@kindgi/guardrails 0.0.0-bootstrap.0 → 0.1.1

package/src/action-handler.ts

@@ -0,0 +1,179 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+import type { EvaluationResult, Guardrail, RunTrace } from './types.js';
+
+/**
+ * A handler that knows how to APPLY one action (`halt`, `retry`,
+ * `escalate`, `log-only`, `compensate`, or custom). Registered once at
+ * boot. When `EvaluationBindings.actions` is set, the engine calls the
+ * handler for a violation's action after evaluating the guardrail;
+ * without it, the engine only reports the action and the caller applies
+ * it.
+ *
+ * Handlers don't mutate the trace; they emit side effects (schedule
+ * retry, enqueue HITL review, run compensating tool). The engine
+ * computes `action` from the guardrail's declaration and hands off to
+ * the registered handler.
+ *
+ * Adapter packages register their own action handlers (e.g. escalate →
+ * a HITL queue) without touching the engine.
+ */
+export interface ActionHandler {
+  /** Discriminant matching `guardrail.action['on-violation']`. */
+  readonly action: string;
+  /** Human-friendly name for diagnostics. */
+  readonly name?: string;
+  /**
+   * Apply the action. Called after the engine identifies a violation.
+   * An `err` result is attached to the evaluation as
+   * `result.attributes.actionHandlerError`; it doesn't roll back the
+   * evaluation (violation still recorded, compliance evidence still
+   * emitted).
+   */
+  apply(context: ActionContext): Promise<ActionResult>;
+}
+
+export interface ActionContext {
+  readonly guardrail: Guardrail;
+  readonly evaluation: EvaluationResult;
+  readonly trace: RunTrace;
+}
+
+export type ActionResult =
+  | { readonly kind: 'ok' }
+  | { readonly kind: 'err'; readonly error: { readonly code: string; readonly message: string } };
+
+/** Registry the engine consults when a violation surfaces. */
+export interface ActionHandlerRegistry {
+  register(handler: ActionHandler): void;
+  get(action: string): ActionHandler | undefined;
+  list(): readonly ActionHandler[];
+}
+
+export function createActionHandlerRegistry(
+  seed: readonly ActionHandler[] = [],
+): ActionHandlerRegistry {
+  const handlers = new Map<string, ActionHandler>();
+  for (const h of seed) handlers.set(h.action, h);
+  return {
+    register(handler): void {
+      handlers.set(handler.action, handler);
+    },
+    get(action): ActionHandler | undefined {
+      return handlers.get(action);
+    },
+    list(): readonly ActionHandler[] {
+      return [...handlers.values()];
+    },
+  };
+}
+
+// ============ built-in action handlers (record-only defaults) ============
+
+/**
+ * `halt` — the caller (e.g. the agent runtime) is expected to stop the
+ * run. This handler is a no-op record; the enforcement happens in the
+ * caller, which sees the `halt` action in the EvaluationResult.
+ */
+export const haltHandler: ActionHandler = {
+  action: 'halt',
+  name: 'Halt run',
+  async apply(): Promise<ActionResult> {
+    return { kind: 'ok' };
+  },
+};
+
+/** `log-only` — record + carry on. */
+export const logOnlyHandler: ActionHandler = {
+  action: 'log-only',
+  name: 'Log only',
+  async apply(): Promise<ActionResult> {
+    return { kind: 'ok' };
+  },
+};
+
+/** `noop` — action synthesized when the check passes; nothing to do. */
+export const noopHandler: ActionHandler = {
+  action: 'noop',
+  name: 'No-op (check passed)',
+  async apply(): Promise<ActionResult> {
+    return { kind: 'ok' };
+  },
+};
+
+/**
+ * `retry` — records the retry intent. Actual retry scheduling happens
+ * in the caller. Handler validates the guardrail's action.retry policy
+ * is well-formed.
+ */
+export const retryHandler: ActionHandler = {
+  action: 'retry',
+  name: 'Retry (caller-scheduled)',
+  async apply(ctx): Promise<ActionResult> {
+    const retry = ctx.guardrail.action.retry;
+    if (retry === undefined || retry.maxAttempts <= 0) {
+      return {
+        kind: 'err',
+        error: {
+          code: 'invalid-action-config',
+          message: `retry action on guardrail "${ctx.guardrail.id}" needs action.retry.maxAttempts > 0`,
+        },
+      };
+    }
+    return { kind: 'ok' };
+  },
+};
+
+/**
+ * `escalate` — records the escalate intent. Actual routing (e.g. to a
+ * HITL review queue) happens in the caller or an adapter handler.
+ * Handler validates `guardrail.action.escalateTo` is set.
+ */
+export const escalateHandler: ActionHandler = {
+  action: 'escalate',
+  name: 'Escalate (caller-routed)',
+  async apply(ctx): Promise<ActionResult> {
+    if (ctx.guardrail.action.escalateTo === undefined) {
+      return {
+        kind: 'err',
+        error: {
+          code: 'invalid-action-config',
+          message: `escalate action on guardrail "${ctx.guardrail.id}" needs action.escalateTo`,
+        },
+      };
+    }
+    return { kind: 'ok' };
+  },
+};
+
+/**
+ * `compensate` — records the compensation intent. The caller invokes
+ * the compensating tool via `guardrail.action.compensateWith`.
+ */
+export const compensateHandler: ActionHandler = {
+  action: 'compensate',
+  name: 'Compensate (caller-invoked)',
+  async apply(ctx): Promise<ActionResult> {
+    if (ctx.guardrail.action.compensateWith === undefined) {
+      return {
+        kind: 'err',
+        error: {
+          code: 'invalid-action-config',
+          message: `compensate action on guardrail "${ctx.guardrail.id}" needs action.compensateWith`,
+        },
+      };
+    }
+    return { kind: 'ok' };
+  },
+};
+
+/** Convenience seed with all built-in handlers. */
+export const BUILT_IN_ACTION_HANDLERS: readonly ActionHandler[] = [
+  haltHandler,
+  logOnlyHandler,
+  noopHandler,
+  retryHandler,
+  escalateHandler,
+  compensateHandler,
+];

package/src/checks.ts

@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+import type { CheckFunction, CheckRegistry, RegisteredCheck } from './types.js';
+
+/**
+ * Built-in check library. Every entry is `kind: 'zero-llm'` — pure
+ * functions over the run trace, no external calls, deterministic. See
+ * `judge.ts` for LLM-judge evaluation.
+ *
+ * Adding a new built-in check: implement the function, add it to
+ * `BUILT_IN_CHECKS`, document its `config` schema in the JSDoc block.
+ */
+
+/**
+ * `must-cite`: assistant output must include at least N matches of the
+ * citation pattern. Config:
+ *   `{ minCitations?: number /* default 1 *\/, sourcePattern?: string /* regex *\/ }`
+ *
+ * Default `sourcePattern` matches `[<name>]`-style citations; override for
+ * verticals with different citation conventions.
+ */
+const mustCite: CheckFunction = async (config, trace) => {
+  const minCitations = typeof config.minCitations === 'number' ? config.minCitations : 1;
+  const sourcePattern =
+    typeof config.sourcePattern === 'string' ? config.sourcePattern : '\\[[^\\]]+\\]';
+  if (trace.output === undefined || trace.output.length === 0) {
+    return { passed: false, reason: 'output empty; nothing to cite' };
+  }
+  const re = new RegExp(sourcePattern, 'g');
+  const matches = trace.output.match(re) ?? [];
+  if (matches.length >= minCitations) {
+    return { passed: true, attributes: { citationCount: matches.length } };
+  }
+  return {
+    passed: false,
+    reason: `expected >= ${minCitations} citations, found ${matches.length}`,
+    attributes: { citationCount: matches.length },
+  };
+};
+
+/**
+ * `never-call-tool`: fail if any of the listed tools were invoked.
+ * Config: `{ tools: string[] }` — tool ids or names to forbid.
+ */
+const neverCallTool: CheckFunction = async (config, trace) => {
+  // Accept both tool id / name strings and ToolRef objects
+  // ({ id, version }) — pack config authors may use either.
+  const rawTools = Array.isArray(config.tools) ? (config.tools as unknown[]) : [];
+  const forbidden = new Set<string>();
+  for (const entry of rawTools) {
+    if (typeof entry === 'string') {
+      forbidden.add(entry);
+    } else if (
+      entry !== null &&
+      typeof entry === 'object' &&
+      'id' in entry &&
+      typeof (entry as { id: unknown }).id === 'string'
+    ) {
+      forbidden.add((entry as { id: string }).id);
+    }
+  }
+  const violations: string[] = [];
+  for (const call of trace.toolCalls) {
+    if (forbidden.has(call.toolId) || forbidden.has(call.toolName)) {
+      violations.push(call.toolName);
+    }
+  }
+  if (violations.length === 0) return { passed: true };
+  return {
+    passed: false,
+    reason: `forbidden tool(s) invoked: ${[...new Set(violations)].join(', ')}`,
+    attributes: { violatingTools: [...new Set(violations)] },
+  };
+};
+
+/**
+ * `max-tool-calls`: cap total tool invocations. Config: `{ max?: number }` (default 10).
+ * Guards against runaway agents.
+ */
+const maxToolCalls: CheckFunction = async (config, trace) => {
+  const max = typeof config.max === 'number' ? config.max : 10;
+  if (trace.toolCalls.length <= max) {
+    return { passed: true, attributes: { toolCallCount: trace.toolCalls.length } };
+  }
+  return {
+    passed: false,
+    reason: `expected <= ${max} tool calls, saw ${trace.toolCalls.length}`,
+    attributes: { toolCallCount: trace.toolCalls.length },
+  };
+};
+
+/**
+ * `output-matches`: final assistant output must match a regex (or fail
+ * if `negate: true`). Config: `{ pattern: string, flags?: string, negate?: boolean }`.
+ */
+const outputMatches: CheckFunction = async (config, trace) => {
+  const pattern = typeof config.pattern === 'string' ? config.pattern : '';
+  const flags = typeof config.flags === 'string' ? config.flags : '';
+  const negate = config.negate === true;
+  if (pattern.length === 0) {
+    return { passed: false, reason: 'pattern config is required' };
+  }
+  const re = new RegExp(pattern, flags);
+  const output = trace.output ?? '';
+  const matched = re.test(output);
+  const passed = negate ? !matched : matched;
+  return passed
+    ? { passed: true }
+    : {
+        passed: false,
+        reason: negate
+          ? `output matched forbidden pattern /${pattern}/`
+          : `output did not match /${pattern}/`,
+      };
+};
+
+/**
+ * `tool-order`: tool calls must appear in a specified order. Config:
+ *   `{ sequence: string[] }` — tool names in expected order (subsequence).
+ * Non-listed tools are allowed to appear anywhere; the sequence must exist
+ * as a subsequence of the actual call order.
+ */
+const toolOrder: CheckFunction = async (config, trace) => {
+  const sequence = Array.isArray(config.sequence) ? (config.sequence as string[]) : [];
+  if (sequence.length === 0) return { passed: true };
+  let seqIndex = 0;
+  for (const call of trace.toolCalls) {
+    if (call.toolName === sequence[seqIndex]) seqIndex += 1;
+    if (seqIndex === sequence.length) return { passed: true };
+  }
+  return {
+    passed: false,
+    reason: `expected tool-call subsequence [${sequence.join(', ')}] not observed`,
+    attributes: { matchedPrefix: sequence.slice(0, seqIndex) },
+  };
+};
+
+/**
+ * `required-substring`: `trace.output` must contain EVERY listed pattern.
+ * Config: `{ patterns: string[], caseSensitive?: boolean }`.
+ *
+ * Mirror of `forbidden-substring` — enables "output must include the
+ * standard legal disclaimer / required attribution / policy footer"
+ * without needing an llm-judge.
+ *
+ * Empty `patterns` array passes vacuously. Missing `output` on the
+ * trace fails (nothing can contain the required text).
+ */
+const requiredSubstring: CheckFunction = async (config, trace) => {
+  const patternsRaw = Array.isArray(config.patterns) ? (config.patterns as unknown[]) : [];
+  const patterns = patternsRaw.filter((p): p is string => typeof p === 'string' && p.length > 0);
+  if (patterns.length === 0) return { passed: true };
+  if (trace.output === undefined || trace.output.length === 0) {
+    return {
+      passed: false,
+      reason: `output empty; ${patterns.length} required pattern(s) not satisfied`,
+      attributes: { missing: patterns },
+    };
+  }
+  const caseSensitive = config.caseSensitive === true;
+  const haystack = caseSensitive ? trace.output : trace.output.toLowerCase();
+  const missing: string[] = [];
+  for (const p of patterns) {
+    const needle = caseSensitive ? p : p.toLowerCase();
+    if (!haystack.includes(needle)) missing.push(p);
+  }
+  if (missing.length === 0) return { passed: true };
+  return {
+    passed: false,
+    reason: `output missing required pattern(s): ${missing.join(', ')}`,
+    attributes: { missing },
+  };
+};
+
+/**
+ * `forbidden-substring`: `trace.output` must NOT contain any listed pattern.
+ * Config: `{ patterns: string[], caseSensitive?: boolean }`.
+ *
+ * Symmetric to `required-substring`. Enables "output must not contain
+ * PII markers / off-limits phrases / policy trigger words" without an
+ * llm-judge.
+ */
+const forbiddenSubstring: CheckFunction = async (config, trace) => {
+  const patternsRaw = Array.isArray(config.patterns) ? (config.patterns as unknown[]) : [];
+  const patterns = patternsRaw.filter((p): p is string => typeof p === 'string' && p.length > 0);
+  if (patterns.length === 0) return { passed: true };
+  if (trace.output === undefined || trace.output.length === 0) return { passed: true };
+  const caseSensitive = config.caseSensitive === true;
+  const haystack = caseSensitive ? trace.output : trace.output.toLowerCase();
+  const violated: string[] = [];
+  for (const p of patterns) {
+    const needle = caseSensitive ? p : p.toLowerCase();
+    if (haystack.includes(needle)) violated.push(p);
+  }
+  if (violated.length === 0) return { passed: true };
+  return {
+    passed: false,
+    reason: `output contains forbidden pattern(s): ${violated.join(', ')}`,
+    attributes: { violated },
+  };
+};
+
+const BUILT_IN_CHECKS: readonly RegisteredCheck[] = [
+  { id: 'must-cite', kind: 'zero-llm', evaluate: mustCite },
+  { id: 'never-call-tool', kind: 'zero-llm', evaluate: neverCallTool },
+  { id: 'max-tool-calls', kind: 'zero-llm', evaluate: maxToolCalls },
+  { id: 'output-matches', kind: 'zero-llm', evaluate: outputMatches },
+  { id: 'tool-order', kind: 'zero-llm', evaluate: toolOrder },
+  { id: 'required-substring', kind: 'zero-llm', evaluate: requiredSubstring },
+  { id: 'forbidden-substring', kind: 'zero-llm', evaluate: forbiddenSubstring },
+];
+
+/**
+ * Create a fresh CheckRegistry pre-populated with built-in checks.
+ * Consumers register custom checks at pack init.
+ */
+export function createCheckRegistry(seed: readonly RegisteredCheck[] = []): CheckRegistry {
+  const checks = new Map<string, RegisteredCheck>();
+  for (const c of BUILT_IN_CHECKS) checks.set(c.id, c);
+  for (const c of seed) checks.set(c.id, c);
+  return {
+    register(check): void {
+      checks.set(check.id, check);
+    },
+    get(id): RegisteredCheck | undefined {
+      return checks.get(id);
+    },
+    list(): readonly RegisteredCheck[] {
+      return [...checks.values()];
+    },
+  };
+}
+
+/** Exported for tests + downstream introspection. */
+export const BUILT_IN_CHECK_IDS = BUILT_IN_CHECKS.map((c) => c.id);

package/src/define-check.ts

@@ -0,0 +1,207 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+
+import type { ValidateFunction } from 'ajv';
+import * as addFormatsModule from 'ajv-formats';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+
+import { isZodSchema, loadZodConverterSync, toJSONSchemaSync } from '@kindgi/schema';
+import type { AnySchema, ZodLikeSchema } from '@kindgi/schema';
+
+import type { InvalidCheckDefinitionError } from './errors.js';
+import type { CheckFunction, GuardrailKind, RegisteredCheck } from './types.js';
+
+type AddFormatsFn = (ajv: InstanceType<typeof Ajv2020>, opts?: unknown) => unknown;
+const addFormatsRaw = addFormatsModule as unknown;
+const addFormats: AddFormatsFn =
+  typeof addFormatsRaw === 'function'
+    ? (addFormatsRaw as AddFormatsFn)
+    : (addFormatsRaw as { default: AddFormatsFn }).default;
+
+/**
+ * Author-time inference from a Zod schema's `_zod.output`. Non-Zod
+ * schemas fall through to `Readonly<Record<string, unknown>>` — the
+ * same type that `Guardrail.config` already carries.
+ */
+export type InferCheckConfig<T> = T extends { readonly _zod: { readonly output: infer O } }
+  ? O
+  : Readonly<Record<string, unknown>>;
+
+/**
+ * The author-facing spec accepted by `defineCheck`. Extends
+ * `RegisteredCheck` with an optional `configSchema` slot that can be
+ * either a JSON Schema object or a Zod v4 schema. When set,
+ * `defineCheck` derives `validateConfig` from the schema — authors
+ * don't have to write it separately.
+ *
+ * `evaluate` is typed against the schema-inferred config for Zod-
+ * authored checks; JSON-Schema-authored checks fall back to
+ * `Readonly<Record<string, unknown>>`.
+ */
+export interface DefineCheckSpec<TConfigSchema extends AnySchema> {
+  /**
+   * Check identifier. Referenced by `Guardrail.check` on the wire.
+   * Convention: dot-namespaced for pack-authored checks (e.g.
+   * `'acme.max-citations'`); framework-shipped checks use stable ids
+   * like `'must-cite'` / `'never-call-tool'`.
+   */
+  readonly id: string;
+  /**
+   * `'zero-llm'` — pure function over the trace (fast, deterministic,
+   * default). `'llm-judge'` — uses a model (opt-in, costs money;
+   * needs `bindings.providerRegistry` or `bindings.judgeProvider`).
+   * `'external'` — evaluated by a caller-registered strategy.
+   */
+  readonly kind: GuardrailKind;
+  /**
+   * Config schema — Zod v4 or JSON Schema. When present, `defineCheck`
+   * derives `RegisteredCheck.validateConfig` from it, and
+   * `defineGuardrail` runs that against each `Guardrail.config`.
+   * Zod authors get schema-inferred config types on `evaluate`'s first
+   * parameter.
+   */
+  readonly configSchema?: TConfigSchema;
+  /**
+   * The check function. Signature: `(config, trace, bindings) => Promise<CheckResult>`.
+   * `config` is the guardrail's declared config (typed via `configSchema`
+   * when Zod-authored). `trace` is the accumulated `RunTrace` from the
+   * agent turn. `bindings` is the `EvaluationBindings` the caller
+   * passed to the engine (`{}` when none).
+   * Return `{passed: true}` or `{passed: false, reason: string, ...}`.
+   */
+  readonly evaluate: (
+    config: InferCheckConfig<TConfigSchema>,
+    trace: Parameters<CheckFunction>[1],
+    bindings: Parameters<CheckFunction>[2],
+  ) => ReturnType<CheckFunction>;
+  /**
+   * Optional custom config validator. When `configSchema` is also set,
+   * both run — `configSchema` first, then this. `undefined` return means
+   * "config is valid"; non-undefined string is the error message.
+   */
+  readonly validateConfig?: (config: unknown) => string | undefined;
+}
+
+/**
+ * The concrete RegisteredCheck returned by `defineCheck`. When the
+ * author provided a Zod schema at `configSchema`, `configZod` is
+ * present so TS callers can `z.infer<typeof check.configZod>` for
+ * static types.
+ */
+export type DefinedCheck<TConfigSchema extends AnySchema> = RegisteredCheck & {
+  readonly configZod: TConfigSchema extends ZodLikeSchema ? TConfigSchema : undefined;
+  readonly configJsonSchema?: Readonly<Record<string, unknown>>;
+};
+
+/**
+ * Build a `RegisteredCheck` with optional schema-derived config
+ * validation. Two authoring surfaces coexist:
+ *   1. JSON Schema Draft 2020-12 objects — compiled at author time
+ *      via Ajv; the check's `validateConfig` is derived from the
+ *      compiled validator.
+ *   2. Zod v4 schemas — converted via `z.toJSONSchema()` (peer dep),
+ *      then compiled the same way. TS callers get `z.infer<typeof
+ *      check.configZod>` for static config typing.
+ *
+ * When `configSchema` is omitted, this behaves as a passthrough:
+ * returns the check with the caller's `validateConfig` (or undefined).
+ *
+ * Failures at author time (Zod conversion or Ajv compile) surface via
+ * throw — same failure mode as construction of a bad
+ * `RegisteredCheck` object literal. Consumers catch at pack-init;
+ * downstream `defineGuardrail` runs the derived `validateConfig` at
+ * spec-registration time and reports via `Result`.
+ */
+export function defineCheck<TConfigSchema extends AnySchema = AnySchema>(
+  spec: DefineCheckSpec<TConfigSchema>,
+): DefinedCheck<TConfigSchema> {
+  const converter =
+    spec.configSchema !== undefined && isZodSchema(spec.configSchema)
+      ? loadZodConverterSync()
+      : undefined;
+
+  let derivedValidator: ((config: unknown) => string | undefined) | undefined;
+  let jsonSchema: Readonly<Record<string, unknown>> | undefined;
+  let zodSchema: ZodLikeSchema | undefined;
+
+  if (spec.configSchema !== undefined) {
+    if (isZodSchema(spec.configSchema)) {
+      zodSchema = spec.configSchema;
+      const converted = toJSONSchemaSync(spec.configSchema, converter, 'input');
+      if (converted.kind === 'err') {
+        const err: InvalidCheckDefinitionError = {
+          code: 'invalid-check-definition',
+          message: `Check "${spec.id}" configSchema Zod conversion failed: ${converted.error.message}`,
+          checkId: spec.id,
+          cause: converted.error.cause,
+        };
+        throw errorFromDefinition(err);
+      }
+      jsonSchema = converted.value;
+    } else {
+      jsonSchema = spec.configSchema as Readonly<Record<string, unknown>>;
+    }
+    const validator = compileValidator(jsonSchema, spec.id);
+    derivedValidator = (config: unknown) => {
+      if (!validator(config)) {
+        const errors = validator.errors ?? [];
+        const first = errors[0] as { instancePath?: string; message?: string } | undefined;
+        const path = first?.instancePath ?? '';
+        const message = first?.message ?? 'invalid config';
+        return `${path} ${message}`.trim();
+      }
+      return undefined;
+    };
+  }
+
+  const chainValidator = (
+    a?: (config: unknown) => string | undefined,
+    b?: (config: unknown) => string | undefined,
+  ): ((config: unknown) => string | undefined) | undefined => {
+    if (a === undefined) return b;
+    if (b === undefined) return a;
+    return (config) => {
+      const first = a(config);
+      if (first !== undefined) return first;
+      return b(config);
+    };
+  };
+
+  const validate = chainValidator(derivedValidator, spec.validateConfig);
+
+  const check = {
+    id: spec.id,
+    kind: spec.kind,
+    evaluate: spec.evaluate as CheckFunction,
+    ...(validate !== undefined && { validateConfig: validate }),
+    ...(zodSchema !== undefined && { configZod: zodSchema }),
+    ...(jsonSchema !== undefined && { configJsonSchema: jsonSchema }),
+  } as unknown as DefinedCheck<TConfigSchema>;
+
+  return check;
+}
+
+function compileValidator(
+  schema: Readonly<Record<string, unknown>>,
+  checkId: string,
+): ValidateFunction {
+  const ajv = new Ajv2020({ strict: true, allErrors: true, allowUnionTypes: false });
+  addFormats(ajv);
+  try {
+    return ajv.compile(schema as object);
+  } catch (cause) {
+    const err: InvalidCheckDefinitionError = {
+      code: 'invalid-check-definition',
+      message: `Check "${checkId}" configSchema does not compile as JSON Schema Draft 2020-12: ${cause instanceof Error ? cause.message : String(cause)}`,
+      checkId,
+      cause,
+    };
+    throw errorFromDefinition(err);
+  }
+}
+
+function errorFromDefinition(err: InvalidCheckDefinitionError): Error {
+  const wrapped = new Error(err.message);
+  Object.assign(wrapped, err);
+  return wrapped;
+}