@melra/http-runtime 0.3.0-alpha.11

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,49 @@
+# @melra/http-runtime
+
+Governed HTTP and API calls for [MELRA](https://github.com/XAGI-Lab/melra) —
+one bounded request, checked against the same destination boundary the browser
+uses.
+
+```bash
+npm install @melra/http-runtime
+```
+
+```ts
+import { HttpRuntime } from "@melra/http-runtime";
+
+const http = new HttpRuntime({ allowedDomains: ["api.example.com"], allowLocalhost: false });
+```
+
+One action, `http.request`, with a method, a URL, optional headers and body, a
+response-size cap, and a timeout. `GET` and `HEAD` classify as reads; every
+other method is a mutation and needs declared evidence and an approval like any
+other mutation.
+
+## The destination boundary
+
+`assertSafeDestination` from [`@melra/policy-core`](../policy-core) runs before
+any socket opens: non-`http(s)` protocols, URL credentials, and private,
+loopback, link-local, and cloud-metadata addresses are refused, and DNS is
+resolved first so a public name cannot be rebound to a private address.
+
+The socket then connects to the **address that was checked**, not to the name —
+the same pinning the browser's proxy does, and for the same reason.
+
+Redirects are not followed. A `Location` header points somewhere the destination
+check never saw, so the status and the header come back and the caller can plan
+a second governed request.
+
+## What it cannot promise
+
+Exactly-once. HTTP is at-least-once at the provider, so a mutation here runs at
+most once from MELRA and is never retried. `idempotencyKey` is sent as
+`Idempotency-Key` for providers that honour it, but MELRA cannot verify that
+they do — it does not upgrade the execution guarantee.
+
+The request body travels under the `content` field, which redaction strips
+before anything is persisted. Raw bytes reach the live caller only.
+
+Requires Node.js 22 or newer. Full documentation:
+[github.com/XAGI-Lab/melra](https://github.com/XAGI-Lab/melra)
+
+Apache-2.0

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import type { HttpOperation } from "@melra/protocol";
+import { type CredentialBroker, type NetworkPolicy } from "@melra/policy-core";
+export interface HttpRuntimeOptions extends NetworkPolicy {
+    /**
+     * Supplies the secrets this adapter is allowed to send. Omitted means every
+     * request goes out with exactly the headers the caller wrote.
+     */
+    credentials?: CredentialBroker;
+}
+/**
+ * One governed HTTP call.
+ *
+ * The interesting part is which socket opens. `assertSafeDestination` resolves
+ * the name and checks every answer, then this connects to the address it just
+ * checked rather than to the name — the same pinning `PinningProxy` does for the
+ * browser, and for the same reason: a resolver that answers public once and
+ * private the second time would otherwise make the check meaningless.
+ */
+export declare class HttpRuntime {
+    private readonly options;
+    constructor(options: HttpRuntimeOptions);
+    execute(operation: HttpOperation, signal?: AbortSignal): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD;;;OAGG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAElD,OAAO,CACX,SAAS,EAAE,aAAa,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAuIpC"}

package/dist/index.js

@@ -0,0 +1,145 @@
+// Copyright 2026 XAGI Labs Private Limited
+// SPDX-License-Identifier: Apache-2.0
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { outcomeUnknown } from "@melra/protocol";
+import { assertSafeDestination, classifyOperation, } from "@melra/policy-core";
+/**
+ * One governed HTTP call.
+ *
+ * The interesting part is which socket opens. `assertSafeDestination` resolves
+ * the name and checks every answer, then this connects to the address it just
+ * checked rather than to the name — the same pinning `PinningProxy` does for the
+ * browser, and for the same reason: a resolver that answers public once and
+ * private the second time would otherwise make the check meaningless.
+ */
+export class HttpRuntime {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async execute(operation, signal) {
+        const { url, address } = await assertSafeDestination(operation.url, this.options);
+        // Checked here and not only in the router: the destination check above is
+        // an await, and a cancel that lands inside that window would otherwise be
+        // lost and the request would go out anyway.
+        if (signal?.aborted === true)
+            throw new Error("task_cancelled");
+        const secure = url.protocol === "https:";
+        const send = secure ? httpsRequest : httpRequest;
+        // Brokered against the destination that was *checked*, not the one the
+        // caller wrote: pinning already collapsed the name to an address, and a
+        // credential scoped by host has to be scoped by the same host the socket
+        // will actually talk to.
+        const { capability, target } = classifyOperation(operation);
+        const brokered = await this.options.credentials?.headersFor({
+            host: url.hostname,
+            capability,
+            target,
+        });
+        const headers = {
+            // Lowercased before the merge, or `Authorization: guess` from the caller
+            // and `authorization: <secret>` from the broker are two distinct keys and
+            // both go on the wire — which server wins is then the server's choice.
+            ...Object.fromEntries(Object.entries(operation.headers ?? {}).map(([name, value]) => [
+                name.toLowerCase(),
+                value,
+            ])),
+            // Last, so a caller cannot name the same header and have its own value
+            // ride out under a credential's name.
+            ...brokered?.headers,
+            // `Host` carries the name so a name-based virtual host still resolves at
+            // the far end even though the socket was opened to a literal address.
+            host: url.host,
+            ...(operation.idempotencyKey === undefined
+                ? {}
+                : { "idempotency-key": operation.idempotencyKey }),
+        };
+        if (operation.content !== undefined) {
+            headers["content-length"] = String(Buffer.byteLength(operation.content));
+        }
+        return await new Promise((resolve, reject) => {
+            const call = send({
+                host: address,
+                port: url.port === "" ? (secure ? 443 : 80) : Number(url.port),
+                method: operation.method,
+                path: `${url.pathname}${url.search}`,
+                headers,
+                // TLS is validated against the name the caller asked for, not the
+                // address the socket went to, or pinning would break every https URL.
+                ...(secure ? { servername: url.hostname } : {}),
+                timeout: operation.timeoutMs,
+            }, (response) => {
+                const chunks = [];
+                let bytes = 0;
+                let truncated = false;
+                response.on("data", (chunk) => {
+                    bytes += chunk.length;
+                    if (bytes > operation.maxResponseBytes) {
+                        // Stop reading rather than buffering an unbounded body into the
+                        // host's heap. What arrived is still reported, flagged.
+                        truncated = true;
+                        response.destroy();
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                const finish = () => {
+                    const status = response.statusCode ?? 0;
+                    resolve({
+                        // The far end's own word, which is all HTTP can offer. A caller
+                        // who needs more declares an independent re-read as evidence.
+                        //
+                        // 3xx is not success: redirects are deliberately not followed —
+                        // the destination check ran against the URL the caller named, and
+                        // a `Location` pointing at 169.254.169.254 would walk straight
+                        // past it. The caller gets the status and the header and can plan
+                        // a second governed request to wherever it points.
+                        success: status >= 200 && status < 300,
+                        status,
+                        statusText: response.statusMessage ?? "",
+                        headers: response.headers,
+                        content: Buffer.concat(chunks).toString("utf8"),
+                        bytes,
+                        truncated,
+                        url: url.toString(),
+                        method: operation.method,
+                        // Names only. Which credential authorised the call is something a
+                        // receipt should record; its value is the one thing that must not
+                        // leave this function.
+                        credentials: brokered?.used ?? [],
+                        // Echoed back so a reconciliation predicate can be written
+                        // against the one fact that was true *before* the call. After a
+                        // request that went unanswered there is no response to read, so
+                        // this is the only handle on what the provider was asked to do.
+                        ...(operation.idempotencyKey === undefined
+                            ? {}
+                            : { idempotencyKey: operation.idempotencyKey }),
+                    });
+                };
+                response.on("end", finish);
+                response.on("close", finish);
+                response.on("error", reject);
+            });
+            // Whether the request made it out. A socket error before this is a
+            // request that never happened; after it, the far end may have done the
+            // work and lost the reply, and only `outcomeUnknown` says so honestly.
+            // `bytesWritten` is not the signal — it counts headers buffered on a
+            // socket that never connected, so ECONNREFUSED reports a nonzero count.
+            const failed = (error) => {
+                reject(call.writableFinished ? outcomeUnknown(error.message) : error);
+            };
+            // A timeout fires the event but does not end the request; without this an
+            // unresponsive host holds the socket for the life of the process.
+            call.on("timeout", () => {
+                call.destroy(new Error("http_timeout"));
+            });
+            call.on("error", failed);
+            signal?.addEventListener("abort", () => call.destroy(new Error("task_cancelled")), { once: true });
+            if (operation.content !== undefined)
+                call.write(operation.content);
+            call.end();
+        });
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAGrD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAGlB,MAAM,oBAAoB,CAAC;AAU5B;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAE5D,KAAK,CAAC,OAAO,CACX,SAAwB,EACxB,MAAoB;QAEpB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAClD,SAAS,CAAC,GAAG,EACb,IAAI,CAAC,OAAO,CACb,CAAC;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,4CAA4C;QAC5C,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACjD,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC;YAC1D,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,UAAU;YACV,MAAM;SACP,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B;YACtC,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC7D,IAAI,CAAC,WAAW,EAAE;gBAClB,KAAK;aACN,CAAC,CACH;YACD,uEAAuE;YACvE,sCAAsC;YACtC,GAAG,QAAQ,EAAE,OAAO;YACpB,yEAAyE;YACzE,sEAAsE;YACtE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC;SACrD,CAAC;QACF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,IAAI,OAAO,CAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpE,MAAM,IAAI,GAAG,IAAI,CACf;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC9D,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,OAAO;gBACP,kEAAkE;gBAClE,sEAAsE;gBACtE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,OAAO,EAAE,SAAS,CAAC,SAAS;aAC7B,EACD,CAAC,QAAyB,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBACpC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;oBACtB,IAAI,KAAK,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC;wBACvC,gEAAgE;wBAChE,wDAAwD;wBACxD,SAAS,GAAG,IAAI,CAAC;wBACjB,QAAQ,CAAC,OAAO,EAAE,CAAC;wBACnB,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,GAAS,EAAE;oBACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;oBACxC,OAAO,CAAC;wBACN,gEAAgE;wBAChE,8DAA8D;wBAC9D,EAAE;wBACF,gEAAgE;wBAChE,kEAAkE;wBAClE,+DAA+D;wBAC/D,kEAAkE;wBAClE,mDAAmD;wBACnD,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;wBACtC,MAAM;wBACN,UAAU,EAAE,QAAQ,CAAC,aAAa,IAAI,EAAE;wBACxC,OAAO,EAAE,QAAQ,CAAC,OAAkC;wBACpD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;wBAC/C,KAAK;wBACL,SAAS;wBACT,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;wBACnB,MAAM,EAAE,SAAS,CAAC,MAAM;wBACxB,kEAAkE;wBAClE,kEAAkE;wBAClE,uBAAuB;wBACvB,WAAW,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;wBACjC,2DAA2D;wBAC3D,gEAAgE;wBAChE,gEAAgE;wBAChE,gEAAgE;wBAChE,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS;4BACxC,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC;qBAClD,CAAC,CAAC;gBACL,CAAC,CAAC;gBACF,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC3B,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC,CACF,CAAC;YACF,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,MAAM,GAAG,CAAC,KAAY,EAAQ,EAAE;gBACpC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACxE,CAAC,CAAC;YACF,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzB,MAAM,EAAE,gBAAgB,CACtB,OAAO,EACP,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAC/C,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;YACF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/index.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test.d.ts.map

package/dist/index.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.d.ts","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":""}

package/dist/index.test.js

@@ -0,0 +1,119 @@
+// Copyright 2026 XAGI Labs Private Limited
+// SPDX-License-Identifier: Apache-2.0
+import { createServer } from "node:http";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { HttpOperationSchema } from "@melra/protocol";
+import { HttpRuntime } from "./index.js";
+let server;
+let origin;
+/** Last request the fixture saw, so header and body handling is assertable. */
+let seen;
+beforeAll(async () => {
+    server = createServer((req, res) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", () => {
+            seen = {
+                method: req.method ?? "",
+                url: req.url ?? "",
+                headers: req.headers,
+                body: Buffer.concat(chunks).toString("utf8"),
+            };
+            if (req.url === "/teapot") {
+                res.writeHead(418).end("no coffee");
+                return;
+            }
+            if (req.url === "/big") {
+                res.writeHead(200).end("x".repeat(50_000));
+                return;
+            }
+            // Accepts the request and never answers, which is the case MELRA must not
+            // report as "the effect did not happen".
+            if (req.url === "/silent")
+                return;
+            res.writeHead(201, { "content-type": "application/json" });
+            res.end(JSON.stringify({ created: true }));
+        });
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    origin = `http://127.0.0.1:${server.address().port}`;
+});
+afterAll(async () => {
+    await new Promise((resolve) => server.close(() => resolve()));
+});
+const runtime = () => new HttpRuntime({ allowedDomains: ["*"], allowLocalhost: true });
+const operation = (fields) => HttpOperationSchema.parse({ kind: "http", action: "request", ...fields });
+describe("http runtime", () => {
+    it("posts a body and reports the response status", async () => {
+        const result = await runtime().execute(operation({
+            method: "POST",
+            url: `${origin}/orders`,
+            content: JSON.stringify({ item: "widget" }),
+            headers: { "content-type": "application/json" },
+            idempotencyKey: "order-42",
+        }));
+        expect(seen.method).toBe("POST");
+        expect(seen.body).toBe('{"item":"widget"}');
+        expect(seen.headers["idempotency-key"]).toBe("order-42");
+        expect(result.status).toBe(201);
+        expect(result.success).toBe(true);
+        expect(result.content).toBe('{"created":true}');
+    });
+    it("reports a failing status as an unsuccessful effect", async () => {
+        const result = await runtime().execute(operation({ url: `${origin}/teapot` }));
+        expect(result.status).toBe(418);
+        // The adapter never asserts its own success: a 418 is a completed call and
+        // a failed effect, and verification is what turns that into `partial`.
+        expect(result.success).toBe(false);
+    });
+    it("stops reading a body past the cap instead of buffering it", async () => {
+        const result = await runtime().execute(operation({ url: `${origin}/big`, maxResponseBytes: 1_000 }));
+        expect(result.truncated).toBe(true);
+        expect(String(result.content).length).toBeLessThan(50_000);
+    });
+    it("refuses a private destination before any socket opens", async () => {
+        const guarded = new HttpRuntime({
+            allowedDomains: ["*"],
+            allowLocalhost: false,
+        });
+        await expect(guarded.execute(operation({ url: "http://169.254.169.254/latest/meta-data/" }))).rejects.toThrow("destination_private_blocked");
+    });
+    it("refuses a host outside the allowlist", async () => {
+        const guarded = new HttpRuntime({
+            allowedDomains: ["example.com"],
+            allowLocalhost: false,
+        });
+        await expect(guarded.execute(operation({ url: "http://attacker.test/" }))).rejects.toThrow("destination_domain_not_allowed");
+    });
+    it("rejects an unknown field", () => {
+        expect(() => operation({ url: `${origin}/`, followRedirects: true })).toThrow();
+    });
+    it("cancels in flight when the task signal aborts", async () => {
+        const controller = new AbortController();
+        const pending = runtime().execute(operation({ url: `${origin}/orders` }), controller.signal);
+        controller.abort();
+        await expect(pending).rejects.toThrow("task_cancelled");
+    });
+    it("marks the outcome unknown when a sent request goes unanswered", async () => {
+        // The far end has the request and may already have acted on it. Claiming
+        // failure here would be the kernel asserting something it cannot know.
+        await expect(runtime().execute(operation({
+            method: "POST",
+            url: `${origin}/silent`,
+            content: "charge",
+            timeoutMs: 300,
+        }))).rejects.toThrow("effect_outcome_unknown:http_timeout");
+    });
+    it("reports a plain failure when the request never left the machine", async () => {
+        const closed = createServer();
+        await new Promise((resolve) => closed.listen(0, "127.0.0.1", resolve));
+        const port = closed.address().port;
+        await new Promise((resolve) => closed.close(() => resolve()));
+        const attempt = runtime().execute(operation({ method: "POST", url: `http://127.0.0.1:${port}/charges` }));
+        // Nothing reached a server, so this one really did not happen — and must
+        // not be parked for reconciliation.
+        await expect(attempt).rejects.toThrow(/ECONNREFUSED/);
+        await expect(attempt).rejects.not.toThrow(/effect_outcome_unknown/);
+    });
+});
+//# sourceMappingURL=index.test.js.map

package/dist/index.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,sCAAsC;AAEtC,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,IAAI,MAAc,CAAC;AACnB,IAAI,MAAc,CAAC;AACnB,+EAA+E;AAC/E,IAAI,IAAqF,CAAC;AAE1F,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,GAAG;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;gBACxB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAkC;gBAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC7C,CAAC;YACF,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,0EAA0E;YAC1E,yCAAyC;YACzC,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;gBAAE,OAAO;YAClC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,oBAAqB,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,GAAgB,EAAE,CAChC,IAAI,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;AAEnE,MAAM,SAAS,GAAG,CAAC,MAA+B,EAAE,EAAE,CACpD,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAE5E,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,CACpC,SAAS,CAAC;YACR,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,MAAM,SAAS;YACvB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC3C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,cAAc,EAAE,UAAU;SAC3B,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,CACpC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,CACvC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,CACpC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;YAC9B,cAAc,EAAE,CAAC,GAAG,CAAC;YACrB,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,CACV,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,0CAA0C,EAAE,CAAC,CAAC,CAChF,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;YAC9B,cAAc,EAAE,CAAC,aAAa,CAAC;YAC/B,cAAc,EAAE,KAAK;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,CACV,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAC7D,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,GAAG,EAAE,CACV,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CACxD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,CAC/B,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,EACtC,UAAU,CAAC,MAAM,CAClB,CAAC;QACF,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,MAAM,CACV,OAAO,EAAE,CAAC,OAAO,CACf,SAAS,CAAC;YACR,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,GAAG,MAAM,SAAS;YACvB,OAAO,EAAE,QAAQ;YACjB,SAAS,EAAE,GAAG;SACf,CAAC,CACH,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CACvC,CAAC;QACF,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;QACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAEpE,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,CAC/B,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,IAAI,UAAU,EAAE,CAAC,CACvE,CAAC;QAEF,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@melra/http-runtime",
+  "version": "0.3.0-alpha.11",
+  "description": "HTTP/API reference effect adapter for the MELRA kernel.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XAGI-Lab/melra.git",
+    "directory": "packages/http-runtime"
+  },
+  "homepage": "https://github.com/XAGI-Lab/melra#readme",
+  "bugs": "https://github.com/XAGI-Lab/melra/issues",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@melra/policy-core": "0.3.0-alpha.11",
+    "@melra/protocol": "0.3.0-alpha.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "rm -rf dist",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}