@lifeaitools/clauth 1.30.26 → 2.0.0

package/cli/webdav-service.js

@@ -1,339 +1,339 @@
-// cli/webdav-service.js
-// WebDAV child-process supervisor — rclone serve webdav
-//
-// ISOLATION: This module has zero coupling to existing fs_* tool handlers.
-// Rollback: set webdav.enabled=false in the config block (or remove it)
-//           + delete this file + remove the two-line import in serve.js.
-//
-// Design: lazy-start. The rclone child spawns on the first fs_dav_setup call.
-// Subsequent calls return the running child's status without restarting.
-// On child crash: exponential-backoff restart loop (2s → 5s → 15s → 60s).
-
-import { spawn, execSync } from "child_process";
-import { writeFileSync, readFileSync, unlinkSync, mkdirSync, readdirSync } from "fs";
-import { tmpdir, homedir } from "os";
-import { join } from "path";
-import crypto from "crypto";
-import * as api from "./api.js";
-import { deriveToken } from "./fingerprint.js";
-
-const WEBDAV_PORT = 8620;
-const WEBDAV_USER = "claude";
-const CRED_NAME   = "webdav-claude";
-const RESTART_DELAYS = [2000, 5000, 15000, 60000];
-
-const APPDATA      = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
-const CONFIG_PATH  = join(APPDATA, "clauth", "webdav-config.json");
-
-const DEFAULT_CONFIG = {
-  enabled: true,
-  port: WEBDAV_PORT,
-  credential: CRED_NAME,
-  upstreams: [],
-};
-
-// ── Config persistence ──────────────────────────────────────────
-
-export function loadConfig() {
-  try {
-    const raw = readFileSync(CONFIG_PATH, "utf8");
-    const cfg = JSON.parse(raw);
-    if (!Array.isArray(cfg.upstreams)) cfg.upstreams = [];
-    return { ...DEFAULT_CONFIG, ...cfg };
-  } catch {
-    return { ...DEFAULT_CONFIG };
-  }
-}
-
-export function saveConfig(cfg) {
-  const dir = join(APPDATA, "clauth");
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2), "utf8");
-  _fsCfgCache = null;
-}
-
-export function addMount(name, mountPath) {
-  const cfg = loadConfig();
-  if (cfg.upstreams.some(u => u.name === name)) return { error: `Mount '${name}' already exists` };
-  cfg.upstreams.push({ name, path: mountPath });
-  saveConfig(cfg);
-  return { ok: true, upstreams: cfg.upstreams };
-}
-
-export function removeMount(name) {
-  const cfg = loadConfig();
-  const before = cfg.upstreams.length;
-  cfg.upstreams = cfg.upstreams.filter(u => u.name !== name);
-  if (cfg.upstreams.length === before) return { error: `Mount '${name}' not found` };
-  saveConfig(cfg);
-  return { ok: true, upstreams: cfg.upstreams };
-}
-
-export function updateMount(name, updates) {
-  const cfg = loadConfig();
-  const mount = cfg.upstreams.find(u => u.name === name);
-  if (!mount) return { error: `Mount '${name}' not found` };
-  if (updates.credential !== undefined) cfg.credential = updates.credential;
-  saveConfig(cfg);
-  return { ok: true, upstreams: cfg.upstreams };
-}
-
-let _fsCfgCache = null;
-
-// ── Module state ────────────────────────────────────────────────
-let _child       = null;
-let _configPath  = null;
-let _status      = "stopped";  // stopped | starting | running | error
-let _error       = null;
-let _restartCount = 0;
-let _startedAt   = null;
-let _vaultFn     = null;       // () => { password, machineHash }
-let _cfg         = null;
-
-// ── Public API ───────────────────────────────────────────────────
-
-/**
- * Ensure the rclone WebDAV child is running.
- * Idempotent — safe to call multiple times.
- * Returns { ok: true } or { error: string }.
- */
-export async function ensureRunning(vaultFn, config) {
-  if (vaultFn) _vaultFn = vaultFn;
-  if (config)  _cfg     = config;
-  if (!_cfg)   _cfg     = loadConfig();
-
-  if (_status === "running" && _child) return { ok: true };
-  if (_status === "starting")          return { ok: true, message: "still starting" };
-
-  return _startChild();
-}
-
-/** Current supervisor status — safe to call at any time. */
-export function getStatus() {
-  return {
-    status:        _status,
-    port:          WEBDAV_PORT,
-    url:           _status === "running" ? `http://127.0.0.1:${WEBDAV_PORT}` : null,
-    error:         _error || null,
-    restart_count: _restartCount,
-    started_at:    _startedAt || null,
-  };
-}
-
-/** Kill the child and clean up the temp config file. */
-export function shutdown() {
-  if (_child) {
-    _child.removeAllListeners();
-    _child.kill("SIGTERM");
-    _child = null;
-  }
-  _cleanupConfig();
-  _status = "stopped";
-}
-
-/**
- * rclone-compatible AES-CTR "obscure" — same algorithm as `rclone obscure`.
- * Used by fs_dav_setup to embed a non-plaintext credential in the mount script.
- * The result can be passed as RCLONE_CONFIG_xxx_PASS.
- */
-export function rcloneObscure(password) {
-  // Key from rclone source: lib/obscure/obscure.go  cryptKey
-  const key = Buffer.from([
-    0x9c, 0x93, 0x5b, 0x48, 0x73, 0x0a, 0x55, 0x4d,
-    0x6b, 0xfd, 0x7c, 0x63, 0xc8, 0x86, 0xd9, 0x2d,
-    0x02, 0x01, 0x99, 0x87, 0x54, 0xd3, 0x9b, 0xeb,
-    0x40, 0x87, 0x3f, 0xa1, 0x3f, 0x7a, 0xbe, 0x5e,
-  ]);
-  const iv     = crypto.randomBytes(16);
-  const cipher = crypto.createCipheriv("aes-256-ctr", key, iv);
-  const ct     = Buffer.concat([cipher.update(Buffer.from(password, "utf8")), cipher.final()]);
-  return Buffer.concat([iv, ct]).toString("base64url");
-}
-
-// ── Internal ─────────────────────────────────────────────────────
-
-async function _startChild() {
-  _status = "starting";
-  _error  = null;
-
-  if (!_cfg?.upstreams?.length) {
-    _status = "error";
-    _error  = "No mount points configured — add them in the clauth dashboard";
-    return { error: _error };
-  }
-
-  // 1. Resolve credential from vault
-  let pass;
-  try {
-    const vault = _vaultFn?.();
-    if (!vault?.password) {
-      _status = "error";
-      _error  = "Vault is locked — unlock clauth first";
-      return { error: _error };
-    }
-    const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
-    const credName = _cfg.credential || CRED_NAME;
-    const result   = await api.retrieve(vault.password, vault.machineHash, token, timestamp, credName);
-    if (!result.value) {
-      _status = "error";
-      _error  = `Credential '${credName}' not found — register it in the vault first`;
-      return { error: _error };
-    }
-    pass = result.value;
-  } catch (err) {
-    _status = "error";
-    _error  = `Credential fetch failed: ${err.message}`;
-    return { error: _error };
-  }
-
-  // 2. Locate rclone
-  const rclonePath = _findRclone();
-  if (!rclonePath) {
-    _status = "error";
-    _error  = "rclone not found — install with: winget install Rclone.Rclone";
-    return { error: _error };
-  }
-
-  // 3. Write rclone config — combine backend with quoted entries for paths with spaces.
-  //    Per rclone docs: "dir=remote:path with space" (quote the whole entry).
-  const mounts = _cfg.upstreams || [];
-  const combineUpstreams = mounts
-    .map(u => `"${u.name}=${u.path.replace(/\\/g, "/")}"`)
-    .join(" ");
-  const configContent = `[srv]\ntype = combine\nupstreams = ${combineUpstreams}\n`;
-  _cleanupConfig();
-  _configPath = join(tmpdir(), `.rclone-webdav-${process.pid}.conf`);
-  try {
-    writeFileSync(_configPath, configContent, { mode: 0o600 });
-  } catch (err) {
-    _status = "error";
-    _error  = `Config write failed: ${err.message}`;
-    return { error: _error };
-  }
-
-  // 4. Spawn rclone
-  return new Promise(resolve => {
-    let settled = false;
-    const settle = (val) => { if (!settled) { settled = true; resolve(val); } };
-
-    try {
-      _child = spawn(rclonePath, [
-        "serve", "webdav", "srv:",
-        "--config",   _configPath,
-        "--addr",     `127.0.0.1:${WEBDAV_PORT}`,
-        "--user",     WEBDAV_USER,
-        "--pass",     pass,
-        "--no-modtime",
-        "--vfs-cache-mode", "full",
-        "--vfs-write-back", "0s",
-        "--ignore-size",
-        "--cache-dir", join(process.env.TEMP || tmpdir(), "rclone-dav-cache"),
-        "--transfers", "4",
-      ], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
-
-    } catch (spawnErr) {
-      _child = null;
-      _status = "error";
-      _error  = spawnErr.message;
-      _cleanupConfig();
-      settle({ error: spawnErr.message });
-      return;
-    }
-
-    _child.stdout.on("data", () => {});
-
-    _child.stderr.on("data", (chunk) => {
-      const line = chunk.toString().trim();
-      if (line.includes("Serving WebDAV") || line.includes("Listening on")) {
-        _status    = "running";
-        _startedAt = new Date().toISOString();
-        settle({ ok: true });
-      }
-      // Surface errors but don't stop on every stderr line — rclone logs normally to stderr
-      if (/\berror\b/i.test(line) || /\bfatal\b/i.test(line)) {
-        _error = line.slice(0, 300);
-      }
-    });
-
-    _child.on("error", (err) => {
-      _child  = null;
-      _status = "error";
-      _error  = err.message;
-      _cleanupConfig();
-      settle({ error: err.message });
-      _scheduleRestart();
-    });
-
-    _child.on("exit", (code, signal) => {
-      _child = null;
-      if (signal === "SIGTERM" || signal === "SIGKILL" || code === 0) {
-        _status = "stopped";
-        _cleanupConfig();
-        return;
-      }
-      _status = "error";
-      _error  = `rclone exited unexpectedly (code=${code} signal=${signal})`;
-      _cleanupConfig();
-      settle({ error: _error });
-      _scheduleRestart();
-    });
-
-    // Optimistic fallback: if rclone doesn't print "Serving WebDAV" within 2s, assume running
-    setTimeout(() => {
-      if (_status === "starting") {
-        _status    = "running";
-        _startedAt = _startedAt || new Date().toISOString();
-      }
-      settle({ ok: true });
-    }, 2000);
-  });
-}
-
-function _scheduleRestart() {
-  const delay = RESTART_DELAYS[Math.min(_restartCount, RESTART_DELAYS.length - 1)];
-  _restartCount++;
-  setTimeout(() => {
-    if (_status === "stopped") return; // intentionally stopped, don't restart
-    _startChild();
-  }, delay);
-}
-
-function _cleanupConfig() {
-  if (_configPath) {
-    try { unlinkSync(_configPath); } catch {}
-    _configPath = null;
-  }
-}
-
-function _findRclone() {
-  const home = homedir();
-  const wingetBase = process.env.LOCALAPPDATA
-    ? join(process.env.LOCALAPPDATA, "Microsoft", "WinGet", "Packages")
-    : null;
-  const execOpts = { stdio: "pipe", timeout: 4000, windowsHide: true };
-
-  const candidates = [
-    "rclone",
-    "C:\\Program Files\\rclone\\rclone.exe",
-    join(home, "scoop", "apps", "rclone", "current", "rclone.exe"),
-    "C:\\ProgramData\\scoop\\apps\\rclone\\current\\rclone.exe",
-  ];
-
-  // Winget installs into a version-stamped subdirectory — glob for it
-  if (wingetBase) {
-    const wingetPkg = join(wingetBase, "Rclone.Rclone_Microsoft.Winget.Source_8wekyb3d8bbwe");
-    try {
-      for (const d of readdirSync(wingetPkg)) {
-        if (d.startsWith("rclone-")) candidates.push(join(wingetPkg, d, "rclone.exe"));
-      }
-    } catch {}
-  }
-
-  for (const c of candidates) {
-    try {
-      execSync(`"${c}" version`, execOpts);
-      return c;
-    } catch {}
-  }
-  return null;
-}
+// cli/webdav-service.js
+// WebDAV child-process supervisor — rclone serve webdav
+//
+// ISOLATION: This module has zero coupling to existing fs_* tool handlers.
+// Rollback: set webdav.enabled=false in the config block (or remove it)
+//           + delete this file + remove the two-line import in serve.js.
+//
+// Design: lazy-start. The rclone child spawns on the first fs_dav_setup call.
+// Subsequent calls return the running child's status without restarting.
+// On child crash: exponential-backoff restart loop (2s → 5s → 15s → 60s).
+
+import { spawn, execSync } from "child_process";
+import { writeFileSync, readFileSync, unlinkSync, mkdirSync, readdirSync } from "fs";
+import { tmpdir, homedir } from "os";
+import { join } from "path";
+import crypto from "crypto";
+import * as api from "./api.js";
+import { deriveToken } from "./fingerprint.js";
+
+const WEBDAV_PORT = 8620;
+const WEBDAV_USER = "claude";
+const CRED_NAME   = "webdav-claude";
+const RESTART_DELAYS = [2000, 5000, 15000, 60000];
+
+const APPDATA      = process.env.APPDATA || join(homedir(), "AppData", "Roaming");
+const CONFIG_PATH  = join(APPDATA, "clauth", "webdav-config.json");
+
+const DEFAULT_CONFIG = {
+  enabled: true,
+  port: WEBDAV_PORT,
+  credential: CRED_NAME,
+  upstreams: [],
+};
+
+// ── Config persistence ──────────────────────────────────────────
+
+export function loadConfig() {
+  try {
+    const raw = readFileSync(CONFIG_PATH, "utf8");
+    const cfg = JSON.parse(raw);
+    if (!Array.isArray(cfg.upstreams)) cfg.upstreams = [];
+    return { ...DEFAULT_CONFIG, ...cfg };
+  } catch {
+    return { ...DEFAULT_CONFIG };
+  }
+}
+
+export function saveConfig(cfg) {
+  const dir = join(APPDATA, "clauth");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2), "utf8");
+  _fsCfgCache = null;
+}
+
+export function addMount(name, mountPath) {
+  const cfg = loadConfig();
+  if (cfg.upstreams.some(u => u.name === name)) return { error: `Mount '${name}' already exists` };
+  cfg.upstreams.push({ name, path: mountPath });
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+export function removeMount(name) {
+  const cfg = loadConfig();
+  const before = cfg.upstreams.length;
+  cfg.upstreams = cfg.upstreams.filter(u => u.name !== name);
+  if (cfg.upstreams.length === before) return { error: `Mount '${name}' not found` };
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+export function updateMount(name, updates) {
+  const cfg = loadConfig();
+  const mount = cfg.upstreams.find(u => u.name === name);
+  if (!mount) return { error: `Mount '${name}' not found` };
+  if (updates.credential !== undefined) cfg.credential = updates.credential;
+  saveConfig(cfg);
+  return { ok: true, upstreams: cfg.upstreams };
+}
+
+let _fsCfgCache = null;
+
+// ── Module state ────────────────────────────────────────────────
+let _child       = null;
+let _configPath  = null;
+let _status      = "stopped";  // stopped | starting | running | error
+let _error       = null;
+let _restartCount = 0;
+let _startedAt   = null;
+let _vaultFn     = null;       // () => { password, machineHash }
+let _cfg         = null;
+
+// ── Public API ───────────────────────────────────────────────────
+
+/**
+ * Ensure the rclone WebDAV child is running.
+ * Idempotent — safe to call multiple times.
+ * Returns { ok: true } or { error: string }.
+ */
+export async function ensureRunning(vaultFn, config) {
+  if (vaultFn) _vaultFn = vaultFn;
+  if (config)  _cfg     = config;
+  if (!_cfg)   _cfg     = loadConfig();
+
+  if (_status === "running" && _child) return { ok: true };
+  if (_status === "starting")          return { ok: true, message: "still starting" };
+
+  return _startChild();
+}
+
+/** Current supervisor status — safe to call at any time. */
+export function getStatus() {
+  return {
+    status:        _status,
+    port:          WEBDAV_PORT,
+    url:           _status === "running" ? `http://127.0.0.1:${WEBDAV_PORT}` : null,
+    error:         _error || null,
+    restart_count: _restartCount,
+    started_at:    _startedAt || null,
+  };
+}
+
+/** Kill the child and clean up the temp config file. */
+export function shutdown() {
+  if (_child) {
+    _child.removeAllListeners();
+    _child.kill("SIGTERM");
+    _child = null;
+  }
+  _cleanupConfig();
+  _status = "stopped";
+}
+
+/**
+ * rclone-compatible AES-CTR "obscure" — same algorithm as `rclone obscure`.
+ * Used by fs_dav_setup to embed a non-plaintext credential in the mount script.
+ * The result can be passed as RCLONE_CONFIG_xxx_PASS.
+ */
+export function rcloneObscure(password) {
+  // Key from rclone source: lib/obscure/obscure.go  cryptKey
+  const key = Buffer.from([
+    0x9c, 0x93, 0x5b, 0x48, 0x73, 0x0a, 0x55, 0x4d,
+    0x6b, 0xfd, 0x7c, 0x63, 0xc8, 0x86, 0xd9, 0x2d,
+    0x02, 0x01, 0x99, 0x87, 0x54, 0xd3, 0x9b, 0xeb,
+    0x40, 0x87, 0x3f, 0xa1, 0x3f, 0x7a, 0xbe, 0x5e,
+  ]);
+  const iv     = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv("aes-256-ctr", key, iv);
+  const ct     = Buffer.concat([cipher.update(Buffer.from(password, "utf8")), cipher.final()]);
+  return Buffer.concat([iv, ct]).toString("base64url");
+}
+
+// ── Internal ─────────────────────────────────────────────────────
+
+async function _startChild() {
+  _status = "starting";
+  _error  = null;
+
+  if (!_cfg?.upstreams?.length) {
+    _status = "error";
+    _error  = "No mount points configured — add them in the clauth dashboard";
+    return { error: _error };
+  }
+
+  // 1. Resolve credential from vault
+  let pass;
+  try {
+    const vault = _vaultFn?.();
+    if (!vault?.password) {
+      _status = "error";
+      _error  = "Vault is locked — unlock clauth first";
+      return { error: _error };
+    }
+    const { token, timestamp } = deriveToken(vault.password, vault.machineHash);
+    const credName = _cfg.credential || CRED_NAME;
+    const result   = await api.retrieve(vault.password, vault.machineHash, token, timestamp, credName);
+    if (!result.value) {
+      _status = "error";
+      _error  = `Credential '${credName}' not found — register it in the vault first`;
+      return { error: _error };
+    }
+    pass = result.value;
+  } catch (err) {
+    _status = "error";
+    _error  = `Credential fetch failed: ${err.message}`;
+    return { error: _error };
+  }
+
+  // 2. Locate rclone
+  const rclonePath = _findRclone();
+  if (!rclonePath) {
+    _status = "error";
+    _error  = "rclone not found — install with: winget install Rclone.Rclone";
+    return { error: _error };
+  }
+
+  // 3. Write rclone config — combine backend with quoted entries for paths with spaces.
+  //    Per rclone docs: "dir=remote:path with space" (quote the whole entry).
+  const mounts = _cfg.upstreams || [];
+  const combineUpstreams = mounts
+    .map(u => `"${u.name}=${u.path.replace(/\\/g, "/")}"`)
+    .join(" ");
+  const configContent = `[srv]\ntype = combine\nupstreams = ${combineUpstreams}\n`;
+  _cleanupConfig();
+  _configPath = join(tmpdir(), `.rclone-webdav-${process.pid}.conf`);
+  try {
+    writeFileSync(_configPath, configContent, { mode: 0o600 });
+  } catch (err) {
+    _status = "error";
+    _error  = `Config write failed: ${err.message}`;
+    return { error: _error };
+  }
+
+  // 4. Spawn rclone
+  return new Promise(resolve => {
+    let settled = false;
+    const settle = (val) => { if (!settled) { settled = true; resolve(val); } };
+
+    try {
+      _child = spawn(rclonePath, [
+        "serve", "webdav", "srv:",
+        "--config",   _configPath,
+        "--addr",     `127.0.0.1:${WEBDAV_PORT}`,
+        "--user",     WEBDAV_USER,
+        "--pass",     pass,
+        "--no-modtime",
+        "--vfs-cache-mode", "full",
+        "--vfs-write-back", "0s",
+        "--ignore-size",
+        "--cache-dir", join(process.env.TEMP || tmpdir(), "rclone-dav-cache"),
+        "--transfers", "4",
+      ], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+
+    } catch (spawnErr) {
+      _child = null;
+      _status = "error";
+      _error  = spawnErr.message;
+      _cleanupConfig();
+      settle({ error: spawnErr.message });
+      return;
+    }
+
+    _child.stdout.on("data", () => {});
+
+    _child.stderr.on("data", (chunk) => {
+      const line = chunk.toString().trim();
+      if (line.includes("Serving WebDAV") || line.includes("Listening on")) {
+        _status    = "running";
+        _startedAt = new Date().toISOString();
+        settle({ ok: true });
+      }
+      // Surface errors but don't stop on every stderr line — rclone logs normally to stderr
+      if (/\berror\b/i.test(line) || /\bfatal\b/i.test(line)) {
+        _error = line.slice(0, 300);
+      }
+    });
+
+    _child.on("error", (err) => {
+      _child  = null;
+      _status = "error";
+      _error  = err.message;
+      _cleanupConfig();
+      settle({ error: err.message });
+      _scheduleRestart();
+    });
+
+    _child.on("exit", (code, signal) => {
+      _child = null;
+      if (signal === "SIGTERM" || signal === "SIGKILL" || code === 0) {
+        _status = "stopped";
+        _cleanupConfig();
+        return;
+      }
+      _status = "error";
+      _error  = `rclone exited unexpectedly (code=${code} signal=${signal})`;
+      _cleanupConfig();
+      settle({ error: _error });
+      _scheduleRestart();
+    });
+
+    // Optimistic fallback: if rclone doesn't print "Serving WebDAV" within 2s, assume running
+    setTimeout(() => {
+      if (_status === "starting") {
+        _status    = "running";
+        _startedAt = _startedAt || new Date().toISOString();
+      }
+      settle({ ok: true });
+    }, 2000);
+  });
+}
+
+function _scheduleRestart() {
+  const delay = RESTART_DELAYS[Math.min(_restartCount, RESTART_DELAYS.length - 1)];
+  _restartCount++;
+  setTimeout(() => {
+    if (_status === "stopped") return; // intentionally stopped, don't restart
+    _startChild();
+  }, delay);
+}
+
+function _cleanupConfig() {
+  if (_configPath) {
+    try { unlinkSync(_configPath); } catch {}
+    _configPath = null;
+  }
+}
+
+function _findRclone() {
+  const home = homedir();
+  const wingetBase = process.env.LOCALAPPDATA
+    ? join(process.env.LOCALAPPDATA, "Microsoft", "WinGet", "Packages")
+    : null;
+  const execOpts = { stdio: "pipe", timeout: 4000, windowsHide: true };
+
+  const candidates = [
+    "rclone",
+    "C:\\Program Files\\rclone\\rclone.exe",
+    join(home, "scoop", "apps", "rclone", "current", "rclone.exe"),
+    "C:\\ProgramData\\scoop\\apps\\rclone\\current\\rclone.exe",
+  ];
+
+  // Winget installs into a version-stamped subdirectory — glob for it
+  if (wingetBase) {
+    const wingetPkg = join(wingetBase, "Rclone.Rclone_Microsoft.Winget.Source_8wekyb3d8bbwe");
+    try {
+      for (const d of readdirSync(wingetPkg)) {
+        if (d.startsWith("rclone-")) candidates.push(join(wingetPkg, d, "rclone.exe"));
+      }
+    } catch {}
+  }
+
+  for (const c of candidates) {
+    try {
+      execSync(`"${c}" version`, execOpts);
+      return c;
+    } catch {}
+  }
+  return null;
+}