => DeviceAuthorizationStore;
+export declare const createInMemoryLogoutDeliveryStore: () => LogoutDeliveryStore;
 export declare const createInMemoryOAuthClientStore: (clients: OAuthClient[]) => OAuthClientStore;
 export declare const createInMemoryOidcRefreshTokenStore: () => OidcRefreshTokenStore;

package/dist/oidc/logout.d.ts

@@ -0,0 +1,38 @@
+import type { OidcProviderConfig } from './config';
+import type { LogoutDelivery, OAuthClient } from './types';
+export declare const resolvePostLogoutRedirect: ({ client, requestedUri }: {
+    client: OAuthClient;
+    requestedUri: string | undefined;
+}) => string | undefined;
+export declare const verifyIdTokenHint: <UserType>({ config, idTokenHint }: {
+    config: OidcProviderConfig<UserType>;
+    idTokenHint: string;
+}) => Promise<{
+    audClientId: any;
+    sub: any;
+} | undefined>;
+type DeliveryFetch = (url: string, init: {
+    body: string;
+    headers: Record<string, string>;
+    method: string;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+}>;
+export declare const mintLogoutToken: <UserType>({ clientId, config, now, sub }: {
+    clientId: string;
+    config: OidcProviderConfig<UserType>;
+    now?: number;
+    sub: string;
+}) => Promise<string>;
+export declare const fanOutBackchannelLogout: <UserType>({ config, fetchImpl, now, onError, skipClientId, timeoutMs, userId }: {
+    config: OidcProviderConfig<UserType>;
+    fetchImpl?: DeliveryFetch;
+    now?: number;
+    onError?: (delivery: LogoutDelivery) => void | Promise<void>;
+    skipClientId?: string;
+    timeoutMs?: number;
+    userId: string;
+}) => Promise<string[]>;
+export {};

package/dist/oidc/postgresStores.d.ts

@@ -1,9 +1,28 @@
 import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuthorizationCodeStore, DeviceAuthorizationStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
+import type { AuthorizationCodeStore, DeviceAuthorizationStore, LogoutDeliveryStore, OAuthClientStore, OidcRefreshTokenStore } from './types';
 export declare const oauthClientsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_clients";
     schema: undefined;
     columns: {
+        backchannel_logout_uri: import("drizzle-orm/pg-core").PgColumn<{
+            name: "backchannel_logout_uri";
+            tableName: "auth_oauth_clients";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 2048;
+        }>;
         client_id: import("drizzle-orm/pg-core").PgColumn<{
             name: "client_id";
             tableName: "auth_oauth_clients";
@@ -61,6 +80,49 @@ export declare const oauthClientsTable: import("drizzle-orm/pg-core").PgTableWit
         }, {}, {
             length: 255;
         }>;
+        post_logout_redirect_uris: import("drizzle-orm/pg-core").PgColumn<{
+            name: "post_logout_redirect_uris";
+            tableName: "auth_oauth_clients";
+            dataType: "array";
+            columnType: "PgArray";
+            data: string[];
+            driverParam: string | string[];
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: import("drizzle-orm").Column<{
+                name: "post_logout_redirect_uris";
+                tableName: "auth_oauth_clients";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            baseBuilder: import("drizzle-orm/pg-core").PgColumnBuilder<{
+                name: "post_logout_redirect_uris";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                enumValues: [string, ...string[]];
+                driverParam: string;
+            }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
+            size: undefined;
+        }>;
         redirect_uris: import("drizzle-orm/pg-core").PgColumn<{
             name: "redirect_uris";
             tableName: "auth_oauth_clients";
@@ -582,6 +644,174 @@ export declare const oauthDeviceAuthorizationsTable: import("drizzle-orm/pg-core
     };
     dialect: "pg";
 }>;
+export declare const oauthLogoutDeliveriesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_oauth_logout_deliveries";
+    schema: undefined;
+    columns: {
+        attempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempts";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        client_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "client_id";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        endpoint_url: import("drizzle-orm/pg-core").PgColumn<{
+            name: "endpoint_url";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 2048;
+        }>;
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        last_error: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_error";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        last_status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_status";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        logout_token: import("drizzle-orm/pg-core").PgColumn<{
+            name: "logout_token";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        user_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "auth_oauth_logout_deliveries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "auth_oauth_refresh_tokens";
     schema: undefined;
@@ -763,9 +993,11 @@ export declare const oauthRefreshTokensTable: import("drizzle-orm/pg-core").PgTa
 }>;
 export declare const createNeonAuthorizationCodeStore: (databaseUrl: string) => AuthorizationCodeStore;
 export declare const createNeonDeviceAuthorizationStore: (databaseUrl: string) => DeviceAuthorizationStore;
+export declare const createNeonLogoutDeliveryStore: (databaseUrl: string) => LogoutDeliveryStore;
 export declare const createNeonOAuthClientStore: (databaseUrl: string) => OAuthClientStore;
 export declare const createNeonOidcRefreshTokenStore: (databaseUrl: string) => OidcRefreshTokenStore;
 export declare const createPostgresAuthorizationCodeStore: (db: AnyPgDatabase) => AuthorizationCodeStore;
 export declare const createPostgresDeviceAuthorizationStore: (db: AnyPgDatabase) => DeviceAuthorizationStore;
+export declare const createPostgresLogoutDeliveryStore: (db: AnyPgDatabase) => LogoutDeliveryStore;
 export declare const createPostgresOAuthClientStore: (db: AnyPgDatabase) => OAuthClientStore;
 export declare const createPostgresOidcRefreshTokenStore: (db: AnyPgDatabase) => OidcRefreshTokenStore;

package/dist/oidc/routes.d.ts

@@ -193,6 +193,58 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
             };
         };
     };
+} & {
+    [x: string]: {
+        get: {
+            body: unknown;
+            params: {};
+            query: {
+                client_id?: string | undefined;
+                state?: string | undefined;
+                id_token_hint?: string | undefined;
+                post_logout_redirect_uri?: string | undefined;
+            };
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
+} & {
+    [x: string]: {
+        post: {
+            body: {
+                client_id?: string | undefined;
+                state?: string | undefined;
+                id_token_hint?: string | undefined;
+                post_logout_redirect_uri?: string | undefined;
+            };
+            params: {};
+            query: unknown;
+            headers: unknown;
+            response: {
+                200: Response;
+                422: {
+                    type: "validation";
+                    on: string;
+                    summary?: string;
+                    message?: string;
+                    found?: unknown;
+                    property?: string;
+                    expected?: string;
+                };
+            };
+        };
+    };
 } & {
     [x: string]: {
         get: {
@@ -224,7 +276,7 @@ export declare const oidcProviderRoutes: <UserType>(config: OidcProviderConfig<U
                 query: unknown;
                 headers: unknown;
                 response: {
-                    200: Record<string, string | string[]>;
+                    200: Record<string, string | boolean | string[]>;
                 };
             };
         };

package/dist/oidc/types.d.ts

@@ -1,7 +1,9 @@
 export type OAuthClient = {
+    backchannelLogoutUri?: string;
     clientId: string;
     hashedSecret?: string;
     name: string;
+    postLogoutRedirectUris?: string[];
     redirectUris: string[];
     scopes: string[];
 };
@@ -39,6 +41,7 @@ export type OidcRefreshTokenStore = {
     consumeToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
     deleteForUser: (userId: string) => Promise<void>;
     getToken: (tokenHash: string) => Promise<OidcRefreshToken | undefined>;
+    listClientIdsForUser: (userId: string) => Promise<string[]>;
     saveToken: (token: OidcRefreshToken) => Promise<void>;
 };
 export type DeviceAuthorizationStatus = 'approved' | 'denied' | 'pending';
@@ -53,6 +56,22 @@ export type DeviceAuthorization = {
     userCode: string;
     userSub?: string;
 };
+export type LogoutDelivery = {
+    attempts: number;
+    clientId: string;
+    createdAt: number;
+    endpointUrl: string;
+    id: string;
+    lastError?: string;
+    lastStatus?: number;
+    logoutToken: string;
+    userId: string;
+};
+export type LogoutDeliveryStore = {
+    listFailed: (limit?: number) => Promise<LogoutDelivery[]>;
+    recordFailure: (delivery: LogoutDelivery) => Promise<void>;
+    removeFailure: (deliveryId: string) => Promise<void>;
+};
 export type DeviceAuthorizationStore = {
     deleteByDeviceCodeHash: (deviceCodeHash: string) => Promise<void>;
     findByDeviceCodeHash: (deviceCodeHash: string) => Promise<DeviceAuthorization | undefined>;

package/dist/webhooks/config.d.ts

@@ -1,5 +1,15 @@
-import type { WebhookEndpoint, WebhookEvent } from './types';
+import type { WebhookDeliveryStore, WebhookEndpoint, WebhookEvent } from './types';
+export declare const DEFAULT_WEBHOOK_RETRY: {
+    readonly attempts: 3;
+    readonly backoffMultiplier: 2;
+    readonly initialDelayMs: 1000;
+};
 export declare const DEFAULT_WEBHOOK_TIMEOUT_MS: number;
+export type WebhookRetryConfig = {
+    attempts?: number;
+    backoffMultiplier?: number;
+    initialDelayMs?: number;
+};
 export type WebhookFetch = (url: string, init: {
     body: string;
     headers: Record<string, string>;
@@ -10,6 +20,7 @@ export type WebhookFetch = (url: string, init: {
     status: number;
 }>;
 export type WebhooksConfig = {
+    deliveryStore?: WebhookDeliveryStore;
     endpoints: WebhookEndpoint[];
     fetch?: WebhookFetch;
     onDeliveryError?: (context: {
@@ -17,5 +28,7 @@ export type WebhooksConfig = {
         error: unknown;
         event: WebhookEvent;
     }) => void | Promise<void>;
+    retry?: WebhookRetryConfig;
+    sleep?: (ms: number) => Promise<void>;
     timeoutMs?: number;
 };

package/dist/webhooks/dispatcher.d.ts

@@ -1,3 +1,3 @@
 import type { AuditEvent } from '../audit/types';
 import { type WebhooksConfig } from './config';
-export declare const createWebhookDispatcher: ({ endpoints, fetch: fetchImpl, onDeliveryError, timeoutMs }: WebhooksConfig) => (event: AuditEvent) => Promise<void>;
+export declare const createWebhookDispatcher: ({ deliveryStore, endpoints, fetch: fetchImpl, onDeliveryError, retry, sleep, timeoutMs }: WebhooksConfig) => (event: AuditEvent) => Promise<void>;

package/dist/webhooks/inMemoryStore.d.ts

@@ -0,0 +1,2 @@
+import type { WebhookDeliveryStore } from './types';
+export declare const createInMemoryWebhookDeliveryStore: () => WebhookDeliveryStore;

package/dist/webhooks/postgresStore.d.ts

@@ -0,0 +1,136 @@
+import { type AnyPgDatabase } from '../stores/postgres';
+import type { WebhookDeliveryStore, WebhookEvent } from './types';
+export declare const webhookDeliveriesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "auth_webhook_deliveries";
+    schema: undefined;
+    columns: {
+        attempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempts";
+            tableName: "auth_webhook_deliveries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        created_at_ms: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at_ms";
+            tableName: "auth_webhook_deliveries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        endpoint_url: import("drizzle-orm/pg-core").PgColumn<{
+            name: "endpoint_url";
+            tableName: "auth_webhook_deliveries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 2048;
+        }>;
+        envelope_id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "envelope_id";
+            tableName: "auth_webhook_deliveries";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        envelope_json: import("drizzle-orm/pg-core").PgColumn<{
+            name: "envelope_json";
+            tableName: "auth_webhook_deliveries";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: WebhookEvent;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: WebhookEvent;
+        }>;
+        last_error: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_error";
+            tableName: "auth_webhook_deliveries";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        last_status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_status";
+            tableName: "auth_webhook_deliveries";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const createNeonWebhookDeliveryStore: (databaseUrl: string) => WebhookDeliveryStore;
+export declare const createPostgresWebhookDeliveryStore: (db: AnyPgDatabase) => WebhookDeliveryStore;

package/dist/webhooks/types.d.ts

@@ -1,5 +1,6 @@
 import type { AuditEvent, AuditEventType } from '../audit/types';
 export type WebhookEndpoint = {
+    events?: readonly AuditEventType[];
     secret: string;
     url: string;
 };
@@ -9,3 +10,16 @@ export type WebhookEvent = {
     id: string;
     type: AuditEventType;
 };
+export type WebhookDelivery = {
+    attempts: number;
+    createdAt: number;
+    endpointUrl: string;
+    envelope: WebhookEvent;
+    lastError?: string;
+    lastStatus?: number;
+};
+export type WebhookDeliveryStore = {
+    listFailed: (limit?: number) => Promise<WebhookDelivery[]>;
+    recordFailure: (delivery: WebhookDelivery) => Promise<void>;
+    removeFailure: (envelopeId: string) => Promise<void>;
+};

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.28.0",
+	"version": "0.29.0-beta.1",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {