@iowarp/clio-coder 0.3.0 → 0.3.2

package/src/core/state-file-lock.ts

@@ -0,0 +1,219 @@
+import { closeSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, utimesSync, writeSync } from "node:fs";
+import { hostname } from "node:os";
+import { dirname } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { processAlive, processBirthToken } from "./process-identity.js";
+
+/**
+ * The one cross-process advisory file lock. Every durable lock in the tree runs
+ * through it (settings.yaml, the dispatch admission state file,
+ * credentials.yaml, residency mutations) so there is a single staleness policy
+ * instead of four that disagreed by a factor of 26.
+ *
+ * The lock is keyed by target path (`<target>.lock`) and records the owner's
+ * host, pid and birth token. A holder is presumed gone only when its pid is
+ * gone on this host; a record from another host is never adjudicated here. The
+ * age of the lockfile decides only for a record whose owner cannot be read, so
+ * staleness is a backstop rather than a cap on how long a critical section may
+ * legitimately take: the settings lock used to steal itself back from a healthy
+ * writer after five seconds. Async holders additionally refresh the lockfile mtime while
+ * they work, so even the backstop does not fire under a live holder. The sync
+ * path blocks the event loop by construction and cannot run that timer; pid
+ * liveness is what protects it.
+ */
+
+/** Consulted only when the owner cannot be identified. */
+const STALE_LOCK_MS = 30_000;
+/** Well under STALE_LOCK_MS, so a slow holder never reads as an abandoned one. */
+const REFRESH_LOCK_MS = 5_000;
+/**
+ * Default acquisition budget. Deliberately under DEFAULT_CAPACITY_LEASE_TTL_MS:
+ * the sync path blocks the event loop, so a process waiting here also stalls its
+ * own lease heartbeat, and a wait longer than a lease lives would let a live
+ * holder's lease expire under it. capacity-lease.ts asserts the relation.
+ */
+export const FILE_LOCK_ACQUIRE_TIMEOUT_MS = 20_000;
+
+export interface StateFileLockOptions {
+	/** Acquisition budget. Default `FILE_LOCK_ACQUIRE_TIMEOUT_MS`. */
+	timeoutMs?: number;
+	/** Cancel an asynchronous lock wait and never enter or commit its critical section. */
+	signal?: AbortSignal;
+	/**
+	 * `run-unlocked` runs `fn` anyway when the lock cannot be taken. Residency
+	 * mutations need it: serializing them is an optimization and must never fail
+	 * or stall a turn. Everything else fails closed.
+	 */
+	onAcquireFailure?: "throw" | "run-unlocked";
+}
+
+interface LockOwner {
+	/** Null on a record written before the field existed; read as this host. */
+	host: string | null;
+	pid: number;
+	birthToken: string | null;
+}
+
+function readLockOwner(lockPath: string): LockOwner | null {
+	try {
+		const raw = readFileSync(lockPath, "utf8").trim();
+		const record = raw.startsWith("{") ? (JSON.parse(raw) as Record<string, unknown>) : { pid: Number.parseInt(raw, 10) };
+		const { host, pid, birthToken } = record;
+		if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return null;
+		return {
+			host: typeof host === "string" ? host : null,
+			pid,
+			birthToken: typeof birthToken === "string" ? birthToken : null,
+		};
+	} catch {
+		return null;
+	}
+}
+
+/** Mirrors compete-worktrees' ownerIsAlive: foreign hosts are never adjudicated, a null token cannot rule out pid reuse. */
+function ownerIsAlive(owner: LockOwner): boolean {
+	if (owner.host !== null && owner.host !== hostname()) return true;
+	if (!processAlive(owner.pid)) return false;
+	if (owner.birthToken === null) return true;
+	const current = processBirthToken(owner.pid);
+	return current === null || current === owner.birthToken;
+}
+
+function lockfileAgeMs(lockPath: string): number | null {
+	try {
+		return Date.now() - statSync(lockPath).mtimeMs;
+	} catch {
+		return null;
+	}
+}
+
+/** True once the lock is ours. Steals only from an owner that is provably gone. */
+function tryAcquire(lockPath: string): boolean {
+	try {
+		const fd = openSync(lockPath, "wx", 0o600);
+		try {
+			writeSync(
+				fd,
+				`${JSON.stringify({ host: hostname(), pid: process.pid, birthToken: processBirthToken(), at: new Date().toISOString() })}\n`,
+			);
+		} finally {
+			closeSync(fd);
+		}
+		return true;
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+	}
+	const owner = readLockOwner(lockPath);
+	const ageMs = lockfileAgeMs(lockPath);
+	const abandoned = owner !== null ? !ownerIsAlive(owner) : ageMs !== null && ageMs > STALE_LOCK_MS;
+	if (abandoned) {
+		try {
+			unlinkSync(lockPath);
+		} catch {
+			// Another waiter reclaimed it first; the next attempt races normally.
+		}
+	}
+	return false;
+}
+
+function timeoutError(lockPath: string, timeoutMs: number): Error {
+	return new Error(
+		`timed out after ${timeoutMs}ms waiting for ${lockPath} (owner pid=${readLockOwner(lockPath)?.pid ?? "?"}); delete it if no other clio process is running`,
+	);
+}
+
+function backoffMs(attempt: number): number {
+	return Math.min(100, 5 * 2 ** Math.min(attempt, 5));
+}
+
+function release(lockPath: string): void {
+	// Only unlink a lock we still own. If ours was reclaimed as abandoned and a
+	// sibling now holds a fresh one, deleting here would open their section.
+	const owner = readLockOwner(lockPath);
+	if (owner?.pid !== process.pid || (owner.host !== null && owner.host !== hostname())) return;
+	try {
+		unlinkSync(lockPath);
+	} catch {
+		// Already gone; fine.
+	}
+}
+
+/**
+ * Keep a held lock's mtime current so the staleness backstop cannot fire under
+ * a live holder. Only the async path can do this; see the module comment.
+ */
+function startRefresh(lockPath: string): () => void {
+	const timer = setInterval(() => {
+		const at = new Date();
+		try {
+			utimesSync(lockPath, at, at);
+		} catch {
+			// Released or stolen; `release` re-checks ownership either way.
+		}
+	}, REFRESH_LOCK_MS);
+	timer.unref();
+	return () => clearInterval(timer);
+}
+
+/** Synchronous variant for admission planners whose host API cannot yield. */
+export function withStateFileLockSync<T>(targetPath: string, fn: () => T, options: StateFileLockOptions = {}): T {
+	const lockPath = `${targetPath}.lock`;
+	const timeoutMs = options.timeoutMs ?? FILE_LOCK_ACQUIRE_TIMEOUT_MS;
+	let held = false;
+	try {
+		options.signal?.throwIfAborted();
+		mkdirSync(dirname(lockPath), { recursive: true });
+		const deadlineMs = Date.now() + timeoutMs;
+		for (let attempt = 1; !tryAcquire(lockPath); attempt += 1) {
+			options.signal?.throwIfAborted();
+			if (Date.now() > deadlineMs) throw timeoutError(lockPath, timeoutMs);
+			// Atomics.wait rather than a timer: the callers of this variant are
+			// inside host APIs that cannot yield.
+			Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, backoffMs(attempt));
+		}
+		held = true;
+	} catch (err) {
+		options.signal?.throwIfAborted();
+		if (options.onAcquireFailure !== "run-unlocked") throw err;
+	}
+	try {
+		return fn();
+	} finally {
+		if (held) release(lockPath);
+	}
+}
+
+export async function withStateFileLock<T>(
+	targetPath: string,
+	fn: () => T | Promise<T>,
+	options: StateFileLockOptions = {},
+): Promise<T> {
+	const lockPath = `${targetPath}.lock`;
+	const timeoutMs = options.timeoutMs ?? FILE_LOCK_ACQUIRE_TIMEOUT_MS;
+	let held = false;
+	try {
+		options.signal?.throwIfAborted();
+		mkdirSync(dirname(lockPath), { recursive: true });
+		const deadlineMs = Date.now() + timeoutMs;
+		for (let attempt = 1; !tryAcquire(lockPath); attempt += 1) {
+			options.signal?.throwIfAborted();
+			if (Date.now() > deadlineMs) throw timeoutError(lockPath, timeoutMs);
+			const base = backoffMs(attempt);
+			const delayMs = base + Math.floor(Math.random() * base);
+			if (options.signal) await sleep(delayMs, undefined, { signal: options.signal });
+			else await sleep(delayMs);
+		}
+		held = true;
+		options.signal?.throwIfAborted();
+	} catch (err) {
+		options.signal?.throwIfAborted();
+		if (options.onAcquireFailure !== "run-unlocked") throw err;
+	}
+	const stopRefresh = held ? startRefresh(lockPath) : null;
+	try {
+		return await fn();
+	} finally {
+		stopRefresh?.();
+		if (held) release(lockPath);
+	}
+}

package/src/core/termination.ts

@@ -0,0 +1,275 @@
+/**
+ * Shutdown coordinator implementing the four-phase sequence from spec §17:
+ *   DRAIN     stop accepting new input / dispatch
+ *   TERMINATE kill active workers (wired in Phase 7)
+ *   PERSIST   atomic writes of domain state
+ *   EXIT      tear down TUI and process.exit
+ *
+ * Each registered hook runs under a per-hook timeout so a single slow or
+ * hanging hook cannot block the TUI from exiting. The cap is 500ms by
+ * default and can be overridden via CLIO_CODER_SHUTDOWN_HOOK_MS for tests.
+ * Timed-out hooks are logged and shutdown continues to the next hook.
+ *
+ * Every diagnostic here is written after the TUI has stopped: the interactive
+ * controller stops the terminal before it calls shutdown(), and the signal path
+ * stops it from a drain hook, which precedes persist. The renderer is gone, so
+ * a diagnostic goes to stderr and is wrapped to the terminal width so it does
+ * not overrun the frame the TUI just handed back.
+ */
+
+import { BusChannels } from "./bus-events.js";
+import { getSharedBus } from "./shared-bus.js";
+
+export type TerminationPhase = "idle" | "draining" | "terminating" | "persisting" | "exiting";
+
+type Hook = () => void | Promise<void>;
+
+/** Wall-clock budget per hook and per domain.stop() call. */
+export const DEFAULT_SHUTDOWN_HOOK_MS = 500;
+
+const SIGNAL_EXIT_CODES: Partial<Record<NodeJS.Signals, number>> = {
+	SIGHUP: 129,
+	SIGINT: 130,
+	SIGTERM: 143,
+};
+
+/**
+ * Break `text` into lines no wider than `width` columns, at spaces where
+ * possible and mid-word when a single token is wider than the terminal.
+ */
+export function wrapToWidth(text: string, width: number): string[] {
+	if (!Number.isFinite(width) || width < 1) return [text];
+	const lines: string[] = [];
+	let current = "";
+	for (const word of text.split(/\s+/).filter((w) => w.length > 0)) {
+		let token = word;
+		while (token.length > width) {
+			if (current) {
+				lines.push(current);
+				current = "";
+			}
+			lines.push(token.slice(0, width));
+			token = token.slice(width);
+		}
+		if (!current) current = token;
+		else if (current.length + 1 + token.length <= width) current = `${current} ${token}`;
+		else {
+			lines.push(current);
+			current = token;
+		}
+	}
+	if (current) lines.push(current);
+	return lines.length > 0 ? lines : [""];
+}
+
+/**
+ * Emit a shutdown notice on stderr, wrapped to the terminal width when stderr
+ * or stdout is a TTY. Off a TTY the text goes out unwrapped, since a log
+ * consumer wants one record per line.
+ */
+export function writeShutdownNotice(text: string): void {
+	const width = process.stderr.columns ?? process.stdout.columns;
+	const lines = width === undefined ? [text] : wrapToWidth(text, width);
+	process.stderr.write(`${lines.join("\n")}\n`);
+}
+
+export function resolveShutdownHookBudgetMs(): number {
+	const raw = process.env.CLIO_CODER_SHUTDOWN_HOOK_MS;
+	if (raw === undefined) return DEFAULT_SHUTDOWN_HOOK_MS;
+	const parsed = Number.parseInt(raw, 10);
+	if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_SHUTDOWN_HOOK_MS;
+	return parsed;
+}
+
+/**
+ * Run `op` with a wall-clock cap. Resolves true when `op` completes within
+ * the budget, false when the cap fires first. Errors from `op` are swallowed
+ * and reported via `onError` so a rejecting hook cannot propagate past the
+ * shutdown coordinator.
+ */
+export async function runWithBudget(
+	op: () => void | Promise<void>,
+	budgetMs: number,
+	onError?: (err: unknown) => void,
+): Promise<boolean> {
+	let timer: NodeJS.Timeout | undefined;
+	const timeout = new Promise<"timeout">((resolve) => {
+		timer = setTimeout(() => resolve("timeout"), budgetMs);
+	});
+	try {
+		const done = Promise.resolve()
+			.then(() => op())
+			.then(() => "done" as const)
+			.catch((err) => {
+				onError?.(err);
+				return "done" as const;
+			});
+		const outcome = await Promise.race([done, timeout]);
+		return outcome === "done";
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+
+class TerminationCoordinator {
+	private phase: TerminationPhase = "idle";
+	private readonly drainHooks: Hook[] = [];
+	private readonly terminateHooks: Hook[] = [];
+	private readonly persistHooks: Hook[] = [];
+	private exitCode = 0;
+	private started = false;
+	private drained = false;
+	private readonly pendingNotices: string[] = [];
+	private signalHandler: ((signal: NodeJS.Signals) => void) | null = null;
+
+	getPhase(): TerminationPhase {
+		return this.phase;
+	}
+
+	/**
+	 * The process exit code this shutdown will use. Set before any hook runs,
+	 * so a hook sealing terminal accounting records the same status the process
+	 * reports (130 for SIGINT, 143 for SIGTERM).
+	 */
+	getExitCode(): number {
+		return this.exitCode;
+	}
+
+	onDrain(hook: Hook): void {
+		this.drainHooks.push(hook);
+	}
+	onTerminate(hook: Hook): void {
+		this.terminateHooks.push(hook);
+	}
+	onPersist(hook: Hook): void {
+		this.persistHooks.push(hook);
+	}
+
+	async shutdown(code = 0): Promise<void> {
+		if (this.started) return;
+		this.started = true;
+		this.exitCode = code;
+		const bus = getSharedBus();
+		const debug = process.env.CLIO_CODER_DEBUG_SHUTDOWN === "1";
+		const budgetMs = resolveShutdownHookBudgetMs();
+		const mark = debug ? process.hrtime.bigint() : 0n;
+		const log = (msg: string): void => {
+			if (!debug) return;
+			const ms = Number(process.hrtime.bigint() - mark) / 1e6;
+			process.stderr.write(`[clio:shutdown] +${ms.toFixed(1)}ms ${msg}\n`);
+		};
+
+		this.phase = "draining";
+		bus.emit(BusChannels.ShutdownRequested, { phase: this.phase });
+		log("drain:start");
+		await this.runHooks(this.drainHooks, "drain", budgetMs, log);
+		log("drain:end");
+		this.drained = true;
+		this.flushNotices();
+		bus.emit(BusChannels.ShutdownDrained, {});
+
+		this.phase = "terminating";
+		log("terminate:start");
+		await this.runHooks(this.terminateHooks, "terminate", budgetMs, log);
+		log("terminate:end");
+		bus.emit(BusChannels.ShutdownTerminated, {});
+
+		this.phase = "persisting";
+		log("persist:start");
+		await this.runHooks(this.persistHooks, "persist", budgetMs, log);
+		log("persist:end");
+		bus.emit(BusChannels.ShutdownPersisted, {});
+
+		this.phase = "exiting";
+		bus.emit(BusChannels.SessionEnd, { exitCode: this.exitCode });
+		log("process.exit");
+		process.exit(this.exitCode);
+	}
+
+	private async runHooks(hooks: Hook[], phase: string, budgetMs: number, log: (msg: string) => void): Promise<void> {
+		for (let i = 0; i < hooks.length; i++) {
+			const hook = hooks[i];
+			if (!hook) continue;
+			const t0 = process.hrtime.bigint();
+			const completed = await runWithBudget(hook, budgetMs, (err) => {
+				const message = err instanceof Error ? err.message : String(err);
+				writeShutdownNotice(`[clio:termination] ${phase}[${i}] failed: ${message}`);
+				if (err instanceof Error && err.stack) log(err.stack);
+			});
+			const dt = Number(process.hrtime.bigint() - t0) / 1e6;
+			if (!completed) {
+				writeShutdownNotice(`[clio:termination] ${phase}[${i}] exceeded ${budgetMs}ms budget; shutdown continues`);
+			}
+			log(`  ${phase}[${i}] ${dt.toFixed(1)}ms${completed ? "" : " (timed out)"}`);
+		}
+	}
+
+	/**
+	 * SIGHUP is here for the same reason as SIGTERM. Without a listener Node
+	 * takes its default action and the process dies with no shutdown at all,
+	 * which on a TUI session means the terminal is never given back. Exit codes
+	 * follow the 128+signal convention.
+	 */
+	installSignalHandlers(): void {
+		if (this.signalHandler) return;
+		const handler = (signal: NodeJS.Signals): void => {
+			this.notice(`Clio Coder: received ${signal}, shutting down...`);
+			void this.shutdown(SIGNAL_EXIT_CODES[signal] ?? 143);
+		};
+		this.signalHandler = handler;
+		process.once("SIGINT", handler);
+		process.once("SIGTERM", handler);
+		process.once("SIGHUP", handler);
+	}
+
+	/**
+	 * Report something the operator should read after the process is gone,
+	 * such as which signal ended it. Nothing here knows whether a TUI is on
+	 * screen, but it does know that the terminal teardown is a drain hook: so
+	 * until drain has finished the notice is held, and the moment it has, the
+	 * notice goes to the terminal the TUI just handed back. Written straight
+	 * away once drain is over, which is the case for a re-armed SIGINT arriving
+	 * mid-shutdown. A second SIGTERM or SIGHUP inside the drain window takes
+	 * Node's default action and the held notice dies with the process; that
+	 * window is bounded by the per-hook budget and the shell reports the kill.
+	 */
+	notice(text: string): void {
+		if (this.drained) {
+			writeShutdownNotice(text);
+			return;
+		}
+		this.pendingNotices.push(text);
+	}
+
+	private flushNotices(): void {
+		for (const text of this.pendingNotices.splice(0)) writeShutdownNotice(text);
+	}
+
+	/**
+	 * Hand SIGINT to a foreground owner and return the call that takes it back.
+	 *
+	 * Boot arms this coordinator before any interactive surface exists, and Node
+	 * runs signal listeners in registration order, so a TUI that merely added its
+	 * own listener would lose every first press to a shutdown already underway.
+	 * One owner holds the interrupt at a time and the transfer is explicit.
+	 * SIGTERM is not part of the handover; it is never an interactive gesture.
+	 */
+	releaseInterruptOwnership(): () => void {
+		const handler = this.signalHandler;
+		if (!handler) return () => {};
+		process.off("SIGINT", handler);
+		let restored = false;
+		return () => {
+			if (restored) return;
+			restored = true;
+			process.once("SIGINT", handler);
+		};
+	}
+}
+
+let coordinator: TerminationCoordinator | null = null;
+
+export function getTerminationCoordinator(): TerminationCoordinator {
+	if (!coordinator) coordinator = new TerminationCoordinator();
+	return coordinator;
+}

package/src/core/timers.ts

@@ -0,0 +1,38 @@
+/** Largest delay Node can schedule without overflowing to an approximately 1 ms timer. */
+export const MAX_TIMER_DELAY_MS = 2_147_483_647;
+
+/**
+ * Normalize optional/disable-capable timer inputs. Nonpositive and NaN values
+ * disable the timer; oversized and infinite values cap at Node's real limit.
+ */
+export function clampTimerDelayMs(value: number): number {
+	if (Number.isNaN(value) || value <= 0) return 0;
+	return value >= MAX_TIMER_DELAY_MS ? MAX_TIMER_DELAY_MS : Math.floor(value);
+}
+
+export function sleep(ms: number): Promise<void> {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+let negativeDurations = 0;
+
+/**
+ * Elapsed between two reads of the same clock, signed.
+ *
+ * A negative result means the clock moved backwards between the two reads —
+ * an NTP correction, a resume, or a duration derived across two hosts — and it
+ * is a bug in the caller, not a value to be silently swallowed. Clamping with
+ * `Math.max(0, …)` hides that, so the clamp belongs at the render boundary and
+ * nothing else. Every occurrence is counted; nothing is written to stderr,
+ * because the TUI owns that stream and this sits on hot measurement paths.
+ */
+export function rawDurationMs(start: number, end: number): number {
+	const elapsed = end - start;
+	if (elapsed < 0) negativeDurations += 1;
+	return elapsed;
+}
+
+/** How many negative durations this process has produced since it started. */
+export function negativeDurationCount(): number {
+	return negativeDurations;
+}

package/src/core/tool-names.ts

@@ -0,0 +1,65 @@
+/**
+ * Canonical tool names. Everything that dispatches a tool call references these constants
+ * so mode matrices, safety classifiers, and audit filters never diverge on spelling.
+ *
+ * The surface is organized in seven planes; each plane is one policy unit
+ * (action class, size posture, details schema, concurrency rule):
+ *   OBSERVE      read, grep, find, ls, code_nav, context, credential_present
+ *   MUTATE       write, edit
+ *   EXECUTE      bash, git, verify
+ *   ORCHESTRATE  dispatch, monitor, steer, tasks
+ *   RETRIEVE     web_fetch
+ *   INTERACT     ask_user
+ *   ARTIFACT     artifact
+ */
+
+export const ToolNames = {
+	// OBSERVE
+	Read: "read",
+	Grep: "grep",
+	Find: "find",
+	Ls: "ls",
+	CodeNav: "code_nav",
+	Context: "context",
+	CredentialPresent: "credential_present",
+	// MUTATE
+	Write: "write",
+	Edit: "edit",
+	// EXECUTE
+	Bash: "bash",
+	Git: "git",
+	Verify: "verify",
+	// ORCHESTRATE
+	Dispatch: "dispatch",
+	Monitor: "monitor",
+	Steer: "steer",
+	Tasks: "tasks",
+	Ledger: "ledger",
+	// RETRIEVE
+	WebFetch: "web_fetch",
+	// INTERACT
+	AskUser: "ask_user",
+	// ARTIFACT
+	Artifact: "artifact",
+	// DESIGN-RESERVED, not implemented: gateway, the MCP/DB proxy. One fixed
+	// schema; external capabilities are surfaced through find/describe/call
+	// RESULTS, never as per-capability schemas in the prompt prefix. Contract
+	// sketch: gateway(op: "find" | "describe" | "call", capability?, args?)
+	// -> JSON capability listings / schemas / call results, network action
+	// class, sequential. Reserving the name here keeps classifiers and
+	// profiles from ever assigning "gateway" to a dynamic tool.
+	// Gateway: "gateway",
+} as const;
+
+export type BuiltinToolName = (typeof ToolNames)[keyof typeof ToolNames];
+
+declare const dynamicToolNameBrand: unique symbol;
+export type DynamicToolName = string & { readonly [dynamicToolNameBrand]: "dynamic-tool-name" };
+
+export type ToolName = BuiltinToolName | DynamicToolName;
+
+export const ALL_TOOL_NAMES: ReadonlyArray<BuiltinToolName> = Object.values(ToolNames);
+
+export function isBuiltinToolName(name: ToolName): name is BuiltinToolName {
+	return (ALL_TOOL_NAMES as ReadonlyArray<string>).includes(name);
+}

package/src/core/verification-scripts.ts

@@ -0,0 +1,13 @@
+export const VERIFICATION_SCRIPT_FAMILY_HINT = "test*/lint*/build*/typecheck*/check*/format*/ci*";
+
+const VERIFICATION_SCRIPT_PATTERN = /^(?:test|lint|build|typecheck|check|format|ci)(?:[:.-].*)?$/;
+
+export function isVerificationScriptName(name: string): boolean {
+	return VERIFICATION_SCRIPT_PATTERN.test(name);
+}
+
+export function declaredVerificationScripts(scripts: Record<string, unknown>): string[] {
+	return Object.keys(scripts)
+		.filter((name) => isVerificationScriptName(name))
+		.sort((a, b) => a.localeCompare(b));
+}