@multiplatform.one/keycloak 5.0.26 → 6.0.0

package/src/session/index.ts

@@ -1,60 +1,62 @@
-/*
+/**
  * File: /src/session/index.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 19-11-2024 20:26:31
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Better Auth session hook for web.
+ * Replaces the previous next-auth/react useSession.
  */
 
-import { isBrowser, isElectron } from "multiplatform.one";
-import type { Session as NextSession } from "next-auth";
-import { useSession as useNextSession } from "next-auth/react";
-import type {
-  SessionContextValue as NextSessionContextValue,
-  UseSessionOptions,
-} from "next-auth/react";
+import { isBrowser, isTauri } from "@multiplatform.one/platform";
+import { getAuthClient } from "../betterAuth/client";
+
+export interface Session {
+  accessToken?: string;
+  err?: Error;
+  idToken?: string;
+  refreshToken?: string;
+  user?: {
+    id: string;
+    name?: string | null;
+    email?: string | null;
+    image?: string | null;
+  };
+  expires?: string;
+}
 
-export type SessionContextValue<R extends boolean> = Partial<
-  Omit<NextSessionContextValue<R> & { session: Session }, "data">
->;
+export type SessionStatus = "loading" | "authenticated" | "unauthenticated";
 
-let useSession = <R extends boolean>(
-  _options?: UseSessionOptions<R>,
+export interface SessionContextValue<_R extends boolean = false> {
+  session: Session | null;
+  status: SessionStatus;
+  update?: () => void;
+}
+
+let useSession = <R extends boolean = false>(
+  _options?: Record<string, unknown>,
 ): SessionContextValue<R> => {
-  return {};
+  return { session: null, status: "unauthenticated" };
 };
 
-if (isBrowser && !isElectron) {
-  useSession = <R extends boolean>(
-    options?: UseSessionOptions<R>,
+if (isBrowser && !isTauri) {
+  useSession = <R extends boolean = false>(
+    _options?: Record<string, unknown>,
   ): SessionContextValue<R> => {
-    const nextSession = useNextSession(options);
+    const client = getAuthClient();
+    const { data, isPending, error: _error } = client.useSession();
+    if (isPending) {
+      return { session: null, status: "loading" };
+    }
+    if (!data?.user) {
+      return { session: null, status: "unauthenticated" };
+    }
     return {
-      update: nextSession.update,
-      status: nextSession.status,
-      session: nextSession.data as Session,
-    } as SessionContextValue<R>;
+      session: {
+        user: data.user as Session["user"],
+        expires: data.session?.expiresAt?.toString(),
+      },
+      status: "authenticated",
+    };
   };
 }
 
-export interface Session extends NextSession {
-  accessToken?: string;
-  err?: Error;
-  idToken?: string;
-  refreshToken?: string;
-}
-
 export { useSession };

package/src/session/index.webext.ts

@@ -1,33 +1,19 @@
-/*
- * File: /src/session/index.native.ts
+/**
+ * File: /src/session/index.webext.ts
  * Project: @multiplatform.one/keycloak
- * File Created: 04-04-2024 15:50:39
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * Session stub for web extensions. Uses Better Auth client internally
+ * when available; otherwise returns empty session.
  */
 
-import type { UseSessionOptions } from "next-auth/react";
 import type { SessionContextValue } from "./index";
 
 export async function getSession() {
   return null;
 }
 
-export function useSession<R extends boolean>(
-  _options?: UseSessionOptions<R>,
+export function useSession<R extends boolean = false>(
+  _options?: Record<string, unknown>,
 ): SessionContextValue<R> {
-  return {};
+  return { session: null, status: "unauthenticated" };
 }

package/src/state.ts

@@ -1,35 +1,34 @@
-/*
- * File: /src/state.ts
- * Project: @multiplatform.one/keycloak
- * File Created: 19-11-2024 20:26:31
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
+import { createStore, useStore } from "@multiplatform.one/store";
+import { isBrowser, isIframe, isServer, isTauri } from "@multiplatform.one/platform";
 
-import { createUseStore } from "@multiplatform.one/use-store";
-import { isBrowser, isElectron, isIframe, isServer } from "multiplatform.one";
+export const persist = isIframe || isTauri || (!isBrowser && !isServer);
 
-export const persist = isIframe || isElectron || (!isBrowser && !isServer);
+export interface AuthTokenState {
+  idToken: string;
+  refreshToken: string;
+  token: string;
+}
 
-class AuthStore {
-  idToken = "";
-  refreshToken = "";
-  token = "";
+export interface AuthState extends AuthTokenState {
+  setIdToken: (idToken: string) => void;
+  setRefreshToken: (refreshToken: string) => void;
+  setToken: (token: string) => void;
+  setTokens: (tokens: { idToken?: string; refreshToken?: string; token?: string }) => void;
 }
 
-export const useAuthStore = createUseStore(AuthStore, {
-  persist: persist as true,
-});
+const authStore = createStore<AuthTokenState>(
+  { idToken: "", refreshToken: "", token: "" },
+  { name: "auth", persist: persist as boolean },
+);
+
+export function useAuthStore(): AuthState {
+  const state = useStore(authStore);
+  return {
+    ...state,
+    setIdToken: (idToken: string) => authStore.setState((prev) => ({ ...prev, idToken })),
+    setRefreshToken: (refreshToken: string) =>
+      authStore.setState((prev) => ({ ...prev, refreshToken })),
+    setToken: (token: string) => authStore.setState((prev) => ({ ...prev, token })),
+    setTokens: (tokens) => authStore.setState((prev) => ({ ...prev, ...tokens })),
+  };
+}

package/src/token.spec.ts

@@ -0,0 +1,168 @@
+import { describe, expect, it, vi, afterEach } from "vitest";
+import {
+  getWalletsFromToken,
+  getWalletAddresses,
+  hasWallets,
+  getAllWalletAddresses,
+  isTokenExpired,
+  validOrRefreshableToken,
+} from "./token";
+
+function makeJwt(payload: Record<string, unknown>): string {
+  const header = btoa(JSON.stringify({ alg: "none", typ: "JWT" }));
+  const body = btoa(JSON.stringify(payload));
+  return `${header}.${body}.`;
+}
+
+const walletPayload = {
+  crypto: {
+    wallets: {
+      ethereum: { addresses: ["0xABCD", "0x1234"] },
+      solana: { addresses: ["SolAddr1"] },
+    },
+  },
+  exp: Math.floor(Date.now() / 1000) + 3600,
+};
+
+const noWalletPayload = {
+  sub: "user-123",
+  exp: Math.floor(Date.now() / 1000) + 3600,
+};
+
+describe("getWalletsFromToken", () => {
+  it("extracts wallet map from a token with crypto claim", () => {
+    const token = makeJwt(walletPayload);
+    const wallets = getWalletsFromToken(token);
+    expect(wallets.ethereum?.addresses).toEqual(["0xABCD", "0x1234"]);
+    expect(wallets.solana?.addresses).toEqual(["SolAddr1"]);
+  });
+
+  it("returns empty object when no crypto claim", () => {
+    const token = makeJwt(noWalletPayload);
+    expect(getWalletsFromToken(token)).toEqual({});
+  });
+
+  it("returns empty object for invalid token", () => {
+    expect(getWalletsFromToken("not.a.jwt")).toEqual({});
+  });
+
+  it("returns empty object for empty string", () => {
+    expect(getWalletsFromToken("")).toEqual({});
+  });
+});
+
+describe("getWalletAddresses", () => {
+  it("extracts ethereum addresses by default", () => {
+    const token = makeJwt(walletPayload);
+    expect(getWalletAddresses(token)).toEqual(["0xABCD", "0x1234"]);
+  });
+
+  it("extracts addresses for a specific wallet type", () => {
+    const token = makeJwt(walletPayload);
+    expect(getWalletAddresses(token, "solana")).toEqual(["SolAddr1"]);
+  });
+
+  it("returns empty array for missing wallet type", () => {
+    const token = makeJwt(walletPayload);
+    expect(getWalletAddresses(token, "sui")).toEqual([]);
+  });
+
+  it("returns empty array for token without wallets", () => {
+    const token = makeJwt(noWalletPayload);
+    expect(getWalletAddresses(token)).toEqual([]);
+  });
+});
+
+describe("hasWallets", () => {
+  it("returns true when token has wallet addresses", () => {
+    const token = makeJwt(walletPayload);
+    expect(hasWallets(token)).toBe(true);
+  });
+
+  it("returns false when token has no crypto claim", () => {
+    const token = makeJwt(noWalletPayload);
+    expect(hasWallets(token)).toBe(false);
+  });
+
+  it("returns false when wallets map has empty addresses", () => {
+    const token = makeJwt({
+      crypto: { wallets: { ethereum: { addresses: [] } } },
+    });
+    expect(hasWallets(token)).toBe(false);
+  });
+});
+
+describe("getAllWalletAddresses", () => {
+  it("returns all addresses with their wallet types", () => {
+    const token = makeJwt(walletPayload);
+    const result = getAllWalletAddresses(token);
+    expect(result).toEqual([
+      { walletType: "ethereum", address: "0xABCD" },
+      { walletType: "ethereum", address: "0x1234" },
+      { walletType: "solana", address: "SolAddr1" },
+    ]);
+  });
+
+  it("returns empty array for token without wallets", () => {
+    const token = makeJwt(noWalletPayload);
+    expect(getAllWalletAddresses(token)).toEqual([]);
+  });
+});
+
+describe("isTokenExpired", () => {
+  it("returns false for a token expiring in the future", () => {
+    const token = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+    expect(isTokenExpired(token)).toBe(false);
+  });
+
+  it("returns true for a token that expired in the past", () => {
+    const token = makeJwt({ exp: Math.floor(Date.now() / 1000) - 60 });
+    expect(isTokenExpired(token)).toBe(true);
+  });
+
+  it("returns false when token has no exp claim", () => {
+    const token = makeJwt({ sub: "user" });
+    expect(isTokenExpired(token)).toBe(false);
+  });
+});
+
+describe("validOrRefreshableToken", () => {
+  const validToken = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600 });
+  const expiredToken = makeJwt({ exp: Math.floor(Date.now() / 1000) - 60 });
+
+  it("returns undefined when token is undefined", () => {
+    expect(validOrRefreshableToken(undefined)).toBeUndefined();
+  });
+
+  it("returns false when token is falsy (empty string)", () => {
+    expect(validOrRefreshableToken("")).toBe(false);
+  });
+
+  it("returns false when token is false", () => {
+    expect(validOrRefreshableToken(false)).toBe(false);
+  });
+
+  it("returns the token when it is valid and no refresh token", () => {
+    expect(validOrRefreshableToken(validToken)).toBe(validToken);
+  });
+
+  it("returns false when token is expired and no refresh token", () => {
+    expect(validOrRefreshableToken(expiredToken)).toBe(false);
+  });
+
+  it("returns the token when expired but refresh token is true", () => {
+    expect(validOrRefreshableToken(expiredToken, true)).toBe(expiredToken);
+  });
+
+  it("returns the token when expired but refresh token is valid", () => {
+    expect(validOrRefreshableToken(expiredToken, validToken)).toBe(expiredToken);
+  });
+
+  it("returns false when both token and refresh token are expired", () => {
+    expect(validOrRefreshableToken(expiredToken, expiredToken)).toBe(false);
+  });
+
+  it("returns boolean token as-is when not a string", () => {
+    expect(validOrRefreshableToken(true)).toBe(true);
+  });
+});

package/src/token.ts

@@ -1,26 +1,141 @@
-/*
- * File: /src/token.ts
- * Project: @multiplatform.one/keycloak
- * File Created: 04-04-2024 15:50:39
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
+import { jwtDecode } from "jwt-decode";
+import type { KeycloakTokenParsed } from "@multiplatform.one/keycloak-js";
+
+/**
+ * Wallet types supported by siwe-keycloak extension.
+ * Currently supports Ethereum wallets, with Solana and Sui planned.
+ */
+export type WalletType = "ethereum" | "solana" | "sui";
+
+/**
+ * Structure of wallet data within a chain type.
+ * Contains an array of wallet addresses for that chain.
+ */
+export interface WalletTypeInfo {
+  addresses: string[];
+}
+
+/**
+ * Map of wallet types to their wallet info.
+ * This is the structure inside token.crypto.wallets
+ */
+export interface WalletsMap {
+  [walletType: string]: WalletTypeInfo;
+}
+
+/**
+ * The crypto claim structure added to tokens by siwe-wallet-mapper.
+ * Contains wallet information from the siwe-keycloak extension.
+ */
+export interface CryptoClaim {
+  wallets: WalletsMap;
+}
+
+/**
+ * Extracts wallet addresses from a JWT token that includes the siwe-wallet-mapper claims.
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * The siwe-keycloak extension adds a "crypto" claim with the following structure:
+ * ```json
+ * {
+ *   "crypto": {
+ *     "wallets": {
+ *       "ethereum": {
+ *         "addresses": ["0x1234...", "0x5678..."]
+ *       }
+ *     }
+ *   }
+ * }
+ * ```
  *
- *     http://www.apache.org/licenses/LICENSE-2.0
+ * @param token - JWT access token or ID token string
+ * @returns Object containing wallet addresses by type, or empty object if no wallets
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
+ * @example
+ * ```typescript
+ * const wallets = getWalletsFromToken(accessToken);
+ * // { ethereum: { addresses: ['0x1234...'] } }
+ *
+ * const ethAddresses = wallets.ethereum?.addresses ?? [];
+ * // ['0x1234...']
+ * ```
  */
+export function getWalletsFromToken(token: string): WalletsMap {
+  try {
+    const decoded = jwtDecode<TokenWithWallets>(token);
+    return decoded.crypto?.wallets ?? {};
+  } catch {
+    return {};
+  }
+}
 
-import { jwtDecode } from "jwt-decode";
-import type { KeycloakTokenParsed } from "keycloak-js";
+/**
+ * Extracts all wallet addresses of a specific type from a JWT token.
+ *
+ * @param token - JWT access token or ID token string
+ * @param walletType - The wallet type to extract (e.g., "ethereum", "solana")
+ * @returns Array of wallet addresses, or empty array if none found
+ *
+ * @example
+ * ```typescript
+ * const addresses = getWalletAddresses(accessToken, 'ethereum');
+ * // ['0x1234...', '0x5678...']
+ * ```
+ */
+export function getWalletAddresses(token: string, walletType: WalletType = "ethereum"): string[] {
+  const wallets = getWalletsFromToken(token);
+  return wallets[walletType]?.addresses ?? [];
+}
+
+/**
+ * Checks if a user has any wallet addresses in their token.
+ *
+ * @param token - JWT access token or ID token string
+ * @returns true if the user has at least one wallet address
+ *
+ * @example
+ * ```typescript
+ * if (hasWallets(accessToken)) {
+ *   // User authenticated with a wallet or has registered wallets
+ * }
+ * ```
+ */
+export function hasWallets(token: string): boolean {
+  const wallets = getWalletsFromToken(token);
+  return Object.values(wallets).some((info) => info.addresses && info.addresses.length > 0);
+}
+
+/**
+ * Gets all wallet addresses across all chain types from a token.
+ *
+ * @param token - JWT access token or ID token string
+ * @returns Array of objects with walletType and address
+ *
+ * @example
+ * ```typescript
+ * const allWallets = getAllWalletAddresses(accessToken);
+ * // [
+ * //   { walletType: 'ethereum', address: '0x1234...' },
+ * //   { walletType: 'ethereum', address: '0x5678...' },
+ * //   { walletType: 'solana', address: 'AbCd...' }
+ * // ]
+ * ```
+ */
+export function getAllWalletAddresses(
+  token: string,
+): Array<{ walletType: string; address: string }> {
+  const wallets = getWalletsFromToken(token);
+  const result: Array<{ walletType: string; address: string }> = [];
+
+  for (const [walletType, info] of Object.entries(wallets)) {
+    if (info.addresses) {
+      for (const address of info.addresses) {
+        result.push({ walletType, address });
+      }
+    }
+  }
+
+  return result;
+}
 
 export function validOrRefreshableToken(
   token?: string | false,
@@ -30,10 +145,7 @@ export function validOrRefreshableToken(
   token?: string | boolean,
   refreshToken?: string | boolean,
 ): string | boolean | undefined;
-export function validOrRefreshableToken(
-  token?: string | boolean,
-  refreshToken?: string | boolean,
-) {
+export function validOrRefreshableToken(token?: string | boolean, refreshToken?: string | boolean) {
   if (typeof token === "undefined") return;
   if (!token) return false;
   if (typeof token !== "string") return token;
@@ -56,7 +168,18 @@ export interface TokenParsed extends KeycloakTokenParsed {
   typ?: "Bearer" | string;
 }
 
-export interface AccessTokenParsed extends TokenParsed {
+/**
+ * Extended token interface that includes wallet claims from siwe-keycloak.
+ */
+export interface TokenWithWallets extends TokenParsed {
+  /**
+   * Crypto claim containing wallet addresses.
+   * Added by the siwe-wallet-mapper protocol mapper.
+   */
+  crypto?: CryptoClaim;
+}
+
+export interface AccessTokenParsed extends TokenWithWallets {
   email?: string;
   email_verified?: boolean;
   preferred_username?: string;

package/src/types.ts

@@ -1,24 +1,3 @@
-/*
- * File: /src/types.ts
- * Project: @multiplatform.one/keycloak
- * File Created: 04-04-2024 15:50:39
- * Author: Clay Risser
- * -----
- * BitSpur (c) Copyright 2021 - 2024
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
 declare global {
   interface Window {
     ReactNativeWebView: {

package/dist/cjs/Authenticated.cjs

@@ -1,83 +0,0 @@
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf,
-  __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-    for (var name in all) __defProp(target, name, {
-      get: all[name],
-      enumerable: !0
-    });
-  },
-  __copyProps = (to, from, except, desc) => {
-    if (from && typeof from == "object" || typeof from == "function") for (let key of __getOwnPropNames(from)) !__hasOwnProp.call(to, key) && key !== except && __defProp(to, key, {
-      get: () => from[key],
-      enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-    });
-    return to;
-  };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-    value: mod,
-    enumerable: !0
-  }) : target, mod)),
-  __toCommonJS = mod => __copyProps(__defProp({}, "__esModule", {
-    value: !0
-  }), mod);
-var Authenticated_exports = {};
-__export(Authenticated_exports, {
-  Authenticated: () => Authenticated,
-  withAuthenticated: () => withAuthenticated
-});
-module.exports = __toCommonJS(Authenticated_exports);
-var import_async_storage = __toESM(require("@react-native-async-storage/async-storage")),
-  import_multiplatform = require("multiplatform.one"),
-  import_react = require("react"),
-  import_tamagui = require("tamagui"),
-  import_hooks = require("./hooks/index.cjs"),
-  import_keycloak = require("./keycloak/index.cjs"),
-  import_jsx_runtime = require("react/jsx-runtime");
-global.AsyncStorage = import_async_storage.default;
-function Authenticated({
-  children,
-  disabled,
-  loggedOutComponent,
-  loadingComponent
-}) {
-  const authConfig = (0, import_hooks.useAuthConfig)(),
-    keycloak = (0, import_keycloak.useKeycloak)(),
-    tokensFromQuery = (0, import_hooks.useTokensFromQuery)();
-  if ((0, import_react.useEffect)(() => {
-    !keycloak || !authConfig.iframeSso && import_multiplatform.isIframe || import_multiplatform.isServer || keycloak.authenticated || tokensFromQuery || keycloak?.login({
-      redirectUri: authConfig.loginRedirectUri
-    });
-  }, [keycloak?.authenticated]), typeof disabled > "u" && (disabled = authConfig.disabled), disabled) return /* @__PURE__ */(0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, {
-    children
-  });
-  if (typeof keycloak > "u") {
-    const LoadingComponent = loadingComponent;
-    return LoadingComponent ? /* @__PURE__ */(0, import_jsx_runtime.jsx)(LoadingComponent, {}) : /* @__PURE__ */(0, import_jsx_runtime.jsx)(import_tamagui.Text, {
-      children: authConfig.debug ? "loading" : null
-    });
-  }
-  if (keycloak === null || keycloak.authenticated) return /* @__PURE__ */(0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, {
-    children
-  });
-  const LoggedOutComponent = loggedOutComponent;
-  return LoggedOutComponent ? /* @__PURE__ */(0, import_jsx_runtime.jsx)(LoggedOutComponent, {}) : /* @__PURE__ */(0, import_jsx_runtime.jsx)(import_tamagui.Text, {
-    children: authConfig.debug ? "not authenticated" : null
-  });
-}
-function withAuthenticated(Component, options = {}) {
-  return props => /* @__PURE__ */(0, import_jsx_runtime.jsx)(Authenticated, {
-    ...options,
-    children: /* @__PURE__ */(0, import_jsx_runtime.jsx)(Component, {
-      ...props
-    })
-  });
-}