@nervur-org/dock 0.3.0

package/dist/dock/webpush.js

@@ -0,0 +1,144 @@
+const subtle = () => globalThis.crypto.subtle;
+const ES256 = { name: 'ECDSA', namedCurve: 'P-256' };
+const b64url = (bytes) => {
+    let binary = '';
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+};
+const unb64url = (v) => {
+    const binary = atob(v.replaceAll('-', '+').replaceAll('_', '/'));
+    const out = new Uint8Array(binary.length);
+    for (let at = 0; at < binary.length; at += 1)
+        out[at] = binary.charCodeAt(at);
+    return out;
+};
+const utf8 = (v) => new TextEncoder().encode(v);
+// The key a page subscribes with, `applicationServerKey`: the public half
+// as the 65 uncompressed bytes, base64url. It is public by definition and
+// travels in the world's config beside its routes.
+export function publicOf(key) {
+    if (typeof key.x !== 'string' || typeof key.y !== 'string')
+        throw new Error('a vapid key is a P-256 JWK');
+    const x = unb64url(key.x), y = unb64url(key.y);
+    const raw = new Uint8Array(65);
+    raw[0] = 4;
+    raw.set(x, 1);
+    raw.set(y, 33);
+    return b64url(raw);
+}
+// A world's own keypair, minted once and kept as its secret. The private
+// half is the JWK; the public half is what a page subscribes with.
+export async function mintVapid() {
+    const pair = await subtle().generateKey(ES256, true, ['sign', 'verify']);
+    const key = await subtle().exportKey('jwk', pair.privateKey);
+    return { key, publicKey: publicOf(key) };
+}
+// The signed token one push service is handed, good for twelve hours. The
+// audience is that service's origin and nothing finer: a token minted for
+// one service says nothing to another, and it names no endpoint, so it
+// cannot be read back into which device was rung.
+async function vapidToken(v, endpoint) {
+    const key = await subtle().importKey('jwk', v.key, ES256, false, ['sign']);
+    const head = b64url(utf8(JSON.stringify({ typ: 'JWT', alg: 'ES256' })));
+    const claims = b64url(utf8(JSON.stringify({ aud: new URL(endpoint).origin, exp: Math.floor(Date.now() / 1000) + 12 * 3600, sub: v.subject })));
+    const signed = await subtle().sign({ name: 'ECDSA', hash: 'SHA-256' }, key, utf8(`${head}.${claims}`));
+    return `${head}.${claims}.${b64url(new Uint8Array(signed))}`;
+}
+// What a push service will carry, RFC 8291's own ceiling, and what the
+// record costs before a byte of the line: the salt, the record size, the
+// length of the key, the key itself, the padding delimiter and the GCM tag.
+const RECORD = 4096;
+const OVERHEAD = 16 + 4 + 1 + 65 + 1 + 16;
+const hmac = async (key, data) => {
+    const k = await subtle().importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    return new Uint8Array(await subtle().sign('HMAC', k, data));
+};
+const joined = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const p of parts) {
+        out.set(p, at);
+        at += p.length;
+    }
+    return out;
+};
+// The keys a subscription hands a world, which RFC 8291 encrypts to: the
+// browser's own P-256 public point and the sixteen bytes of authentication
+// secret it minted with it. A token without them is a subscription made
+// before this or one a browser gave no keys for, and it is rung with no
+// body rather than refused.
+function keysOf(token) {
+    if (typeof token.p256dh !== 'string' || typeof token.auth !== 'string')
+        return null;
+    try {
+        const ua = unb64url(token.p256dh), auth = unb64url(token.auth);
+        return ua.length === 65 && ua[0] === 4 && auth.length === 16 ? { ua, auth } : null;
+    }
+    catch {
+        return null;
+    }
+}
+// One record, `aes128gcm`, RFC 8188 with the key derivation of RFC 8291.
+// The world mints a keypair for this ring alone, agrees with the browser's,
+// and salts each record freshly, so two rings to one device share no key
+// and no nonce.
+export async function encrypt(line, ua, auth) {
+    const pair = await subtle().generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']);
+    const as = new Uint8Array(await subtle().exportKey('raw', pair.publicKey));
+    const theirs = await subtle().importKey('raw', ua, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+    const shared = new Uint8Array(await subtle().deriveBits({ name: 'ECDH', public: theirs }, pair.privateKey, 256));
+    // The input keying material is the agreement, stretched under the
+    // subscription's auth secret and bound to both public keys, so a record
+    // cannot be replayed at a device it was not encrypted for.
+    const ikm = await hmac(await hmac(auth, shared), joined(utf8('WebPush: info\0'), ua, as, Uint8Array.of(1)));
+    const salt = globalThis.crypto.getRandomValues(new Uint8Array(16));
+    const prk = await hmac(salt, ikm);
+    const cek = (await hmac(prk, joined(utf8('Content-Encoding: aes128gcm\0'), Uint8Array.of(1)))).slice(0, 16);
+    const nonce = (await hmac(prk, joined(utf8('Content-Encoding: nonce\0'), Uint8Array.of(1)))).slice(0, 12);
+    // One record, so the padding delimiter is 2 and there is nothing after
+    // it. A line too long for what a push service carries is cut at the body,
+    // which is where a lock screen cuts it anyway.
+    let text = utf8(JSON.stringify(line));
+    if (text.length > RECORD - OVERHEAD) {
+        const room = RECORD - OVERHEAD - utf8(JSON.stringify({ ...line, body: '' })).length;
+        text = utf8(JSON.stringify({ ...line, body: new TextDecoder().decode(utf8(line.body).slice(0, Math.max(0, room))) }));
+    }
+    const key = await subtle().importKey('raw', cek, 'AES-GCM', false, ['encrypt']);
+    const sealed = new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv: nonce }, key, joined(text, Uint8Array.of(2))));
+    const head = new Uint8Array(21);
+    head.set(salt, 0);
+    new DataView(head.buffer).setUint32(16, RECORD);
+    head[20] = as.length;
+    return joined(head, as, sealed);
+}
+// The ground. A `web` token is an endpoint and, when the browser gave them,
+// the two keys of its own subscription, which is what a line is encrypted
+// to. A token with no keys is rung with no body.
+export function webPush(v) {
+    const publicKey = publicOf(v.key);
+    return {
+        async ring(token, _sealed, line) {
+            const endpoint = token.endpoint;
+            if (typeof endpoint !== 'string' || !/^https?:\/\//.test(endpoint))
+                throw new Error('a web token is an endpoint');
+            const keys = line ? keysOf(token) : null;
+            const body = keys && line ? await encrypt(line, keys.ua, keys.auth) : undefined;
+            const res = await fetch(endpoint, {
+                method: 'POST',
+                headers: {
+                    authorization: `vapid t=${await vapidToken(v, endpoint)}, k=${publicKey}`,
+                    ttl: '60',
+                    ...(body ? { 'content-encoding': 'aes128gcm', 'content-type': 'application/octet-stream' } : {}),
+                },
+                ...(body ? { body: body } : {}),
+            });
+            // 404 and 410 are the push service saying this endpoint is gone. The
+            // device sends a fresh one when it next comes up, so nothing here
+            // forgets a token: a world that dropped one would stop ringing a
+            // device that is merely off.
+            if (!res.ok)
+                throw new Error(`the push service answered ${res.status}`);
+        },
+    };
+}

package/dist/harbor/browser.d.ts

@@ -0,0 +1,15 @@
+import type { BeingClass } from '@nervur-org/nervur';
+import { Harbor, type Dialer, type Lend, type Store } from '@nervur-org/nervur/harbor';
+export declare const BUILT_IN: Record<string, BeingClass>;
+export declare class BrowserHarbor extends Harbor {
+    #private;
+    readonly name: string;
+    readonly dialers: Dialer[];
+    constructor(store?: string | Store, classes?: Record<string, BeingClass>, lend?: Lend);
+    lent: Record<string, string> | undefined;
+    stand(lent: Record<string, string>): Promise<void>;
+    boot(): Promise<void>;
+    dial(url: string): Dialer;
+    wake(): void;
+    close(): Promise<void>;
+}

package/dist/harbor/browser.js

@@ -0,0 +1,82 @@
+import { User, Desk, Avatar, Presence, Courier } from '../beings/index.js';
+import { Harbor, dial } from '@nervur-org/nervur/harbor';
+import { FACULTY_CLASSES, settled, stand } from '../dock/index.js';
+import { Idb } from './idb.js';
+export const BUILT_IN = { User, Desk, Avatar, Presence, Courier, ...FACULTY_CLASSES };
+export class BrowserHarbor extends Harbor {
+    name;
+    dialers = [];
+    #locked;
+    #release;
+    // `lend` is what this box lends the beings of the wards it hosts: a name
+    // to an invitation on a being of its own ward. `stand` builds one; a bare
+    // tab hands none and every name answers null.
+    constructor(store = 'quo', classes = {}, lend) {
+        const s = typeof store === 'string' ? new Idb(store) : store;
+        super(s, async () => ({ ...BUILT_IN, ...classes }), lend);
+        this.name = typeof store === 'string' ? store : 'quo';
+        this.#locked = typeof store === 'string';
+    }
+    // What this box lends, by name. A bare tab says nothing, stands no ward of
+    // its own and lends nothing.
+    lent;
+    // What this box lends is said before it boots, and standing the ward is
+    // part of booting: a being born in any other ward lends from her first
+    // line, and a ground that could not reach it yet would leave her holding
+    // nothing until her next birth.
+    async stand(lent) {
+        this.lent = lent;
+        if (this.wards.size > 0)
+            this.lend = await stand(this, lent);
+    }
+    // Take the lock and boot every ward kept here. A lock already held is
+    // another tab's harbor over this seed, and this one refuses to boot.
+    async boot() {
+        if (this.#locked)
+            await this.#lease();
+        if (this.lent)
+            this.lend = await stand(this, this.lent);
+        await super.boot();
+        // Every being who takes what this box lends does it at her birth, and
+        // birth is synchronous while taking a standing is not. A box is up when
+        // they have landed, not before, here as on a daemon: a page painted
+        // ahead of them shows a device that can do nothing.
+        await settled();
+    }
+    // Hold one socket to a world's quo. route.
+    dial(url) {
+        const d = dial(this, url);
+        this.dialers.push(d);
+        return d;
+    }
+    // The device is back: a phone out of a pocket, an app to the foreground.
+    // Every socket is told, and one that died silently is dialed again.
+    wake() {
+        for (const d of this.dialers)
+            d.wake();
+    }
+    async close() {
+        for (const d of this.dialers.splice(0))
+            d.close();
+        this.store.close?.();
+        this.#release?.();
+        this.#release = undefined;
+    }
+    async #lease() {
+        const locks = globalThis.navigator?.locks;
+        if (!locks)
+            return; // no web locks on this terrain: nothing vouches, as in the memory harbor
+        const granted = await new Promise((ok) => {
+            void locks.request(`quo:${this.name}`, { ifAvailable: true }, (lock) => {
+                if (!lock) {
+                    ok(false);
+                    return;
+                }
+                ok(true);
+                return new Promise((release) => (this.#release = release)); // held until close
+            });
+        });
+        if (!granted)
+            throw new Error(`harbor ${this.name} is held by another tab`);
+    }
+}

package/dist/harbor/capacitor.d.ts

@@ -0,0 +1,28 @@
+import { Directory } from '@capacitor/filesystem';
+import type { BeingClass, JsonObject } from '@nervur-org/nervur';
+import { Location, Notifications, type Token, type Where } from '../dock/index.ts';
+import { BrowserHarbor } from './browser.ts';
+import { Sealed, type Files, type Secrets } from './sealed.ts';
+export declare class PhoneLocation extends Location {
+    where(): Promise<Where | JsonObject>;
+}
+export declare class PhoneNotifications extends Notifications {
+    notify(args: JsonObject): Promise<JsonObject>;
+    protected plant(pair: {
+        secret: Uint8Array;
+    }): Promise<void>;
+}
+export declare const PHONE_FACULTIES: Record<string, BeingClass>;
+export declare const phoneLent: Record<string, string>;
+export declare function phoneEar(sandbox?: boolean, within?: number, named?: {
+    bell?: string;
+    app?: string;
+}): () => Promise<Token | null>;
+export declare function nativeHarbor(name?: string, classes?: Record<string, BeingClass>): Promise<BrowserHarbor>;
+export declare const directory: Directory;
+export declare const phoneFiles: Files;
+export declare const phoneSecrets: Secrets;
+export declare const Native: {
+    open: (harbor: string) => Promise<Sealed>;
+    wipe: (harbor: string) => Promise<void>;
+};

package/dist/harbor/capacitor.js

@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: Apache-2.0
+// The phone: the sealed store over Capacitor's Filesystem and a secure
+// storage plugin, the browser harbor over that store, and the phone's
+// faculties as its plugins give them. The files sit in the folder iCloud
+// does not copy on iOS and in the app's own data folder on Android, whose
+// manifest says no backup; the key sits in the Keychain or the Keystore,
+// this device only. The custody rule is the sealed store's, `sealed.ts`,
+// and this file hands it the two seams and nothing more.
+//
+// The harbor on a phone is the browser harbor over that store: the app
+// process is its lease, and the App plugin's foreground is its wake.
+import { Capacitor } from '@capacitor/core';
+import { App } from '@capacitor/app';
+import { Filesystem, Directory, Encoding } from '@capacitor/filesystem';
+import { SecureStorage, KeychainAccess } from '@aparajita/capacitor-secure-storage';
+import { Geolocation } from '@capacitor/geolocation';
+import { LocalNotifications } from '@capacitor/local-notifications';
+import { PushNotifications } from '@capacitor/push-notifications';
+import { LOCATION, NOTIFICATIONS, Location, Notifications } from '../dock/index.js';
+import { BrowserHarbor } from './browser.js';
+import { Sealed } from './sealed.js';
+// The phone's faculties, as its plugins give them: the two defaults extended,
+// and handed to the harbor as its dock. The platform's permission is the
+// faculty's: a prompt is slow work, since it waits on the human, so the first
+// ask puts the prompt up and answers at once that the human is being asked,
+// and a refusal is the error object every ask after answers with.
+// The secure storage item the banner key's secret half is copied into. The
+// account the keychain holds it under is this name behind the plugin's own
+// prefix, `capacitor-storage_banner`, and the extension reads it there.
+const BANNER = 'banner';
+const asked = (what) => new Error(`the human is being asked to allow ${what} on this device; ask again`);
+const refused = (what) => new Error(`${what} is not allowed on this device`);
+export class PhoneLocation extends Location {
+    async where() {
+        const { location } = await Geolocation.checkPermissions();
+        if (location === 'prompt' || location === 'prompt-with-rationale') {
+            void Geolocation.requestPermissions().catch(() => { });
+            throw asked('location');
+        }
+        if (location !== 'granted')
+            throw refused('location');
+        const p = await Geolocation.getCurrentPosition({ enableHighAccuracy: true, timeout: 20_000 });
+        return { lat: p.coords.latitude, lng: p.coords.longitude, accuracy: p.coords.accuracy, at: p.timestamp };
+    }
+}
+export class PhoneNotifications extends Notifications {
+    async notify(args) {
+        const title = typeof args.title === 'string' ? args.title : '';
+        const body = typeof args.body === 'string' ? args.body : '';
+        const { display } = await LocalNotifications.checkPermissions();
+        if (display === 'prompt' || display === 'prompt-with-rationale') {
+            void LocalNotifications.requestPermissions().catch(() => { });
+            throw asked('notifications');
+        }
+        if (display !== 'granted')
+            throw refused('notifications');
+        // `isExactNotification` defaults to true, and on Android 12 and up a
+        // notification that wants an exact alarm without the permission for one
+        // opens the Alarms and reminders settings screen and never answers, so
+        // the ask goes late. This one is shown now and waits for no clock, and
+        // the permission it would otherwise want is the kind a store asks an
+        // alarm app to justify.
+        await LocalNotifications.schedule({ notifications: [{ id: Date.now() % 2147483647, title, body, isExactNotification: false }] });
+        return { shown: true };
+    }
+    // Where a phone's notification process reads the banner key. The process
+    // that draws a banner here is not this one: an extension runs between the
+    // platform and the screen and cannot reach a ward at all, so the secret
+    // half goes into the keychain group the two share. The pair itself stays
+    // in the faculty's cells, which is the truth of it, and this is a copy of
+    // one half put somewhere a platform can find it.
+    //
+    // It goes through the same secure storage the store keeps its key in, and
+    // not through a plugin of the app's own. An item written there lands in
+    // the app's first keychain group, which is the group the extension is in,
+    // so the two meet with nothing written to make them meet. A plugin would
+    // have had to be registered before the page loads, which on this platform
+    // is a list a `cap sync` rewrites, so the app would have carried a hand
+    // edit that the next sync undoes.
+    //
+    // The platform's permission is asked for here, in the same act. A device
+    // that has just minted a banner key is a device about to be rung, and the
+    // ring that will carry that banner is an alert the platform draws, which
+    // it draws for nobody who has not allowed it. Registering for remote
+    // notifications asked for nothing, deliberately, so this is the one place
+    // on this terrain where the person is asked at all.
+    //
+    // A refusal leaves the key where it is and costs the device the line and
+    // not the wake: the seal is planted, the world is admitted, and what
+    // arrives is a push the human never sees until the app is opened. So the
+    // answer is not waited on and not read: the person may say yes later in
+    // Settings and everything already planted still works.
+    async plant(pair) {
+        const hex = Array.from(pair.secret, (b) => b.toString(16).padStart(2, '0')).join('');
+        await SecureStorage.set(BANNER, hex, false, false, KeychainAccess.afterFirstUnlockThisDeviceOnly);
+        const { receive } = await PushNotifications.checkPermissions().catch(() => ({ receive: 'denied' }));
+        if (receive === 'prompt' || receive === 'prompt-with-rationale')
+            await PushNotifications.requestPermissions().catch(() => ({ receive: 'denied' }));
+    }
+}
+// What a phone lends: the two faculties above under the names every box
+// lends them under, and nothing a phone has not. The harbor holds these
+// class bodies for its own ward, and boots one being of each in it.
+export const PHONE_FACULTIES = { Location: PhoneLocation, Notifications: PhoneNotifications };
+export const phoneLent = { [LOCATION]: 'Location', [NOTIFICATIONS]: 'Notifications' };
+// The phone's ear, as `human/app.ts` asks for one: the token this device is
+// reachable at while it sleeps, or null.
+//
+// It asks the human for nothing, and it does not have to. Registering for
+// remote notifications shows no prompt and wants no permission: what a
+// permission gates is showing a human a banner, and a doorbell shows
+// nobody anything. It carries no title, no body and no id, it wakes the
+// app and nothing more, and what the human eventually reads is composed
+// here afterwards out of objects that crossed sealed. So a device whose
+// human has allowed nothing is still reachable, and misses only the line
+// it would have read; the permission it wants for that line is the
+// Notifications faculty's ask and not this one's.
+//
+// The token arrives as an event and not as an answer, so the registration
+// is awaited once and kept: the platform hands the same token back on every
+// later call, and a new one whenever it decides to, which is why the shell
+// asks again on every foreground.
+//
+// `named` is what the build says of this shell, the way `sandbox` is: the
+// bell service holding this app's keys and the app id, so a world rings
+// this phone through the right service whoever shipped the app.
+export function phoneEar(sandbox = false, within = 10_000, named = {}) {
+    let token = null;
+    return async () => {
+        if (!token) {
+            token = await new Promise((answer) => {
+                const done = setTimeout(() => answer(null), within);
+                void PushNotifications.addListener('registration', ({ value }) => {
+                    clearTimeout(done);
+                    answer(value);
+                });
+                void PushNotifications.addListener('registrationError', () => {
+                    clearTimeout(done);
+                    answer(null);
+                });
+                void PushNotifications.register().catch(() => {
+                    clearTimeout(done);
+                    answer(null);
+                });
+            });
+        }
+        if (!token)
+            return null;
+        // Which of Apple's two push hosts minted it. Nothing in a device token
+        // says so, and a development token means nothing to the production
+        // host, so the build that knows what it is is the one that says.
+        const says = { ...(named.bell ? { bell: named.bell } : {}), ...(named.app ? { app: named.app } : {}) };
+        const apple = { kind: 'apns', device: token, sandbox, ...says };
+        const google = { kind: 'fcm', device: token, ...says };
+        return Capacitor.getPlatform() === 'ios' ? apple : google;
+    };
+}
+// The app's one harbor, booted, lending the phone's faculties to its wards,
+// told `wake` every time the app comes to the foreground, since a phone
+// asleep loses its sockets silently.
+export async function nativeHarbor(name = 'quo', classes = {}) {
+    const h = new BrowserHarbor(await Native.open(name), { ...PHONE_FACULTIES, ...classes });
+    await h.stand(phoneLent);
+    await h.boot();
+    await App.addListener('appStateChange', ({ isActive }) => {
+        if (isActive)
+            h.wake();
+    });
+    return h;
+}
+// Where the files live: the folder iCloud does not copy on iOS, the app's
+// own files on Android, whose manifest says no backup.
+export const directory = Capacitor.getPlatform() === 'ios' ? Directory.LibraryNoCloud : Directory.Data;
+// The two seams, as the plugins give them. Two things the plugins taught:
+// the secure store keeps JSON, so a value is read with the call that
+// parses; and mkdir refuses a folder that exists, recursive or not.
+export const phoneFiles = {
+    exists: async (path) => {
+        try {
+            await Filesystem.stat({ path, directory });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    read: async (path) => (await Filesystem.readFile({ path, directory, encoding: Encoding.UTF8 })).data,
+    write: async (path, data) => {
+        await Filesystem.writeFile({ path, directory, data, encoding: Encoding.UTF8 });
+    },
+    remove: async (path) => {
+        await Filesystem.deleteFile({ path, directory });
+    },
+    mkdir: async (path) => {
+        await Filesystem.mkdir({ path, directory, recursive: true });
+    },
+    rmdir: async (path) => {
+        await Filesystem.rmdir({ path, directory, recursive: true });
+    },
+    list: async (path) => (await Filesystem.readdir({ path, directory })).files.map((f) => f.name),
+};
+export const phoneSecrets = {
+    get: async (item) => {
+        const got = await SecureStorage.get(item, false, false);
+        return typeof got === 'string' ? got : undefined;
+    },
+    set: async (item, value) => {
+        await SecureStorage.set(item, value, false, false, KeychainAccess.afterFirstUnlockThisDeviceOnly);
+    },
+    remove: async (item) => {
+        await SecureStorage.remove(item);
+    },
+};
+// The phone's store: the sealed store over the two seams above.
+export const Native = {
+    open: (harbor) => Sealed.open(harbor, phoneFiles, phoneSecrets),
+    wipe: (harbor) => Sealed.wipe(harbor, phoneFiles, phoneSecrets),
+};

package/dist/harbor/disk.d.ts

@@ -0,0 +1,27 @@
+import type { BeingClass } from '@nervur-org/nervur';
+import { Harbor, type Hosted, type Lend } from '@nervur-org/nervur/harbor';
+export type { Hosted, Bound } from '@nervur-org/nervur/harbor';
+export type { WardRecord } from '@nervur-org/nervur/harbor';
+export declare const BUILT_IN: Record<string, BeingClass>;
+export declare function defaultWard(marked: string[], hosted: string[]): string;
+export declare class DiskHarbor extends Harbor {
+    #private;
+    readonly dir: string;
+    defaultWard: string;
+    static setDefault(dir: string, name: string): Promise<void>;
+    static setShown(dir: string, name: string, shown: boolean): Promise<void>;
+    static isShown(dir: string, name: string): boolean;
+    static marked(dir: string): Promise<string[]>;
+    static defaultOf(dir: string): Promise<string>;
+    constructor(dir: string, lend?: Lend, own?: Record<string, BeingClass>);
+    lent: Record<string, string> | undefined;
+    static init(dir: string, name?: string, user?: string, cls?: string, mark?: boolean, shown?: boolean): Promise<{
+        dir: string;
+        name: string;
+        pk: string;
+        user: string;
+    }>;
+    boot(): Promise<void>;
+    close(): Promise<void>;
+    adoptFolder(name: string): Promise<Hosted>;
+}