@indigoai-us/hq-cloud 6.14.36 → 6.14.39

package/src/cli/sync.test.ts

@@ -10,6 +10,13 @@ import { clearContextCache } from "../context.js";
 import type { VaultServiceConfig } from "../types.js";
 import { lockPathFor } from "../operation-lock.js";
 
+// Re-export node:fs as a mutable module so unreadable-link regressions can
+// inject a win32 EINVAL without needing a real Windows reparse point.
+vi.mock("fs", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("fs")>();
+  return { ...actual };
+});
+
 // Mock s3 module at the top level
 vi.mock("../s3.js", async (importOriginal) => {
   const actual = await importOriginal<typeof import("../s3.js")>();
@@ -67,6 +74,12 @@ const mockConfig: VaultServiceConfig = {
   region: "us-east-1",
 };
 
+function errnoError(code: string): NodeJS.ErrnoException {
+  const err = new Error(`${code}: invalid argument, readlink`) as NodeJS.ErrnoException;
+  err.code = code;
+  return err;
+}
+
 const mockEntity = {
   uid: "cmp_01ABCDEF",
   slug: "acme",
@@ -383,6 +396,52 @@ describe("sync", () => {
     expect(journal.files["docs/handoff.md"]?.localDiverges).toBeFalsy();
   });
 
+  it("leaves a downloaded unreadable link unjournaled without emitting a fatal error", async () => {
+    const linkKey = "policies/downloaded-unreadable-link";
+    const linkPath = path.join(tmpDir, "companies", "acme", linkKey);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: linkKey, size: 0, lastModified: new Date(), etag: '"link-etag"' },
+    ]);
+    vi.mocked(s3Module.downloadFile).mockImplementationOnce(
+      async (_ctx: unknown, _key: string, localPath: string) => {
+        fs.mkdirSync(path.dirname(localPath), { recursive: true });
+        fs.symlinkSync("missing-target.md", localPath);
+        return { metadata: {} };
+      },
+    );
+    const realReadlinkSync = fs.readlinkSync;
+    const readlinkSpy = vi
+      .spyOn(fs, "readlinkSync")
+      .mockImplementation(((candidate: fs.PathLike) => {
+        if (candidate === linkPath) throw errnoError("EINVAL");
+        return realReadlinkSync(candidate);
+      }) as typeof fs.readlinkSync);
+    const events: SyncProgressEvent[] = [];
+
+    try {
+      const result = await sync({
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        onEvent: (event) => events.push(event),
+      });
+
+      expect(result.filesDownloaded).toBe(0);
+      expect(result.filesSkipped).toBe(1);
+      expect(events).toContainEqual({
+        type: "not-shipped",
+        reason: "unreadable-link",
+        count: 1,
+        samplePaths: [linkKey],
+      });
+      expect(events.some((event) => event.type === "error")).toBe(false);
+      const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      expect(journal.files[linkKey]).toBeUndefined();
+    } finally {
+      readlinkSpy.mockRestore();
+    }
+  });
+
   it("emits a conflict event with path + resolution on hash mismatch", async () => {
     const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
     fs.mkdirSync(companyDocs, { recursive: true });
@@ -505,6 +564,73 @@ describe("sync", () => {
     expect(journalAfter.files["docs/handoff.md"].remoteEtag).toBeTruthy();
   });
 
+  it("defers a conflict whose downloaded link target cannot be read", async () => {
+    const linkKey = "docs/handoff.md";
+    const localPath = path.join(tmpDir, "companies", "acme", linkKey);
+    fs.mkdirSync(path.dirname(localPath), { recursive: true });
+    fs.writeFileSync(localPath, "local version");
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: linkKey, size: 0, lastModified: new Date(), etag: '"remote-link"' },
+    ]);
+    let mirrorPath = "";
+    vi.mocked(s3Module.downloadFile).mockImplementationOnce(
+      async (_ctx: unknown, _key: string, destination: string) => {
+        mirrorPath = destination;
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        fs.symlinkSync("missing-target.md", destination);
+        return { metadata: {} };
+      },
+    );
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "1",
+        lastSync: new Date().toISOString(),
+        files: {
+          [linkKey]: {
+            hash: "stale-hash",
+            size: 20,
+            syncedAt: new Date(Date.now() - 3600000).toISOString(),
+            direction: "down",
+          },
+        },
+      }),
+    );
+    const realReadlinkSync = fs.readlinkSync;
+    const readlinkSpy = vi
+      .spyOn(fs, "readlinkSync")
+      .mockImplementation(((candidate: fs.PathLike) => {
+        if (candidate === mirrorPath) throw errnoError("EINVAL");
+        return realReadlinkSync(candidate);
+      }) as typeof fs.readlinkSync);
+    const events: SyncProgressEvent[] = [];
+
+    try {
+      const result = await sync({
+        company: "acme",
+        onConflict: "keep",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        onEvent: (event) => events.push(event),
+      });
+
+      expect(result.conflicts).toBe(0);
+      expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
+      expect(events).toContainEqual({
+        type: "not-shipped",
+        reason: "unreadable-link",
+        count: 1,
+        samplePaths: [linkKey],
+      });
+      expect(events.some((event) => event.type === "error")).toBe(false);
+      expect(fs.readFileSync(localPath, "utf-8")).toBe("local version");
+      const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      expect(journal.files[linkKey].hash).toBe("stale-hash");
+    } finally {
+      readlinkSpy.mockRestore();
+    }
+  });
+
   it("still writes a `.conflict-*` mirror when remote genuinely diverges from local", async () => {
     // Guard the other side of the convergence branch: when the probe bytes
     // differ from local, it remains a real conflict — counted, kept, and the
@@ -2782,6 +2908,48 @@ describe("sync", () => {
     expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
   });
 
+  it("skips remote keys under companies/<slug>/ in a company vault (doubly-scoped corrupt object — frogbear exit-2 regression)", async () => {
+    // A company vault is already anchored at its company root, so its keys are
+    // bucket-relative. A remote key literally beginning with `companies/...` is
+    // a doubly-scoped corrupt object: the vault-service refuses to presign it
+    // (INVALID_KEY_COMPANIES_SCOPED), so the per-file GET fails and the whole
+    // company wedges at "errored" (runner exit 2) on every run. Verified live
+    // 2026-06-16 against frogbear. The pull planner must refuse it at planning
+    // time — same policy bucket as the malformed-key / ephemeral filters.
+    const corruptKey = "companies/acme/drafts/reports/signals-2026-06-15.html";
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      // Doubly-scoped corrupt key — must be filtered, never downloaded.
+      { key: corruptKey, size: 2152, lastModified: new Date(), etag: '"corrupt"' },
+      // A legitimate bucket-relative key — must still download.
+      { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"ok"' },
+    ]);
+
+    const result = await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    // The corrupt key MUST NOT be materialized at its doubled local path.
+    expect(
+      fs.existsSync(
+        path.join(companyRoot, "companies", "acme", "drafts", "reports", "signals-2026-06-15.html"),
+      ),
+    ).toBe(false);
+    // The vault-service GET must never be attempted for the corrupt key — the
+    // failing presign is the exact symptom this guard removes.
+    for (const call of vi.mocked(s3Module.downloadFile).mock.calls) {
+      expect(call[1]).not.toBe(corruptKey);
+    }
+    // The legitimate bucket-relative key MUST still download.
+    expect(fs.existsSync(path.join(companyRoot, "docs", "handoff.md"))).toBe(true);
+
+    expect(result.filesDownloaded).toBe(1);
+    expect(result.filesExcludedByPolicy).toBeGreaterThanOrEqual(1);
+    expect(result.aborted).toBe(false);
+  });
+
   it("F02: rejects traversal remote keys before they can escape the company root", async () => {
     const escapeName = `${path.basename(tmpDir)}-escaped.md`;
     const traversalKey = `../../../${escapeName}`;
@@ -4089,6 +4257,47 @@ describe("sync", () => {
     expect(result.conflicts).toBe(0);
   });
 
+  it("defers an unreadable local symlink instead of aborting the pull plan", async () => {
+    const linkKey = "policies/unreadable-link";
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    const linkPath = path.join(companyRoot, linkKey);
+    fs.mkdirSync(path.dirname(linkPath), { recursive: true });
+    fs.symlinkSync("target.md", linkPath);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: linkKey, size: 0, lastModified: new Date(), etag: '"link-etag"' },
+    ]);
+
+    const realReadlinkSync = fs.readlinkSync;
+    const readlinkSpy = vi
+      .spyOn(fs, "readlinkSync")
+      .mockImplementation(((candidate: fs.PathLike) => {
+        if (candidate === linkPath) throw errnoError("EINVAL");
+        return realReadlinkSync(candidate);
+      }) as typeof fs.readlinkSync);
+
+    try {
+      const events: SyncProgressEvent[] = [];
+      const result = await sync({
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        onEvent: (event) => events.push(event),
+      });
+
+      expect(result.filesDownloaded).toBe(0);
+      expect(result.filesSkipped).toBe(1);
+      expect(s3Module.downloadFile).not.toHaveBeenCalled();
+      expect(events).toContainEqual({
+        type: "not-shipped",
+        reason: "unreadable-link",
+        count: 1,
+        samplePaths: [linkKey],
+      });
+    } finally {
+      readlinkSpy.mockRestore();
+    }
+  });
+
   it("classifies a dangling-symlink + remote-change as a conflict without crashing on statSync", async () => {
     // Codex round-11 P2 follow-up: pre-fix, the conflict executor
     // built the resolveConflict prompt with `fs.statSync(localPath).

package/src/cli/sync.ts

@@ -13,6 +13,7 @@ import type {
   SyncJournal,
 } from "../types.js";
 import { VaultAuthError, VaultClient, type SyncMode } from "../vault-client.js";
+import { readlinkOrNull } from "../lib/readlink-safe.js";
 import {
   emitCloudTelemetry,
   type TelemetryClaims,
@@ -78,7 +79,7 @@ import {
   resolveActiveCompany,
   resolveTransferConcurrency,
 } from "../sync-core.js";
-import { isEphemeralPath, isMalformedVaultKey } from "./share.js";
+import { isEphemeralPath, isForbiddenCompanyVaultKey, isMalformedVaultKey } from "./share.js";
 import { resolveConflict } from "./conflict.js";
 import type { ConflictStrategy, ConflictResolution } from "./conflict.js";
 import {
@@ -433,6 +434,34 @@ export type SyncProgressEvent =
       path: string;
       /** The already-journaled spelling that owns this logical path. */
       journaledKey: string;
+    }
+  | {
+      /**
+       * Emitted when local content is deliberately not transferred and would
+       * otherwise vanish from sync output without a trace (feedback_258e4a86 /
+       * feedback_a51cb63d — an hour lost because a "Pushed 0 file(s)" success
+       * named nothing that was skipped). Push batches by reason; pull emits an
+       * unreadable link by its remote key. `reason` distinguishes the cause:
+       *
+       *   - `"unreachable-path"`: a path the caller EXPLICITLY named exists on
+       *     disk but the resolver could not place it under the company folder,
+       *     or could not find it under any base. This is actionable signal — the
+       *     named target was NOT shipped — so the CLI may treat it as an error.
+       *   - `"linked-subtree"`: a directory symlink whose target lives OUTSIDE
+       *     the company folder was recorded as a link but its contents were not
+       *     descended/uploaded. They sync via their own repo, not the vault;
+       *     this is informational, not an error.
+       *   - `"unreadable-link"`: the OS identified a local symbolic link but
+       *     did not expose a readable target. The link is skipped rather than
+       *     dereferenced, and the company leg remains complete.
+       *
+       * `count` is the number of distinct paths for that reason; `samplePaths`
+       * carries up to 10 for display. Not emitted when `count === 0`.
+       */
+      type: "not-shipped";
+      reason: "unreachable-path" | "unreadable-link" | "linked-subtree";
+      count: number;
+      samplePaths: string[];
     };
 
 export interface SyncOptions {
@@ -1236,6 +1265,19 @@ async function executeConflictExecutor(
       counters.filesSkipped++;
       continue;
     }
+    if (item.action === "skip-unreadable-link") {
+      // An unreadable local link must stay non-fatal: the runner treats a
+      // generic error event as a failed company leg. Surface the exact remote
+      // key through the recoverable not-shipped channel instead.
+      counters.filesSkipped++;
+      run.emit({
+        type: "not-shipped",
+        reason: "unreadable-link",
+        count: 1,
+        samplePaths: [item.remoteFile.key],
+      });
+      continue;
+    }
     if (item.action === "skip-excluded-policy") {
       continue;
     }
@@ -1383,10 +1425,23 @@ async function executeConflictItem(
   try {
     const downloaded = await downloadFile(run.ctx, remoteFile.key, conflictAbs);
     remoteFetched = true;
-    const remoteHash = fs.lstatSync(conflictAbs).isSymbolicLink()
-      ? hashSymlinkTarget(fs.readlinkSync(conflictAbs))
-      : (downloaded.contentHash ?? hashFile(conflictAbs));
-    converged = remoteHash === item.localHash;
+    if (fs.lstatSync(conflictAbs).isSymbolicLink()) {
+      const target = readlinkOrNull(conflictAbs);
+      if (target === null) {
+        counters.filesSkipped++;
+        run.emit({
+          type: "not-shipped",
+          reason: "unreadable-link",
+          count: 1,
+          samplePaths: [remoteFile.key],
+        });
+        return null;
+      } else {
+        converged = hashSymlinkTarget(target) === item.localHash;
+      }
+    } else {
+      converged = (downloaded.contentHash ?? hashFile(conflictAbs)) === item.localHash;
+    }
   } catch (probeErr) {
     if (probeErr instanceof VaultAuthError) throw probeErr;
     run.emit({
@@ -1610,9 +1665,23 @@ async function downloadOne(
 
     const localLstat = fs.lstatSync(localPath);
     const isLocalSymlink = localLstat.isSymbolicLink();
-    const hash = isLocalSymlink
-      ? hashSymlinkTarget(fs.readlinkSync(localPath))
-      : (contentHash ?? hashFile(localPath));
+    let hash: string;
+    if (isLocalSymlink) {
+      const target = readlinkOrNull(localPath);
+      if (target === null) {
+        counters.filesSkipped++;
+        run.emit({
+          type: "not-shipped",
+          reason: "unreadable-link",
+          count: 1,
+          samplePaths: [remoteFile.key],
+        });
+        return;
+      }
+      hash = hashSymlinkTarget(target);
+    } else {
+      hash = contentHash ?? hashFile(localPath);
+    }
     const size = isLocalSymlink ? 0 : (contentSize ?? fs.statSync(localPath).size);
 
     updateEntry(
@@ -2141,6 +2210,11 @@ type PullPlanItem =
   | { action: "skip-personal-mode"; remoteFile: RemoteFile; localPath: string }
   | { action: "skip-unchanged"; remoteFile: RemoteFile; localPath: string }
   | { action: "skip-local-only"; remoteFile: RemoteFile; localPath: string }
+  // A local symlink was classified as a link but Windows (or a filesystem
+  // race) would not expose its target. This stays distinct from generic
+  // skip-local-only so the executor can report the exact path without making
+  // the whole company leg fail.
+  | { action: "skip-unreadable-link"; remoteFile: RemoteFile; localPath: string }
   // A stale personal-overlay symlink marker in the vault sitting at a key that
   // is ALSO a real, release-shipped core directory (e.g. an old
   // `core/knowledge/public/agent-browser` overlay marker after a release
@@ -2432,6 +2506,19 @@ function computePullPlan(
       continue;
     }
 
+    // Company-vault double-scoped-key filter. A company vault is already
+    // anchored at its company root, so a remote key under `companies/...` is a
+    // corrupt doubly-scoped object the vault-service refuses to presign
+    // (INVALID_KEY_COMPANIES_SCOPED). Without this, the puller enqueues it, the
+    // per-file GET fails, and the whole company wedges at "errored" (runner
+    // exit 2) on every run (frogbear, 2026-06-16). Refuse at plan time,
+    // symmetric with the malformed/ephemeral filters above. Personal vaults
+    // handle `companies/...` keys in the dedicated branch below.
+    if (isForbiddenCompanyVaultKey(remoteFile.key, personalMode)) {
+      items.push({ action: "skip-excluded-policy", remoteFile, localPath });
+      continue;
+    }
+
     // Personal-vault policy must be symmetric across both transfer legs.
     // The push walker refuses derived/machine-local/sensitive paths, but old
     // objects can remain in the bucket from clients that predate an exclusion.
@@ -2762,9 +2849,19 @@ function computePullPlan(
       ) {
         localHash = journalEntry.hash;
       } else {
-        localHash = isLocalSymlink
-          ? hashSymlinkTarget(fs.readlinkSync(localPath))
-          : hashFile(localPath);
+        if (isLocalSymlink) {
+          const target = readlinkOrNull(localPath);
+          if (target === null) {
+            // We cannot prove whether the local link diverged, so never
+            // overwrite or tombstone it from this plan. A later pass can retry
+            // once the OS exposes a readable target.
+            items.push({ action: "skip-unreadable-link", remoteFile, localPath });
+            continue;
+          }
+          localHash = hashSymlinkTarget(target);
+        } else {
+          localHash = hashFile(localPath);
+        }
       }
       const localChanged = !!journalEntry && journalEntry.hash !== localHash;
       plannedLocalSnapshot = {
@@ -3085,6 +3182,13 @@ function computePullPlan(
     }
     const localPath = resolveContainedVaultPath(companyRoot, key);
     if (localPath === null) continue;
+    // Scope-invalid journal keys (company mode, `companies/…` prefix): the
+    // download branch skips them (presign rejects), but a journaled entry whose
+    // key is absent from the remote LIST is doubled-tree poison that must
+    // drain — local copy under companies/{slug}/companies/{slug}/… removed and
+    // journal dropped. HEAD verify is skipped in verifyPlannedJournalTombstones
+    // (presign would reject); see the auto-verified branch there.
+    const scopeInvalidJournalKey = isForbiddenCompanyVaultKey(key, personalMode);
     // PersonalMode key gating — mirror the download branch. Local (non-cloud)
     // company keys are tombstone-eligible (a peer's delete should propagate),
     // but team-synced orphans are left alone (the team-bucket pull owns those
@@ -3101,8 +3205,15 @@ function computePullPlan(
     if (isEphemeralPath(key)) continue;
     // Honor the current ignore filter — if a path was previously synced
     // but is now ignored (operator edited .hqignore), do NOT delete
-    // the local copy. They're keeping it deliberately.
-    if (!shouldSync(localPath, false) && !shouldSync(localPath, true)) continue;
+    // the local copy. They're keeping it deliberately. Scope-invalid poison
+    // bypasses this: the doubled-tree copy must not survive silently.
+    if (
+      !scopeInvalidJournalKey &&
+      !shouldSync(localPath, false) &&
+      !shouldSync(localPath, true)
+    ) {
+      continue;
+    }
     // Codex P1 (PR #24 round 3): detect local edits before tombstoning.
     // Delete-vs-local-edit race: peer deleted the file remotely while
     // this machine edited it locally before the next sync. Without
@@ -3272,5 +3383,32 @@ function defaultConsoleLogger(event: SyncProgressEvent): void {
     console.warn(
       `  ! ${event.path} skipped — junk key spelling; this logical path is already synced as ${event.journaledKey} (mixed-version peer artifact; the vault doctor collapses the family)`,
     );
+  } else if (event.type === "not-shipped") {
+    if (event.reason === "unreachable-path") {
+      console.warn(
+        `  ! ${event.count} named path${event.count === 1 ? "" : "s"} could NOT be pushed — the file exists but is not reachable under the company folder (nothing was uploaded for ${event.count === 1 ? "it" : "them"}):`,
+      );
+    } else if (event.reason === "unreadable-link") {
+      console.warn(
+        `  ! ${event.count} symbolic link${event.count === 1 ? "" : "s"} could NOT be read and was skipped without dereferencing its target:`,
+      );
+    } else {
+      console.warn(
+        `  ! ${event.count} linked subtree${event.count === 1 ? "" : "s"} recorded but NOT uploaded — contents sync via their own repo, not the vault:`,
+      );
+    }
+    for (const p of event.samplePaths) {
+      console.warn(`    · ${p}`);
+    }
+    if (event.count > event.samplePaths.length) {
+      console.warn(`    ... and ${event.count - event.samplePaths.length} more`);
+    }
+    if (event.reason === "linked-subtree") {
+      console.warn(
+        `    To put a file from a linked subtree in the vault, push it by name:\n` +
+        `      hq sync push <path> --company <slug>\n` +
+        `    That uploads a point-in-time copy; re-run it after each edit (regular sync will not track or update it).`,
+      );
+    }
   }
 }

package/src/lib/readlink-safe.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, it } from "vitest";
+import { readlinkOrNull } from "./readlink-safe.js";
+
+function errnoError(code: string): NodeJS.ErrnoException {
+  const err = new Error(`${code}: scripted readlink failure`) as NodeJS.ErrnoException;
+  err.code = code;
+  return err;
+}
+
+describe("readlinkOrNull", () => {
+  it("uses the filesystem reader by default", () => {
+    expect(readlinkOrNull(`/hq-cloud-missing-link-${process.pid}`)).toBeNull();
+  });
+
+  it("returns the target string verbatim when readlink succeeds", () => {
+    expect(readlinkOrNull("/test/link", () => "../target with spaces")).toBe(
+      "../target with spaces",
+    );
+  });
+
+  it.each(["EINVAL", "ENOENT", "EPERM"])("returns null for %s", (code) => {
+    expect(readlinkOrNull("/test/link", () => {
+      throw errnoError(code);
+    })).toBeNull();
+  });
+
+  it("rethrows non-filesystem failures", () => {
+    const defect = new Error("unexpected test defect");
+
+    expect(() => readlinkOrNull("/test/link", () => {
+      throw defect;
+    })).toThrow(defect);
+  });
+
+  it("rethrows code-bearing programming errors", () => {
+    const defect = new TypeError("path must be a string") as TypeError & { code: string };
+    defect.code = "ERR_INVALID_ARG_TYPE";
+
+    expect(() => readlinkOrNull("/test/link", () => {
+      throw defect;
+    })).toThrow(defect);
+  });
+});

package/src/lib/readlink-safe.ts

@@ -0,0 +1,29 @@
+import * as fs from "fs";
+
+/**
+ * Read a link target without turning an expected filesystem race or an
+ * unsupported link shape into a caller-wide failure.
+ *
+ * A `null` result is deliberately distinct from an empty target string: it
+ * means the caller must preserve the link boundary and choose its conservative
+ * skip/defer path. Non-filesystem exceptions still propagate so programming
+ * errors cannot be mistaken for an unreadable link.
+ */
+export function readlinkOrNull(
+  linkPath: string,
+  readlink: (path: string) => string = (path) => fs.readlinkSync(path, "utf8"),
+): string | null {
+  try {
+    return readlink(linkPath);
+  } catch (err: unknown) {
+    const code =
+      err && typeof err === "object" && "code" in err
+        ? (err as { code?: unknown }).code
+        : undefined;
+    // Node system errors use POSIX-style errno names such as EINVAL and
+    // ENOENT. Runtime/programming errors use ERR_* codes; those must remain
+    // loud rather than being misclassified as an unreadable link.
+    if (typeof code === "string" && /^E[A-Z0-9]+$/.test(code)) return null;
+    throw err;
+  }
+}