@cosmoops/connect-sdk 0.30.1 → 0.33.0

package/dist/esm/client/use-push.js

@@ -0,0 +1,136 @@
+"use client";
+import { useCallback, useState, useSyncExternalStore } from "react";
+import { useConnect } from "./provider.js";
+/**
+ * Read the browser's own permission as external state.
+ *
+ * Not `useState` in an effect: the permission belongs to the browser, it can
+ * change from the address bar while the page is open, and it does not exist
+ * during a server render. `useSyncExternalStore` is the primitive for exactly
+ * that - a server snapshot of `"checking"` and a live client one.
+ */
+function subscribeToPermission(onChange) {
+    let status = null;
+    let cancelled = false;
+    // Absent on some Safari builds, and throws on others. Neither is fatal:
+    // without the subscription the snapshot is still correct on every render, it
+    // simply will not update by itself.
+    navigator.permissions
+        ?.query({ name: "notifications" })
+        .then((result) => {
+        if (cancelled)
+            return;
+        status = result;
+        result.addEventListener("change", onChange);
+    })
+        .catch(() => { });
+    return () => {
+        cancelled = true;
+        status?.removeEventListener("change", onChange);
+    };
+}
+function permissionSnapshot() {
+    if (typeof navigator === "undefined" ||
+        !("serviceWorker" in navigator) ||
+        typeof window === "undefined" ||
+        !("PushManager" in window) ||
+        !("Notification" in window)) {
+        return "unsupported";
+    }
+    if (Notification.permission === "denied")
+        return "denied";
+    return Notification.permission === "granted" ? "granted" : "prompt";
+}
+const serverSnapshot = () => "checking";
+/**
+ * Register this browser for the platform's notifications.
+ *
+ * The subscription is **Connect's, not your application's**: a member who
+ * turns notifications on in one app has turned them on for the platform, and
+ * the same device receives every other app's notifications and Connect's own.
+ * That is the point of centralising it - one browser prompt instead of one per
+ * app, and one place to turn everything off.
+ *
+ * Your application needs a service worker at its own origin that handles the
+ * `push` event; the SDK does not install one, because a worker is a
+ * site-wide concern with caching implications only the host can decide.
+ *
+ * @param serviceWorkerUrl Where your worker lives. Root-scoped by convention.
+ */
+export function useConnectPush(serviceWorkerUrl = "/sw.js") {
+    const { fetchResource, mutateResource } = useConnect();
+    const permission = useSyncExternalStore(subscribeToPermission, permissionSnapshot, serverSnapshot);
+    const [isEnabling, setIsEnabling] = useState(false);
+    const [error, setError] = useState(null);
+    const [unconfigured, setUnconfigured] = useState(false);
+    const enable = useCallback(async () => {
+        setError(null);
+        setIsEnabling(true);
+        try {
+            /*
+             * The key first, and the order matters: if the platform cannot send,
+             * asking for permission spends the member's one prompt on a feature
+             * that will never deliver - and a denial cannot be re-asked.
+             */
+            const key = await fetchResource("/push/key");
+            if (!key.configured || !key.publicKey) {
+                setUnconfigured(true);
+                return null;
+            }
+            if ((await Notification.requestPermission()) !== "granted")
+                return null;
+            const registration = await navigator.serviceWorker.register(serviceWorkerUrl);
+            // `ready` rather than the registration itself: one that is still
+            // installing has no `pushManager`, and subscribing against it throws in
+            // a way that reads as a permission problem.
+            await navigator.serviceWorker.ready;
+            const subscription = await registration.pushManager.subscribe({
+                // Required, and it may not be false - a silent push is reserved for
+                // sites with a far higher engagement bar, and asking for one here has
+                // the browser refuse the subscription outright.
+                userVisibleOnly: true,
+                applicationServerKey: base64UrlToBytes(key.publicKey),
+            });
+            const json = subscription.toJSON();
+            const registered = await mutateResource("/push/subscribe", {
+                endpoint: json.endpoint,
+                keys: { p256dh: json.keys?.p256dh, auth: json.keys?.auth },
+            });
+            return registered.id;
+        }
+        catch {
+            setError("This browser would not register for notifications. Reload the page and try again.");
+            return null;
+        }
+        finally {
+            setIsEnabling(false);
+        }
+    }, [fetchResource, mutateResource, serviceWorkerUrl]);
+    const disable = useCallback(async (deviceId) => {
+        await mutateResource("/push/unsubscribe", { id: deviceId });
+    }, [mutateResource]);
+    return {
+        status: unconfigured && permission !== "denied" ? "unconfigured" : permission,
+        isEnabling,
+        error,
+        enable,
+        disable,
+    };
+}
+/**
+ * The VAPID public key as the bytes `pushManager.subscribe()` wants.
+ *
+ * It travels base64url and the API takes a `BufferSource`. Spelled out rather
+ * than inlined because getting it wrong produces an `InvalidAccessError` that
+ * reads as a permissions fault rather than an encoding one - and the explicit
+ * `ArrayBuffer` matters too: `Uint8Array.from` widens to `ArrayBufferLike`,
+ * which `applicationServerKey` will not accept.
+ */
+function base64UrlToBytes(base64) {
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
+    const raw = atob(padded.replace(/-/g, "+").replace(/_/g, "/"));
+    const bytes = new Uint8Array(new ArrayBuffer(raw.length));
+    for (let index = 0; index < raw.length; index += 1)
+        bytes[index] = raw.charCodeAt(index);
+    return bytes;
+}

package/dist/esm/server/client.js

@@ -20,6 +20,8 @@ import { AnalyticsResource } from "./resources/analytics.js";
 import { OtpResource } from "./resources/otp.js";
 import { SessionsResource } from "./resources/sessions.js";
 import { PlatformResource } from "./resources/platform.js";
+import { VisitorResource } from "./resources/visitor.js";
+import { PushResource } from "./resources/push.js";
 export const DEFAULT_BASE_URL = "https://connect.cosmoops.com";
 const APPLICATION_API_PREFIX = "/api/v1/application";
 /**
@@ -111,8 +113,18 @@ export class ConnectClient {
     integrations;
     /** Which workspaces the signed-in user belongs to, switching between them, and the team - see `WorkspacesResource`. */
     workspaces;
+    /**
+     * The public chat bubble on your own site - see `VisitorResource`. The one
+     * resource here whose caller is not one of your users.
+     */
+    visitor;
     /** The platform's own legal identity and DPDP grievance channel - see `PlatformResource`. */
     platform;
+    /**
+     * Web Push. Connect holds the VAPID keys, the devices and the member's own
+     * preferences; you supply a title, a body and a URL. See `PushResource`.
+     */
+    push;
     /**
      * Relays one `/data/*` or `/kv/*` request verbatim - `createConnectHandler`'s
      * store route and nothing else. See `storePassthrough`.
@@ -156,9 +168,11 @@ export class ConnectClient {
         this.sessions = new SessionsResource(transport, options.clientId ?? null);
         this.integrations = new IntegrationsResource(transport);
         this.workspaces = new WorkspacesResource(transport);
+        this.visitor = new VisitorResource(transport);
         this.platform = new PlatformResource(transport);
+        this.push = new PushResource(transport);
         this.storeRelay = (spec) => storePassthrough(transport, spec);
     }
 }
 /** Kept in step with `package.json` by `sdk.test.ts`. */
-export const SDK_VERSION = "0.30.1";
+export const SDK_VERSION = "0.32.0";

package/dist/esm/server/handler.js

@@ -96,6 +96,24 @@ function redirect(location, cookies = []) {
  * workspace it is not signed into, and a client-supplied `workspaceId`
  * is exactly that hole.
  */
+/**
+ * The visitor's own address, for Connect's per-visitor limiter.
+ *
+ * **Left-most `x-forwarded-for` entry**, which is the same precedence Connect's
+ * own `/api/book` and `/api/auth/session` use, and the same caveat applies: the
+ * left-most entry is the client as the first proxy saw it, and a client can
+ * prepend to that header. That makes it unsuitable for authorization and fine
+ * for this - it partitions your application's own budget between visitors, and
+ * the ceilings that actually cap spending are per key and per application.
+ *
+ * `null` where nothing forwarded one - a local dev server, or a platform that
+ * does not set it. Connect then counts every visitor in one shared bucket,
+ * which is a stricter limit rather than an exemption.
+ */
+function visitorIpOf(request) {
+    const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+    return forwarded || request.headers.get("x-real-ip") || null;
+}
 export function createConnectHandler(options) {
     const basePath = (options.basePath ?? "/api/connect").replace(/\/+$/, "");
     const { client, session } = options;
@@ -327,6 +345,130 @@ export function createConnectHandler(options) {
             return json({ readiness, subscription });
         },
         "GET /plans": async () => json(await client.billing.listPlans()),
+        /* ---------------------------------------------------------------------- */
+        /* The visitor assistant - the only routes here with no session at all     */
+        /* ---------------------------------------------------------------------- */
+        /**
+         * `POST /visitor/session`, `/visitor/chat`, `/visitor/book`.
+         *
+         * Three routes that take **no session**, which makes them the exception to
+         * the rule every other route here follows. That is not a hole: the caller
+         * is a stranger on a public page, and there is no account for a session to
+         * identify. The question "whose data is this" has a different answer here -
+         * it is the *application's*, and the application is the one thing this
+         * bridge does hold a credential for.
+         *
+         * So the scoping that `requireWorkspace` provides elsewhere is provided
+         * here by Connect's own configuration: the workspace a call books into and
+         * the knowledge it answers from come from the application record, and no
+         * field in any of these bodies names a tenant. A browser cannot widen that
+         * by asking, because there is nothing to ask with.
+         *
+         * **`GET /company-profile` is the precedent and the limit of it.** That one
+         * is unauthenticated because the answer is identical for every caller.
+         * These are unauthenticated because the *caller* has no identity - but the
+         * answer is still per application, and spending is still per application.
+         * Which is why they are the only routes here that pass the visitor's own
+         * address along: the limiters on the far side count a visitor, and this
+         * bridge is the only thing that knows which one.
+         */
+        "POST /visitor/session": async (request) => {
+            const body = (await request.json().catch(() => null));
+            /*
+             * **The workspace is the browser's claim here, and that is the one thing
+             * this bridge must not simply relay.** Every other route on this bridge
+             * resolves the tenant from the caller's session; a visitor has none, so
+             * the widget names the customer whose site it is on - and a page can name
+             * any of them.
+             *
+             * Connect checks the workspace against your subscriptions, so the worst
+             * case is bounded to *your own* customers rather than the platform's. That
+             * is still one customer's budget spent from another's page, so an
+             * application serving several customers should resolve the workspace from
+             * its own widget record - by the embed token in the snippet, say - rather
+             * than trusting this field. The SDK cannot do that for you: it does not
+             * know what your widgets are keyed by.
+             */
+            if (typeof body?.workspaceId !== "string") {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "workspaceId is required",
+                    endpoint: "POST /visitor/session",
+                });
+            }
+            return json(await client.visitor.startSession({
+                workspaceId: body.workspaceId,
+                page: typeof body.page === "string" ? body.page : null,
+                resume: typeof body.resume === "string" ? body.resume : null,
+            }, { visitorIp: visitorIpOf(request) }));
+        },
+        "POST /visitor/chat": async (request) => {
+            const body = (await request.json().catch(() => null));
+            if (typeof body?.sessionId !== "string" ||
+                typeof body?.workspaceId !== "string" ||
+                typeof body?.message !== "string") {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "sessionId, workspaceId and message are required",
+                    endpoint: "POST /visitor/chat",
+                });
+            }
+            const upstream = await client.visitor.chat({
+                sessionId: body.sessionId,
+                workspaceId: body.workspaceId,
+                message: body.message,
+                ...(typeof body.assistantName === "string"
+                    ? { assistantName: body.assistantName }
+                    : {}),
+                ...(typeof body.bookingEventTypeSlug === "string"
+                    ? { bookingEventTypeSlug: body.bookingEventTypeSlug }
+                    : {}),
+            }, { visitorIp: visitorIpOf(request) });
+            /*
+             * Piped, never buffered - awaiting the body would collect the whole reply
+             * server-side and deliver it in one lump, which is the only thing
+             * streaming was for. The browser hanging up propagates down this pipe and
+             * stops generation upstream, which on this surface also stops the
+             * spending.
+             */
+            return new Response(upstream.body, {
+                status: upstream.status,
+                headers: {
+                    "content-type": upstream.headers.get("content-type") ?? "text/event-stream",
+                    "cache-control": "no-store",
+                    // Without this a proxy in front of your app may buffer the whole
+                    // stream to inspect it, which undoes the streaming end to end.
+                    "x-accel-buffering": "no",
+                    "x-content-type-options": "nosniff",
+                },
+            });
+        },
+        "POST /visitor/book": async (request) => {
+            const body = (await request.json().catch(() => null));
+            if (typeof body?.sessionId !== "string" ||
+                typeof body?.workspaceId !== "string" ||
+                typeof body?.eventTypeSlug !== "string" ||
+                typeof body?.startAt !== "string") {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "sessionId, workspaceId, eventTypeSlug and startAt are required",
+                    endpoint: "POST /visitor/book",
+                });
+            }
+            return json(await client.visitor.book({
+                sessionId: body.sessionId,
+                workspaceId: body.workspaceId,
+                eventTypeSlug: body.eventTypeSlug,
+                startAt: body.startAt,
+                name: typeof body.name === "string" ? body.name : "",
+                phone: typeof body.phone === "string" ? body.phone : "",
+                email: typeof body.email === "string" ? body.email : null,
+                notes: typeof body.notes === "string" ? body.notes : null,
+            }, { visitorIp: visitorIpOf(request) }));
+        },
         /**
          * The platform's legal identity and grievance channel.
          *
@@ -513,6 +655,60 @@ export function createConnectHandler(options) {
          * switching is simply absent for them rather than half-working - the same
          * treatment `/signin` and `/callback` already get.
          */
+        /*
+         * Push notifications - the browser half, and deliberately only that half.
+         *
+         * **There is no `POST /push` here**, and its absence is the design: a
+         * notification anybody can trigger from a devtools console is one an
+         * attacker can trigger from a compromised page, wearing the styling of an
+         * app the person trusts. Sending is a server-to-server act with your API
+         * key; Connect's own route refuses the session-token path outright.
+         *
+         * What a browser legitimately does is register itself, because
+         * `pushManager.subscribe()` produces a subscription no server can make on
+         * its behalf. All three routes resolve the member from their session, so
+         * there is no `userId` anywhere on this surface - a page cannot register a
+         * device against somebody else's account, nor list theirs.
+         */
+        "GET /push/key": async (request) => json(await client.push.key({ asUser: await requireToken(request) })),
+        "POST /push/subscribe": async (request) => {
+            const token = await requireToken(request);
+            const body = (await request.json().catch(() => null));
+            // Shape-checked here rather than relayed blindly, so a malformed
+            // subscription fails with a sentence naming what is missing instead of
+            // a Zod message from a server the page cannot see.
+            if (typeof body?.endpoint !== "string" ||
+                typeof body.keys?.p256dh !== "string" ||
+                typeof body.keys?.auth !== "string") {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "endpoint and keys.p256dh/keys.auth are required",
+                    endpoint: "POST /push/subscribe",
+                });
+            }
+            return json(await client.push.registerDevice({
+                endpoint: body.endpoint,
+                keys: { p256dh: body.keys.p256dh, auth: body.keys.auth },
+                // Taken from the request rather than the body: a page can put
+                // anything in a field, and this one is shown back on a device
+                // list where a spoofed entry would be the point of spoofing it.
+                userAgent: (request.headers.get("user-agent") ?? "").slice(0, 512),
+            }, { asUser: token }));
+        },
+        "POST /push/unsubscribe": async (request) => {
+            const token = await requireToken(request);
+            const body = (await request.json().catch(() => null));
+            if (typeof body?.id !== "string") {
+                throw new ConnectError({
+                    status: 400,
+                    code: "validation_error",
+                    message: "id is required",
+                    endpoint: "POST /push/unsubscribe",
+                });
+            }
+            return json(await client.push.revokeDevice(body.id, { asUser: token }));
+        },
         "GET /workspaces": async (request) => json({ workspaces: await client.workspaces.list({ asUser: await requireToken(request) }) }),
         "GET /workspaces/members": async (request) => json({ members: await client.workspaces.members({ asUser: await requireToken(request) }) }),
         "POST /workspaces/switch": async (request) => {

package/dist/esm/server/resources/ai.js

@@ -104,4 +104,89 @@ export class AiResource {
         });
         return result.data;
     }
+    /**
+     * Draft every section of a platform-defined assessment from one sentence.
+     *
+     * The intended flow is draft first, then let the person correct it section
+     * by section: a blank questionnaire is the reason most people abandon one,
+     * and editing a strawman is a far smaller ask than authoring from nothing.
+     *
+     * Unattributed - assessments run against platform-wide definitions and the
+     * first consumers run before anyone has signed in, so there is no `asUser`
+     * and no workspace here.
+     */
+    async draftAssessment(input) {
+        const result = await request(this.transport, {
+            method: "POST",
+            path: "/ai/assessment/draft",
+            json: input,
+        });
+        return result.data;
+    }
+    /**
+     * Critique a completed assessment - the tensions between sections, the
+     * riskiest assumption, and a coarse score.
+     *
+     * Unknown section keys in `answers` are ignored rather than rejected, so a
+     * definition changing under a half-finished assessment costs the reader
+     * nothing.
+     */
+    async reviewAssessment(input) {
+        const result = await request(this.transport, {
+            method: "POST",
+            path: "/ai/assessment/review",
+            json: input,
+        });
+        return result.data;
+    }
+    /**
+     * How ready the site at a domain is for AI agents.
+     *
+     * Probes for an MCP server, an OpenAPI description, `llms.txt`, structured
+     * data and a markdown twin; evaluates the site's `robots.txt` against the
+     * assistants that actually fetch pages; checks whether its content survives
+     * without JavaScript and whether a bot wall refuses agents outright. Then
+     * grades what it found and says what to fix first.
+     *
+     * Needs an API key scoped to **`ai:readiness`**, which is separate from every
+     * other AI scope because it is the widest outbound surface on the API - it
+     * POSTs to candidate MCP endpoints and fetches the home page under two user
+     * agents.
+     *
+     * ```ts
+     * const result = await connect.ai.readiness({ domain: "acme.com" });
+     * if (result.status === "assessed") {
+     *   console.log(result.report.grade, result.report.topFix?.fix);
+     * }
+     * ```
+     *
+     * Four things to know before wiring it in:
+     *
+     * - **Set your client timeout to at least 90 seconds.** A cold assessment
+     *   runs the whole probe before answering and can take up to a minute; many
+     *   HTTP clients default to 30s and abandon a request that was about to
+     *   succeed. Cached reads return in milliseconds and are the normal case -
+     *   reports are held for a week.
+     * - **A week, not ninety days**, because a report is a to-do list somebody is
+     *   working through. Pass `refresh` after shipping a fix to see it land.
+     * - **Handle `status: "error"` checks as unknown, not as failures.** They mean
+     *   Connect could not measure that check, and they are excluded from the
+     *   score rather than counted against it.
+     * - **`skipped` says whose problem it is.** `unreachable` means the site did
+     *   not answer; `provider_unavailable` means Connect's own assessment service
+     *   did. Only the second is worth retrying silently, and neither should be
+     *   shown as a failing grade.
+     */
+    readiness(input, options = {}) {
+        return request(this.transport, {
+            method: "POST",
+            path: "/ai/readiness",
+            json: {
+                domain: input.domain,
+                ...(input.refresh ? { refresh: true } : {}),
+            },
+            headers: actingAs(input.asUser),
+            signal: options.signal,
+        });
+    }
 }

package/dist/esm/server/resources/enrichment.js

@@ -49,4 +49,111 @@ export class EnrichmentResource {
             signal: options.signal,
         });
     }
+    /**
+     * What the company at a domain **looks like** - logo, palette, typefaces,
+     * and the radius, spacing and breakpoint scales its own stylesheets declare.
+     *
+     * The sibling of `company()` above: that one answers what a company does,
+     * this one answers what it looks like. Useful for white-labelling a portal
+     * to a customer's brand, pre-filling a design brief, or showing a real
+     * account card instead of a grey placeholder.
+     *
+     * Needs an API key scoped to **`enrichment:brand`** - separate from
+     * `enrichment:read` because it is far more expensive: it crawls
+     * stylesheets, may render the page in a headless browser, and caches image
+     * bytes.
+     *
+     * ```ts
+     * const result = await connect.enrichment.brand({ domain: "acme.com" });
+     * if (result.status === "extracted") {
+     *   const primary = result.profile.brandKit.palette.find((c) => c.role === "primary");
+     * }
+     * ```
+     *
+     * Three things to know before wiring it in:
+     *
+     * - **Set your client timeout to at least 90 seconds.** A cold read runs
+     *   the whole extraction before answering and can take up to a minute; many
+     *   HTTP clients default to 30s and abandon a request that was about to
+     *   succeed. Cached reads return in milliseconds, and cached is the normal
+     *   case - profiles are held for 90 days, so you pay the cold path roughly
+     *   once per domain.
+     * - **Never store `brandKit.logos[].url`.** It is a short-lived signed URL
+     *   minted per read. Render it directly or re-read the profile; persist
+     *   `sourceUrl` if you need something stable.
+     * - **The values were measured, not generated.** Check `palette[].source` -
+     *   a `css-var` entry is the company naming its own colour, a `frequency`
+     *   entry is a ranked count and much weaker.
+     */
+    brand(input, options = {}) {
+        return request(this.transport, {
+            method: "POST",
+            path: "/enrichment/brand",
+            json: {
+                domain: input.domain,
+                ...(input.refresh ? { refresh: true } : {}),
+            },
+            headers: actingAs(input.asUser),
+            signal: options.signal,
+        });
+    }
+    /**
+     * How **visible** the business at a domain is online, scored out of 100.
+     *
+     * The third sibling of `company()` and `brand()`: that one answers what a
+     * business does, the other what it looks like, and this one answers how
+     * findable it is - by a search engine, by a customer, and by the assistants
+     * that increasingly answer questions about a business before anybody visits
+     * its site.
+     *
+     * Needs an API key scoped to **`enrichment:presence`** - separate from
+     * `enrichment:read` and `enrichment:brand` because it is the widest outbound
+     * read of the three: roughly twenty fetches across the site's well-known
+     * paths, and sometimes a headless browser.
+     *
+     * ```ts
+     * const result = await connect.enrichment.presence({ domain: "acme.com" });
+     * if (result.status === "scanned") {
+     *   for (const next of result.scan.recommendations) {
+     *     console.log(`${next.priority}. ${next.title} - ${next.fix}`);
+     *   }
+     * }
+     * ```
+     *
+     * Four things to know before wiring it in:
+     *
+     * - **The score is computed, not generated.** Every point comes from a check
+     *   run against something actually observed, and every check ships with its
+     *   weight, what was seen and the URL that settles it - so the total is
+     *   reconstructable. A model only orders `recommendations` and writes the
+     *   prose; it cannot move the number. That is the whole reason this is worth
+     *   showing a customer: ask a model how good a company's web presence is and
+     *   it answers 72 with total confidence for a site it never read.
+     * - **`social` is claimed, never verified.** Those are URLs the site itself
+     *   printed. Nothing proves the account belongs to that business - render it
+     *   as "linked from their site". Check `machineReadable` too: `false` means
+     *   a real profile that search engines have to infer from a footer link,
+     *   which is a specific, common and easily fixed finding.
+     * - **A low score is a success, not a skip.** Every check failing is the most
+     *   useful report this produces. Only `unreachable` means the site did not
+     *   answer - and `provider_unavailable` means *Connect* did not, which is
+     *   never something to tell your user about their own site.
+     * - **Set your client timeout to at least 90 seconds.** A cold scan runs the
+     *   whole probe before answering; many HTTP clients default to 30s and
+     *   abandon a request that was about to succeed. Cached scans return in
+     *   milliseconds, and cached is the normal case - results are held for a
+     *   fortnight, so you pay the cold path roughly once per domain.
+     */
+    presence(input, options = {}) {
+        return request(this.transport, {
+            method: "POST",
+            path: "/enrichment/presence",
+            json: {
+                domain: input.domain,
+                ...(input.refresh ? { refresh: true } : {}),
+            },
+            headers: actingAs(input.asUser),
+            signal: options.signal,
+        });
+    }
 }