@fluixi/oauth2 1.0.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fluixi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/api-guard.cjs

@@ -0,0 +1,185 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/types.ts
+var OAuthError;
+var init_types = __esm({
+  "src/types.ts"() {
+    "use strict";
+    OAuthError = class extends Error {
+      constructor(message, code, description) {
+        super(message);
+        this.code = code;
+        this.description = description;
+        this.name = "OAuthError";
+      }
+    };
+  }
+});
+
+// src/api-guard.ts
+var api_guard_exports = {};
+__export(api_guard_exports, {
+  createApiGuard: () => createApiGuard,
+  rolesFrom: () => rolesFrom
+});
+module.exports = __toCommonJS(api_guard_exports);
+
+// src/client-auth.ts
+init_types();
+
+// src/discovery.ts
+init_types();
+
+// src/verify.ts
+init_types();
+var TokenError = class extends OAuthError {
+  constructor(message, code = "invalid_token") {
+    super(message, code);
+    this.name = "TokenError";
+  }
+};
+
+// src/roles.ts
+var rolesFrom = {
+  /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+  keycloakRealm: (claims) => {
+    const realm = claims.realm_access;
+    return realm?.roles ?? [];
+  },
+  /** Keycloak, roles scoped to one client rather than the realm. */
+  keycloakClient: (clientId) => (claims) => {
+    const all = claims.resource_access;
+    return all?.[clientId]?.roles ?? [];
+  },
+  /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+  groups: (claims) => Array.isArray(claims.groups) ? claims.groups : [],
+  /** Cognito, which namespaces the claim. */
+  cognito: (claims) => {
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) ? groups : [];
+  },
+  /**
+   * Auth0, which requires a namespaced custom claim added by an action.
+   *
+   * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+   * that is not a URI, so an empty list here usually means the namespace, not the action.
+   */
+  namespaced: (claim) => (claims) => {
+    const value = claims[claim];
+    return Array.isArray(value) ? value : [];
+  },
+  /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+  scope: (claims) => typeof claims.scope === "string" ? claims.scope.split(" ") : []
+};
+
+// src/api-guard.ts
+var asList = (value) => value === void 0 ? [] : Array.isArray(value) ? value : [value];
+function refuse(refusal) {
+  const body = { error: refusal.code };
+  if (refusal.detail) body.detail = refusal.detail;
+  return new Response(JSON.stringify(body), {
+    status: refusal.status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function createApiGuard(options) {
+  const answer = (refusal, request) => {
+    const response = options.onRefused ? options.onRefused(refusal, request) : refuse(refusal);
+    if (refusal.status === 401 && !response.headers.has("www-authenticate")) {
+      response.headers.set("www-authenticate", `Bearer error="${refusal.code}"`);
+    }
+    return response;
+  };
+  const rolesOf = (claims, what) => {
+    if (!options.roles) {
+      throw new Error(
+        `[fluixi/oauth2] this route requires ${what}, but createApiGuard was given no \`roles\`. Providers disagree on where roles live, so there is no default: pass one of \`rolesFrom\`, or a function reading the claim your provider uses.`
+      );
+    }
+    return options.roles(claims);
+  };
+  return (handler, requirements = {}) => async (request) => {
+    let claims;
+    try {
+      claims = await options.verify.fromRequest(request);
+    } catch (cause) {
+      const code = cause instanceof TokenError ? cause.code : "invalid_token";
+      return answer({ status: 401, code }, request);
+    }
+    const wanted = asList(requirements.role);
+    if (wanted.length) {
+      const held = rolesOf(claims, "a role");
+      if (!wanted.some((role) => held.includes(role))) {
+        return answer(
+          {
+            status: 403,
+            code: "insufficient_role",
+            detail: `needs ${wanted.length > 1 ? "one of " : ""}${wanted.join(", ")}`,
+            claims
+          },
+          request
+        );
+      }
+    }
+    if (requirements.allRoles?.length) {
+      const held = rolesOf(claims, "roles");
+      const missing = requirements.allRoles.filter((role) => !held.includes(role));
+      if (missing.length) {
+        return answer(
+          { status: 403, code: "insufficient_role", detail: `needs ${missing.join(", ")}`, claims },
+          request
+        );
+      }
+    }
+    const scopes = asList(requirements.scope);
+    if (scopes.length) {
+      const held = typeof claims.scope === "string" ? claims.scope.split(" ") : [];
+      if (!scopes.some((scope) => held.includes(scope))) {
+        return answer(
+          {
+            status: 403,
+            code: "insufficient_scope",
+            detail: `needs ${scopes.length > 1 ? "one of " : ""}${scopes.join(", ")}`,
+            claims
+          },
+          request
+        );
+      }
+    }
+    if (requirements.require) {
+      const verdict = requirements.require(claims, request);
+      if (verdict !== true) {
+        return answer(
+          {
+            status: 403,
+            code: "forbidden",
+            detail: typeof verdict === "string" ? verdict : void 0,
+            claims
+          },
+          request
+        );
+      }
+    }
+    return handler(request, claims);
+  };
+}

package/dist/api-guard.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Refusing a request at this app's own API.
+ *
+ * `createTokenVerifier` says whether a token holds. What every app then wrote by hand is the
+ * part around it: catch the refusal, answer 401 with a `WWW-Authenticate` header, answer 403
+ * when the token is genuine but not enough, and hand the claims to the route. Thirty-odd
+ * lines, identical everywhere, and the header is not decoration: `browser.ts` reads
+ * `error="..."` out of it to tell an expired token from an endpoint that is down, which is
+ * what makes a refresh happen instead of a sign out.
+ *
+ * So the two halves of that contract now come from the same package. An app that writes the
+ * header itself has to match a format nothing told it about.
+ *
+ * Authentication and authorization stay separate here. The verifier decides whether the token
+ * is genuine; `requirements` decide whether it is enough for one route. Conflating them is how
+ * a 403 ends up reported as a 401 and the client refreshes a perfectly good token in a loop.
+ */
+import { type TokenClaims, type TokenVerifier } from './verify.js';
+export { rolesFrom } from './roles.js';
+/** Why a request was refused. */
+export interface Refusal {
+    /** 401 when the token is not acceptable, 403 when it is genuine but insufficient. */
+    status: 401 | 403;
+    /** A machine-readable code, and what goes in `WWW-Authenticate` for a 401. */
+    code: string;
+    /** What was missing, for a 403. Never sent for a 401: it would describe a token we rejected. */
+    detail?: string;
+    /** The claims, when there were any. Absent for a 401. */
+    claims?: TokenClaims;
+}
+/** What a route demands beyond a valid token. */
+export interface Requirements {
+    /** Any one of these roles is enough. */
+    role?: string | string[];
+    /** Every one of these is required. */
+    allRoles?: string[];
+    /** Any one of these scopes is enough, read from the `scope` claim. */
+    scope?: string | string[];
+    /**
+     * Anything else: a tenant claim, a plan, an ownership check against the URL.
+     *
+     * Return `true` to allow, `false` to refuse, or a string to refuse and say what was wrong.
+     */
+    require?: (claims: TokenClaims, request: Request) => boolean | string;
+}
+export interface ApiGuardOptions {
+    /** The verifier this app configured. */
+    verify: TokenVerifier;
+    /**
+     * How this provider names roles. See `rolesFrom` for the shapes in the wild.
+     *
+     * Left out, `role` and `allRoles` requirements throw rather than silently refusing
+     * everyone: a guard that cannot read roles and quietly answers 403 looks like a
+     * permissions problem for as long as it takes to find.
+     */
+    roles?: (claims: TokenClaims) => string[];
+    /**
+     * Answer a refusal in this app's own shape.
+     *
+     * The default is `{ error, detail? }` as JSON. Override for an API with its own error
+     * envelope. Returning a 401 without `WWW-Authenticate` breaks the client's ability to tell
+     * an expired token from a dead endpoint, so the default header is added to whatever comes
+     * back unless it already carries one.
+     */
+    onRefused?: (refusal: Refusal, request: Request) => Response;
+}
+/** Wraps a route handler so only an acceptable request reaches it. */
+export type ApiGuard = (handler: (request: Request, claims: TokenClaims) => Response | Promise<Response>, requirements?: Requirements) => (request: Request) => Promise<Response>;
+/**
+ * A guard for this app's API routes.
+ *
+ * @example
+ * ```ts
+ * // src/services/auth/verify.ts, the whole file
+ * import { createTokenVerifier, createApiGuard, rolesFrom } from '@fluixi/oauth2/verify';
+ * import { env } from '../../config/env.js';
+ *
+ * export const verify = createTokenVerifier({
+ *   issuer: env.oidcIssuer,
+ *   audience: false,
+ *   authorizedParty: env.clientId,
+ * });
+ *
+ * export const guard = createApiGuard({ verify, roles: rolesFrom.keycloakRealm });
+ * ```
+ *
+ * ```ts
+ * // src/api/reports.ts
+ * export const GET = guard(async (request, claims) => Response.json(await reportsFor(claims.sub)));
+ * export const DELETE = guard(handler, { role: 'admin' });
+ * ```
+ */
+export declare function createApiGuard(options: ApiGuardOptions): ApiGuard;
+//# sourceMappingURL=api-guard.d.ts.map

package/dist/api-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-guard.d.ts","sourceRoot":"","sources":["../src/api-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAc,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,qFAAqF;IACrF,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,MAAM,CAAC;CACvE;AAED,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,MAAM,EAAE,CAAC;IAC1C;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC;CAC9D;AAED,sEAAsE;AACtE,MAAM,MAAM,QAAQ,GAAG,CACrB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,EAChF,YAAY,CAAC,EAAE,YAAY,KACxB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAe7C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CA6FjE"}

package/dist/api-guard.js

@@ -0,0 +1,127 @@
+/**
+ * Refusing a request at this app's own API.
+ *
+ * `createTokenVerifier` says whether a token holds. What every app then wrote by hand is the
+ * part around it: catch the refusal, answer 401 with a `WWW-Authenticate` header, answer 403
+ * when the token is genuine but not enough, and hand the claims to the route. Thirty-odd
+ * lines, identical everywhere, and the header is not decoration: `browser.ts` reads
+ * `error="..."` out of it to tell an expired token from an endpoint that is down, which is
+ * what makes a refresh happen instead of a sign out.
+ *
+ * So the two halves of that contract now come from the same package. An app that writes the
+ * header itself has to match a format nothing told it about.
+ *
+ * Authentication and authorization stay separate here. The verifier decides whether the token
+ * is genuine; `requirements` decide whether it is enough for one route. Conflating them is how
+ * a 403 ends up reported as a 401 and the client refreshes a perfectly good token in a loop.
+ */
+import { TokenError } from './verify.js';
+export { rolesFrom } from './roles.js';
+const asList = (value) => value === undefined ? [] : Array.isArray(value) ? value : [value];
+/** The default refusal body. */
+function refuse(refusal) {
+    const body = { error: refusal.code };
+    if (refusal.detail)
+        body.detail = refusal.detail;
+    return new Response(JSON.stringify(body), {
+        status: refusal.status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+/**
+ * A guard for this app's API routes.
+ *
+ * @example
+ * ```ts
+ * // src/services/auth/verify.ts, the whole file
+ * import { createTokenVerifier, createApiGuard, rolesFrom } from '@fluixi/oauth2/verify';
+ * import { env } from '../../config/env.js';
+ *
+ * export const verify = createTokenVerifier({
+ *   issuer: env.oidcIssuer,
+ *   audience: false,
+ *   authorizedParty: env.clientId,
+ * });
+ *
+ * export const guard = createApiGuard({ verify, roles: rolesFrom.keycloakRealm });
+ * ```
+ *
+ * ```ts
+ * // src/api/reports.ts
+ * export const GET = guard(async (request, claims) => Response.json(await reportsFor(claims.sub)));
+ * export const DELETE = guard(handler, { role: 'admin' });
+ * ```
+ */
+export function createApiGuard(options) {
+    const answer = (refusal, request) => {
+        const response = options.onRefused ? options.onRefused(refusal, request) : refuse(refusal);
+        // Added rather than overwritten: a custom refusal may already say it better.
+        if (refusal.status === 401 && !response.headers.has('www-authenticate')) {
+            response.headers.set('www-authenticate', `Bearer error="${refusal.code}"`);
+        }
+        return response;
+    };
+    const rolesOf = (claims, what) => {
+        if (!options.roles) {
+            throw new Error(`[fluixi/oauth2] this route requires ${what}, but createApiGuard was given no \`roles\`. ` +
+                'Providers disagree on where roles live, so there is no default: pass one of `rolesFrom`, ' +
+                'or a function reading the claim your provider uses.');
+        }
+        return options.roles(claims);
+    };
+    return (handler, requirements = {}) => async (request) => {
+        let claims;
+        try {
+            claims = await options.verify.fromRequest(request);
+        }
+        catch (cause) {
+            // The code travels; the message does not. A refusal that explains why a token failed
+            // tells an attacker which guesses are close.
+            const code = cause instanceof TokenError ? cause.code : 'invalid_token';
+            return answer({ status: 401, code }, request);
+        }
+        const wanted = asList(requirements.role);
+        if (wanted.length) {
+            const held = rolesOf(claims, 'a role');
+            if (!wanted.some((role) => held.includes(role))) {
+                return answer({
+                    status: 403,
+                    code: 'insufficient_role',
+                    detail: `needs ${wanted.length > 1 ? 'one of ' : ''}${wanted.join(', ')}`,
+                    claims,
+                }, request);
+            }
+        }
+        if (requirements.allRoles?.length) {
+            const held = rolesOf(claims, 'roles');
+            const missing = requirements.allRoles.filter((role) => !held.includes(role));
+            if (missing.length) {
+                return answer({ status: 403, code: 'insufficient_role', detail: `needs ${missing.join(', ')}`, claims }, request);
+            }
+        }
+        const scopes = asList(requirements.scope);
+        if (scopes.length) {
+            const held = typeof claims.scope === 'string' ? claims.scope.split(' ') : [];
+            if (!scopes.some((scope) => held.includes(scope))) {
+                return answer({
+                    status: 403,
+                    code: 'insufficient_scope',
+                    detail: `needs ${scopes.length > 1 ? 'one of ' : ''}${scopes.join(', ')}`,
+                    claims,
+                }, request);
+            }
+        }
+        if (requirements.require) {
+            const verdict = requirements.require(claims, request);
+            if (verdict !== true) {
+                return answer({
+                    status: 403,
+                    code: 'forbidden',
+                    detail: typeof verdict === 'string' ? verdict : undefined,
+                    claims,
+                }, request);
+            }
+        }
+        return handler(request, claims);
+    };
+}

package/dist/api-guard.mjs

@@ -0,0 +1,141 @@
+import {
+  OAuthError
+} from "./chunk-OGSFNTKA.mjs";
+import "./chunk-7P6ASYW6.mjs";
+
+// src/verify.ts
+var TokenError = class extends OAuthError {
+  constructor(message, code = "invalid_token") {
+    super(message, code);
+    this.name = "TokenError";
+  }
+};
+
+// src/roles.ts
+var rolesFrom = {
+  /** Keycloak, realm roles. Where it puts them unless a client mapper is configured. */
+  keycloakRealm: (claims) => {
+    const realm = claims.realm_access;
+    return realm?.roles ?? [];
+  },
+  /** Keycloak, roles scoped to one client rather than the realm. */
+  keycloakClient: (clientId) => (claims) => {
+    const all = claims.resource_access;
+    return all?.[clientId]?.roles ?? [];
+  },
+  /** Okta, and anything else using a groups claim. Needs a groups claim on the token. */
+  groups: (claims) => Array.isArray(claims.groups) ? claims.groups : [],
+  /** Cognito, which namespaces the claim. */
+  cognito: (claims) => {
+    const groups = claims["cognito:groups"];
+    return Array.isArray(groups) ? groups : [];
+  },
+  /**
+   * Auth0, which requires a namespaced custom claim added by an action.
+   *
+   * `rolesFrom.namespaced('https://adafri.com/roles')`. Auth0 silently drops a custom claim
+   * that is not a URI, so an empty list here usually means the namespace, not the action.
+   */
+  namespaced: (claim) => (claims) => {
+    const value = claims[claim];
+    return Array.isArray(value) ? value : [];
+  },
+  /** The `scope` claim read as a role list, for a provider issuing no roles at all. */
+  scope: (claims) => typeof claims.scope === "string" ? claims.scope.split(" ") : []
+};
+
+// src/api-guard.ts
+var asList = (value) => value === void 0 ? [] : Array.isArray(value) ? value : [value];
+function refuse(refusal) {
+  const body = { error: refusal.code };
+  if (refusal.detail) body.detail = refusal.detail;
+  return new Response(JSON.stringify(body), {
+    status: refusal.status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function createApiGuard(options) {
+  const answer = (refusal, request) => {
+    const response = options.onRefused ? options.onRefused(refusal, request) : refuse(refusal);
+    if (refusal.status === 401 && !response.headers.has("www-authenticate")) {
+      response.headers.set("www-authenticate", `Bearer error="${refusal.code}"`);
+    }
+    return response;
+  };
+  const rolesOf = (claims, what) => {
+    if (!options.roles) {
+      throw new Error(
+        `[fluixi/oauth2] this route requires ${what}, but createApiGuard was given no \`roles\`. Providers disagree on where roles live, so there is no default: pass one of \`rolesFrom\`, or a function reading the claim your provider uses.`
+      );
+    }
+    return options.roles(claims);
+  };
+  return (handler, requirements = {}) => async (request) => {
+    let claims;
+    try {
+      claims = await options.verify.fromRequest(request);
+    } catch (cause) {
+      const code = cause instanceof TokenError ? cause.code : "invalid_token";
+      return answer({ status: 401, code }, request);
+    }
+    const wanted = asList(requirements.role);
+    if (wanted.length) {
+      const held = rolesOf(claims, "a role");
+      if (!wanted.some((role) => held.includes(role))) {
+        return answer(
+          {
+            status: 403,
+            code: "insufficient_role",
+            detail: `needs ${wanted.length > 1 ? "one of " : ""}${wanted.join(", ")}`,
+            claims
+          },
+          request
+        );
+      }
+    }
+    if (requirements.allRoles?.length) {
+      const held = rolesOf(claims, "roles");
+      const missing = requirements.allRoles.filter((role) => !held.includes(role));
+      if (missing.length) {
+        return answer(
+          { status: 403, code: "insufficient_role", detail: `needs ${missing.join(", ")}`, claims },
+          request
+        );
+      }
+    }
+    const scopes = asList(requirements.scope);
+    if (scopes.length) {
+      const held = typeof claims.scope === "string" ? claims.scope.split(" ") : [];
+      if (!scopes.some((scope) => held.includes(scope))) {
+        return answer(
+          {
+            status: 403,
+            code: "insufficient_scope",
+            detail: `needs ${scopes.length > 1 ? "one of " : ""}${scopes.join(", ")}`,
+            claims
+          },
+          request
+        );
+      }
+    }
+    if (requirements.require) {
+      const verdict = requirements.require(claims, request);
+      if (verdict !== true) {
+        return answer(
+          {
+            status: 403,
+            code: "forbidden",
+            detail: typeof verdict === "string" ? verdict : void 0,
+            claims
+          },
+          request
+        );
+      }
+    }
+    return handler(request, claims);
+  };
+}
+export {
+  createApiGuard,
+  rolesFrom
+};