@legionworks/facet 1.9.0

package/src/validation/tier0/tsx/ast-policy.ts

@@ -0,0 +1,181 @@
+/**
+ * TypeScript AST policy for TSX artifacts.
+ *
+ * This public module keeps the stable import surface while the walker and its
+ * capability rules live in focused modules.
+ */
+
+import ts from "typescript";
+
+import type { DiscriminativeError } from "../../../shared/contracts/validation";
+import { classifyTsxImport, type TsxImportDenial } from "../../../shared/tsx/import-policy";
+import {
+  checkCallExpression,
+  checkElementAccess,
+  checkNewExpression,
+  checkPropertyAccess,
+  checkVariableStatement,
+} from "./ast-policy-capabilities";
+
+export { TSX_CAPABILITY_CODES } from "./ast-policy-shared";
+
+export function isShadowedByLocalBinding(node: ts.Identifier): boolean {
+  let current: ts.Node = node;
+  while (true) {
+    const parent = current.parent;
+    if (parent === undefined) return false;
+    if (
+      (ts.isVariableDeclaration(parent) && parent.name === current) ||
+      (ts.isFunctionDeclaration(parent) && parent.name === current) ||
+      (ts.isParameter(parent) && parent.name === current) ||
+      (ts.isBindingElement(parent) && parent.name === current)
+    ) {
+      return true;
+    }
+    if (scopeDeclaresName(parent, node.text, node)) return true;
+    current = parent;
+  }
+}
+
+function scopeDeclaresName(scope: ts.Node, name: string, beforeNode: ts.Node): boolean {
+  if (
+    ts.isFunctionDeclaration(scope) ||
+    ts.isFunctionExpression(scope) ||
+    ts.isArrowFunction(scope) ||
+    ts.isMethodDeclaration(scope) ||
+    ts.isConstructorDeclaration(scope) ||
+    ts.isGetAccessorDeclaration(scope) ||
+    ts.isSetAccessorDeclaration(scope)
+  ) {
+    for (const param of scope.parameters) {
+      if (parameterDeclaresName(param, name)) return true;
+    }
+    return false;
+  }
+  if (ts.isCatchClause(scope)) {
+    const decl = scope.variableDeclaration;
+    if (decl !== undefined && bindingNameMatches(decl.name, name)) return true;
+    return false;
+  }
+  if (ts.isForStatement(scope)) {
+    const init = scope.initializer;
+    if (init !== undefined && ts.isVariableDeclarationList(init)) {
+      for (const decl of init.declarations) {
+        if (bindingNameMatches(decl.name, name) && decl.getStart() < beforeNode.getStart())
+          return true;
+      }
+    }
+    return false;
+  }
+  if (ts.isForInStatement(scope) || ts.isForOfStatement(scope)) {
+    const init = scope.initializer;
+    if (init !== undefined && ts.isVariableDeclarationList(init)) {
+      for (const decl of init.declarations) {
+        if (bindingNameMatches(decl.name, name)) return true;
+      }
+    }
+    return false;
+  }
+  let statements: readonly ts.Statement[] | undefined;
+  if (ts.isSourceFile(scope)) statements = scope.statements;
+  else if (ts.isBlock(scope)) statements = scope.statements;
+  else if (ts.isModuleBlock(scope)) statements = scope.statements;
+  if (statements === undefined) return false;
+  for (const stmt of statements) {
+    if (statementDeclaresName(stmt, name, beforeNode)) return true;
+  }
+  return false;
+}
+
+function parameterDeclaresName(param: ts.ParameterDeclaration, name: string): boolean {
+  if (param.name === undefined) return false;
+  return bindingNameMatches(param.name, name);
+}
+
+function statementDeclaresName(stmt: ts.Statement, name: string, beforeNode: ts.Node): boolean {
+  if (ts.isVariableStatement(stmt)) {
+    for (const decl of stmt.declarationList.declarations) {
+      if (bindingNameMatches(decl.name, name) && decl.getStart() < beforeNode.getStart())
+        return true;
+    }
+    return false;
+  }
+  if (ts.isFunctionDeclaration(stmt) && stmt.name?.text === name) return true;
+  if (
+    ts.isClassDeclaration(stmt) &&
+    stmt.name?.text === name &&
+    stmt.getStart() < beforeNode.getStart()
+  ) {
+    return true;
+  }
+  if (ts.isImportDeclaration(stmt)) {
+    const clause = stmt.importClause;
+    if (clause === undefined) return false;
+    if (clause.name?.text === name) return true;
+    const bindings = clause.namedBindings;
+    if (bindings !== undefined && ts.isNamedImports(bindings)) {
+      for (const spec of bindings.elements) {
+        if (ts.isIdentifier(spec.name) && spec.name.text === name) return true;
+      }
+    }
+  }
+  return false;
+}
+
+function bindingNameMatches(pattern: ts.BindingName, name: string): boolean {
+  if (ts.isIdentifier(pattern)) return pattern.text === name;
+  if (ts.isObjectBindingPattern(pattern) || ts.isArrayBindingPattern(pattern)) {
+    for (const element of pattern.elements) {
+      if (ts.isOmittedExpression(element)) continue;
+      if (bindingNameMatches(element.name, name)) return true;
+    }
+  }
+  return false;
+}
+
+export function validateTsxAst(sourceText: string): readonly DiscriminativeError[] {
+  const sourceFile = ts.createSourceFile(
+    "artifact.tsx",
+    sourceText,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TSX,
+  );
+  const errors: DiscriminativeError[] = [];
+  for (const statement of sourceFile.statements) {
+    collectImportErrors(statement, errors);
+    collectExportErrors(statement, errors);
+  }
+  const visit = (node: ts.Node): void => {
+    if (ts.isCallExpression(node))
+      checkCallExpression(node, errors, sourceFile, isShadowedByLocalBinding);
+    else if (ts.isNewExpression(node))
+      checkNewExpression(node, errors, sourceFile, isShadowedByLocalBinding);
+    else if (ts.isVariableStatement(node)) checkVariableStatement(node, errors, sourceFile);
+    else if (ts.isPropertyAccessExpression(node)) checkPropertyAccess(node, errors, sourceFile);
+    else if (ts.isElementAccessExpression(node)) checkElementAccess(node, errors, sourceFile);
+    ts.forEachChild(node, visit);
+  };
+  ts.forEachChild(sourceFile, visit);
+  return errors;
+}
+
+function collectImportErrors(statement: ts.Statement, errors: DiscriminativeError[]): void {
+  if (!ts.isImportDeclaration(statement)) return;
+  const specifier = statement.moduleSpecifier;
+  if (!ts.isStringLiteral(specifier)) return;
+  const denial = classifyTsxImport(specifier.text);
+  if (denial !== null) errors.push(denialToError(denial));
+}
+
+function collectExportErrors(statement: ts.Statement, errors: DiscriminativeError[]): void {
+  if (!ts.isExportDeclaration(statement)) return;
+  const specifier = statement.moduleSpecifier;
+  if (specifier === undefined || !ts.isStringLiteral(specifier)) return;
+  const denial = classifyTsxImport(specifier.text);
+  if (denial !== null) errors.push(denialToError(denial));
+}
+
+function denialToError(denial: TsxImportDenial): DiscriminativeError {
+  return { code: denial.code, message: denial.message };
+}

package/src/validation/tier0/tsx/compiler.ts

@@ -0,0 +1,156 @@
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+import { FacetError } from "../../../shared/errors/facet-error";
+import type { TsxExecutionMode } from "../../../shared/contracts/validation";
+import { tsxAllowlistResolverPlugin } from "./allowlist-resolver";
+import { validateTsxAst } from "./ast-policy";
+
+export const TSX_COMPILED_OUTPUT_CAP_BYTES = 2 * 1024 * 1024;
+
+export interface CompileTsxInput {
+  readonly source: string;
+  readonly execution: TsxExecutionMode;
+}
+
+export interface CompileTsxResult {
+  readonly bytes: Uint8Array;
+  readonly sha256: string;
+  readonly mediaType: "text/html" | "text/javascript";
+  readonly html?: string;
+}
+
+const WORK_ROOT = join(resolve(import.meta.dir, "../../../.."), ".facet-tsx-worker");
+
+const INTERACTIVE_MOUNT_ENTRY = [
+  'import { createElement } from "react";',
+  'import { createRoot } from "react-dom/client";',
+  'import Artifact from "./artifact";',
+  'const mount = document.getElementById("facet-tsx-mount");',
+  'if (mount === null) throw new Error("interactive TSX mount is missing");',
+  "createRoot(mount).render(createElement(Artifact));",
+].join("\n");
+
+function canonicalizeBundleBytes(rawBytes: Uint8Array): Uint8Array {
+  const source = new TextDecoder().decode(rawBytes);
+  // Per-call mkdtemp workspaces below vary the entrypoint path. Strip Bun's
+  // path-bearing labels before hashing or storing so that isolation preserves
+  // deterministic bytes. Re-run tests/unit/tsx-compiler.test.ts (cross-checkout
+  // identity) and tests/acceptance/tsx-measurement.test.ts (same-worker ×20,
+  // restart ×3) when either mechanism changes.
+  const canonical = source.replace(
+    /^\/\/ (?:(?:[A-Za-z]:)?[./~][^\r\n]*|[^\r\n]*node_modules\/[^\r\n]*)\.(?:[cm]?[jt]sx?|json)\r?\n/gm,
+    "",
+  );
+  return new TextEncoder().encode(canonical);
+}
+
+function typedCompileError(
+  message: string,
+  details: Record<string, string | number | boolean | null>,
+): FacetError {
+  return new FacetError("tsx_compile_error", message, { retryable: false, details });
+}
+
+export async function compileTsx(input: CompileTsxInput): Promise<CompileTsxResult> {
+  return compileTsxAtWorkRoot(input, WORK_ROOT);
+}
+
+export async function compileTsxAtWorkRootForTests(
+  input: CompileTsxInput,
+  workRoot: string,
+): Promise<CompileTsxResult> {
+  return compileTsxAtWorkRoot(input, workRoot);
+}
+
+async function compileTsxAtWorkRoot(
+  input: CompileTsxInput,
+  workRoot: string,
+): Promise<CompileTsxResult> {
+  const astErrors = validateTsxAst(input.source);
+  if (astErrors.length > 0) {
+    throw new FacetError("tsx_ast_denied", "TSX source violates the capability policy", {
+      retryable: false,
+      details: { errorsJson: JSON.stringify(astErrors) },
+    });
+  }
+
+  mkdirSync(workRoot, { recursive: true, mode: 0o700 });
+  // Each compile needs a private entry/output directory so concurrent builds
+  // cannot substitute one artifact's output for another. That directory makes
+  // paths vary; canonicalizeBundleBytes removes Bun's labels before hashing and
+  // storage. Re-run tests/unit/tsx-compiler.test.ts (cross-checkout identity)
+  // and tests/acceptance/tsx-measurement.test.ts (same-worker ×20, restart ×3)
+  // when either mechanism changes.
+  const compileRoot = mkdtempSync(join(workRoot, "compile-"));
+  try {
+    chmodSync(compileRoot, 0o700);
+    const artifactEntry = join(compileRoot, "artifact.tsx");
+    const interactiveEntry = join(compileRoot, "interactive-entry.tsx");
+    const outDir = join(compileRoot, "out");
+    const output = join(outDir, "artifact.js");
+    mkdirSync(outDir, { recursive: true, mode: 0o700 });
+    await Bun.write(artifactEntry, input.source);
+    if (input.execution === "interactive")
+      await Bun.write(interactiveEntry, INTERACTIVE_MOUNT_ENTRY);
+    const result = await Bun.build({
+      entrypoints: [resolve(input.execution === "interactive" ? interactiveEntry : artifactEntry)],
+      outdir: resolve(outDir),
+      target: "browser",
+      format: "esm",
+      define: { "process.env.NODE_ENV": '"production"' },
+      minify: false,
+      splitting: false,
+      sourcemap: "none",
+      naming: "artifact.js",
+      plugins: [tsxAllowlistResolverPlugin()],
+      throw: false,
+    });
+    if (!result.success || result.outputs.length === 0) {
+      throw typedCompileError("TSX compiler failed", {
+        diagnostics: JSON.stringify(result.logs),
+        outputCount: result.outputs.length,
+      });
+    }
+    const bytes = canonicalizeBundleBytes(new Uint8Array(await result.outputs[0]!.arrayBuffer()));
+    await Bun.write(output, bytes);
+    if (bytes.byteLength > TSX_COMPILED_OUTPUT_CAP_BYTES) {
+      throw new FacetError("tsx_compile_output_cap", "TSX compiler output exceeded the byte cap", {
+        retryable: false,
+        details: { capBytes: TSX_COMPILED_OUTPUT_CAP_BYTES, sizeBytes: bytes.byteLength },
+      });
+    }
+    const bundleSha256 = createHash("sha256").update(bytes).digest("hex");
+    if (input.execution === "interactive") {
+      return { bytes, sha256: bundleSha256, mediaType: "text/javascript" };
+    }
+
+    const moduleUrl = `${Bun.pathToFileURL(output).href}?sha=${bundleSha256}`;
+    const module = (await import(moduleUrl)) as { default?: unknown };
+    const renderToStaticMarkup = (await import("react-dom/server")).renderToStaticMarkup;
+    if (typeof module.default !== "function") {
+      throw new Error("compiled TSX module has no default component export");
+    }
+    const html = renderToStaticMarkup(module.default({}));
+    const htmlBytes = new TextEncoder().encode(html);
+    if (htmlBytes.byteLength > TSX_COMPILED_OUTPUT_CAP_BYTES) {
+      throw new FacetError("tsx_compile_output_cap", "TSX HTML output exceeded the byte cap", {
+        retryable: false,
+        details: { capBytes: TSX_COMPILED_OUTPUT_CAP_BYTES, sizeBytes: htmlBytes.byteLength },
+      });
+    }
+    return {
+      bytes: htmlBytes,
+      sha256: createHash("sha256").update(htmlBytes).digest("hex"),
+      mediaType: "text/html",
+      html,
+    };
+  } catch (error) {
+    if (error instanceof FacetError) throw error;
+    const message = error instanceof Error ? error.message : String(error);
+    throw typedCompileError("TSX static rendering failed", { message });
+  } finally {
+    rmSync(compileRoot, { recursive: true, force: true });
+  }
+}

package/src/validation/tier0/worker-dispatch.ts

@@ -0,0 +1,211 @@
+import type { Tier0WorkerResult } from "../../shared/contracts/validation";
+import { parseChart } from "./chart";
+import { parseHtml } from "./html";
+import { parseMarkdown } from "./markdown";
+import { parseMermaid } from "./mermaid";
+import { parseSvg } from "./svg";
+import { compileTsx } from "./tsx/compiler";
+import type { WorkerInput } from "./worker-input";
+
+export async function runParser(input: WorkerInput): Promise<Tier0WorkerResult> {
+  const base = {
+    revisionSha: input.revisionSha,
+    expected: input.lexical,
+    tier: 0 as const,
+  };
+  switch (input.artifactType) {
+    case "markdown": {
+      const result = parseMarkdown(input.source);
+      const externalImageCount = result.observed.externalImageCount;
+      return {
+        ...base,
+        expected: { ...input.lexical, externalImageCount },
+        status: result.status === "ok" ? "ok" : "error",
+        observed:
+          result.status === "error"
+            ? { ...result.observed, discriminativeErrors: [...result.errors] }
+            : result.observed,
+      };
+    }
+    case "mermaid": {
+      const result = await parseMermaid(input.source);
+      return {
+        ...base,
+        status: result.status === "ok" ? "ok" : "error",
+        observed:
+          result.status === "error"
+            ? { ...result.observed, discriminativeErrors: [...result.errors] }
+            : result.observed,
+      };
+    }
+    case "svg": {
+      const result = parseSvg(input.source);
+      if (result.status === "ok") {
+        return {
+          ...base,
+          status: "ok",
+          observed: { ...result.observed, viewBoxes: [...result.viewBoxes] },
+        };
+      }
+      return {
+        ...base,
+        status: "error",
+        observed: { ...result.observed, discriminativeErrors: [...result.errors] },
+      };
+    }
+    case "chart": {
+      const result = parseChart(input.source);
+      return {
+        ...base,
+        status: result.status === "ok" ? "ok" : "error",
+        observed:
+          result.status === "error"
+            ? { ...result.observed, discriminativeErrors: [...result.errors] }
+            : result.observed,
+      };
+    }
+    case "html": {
+      const result = parseHtml(input.source);
+      const html = result.html;
+      return {
+        ...base,
+        status: result.status,
+        expected: { ...input.lexical, externalImageCount: html.externalImageCount, html },
+        observed: {
+          rendererRootSvgCount: 0,
+          graphCount: 0,
+          mermaidNodeCount: 0,
+          visibleSvgCount: 0,
+          opaqueRegionCount: html.canvasCount,
+          externalImageCount: html.externalImageCount,
+          html,
+          errorCount: result.status === "error" ? result.errors.length : 0,
+          ...(result.status === "error" ? { discriminativeErrors: [...result.errors] } : {}),
+        },
+      };
+    }
+    case "tsx": {
+      if (input.execution === undefined) throw new Error("TSX execution mode missing");
+      try {
+        const compiled = await compileTsx({
+          source: new TextDecoder("utf-8", { fatal: true }).decode(input.source),
+          execution: input.execution,
+        });
+        const encoded = Buffer.from(compiled.bytes).toString("base64");
+        const common = {
+          ...base,
+          status: "ok" as const,
+          execution: input.execution,
+          compiled: {
+            mediaType: compiled.mediaType,
+            bytesBase64: encoded,
+            sha256: compiled.sha256,
+          },
+        };
+        if (input.execution === "interactive") {
+          return {
+            ...common,
+            expected: { ...base.expected },
+            observed: {
+              rendererRootSvgCount: 0,
+              graphCount: 0,
+              mermaidNodeCount: 0,
+              visibleSvgCount: 0,
+              opaqueRegionCount: 0,
+              externalImageCount: 0,
+              errorCount: 0,
+            },
+          };
+        }
+        if (compiled.html === undefined) throw new Error("static TSX compiler omitted HTML");
+        const parsed = parseHtml(new TextEncoder().encode(compiled.html));
+        return {
+          ...common,
+          status: parsed.status,
+          expected: {
+            ...base.expected,
+            rendererRootSvgCount: 0,
+            mermaidNodeCount: 0,
+            opaqueRegionCount: parsed.html.canvasCount,
+            html: parsed.html,
+            externalImageCount: parsed.html.externalImageCount,
+          },
+          observed: {
+            rendererRootSvgCount: 0,
+            graphCount: 0,
+            mermaidNodeCount: 0,
+            visibleSvgCount: 0,
+            opaqueRegionCount: parsed.html.canvasCount,
+            externalImageCount: parsed.html.externalImageCount,
+            html: parsed.html,
+            errorCount: parsed.status === "error" ? parsed.errors.length : 0,
+            ...(parsed.status === "error" ? { discriminativeErrors: [...parsed.errors] } : {}),
+          },
+        };
+      } catch (error) {
+        const facet = error instanceof Error && "code" in error ? error : null;
+        const code =
+          facet !== null && typeof facet.code === "string" ? facet.code : "tsx_compile_error";
+        if (
+          code === "tsx_ast_denied" ||
+          code === "tsx_compile_error" ||
+          code === "tsx_compile_output_cap"
+        ) {
+          const details =
+            facet !== null && "options" in facet
+              ? (facet.options as { details?: Record<string, unknown> }).details
+              : undefined;
+          const errors = tsxDiscriminativeErrors(code, error, details);
+          return {
+            ...base,
+            status: "error",
+            execution: input.execution,
+            observed: {
+              rendererRootSvgCount: 0,
+              graphCount: 0,
+              mermaidNodeCount: 0,
+              visibleSvgCount: 0,
+              opaqueRegionCount: 0,
+              externalImageCount: 0,
+              errorCount: errors.length,
+              discriminativeErrors: errors,
+            },
+          };
+        }
+        throw error;
+      }
+    }
+    default: {
+      const exhaustive: never = input.artifactType;
+      void exhaustive;
+      throw new Error(`Unsupported artifact type for tier 0: ${String(input.artifactType)}`);
+    }
+  }
+}
+
+function tsxDiscriminativeErrors(
+  code: string,
+  error: unknown,
+  details: Record<string, unknown> | undefined,
+): Array<{ code: string; message: string; location?: string }> {
+  if (code === "tsx_ast_denied" && typeof details?.errorsJson === "string") {
+    return JSON.parse(details.errorsJson) as Array<{ code: string; message: string }>;
+  }
+  if (typeof details?.diagnostics === "string") {
+    const diagnostics = JSON.parse(details.diagnostics) as Array<{
+      message?: string;
+      position?: { line?: number; column?: number };
+    }>;
+    return diagnostics.map((diagnostic) => ({
+      code,
+      message: diagnostic.message ?? String(error),
+      ...(diagnostic.position?.line === undefined
+        ? {}
+        : {
+            location: `line ${diagnostic.position.line + 1}:${(diagnostic.position.column ?? 0) + 1}`,
+          }),
+    }));
+  }
+  if (typeof details?.message === "string") return [{ code, message: details.message }];
+  return [{ code, message: error instanceof Error ? error.message : String(error) }];
+}

package/src/validation/tier0/worker-entry.ts

@@ -0,0 +1,96 @@
+/**
+ * Tier 0 worker subprocess entrypoint.
+ *
+ * The file remains the spawn path; protocol decoding and parser dispatch are
+ * kept in focused modules so this entrypoint only owns process I/O.
+ */
+
+import { TIER0_INPUT_CAP_BYTES } from "../sandbox/limits";
+import { parseWorkerInput, type WorkerInput } from "./worker-input";
+import { runParser } from "./worker-dispatch";
+
+export type { WorkerInput } from "./worker-input";
+
+export function splitWorkerInputLines(buffered: string): {
+  readonly lines: readonly string[];
+  readonly remainder: string;
+} {
+  const lines: string[] = [];
+  let remainder = buffered;
+  let lineEnd = remainder.indexOf("\n");
+  while (lineEnd >= 0) {
+    const line = remainder.slice(0, lineEnd);
+    if (Buffer.byteLength(line, "utf8") > TIER0_INPUT_CAP_BYTES) {
+      throw new Error("request line exceeds byte cap");
+    }
+    lines.push(line);
+    remainder = remainder.slice(lineEnd + 1);
+    lineEnd = remainder.indexOf("\n");
+  }
+  if (Buffer.byteLength(remainder, "utf8") > TIER0_INPUT_CAP_BYTES) {
+    throw new Error("request line exceeds byte cap");
+  }
+  return { lines, remainder };
+}
+
+export async function runWorkerLoop(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  writeStdout: (text: string) => void,
+  writeStderr: (text: string) => void,
+): Promise<number> {
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let buffered = "";
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (value === undefined) continue;
+    buffered += decoder.decode(value, { stream: true });
+    let lines: readonly string[];
+    try {
+      ({ lines, remainder: buffered } = splitWorkerInputLines(buffered));
+    } catch {
+      writeStderr("tier0.worker.input_error request line exceeds byte cap\n");
+      return 2;
+    }
+    for (const line of lines) {
+      let input: WorkerInput;
+      try {
+        input = parseWorkerInput(line);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        writeStderr(`tier0.worker.input_error ${message}\n`);
+        return 2;
+      }
+      let result;
+      try {
+        result = await runParser(input);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        writeStderr(`tier0.worker.parser_error ${message}\n`);
+        return 3;
+      }
+      writeStdout(`${JSON.stringify({ requestId: input.requestId, result })}\n`);
+    }
+  }
+  if (buffered.length > 0) {
+    writeStderr("tier0.worker.input_error incomplete request line\n");
+    return 2;
+  }
+  return 0;
+}
+
+export function formatWorkerUnhandled(error: unknown): string {
+  const message = error instanceof Error ? error.message : String(error);
+  return `tier0.worker.unhandled ${message}\n`;
+}
+
+if (import.meta.main) {
+  runWorkerLoop(
+    Bun.stdin.stream().getReader(),
+    process.stdout.write.bind(process.stdout),
+    process.stderr.write.bind(process.stderr),
+  ).then(process.exit, (error) => {
+    process.stderr.write(formatWorkerUnhandled(error));
+    process.exit(1);
+  });
+}