@aifabrix/builder 2.53.0 → 2.54.1

package/lib/channels/microsoft-provisioning/auth-config.js

@@ -0,0 +1,240 @@
+/**
+ * Create or reuse Teams Entra SSO auth-config via Agents Toolkit oauth/register.
+ *
+ * @fileoverview Capture auth-config id without operators pasting the CLI flag
+ */
+
+'use strict';
+
+const path = require('path');
+const crypto = require('crypto');
+const os = require('os');
+const fs = require('../../internal/fs-real-sync');
+const { AUTH_CONFIG_ENV_KEY, APP_ID_URI_ENV_KEY, TENANT_GUID_RE } = require('./constants');
+const {
+  wrapToolkitError,
+  missingCopilotCaptureInputsError,
+  missingMicrosoftTenantError
+} = require('./errors');
+const { ensureMicrosoftSession } = require('./auth');
+const { runAtk } = require('./cli');
+const {
+  readProvisioningState,
+  writeProvisioningState,
+  isReusableAuthConfig
+} = require('./persist');
+
+/**
+ * @param {string} environment
+ * @returns {string}
+ */
+function stableTeamsAppId(environment) {
+  const digest = crypto
+    .createHash('sha1')
+    .update(`aifabrix-copilot:${environment || 'dev'}`)
+    .digest('hex');
+  return `${digest.slice(0, 8)}-${digest.slice(8, 12)}-4${digest.slice(13, 16)}-a${digest.slice(17, 20)}-${digest.slice(20, 32)}`;
+}
+
+/**
+ * @param {string|null|undefined} value
+ * @returns {string|null}
+ */
+function resolveTeamsAppId(value) {
+  const raw = typeof value === 'string' ? value.trim() : '';
+  if (!raw) {
+    return null;
+  }
+  const match = raw.match(TENANT_GUID_RE);
+  return match ? match[0] : null;
+}
+
+/**
+ * Packaged manifest id when known; otherwise a stable per-environment fallback.
+ * @param {Object} inputs
+ * @returns {string}
+ */
+function teamsAppIdForRegister(inputs) {
+  return resolveTeamsAppId(inputs.teamsAppId) || stableTeamsAppId(inputs.environment);
+}
+
+/**
+ * @param {Object} params
+ * @returns {string}
+ */
+function buildOauthRegisterYaml(params) {
+  const name = params.registrationName || 'aifabrix-runtime-mcp-sso';
+  const specificApp = Boolean(resolveTeamsAppId(params.teamsAppId));
+  return [
+    '# yaml-language-server: $schema=https://aka.ms/m365-agents-toolkit/v1.9/yaml.schema.json',
+    'version: v1.9',
+    'provision:',
+    '  - uses: oauth/register',
+    '    with:',
+    `      name: ${JSON.stringify(name)}`,
+    '      flow: authorizationCode',
+    '      appId: ${{TEAMS_APP_ID}}',
+    '      clientId: ${{AAD_APP_CLIENT_ID}}',
+    '      identityProvider: MicrosoftEntra',
+    '      baseUrl: ${{MCP_SERVER_URL}}',
+    `      applicableToApps: ${specificApp ? 'SpecificApp' : 'AnyApp'}`,
+    '      targetAudience: HomeTenant',
+    '    writeToEnvironmentFile:',
+    `      configurationId: ${AUTH_CONFIG_ENV_KEY}`,
+    `      applicationIdUri: ${APP_ID_URI_ENV_KEY}`,
+    ''
+  ].join('\n');
+}
+
+/**
+ * @param {string} content
+ * @param {string} key
+ * @returns {string|null}
+ */
+function readEnvValue(content, key) {
+  const match = String(content || '').match(new RegExp(`^${key}\\s*=\\s*(.*)$`, 'm'));
+  if (!match) {
+    return null;
+  }
+  return match[1].trim().replace(/^['"]|['"]$/g, '') || null;
+}
+
+/**
+ * @param {Object} inputs
+ * @returns {string}
+ */
+function writeToolkitProject(inputs) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'aifabrix-atk-oauth-'));
+  const envDir = path.join(dir, 'env');
+  fs.mkdirSync(envDir, { recursive: true });
+  fs.writeFileSync(path.join(dir, 'm365agents.yml'), buildOauthRegisterYaml(inputs), 'utf8');
+  const prior = inputs.priorAuthConfigId ? `${AUTH_CONFIG_ENV_KEY}=${inputs.priorAuthConfigId}\n` : '';
+  const envBody =
+    `TEAMSFX_ENV=dev\nTEAMS_APP_ID=${teamsAppIdForRegister(inputs)}\n` +
+    `AAD_APP_CLIENT_ID=${inputs.clientId}\nMCP_SERVER_URL=${inputs.mcpServerUrl}\n` +
+    `${prior}${APP_ID_URI_ENV_KEY}=\n`;
+  fs.writeFileSync(path.join(envDir, '.env.dev'), envBody, 'utf8');
+  return dir;
+}
+
+/**
+ * @param {Object} params
+ * @returns {Object|null}
+ */
+function resolveCaptureInputs(params) {
+  const clientId =
+    typeof params.clientId === 'string' && params.clientId.trim() ? params.clientId.trim() : null;
+  const mcpServerUrl =
+    typeof params.mcpServerUrl === 'string' && params.mcpServerUrl.trim()
+      ? params.mcpServerUrl.trim()
+      : null;
+  const tenantId =
+    typeof params.expectedTenantId === 'string' && params.expectedTenantId.trim()
+      ? params.expectedTenantId.trim()
+      : null;
+  if (!clientId || !mcpServerUrl) {
+    return null;
+  }
+  return {
+    clientId,
+    mcpServerUrl,
+    tenantId,
+    environment: params.environment || 'dev',
+    projectRoot: params.projectRoot || process.cwd(),
+    registrationName: params.registrationName,
+    teamsAppId: resolveTeamsAppId(params.teamsAppId)
+  };
+}
+
+/**
+ * @param {string} dir
+ * @returns {{ authConfigId: string|null, applicationIdUri: string|null }}
+ */
+function readToolkitOutputs(dir) {
+  const envPath = path.join(dir, 'env', '.env.dev');
+  const content = fs.existsSync(envPath) ? fs.readFileSync(envPath, 'utf8') : '';
+  return {
+    authConfigId: readEnvValue(content, AUTH_CONFIG_ENV_KEY),
+    applicationIdUri: readEnvValue(content, APP_ID_URI_ENV_KEY)
+  };
+}
+
+/**
+ * @param {Object} inputs
+ * @param {Object} session
+ * @param {Object} deps
+ * @returns {Promise<{ authConfigId: string, applicationIdUri: string|null }>}
+ */
+async function provisionAuthConfig(inputs, session, deps) {
+  const dir = writeToolkitProject(inputs);
+  try {
+    await runAtk(
+      session.binary,
+      ['provision', '--env', 'dev', '--interactive', 'false'],
+      { cwd: dir },
+      deps
+    );
+    const output = readToolkitOutputs(dir);
+    if (!output.authConfigId) {
+      throw wrapToolkitError(new Error('oauth/register did not write a configuration id'));
+    }
+    return output;
+  } catch (error) {
+    if (error && error.code === 'TOOLKIT') {
+      throw error;
+    }
+    throw wrapToolkitError(error);
+  } finally {
+    try {
+      fs.rmSync(dir, { recursive: true, force: true });
+    } catch {
+      // temp workspace is best-effort
+    }
+  }
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} [deps]
+ * @returns {Promise<{ authConfigId: string, applicationIdUri: string|null }|null>}
+ */
+async function captureCopilotAuthConfigId(params, deps = {}) {
+  const inputs = resolveCaptureInputs(params);
+  if (!inputs) {
+    throw missingCopilotCaptureInputsError(params);
+  }
+  const persisted = readProvisioningState(inputs.projectRoot);
+  if (isReusableAuthConfig(persisted, inputs)) {
+    return {
+      authConfigId: persisted.authConfigId,
+      applicationIdUri: persisted.applicationIdUri || null
+    };
+  }
+  const session = await ensureMicrosoftSession(inputs.tenantId, deps);
+  if (!session) {
+    return null;
+  }
+  if (!session.tenantId) {
+    throw missingMicrosoftTenantError();
+  }
+  const created = await provisionAuthConfig(inputs, session, deps);
+  writeProvisioningState(inputs.projectRoot, {
+    environment: inputs.environment,
+    tenantId: inputs.tenantId || session.tenantId,
+    mcpServerUrl: inputs.mcpServerUrl,
+    teamsAppId: teamsAppIdForRegister(inputs),
+    authConfigId: created.authConfigId,
+    applicationIdUri: created.applicationIdUri
+  });
+  return created;
+}
+
+module.exports = {
+  stableTeamsAppId,
+  resolveTeamsAppId,
+  teamsAppIdForRegister,
+  buildOauthRegisterYaml,
+  readEnvValue,
+  resolveCaptureInputs,
+  captureCopilotAuthConfigId
+};

package/lib/channels/microsoft-provisioning/auth.js

@@ -0,0 +1,179 @@
+/**
+ * Microsoft 365 session + Entra tenant check via Agents Toolkit CLI.
+ *
+ * @fileoverview Interactive login when required; never persist Microsoft tokens
+ */
+
+'use strict';
+
+const { spawn } = require('child_process');
+const path = require('path');
+const fs = require('../../internal/fs-real-sync');
+const { TENANT_GUID_RE, ATK_ACCOUNT_NAME } = require('./constants');
+const { microsoftProvisioningError, wrongTenantError, missingMicrosoftTenantError } = require('./errors');
+const { resolveAtkBinary, runAtk, shouldSkipLiveToolkit } = require('./cli');
+const { atkWritableHome, atkInstallEnv } = require('./install-atk');
+
+/**
+ * @param {string} text
+ * @returns {string|null}
+ */
+function extractTenantId(text) {
+  if (typeof text !== 'string' || !text.trim()) {
+    return null;
+  }
+  const trimmed = text.trim();
+  try {
+    const parsed = JSON.parse(trimmed);
+    const fromJson = tenantFromUnknown(parsed);
+    if (fromJson) {
+      return fromJson;
+    }
+  } catch {
+    // fall through to regex / labelled text
+  }
+  const labelled = trimmed.match(/tenantId["'\s:=]+([0-9a-f-]{36})/i);
+  if (labelled) {
+    return labelled[1].toLowerCase();
+  }
+  const match = trimmed.match(TENANT_GUID_RE);
+  return match ? match[0].toLowerCase() : null;
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string|null}
+ */
+function tenantFromUnknown(value) {
+  if (!value) {
+    return null;
+  }
+  if (typeof value === 'string') {
+    return extractTenantId(value);
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const found = tenantFromUnknown(item);
+      if (found) {
+        return found;
+      }
+    }
+    return null;
+  }
+  if (typeof value === 'object' && typeof value.tenantId === 'string') {
+    return extractTenantId(value.tenantId);
+  }
+  return null;
+}
+
+/**
+ * @param {string} expected
+ * @param {string} actual
+ * @returns {void}
+ */
+function assertExpectedTenant(expected, actual) {
+  if (!expected) {
+    return;
+  }
+  if (!actual) {
+    throw microsoftProvisioningError(
+      'Could not determine the signed-in Microsoft tenant. Run: atk auth login m365',
+      'TENANT'
+    );
+  }
+  if (String(expected).toLowerCase() !== String(actual).toLowerCase()) {
+    throw wrongTenantError(expected, actual);
+  }
+}
+
+/**
+ * @param {string} bin
+ * @param {Object} [deps]
+ * @returns {Promise<void>}
+ */
+function loginM365(bin, deps = {}) {
+  if (typeof deps.loginImpl === 'function') {
+    return deps.loginImpl(bin);
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin, ['auth', 'login', 'm365'], {
+      stdio: 'inherit',
+      env: process.env
+    });
+    child.on('error', reject);
+    child.on('close', (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+      reject(new Error(`Microsoft login exited with code ${code}`));
+    });
+  });
+}
+
+/**
+ * Toolkit `auth list` often prints only the account email. Device-code login
+ * writes tenantId.cache.appStudio — use that when the CLI omits the GUID.
+ * @param {Object} [deps]
+ * @returns {string|null}
+ */
+function readCachedAppStudioTenantId(deps = {}) {
+  const filePath = path.join(
+    atkWritableHome(atkInstallEnv(deps.env || process.env)),
+    '.fx',
+    'account',
+    `tenantId.cache.${ATK_ACCOUNT_NAME}`
+  );
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  return extractTenantId(fs.readFileSync(filePath, 'utf8'));
+}
+
+/**
+ * @param {{ stdout?: string, stderr?: string }} listed
+ * @param {Object} [deps]
+ * @returns {string|null}
+ */
+function tenantIdFromListOrCache(listed, deps) {
+  const fromList = extractTenantId(`${listed.stdout}\n${listed.stderr}`);
+  return fromList || readCachedAppStudioTenantId(deps);
+}
+
+/**
+ * @param {string} expectedTenant
+ * @param {Object} [deps]
+ * @returns {Promise<{ binary: string, tenantId: string }|null>}
+ */
+async function ensureMicrosoftSession(expectedTenant, deps = {}) {
+  if (shouldSkipLiveToolkit(deps) && !deps.atkBinary && !deps.execFile) {
+    return null;
+  }
+  const binary = await resolveAtkBinary(deps);
+  if (!binary) {
+    return null;
+  }
+  let listed = await runAtk(binary, ['auth', 'list'], {}, deps);
+  let tenantId = tenantIdFromListOrCache(listed, deps);
+  if (!tenantId && process.stdin.isTTY) {
+    await loginM365(binary, deps);
+    listed = await runAtk(binary, ['auth', 'list'], {}, deps);
+    tenantId = tenantIdFromListOrCache(listed, deps);
+  }
+  if (!tenantId) {
+    tenantId = extractTenantId(expectedTenant);
+  }
+  if (!tenantId) {
+    throw missingMicrosoftTenantError();
+  }
+  assertExpectedTenant(expectedTenant, tenantId);
+  return { binary, tenantId };
+}
+
+module.exports = {
+  extractTenantId,
+  assertExpectedTenant,
+  loginM365,
+  ensureMicrosoftSession,
+  readCachedAppStudioTenantId
+};

package/lib/channels/microsoft-provisioning/cli.js

@@ -0,0 +1,71 @@
+/**
+ * Spawn Microsoft 365 Agents Toolkit (`atk` / `teamsapp`) without scattering argv.
+ *
+ * @fileoverview Documented CLI only; skipped under Jest unless deps allow it
+ */
+
+'use strict';
+
+const { promisify } = require('util');
+const execFileDefault = promisify(require('child_process').execFile);
+const { findOrInstallAtkBinary, atkInstallEnv } = require('./install-atk');
+
+/**
+ * @returns {boolean}
+ */
+function isJestWorker() {
+  return Boolean(process.env.JEST_WORKER_ID);
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {boolean}
+ */
+function shouldSkipLiveToolkit(deps = {}) {
+  if (deps.allowInTests === true) {
+    return false;
+  }
+  return isJestWorker();
+}
+
+/**
+ * @param {Object} [deps]
+ * @returns {Promise<string|null>}
+ */
+async function resolveAtkBinary(deps = {}) {
+  if (typeof deps.atkBinary === 'string' && deps.atkBinary.trim()) {
+    return deps.atkBinary.trim();
+  }
+  if (shouldSkipLiveToolkit(deps)) {
+    return null;
+  }
+  return findOrInstallAtkBinary(deps);
+}
+
+/**
+ * @param {string} bin
+ * @param {string[]} args
+ * @param {Object} [opts]
+ * @param {Object} [deps]
+ * @returns {Promise<{ stdout: string, stderr: string }>}
+ */
+async function runAtk(bin, args, opts = {}, deps = {}) {
+  const execFileImpl = deps.execFile || execFileDefault;
+  const result = await execFileImpl(bin, args, {
+    cwd: opts.cwd,
+    env: atkInstallEnv(opts.env || deps.env || process.env),
+    timeout: opts.timeout || 180000,
+    maxBuffer: 2 * 1024 * 1024
+  });
+  return {
+    stdout: result && result.stdout ? String(result.stdout) : '',
+    stderr: result && result.stderr ? String(result.stderr) : ''
+  };
+}
+
+module.exports = {
+  isJestWorker,
+  shouldSkipLiveToolkit,
+  resolveAtkBinary,
+  runAtk
+};

package/lib/channels/microsoft-provisioning/constants.js

@@ -0,0 +1,75 @@
+/**
+ * Microsoft provisioning constants (Agents Toolkit + Agent 365 preview).
+ *
+ * @fileoverview Shared keys and filenames — no Microsoft tokens
+ */
+
+'use strict';
+
+const STATE_KIND = 'microsoft-copilot-entra-sso';
+const STATE_FILE = 'provisioning-state.json';
+const AUTH_CONFIG_ENV_KEY = 'AIFABRIX_SSO_AUTH_ID';
+const APP_ID_URI_ENV_KEY = 'AIFABRIX_SSO_APP_ID_URI';
+const ATK_BINARIES = ['atk', 'teamsapp'];
+const ATK_NPM_PACKAGE = '@microsoft/m365agentstoolkit-cli';
+/** Teams Toolkit CLI public client — same id `atk auth login m365` uses. */
+const ATK_M365_CLIENT_ID = '7ea7c24c-b1f6-4a20-9d11-9ae12e9e7ac0';
+const ATK_APP_STUDIO_SCOPE = 'https://dev.teams.microsoft.com/AppDefinitions.ReadWrite';
+const ATK_DEVICE_LOGIN_URL = 'https://microsoft.com/devicelogin';
+const ATK_ACCOUNT_NAME = 'appStudio';
+const TEAMS_BINARIES = ['teams'];
+const TEAMS_BOT_STATE_KIND = 'microsoft-teams-bot';
+const TEAMS_BOT_STATE_FILE = 'provisioning-state.json';
+const TEAMS_CLI_PACKAGE = '@microsoft/teams.cli';
+const TEAMS_OPEN_URL = 'https://teams.microsoft.com';
+const TEAMS_ADMIN_APPS_URL = 'https://admin.teams.microsoft.com/policies/manage-apps';
+const KV_TEAMS_BOT_APP_ID = 'teams-bot/botAppId';
+const KV_TEAMS_BOT_APP_SECRET = 'teams-bot/botAppSecret';
+const TEAMS_POLICY_REMAINING =
+  'Approve custom app upload / org publish if tenant policy requires it';
+const TEAMS_CLI_MISSING_REMAINING = [
+  `Install Teams Developer CLI (${TEAMS_CLI_PACKAGE}) and run teams login`,
+  'Re-run aifabrix channel add teams-bot'
+];
+const TENANT_GUID_RE =
+  /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+const SECRET_KEY_RE = /(access|refresh)?token|clientsecret|password|secret/i;
+
+const AGENT365_CHECKPOINT = Object.freeze({
+  preview: true,
+  byoMcpRegisterCli: true,
+  declarativeAgentsSupported: false,
+  republishSupported: false,
+  adminApprovalRequired: true,
+  copilotStudioApiAttach: false,
+  reason:
+    'Agent 365 BYO MCP is preview. Declarative Agents are not a supported BYO client. ' +
+    'Republish of a registered remote MCP is not supported. Admin approval remains. ' +
+    'Copilot Studio attach is pick-from-registry UI, not an API.'
+});
+
+module.exports = {
+  STATE_KIND,
+  STATE_FILE,
+  AUTH_CONFIG_ENV_KEY,
+  APP_ID_URI_ENV_KEY,
+  ATK_BINARIES,
+  ATK_NPM_PACKAGE,
+  ATK_M365_CLIENT_ID,
+  ATK_APP_STUDIO_SCOPE,
+  ATK_DEVICE_LOGIN_URL,
+  ATK_ACCOUNT_NAME,
+  TEAMS_BINARIES,
+  TEAMS_BOT_STATE_KIND,
+  TEAMS_BOT_STATE_FILE,
+  TEAMS_CLI_PACKAGE,
+  TEAMS_OPEN_URL,
+  TEAMS_ADMIN_APPS_URL,
+  KV_TEAMS_BOT_APP_ID,
+  KV_TEAMS_BOT_APP_SECRET,
+  TEAMS_POLICY_REMAINING,
+  TEAMS_CLI_MISSING_REMAINING,
+  TENANT_GUID_RE,
+  SECRET_KEY_RE,
+  AGENT365_CHECKPOINT
+};

package/lib/channels/microsoft-provisioning/errors.js

@@ -0,0 +1,117 @@
+/**
+ * Normalize Microsoft provisioning failures for Copilot / Teams Bot.
+ *
+ * @fileoverview User-facing errors without toolkit internals or tokens
+ */
+
+'use strict';
+
+/**
+ * @param {string} message
+ * @param {string} [code]
+ * @returns {Error}
+ */
+function microsoftProvisioningError(message, code) {
+  const error = new Error(message);
+  error.code = code || 'MICROSOFT_PROVISIONING';
+  return error;
+}
+
+/**
+ * @param {string} expectedTenant
+ * @param {string} actualTenant
+ * @returns {Error}
+ */
+function wrongTenantError(expectedTenant, actualTenant) {
+  return microsoftProvisioningError(
+    `Signed-in Microsoft tenant "${actualTenant}" does not match the Entra tenant ` +
+      `"${expectedTenant}" configured for this environment.`,
+    'WRONG_TENANT'
+  );
+}
+
+/**
+ * @param {unknown} error
+ * @returns {Error}
+ */
+function wrapToolkitError(error) {
+  const raw = error && error.message ? String(error.message) : String(error);
+  const compact = raw.replace(/\s+/g, ' ').trim().slice(0, 400);
+  return microsoftProvisioningError(
+    `Microsoft 365 Agents Toolkit could not create or read the Entra SSO auth-config. ${compact}`,
+    'TOOLKIT'
+  );
+}
+
+/**
+ * @param {string} [text]
+ * @returns {string}
+ */
+function redactTeamsSecrets(text) {
+  return String(text || '')
+    .replace(/CLIENT_SECRET=\S+/gi, 'CLIENT_SECRET=***')
+    .replace(/clientSecret["'\s:=]+[^\s]+/gi, 'clientSecret=***');
+}
+
+/**
+ * @param {unknown} error
+ * @returns {Error}
+ */
+function wrapTeamsCliError(error) {
+  const raw = error && error.message ? String(error.message) : String(error);
+  const compact = redactTeamsSecrets(raw.replace(/\s+/g, ' ').trim()).slice(0, 400);
+  return microsoftProvisioningError(
+    `Teams Developer CLI could not provision the Azure-managed bot. ${compact}`,
+    'TEAMS_CLI'
+  );
+}
+
+/**
+ * @param {string} expectedEnvironment
+ * @param {string} actualEnvironment
+ * @returns {Error}
+ */
+function wrongEnvironmentRegistrationError(expectedEnvironment, actualEnvironment) {
+  return microsoftProvisioningError(
+    `Microsoft registration belongs to environment "${actualEnvironment}", not "${expectedEnvironment}".`,
+    'WRONG_ENVIRONMENT'
+  );
+}
+
+/**
+ * @param {Object} [params]
+ * @returns {Error}
+ */
+function missingMicrosoftTenantError() {
+  return microsoftProvisioningError(
+    'Could not determine the signed-in Microsoft tenant after login. Re-run channel add in a terminal.',
+    'TENANT'
+  );
+}
+
+/**
+ * @param {Object} [params]
+ * @returns {Error}
+ */
+function missingCopilotCaptureInputsError(params = {}) {
+  const clientId = typeof params.clientId === 'string' && params.clientId.trim();
+  const error = microsoftProvisioningError(
+    clientId
+      ? 'Microsoft Copilot setup cannot create Entra SSO until the public MCP URL is available.'
+      : 'Microsoft Copilot setup cannot create Entra SSO until this environment has an Entra application id.',
+    'CAPTURE_INPUTS'
+  );
+  error.statusCode = 400;
+  return error;
+}
+
+module.exports = {
+  microsoftProvisioningError,
+  wrongTenantError,
+  wrapToolkitError,
+  wrapTeamsCliError,
+  redactTeamsSecrets,
+  wrongEnvironmentRegistrationError,
+  missingCopilotCaptureInputsError,
+  missingMicrosoftTenantError
+};