@ngis/plugin-sdk 0.4.0

package/dist/src/types/extensions.d.ts

@@ -0,0 +1,560 @@
+/**
+ * DTOs for `ngis-extension` — the Stage 11 extension registry / market, its
+ * per-user installs, scene-level composition, and the boot / scene-resolve
+ * payloads the plugin loader consumes.
+ *
+ * Field names are the **wire** names; nothing is renamed to taste. Java
+ * `Instant` serializes as an ISO-8601 `string`; Java `JsonNode` maps to
+ * `unknown` unless the shape is genuinely frozen.
+ *
+ * Contract: `docs/extension_loader_stage/README.md` § "W1 kickoff — locked
+ * contracts" (W1.1 / W1.2) and `frontend-api-guide.md` §16.
+ *
+ * **Stage 15 additions are additive only.** The market's *social* shapes live in
+ * `./market-social` (kickoff-authored, read-only to a wave); the two members
+ * imported below are referenced from the existing DTOs rather than re-declared,
+ * so there is exactly one source of truth per wire shape.
+ */
+import type { RatingAggregateDto, VersionScanResultDto } from "./market-social";
+/**
+ * Only `"ui-plugin"` ever has a loadable bundle. `"tool"` and `"ai-skill"`
+ * entries carry `bundleUrl`/`integrity` values that are *meaningless rather
+ * than absent* — always filter on `kind` before attempting a load, a
+ * truthiness check on `bundleUrl` is not enough.
+ */
+export type ExtensionKind = "ui-plugin" | "tool" | "ai-skill";
+export type ExtensionStatus = "ACTIVE" | "DEPRECATED" | "REMOVED";
+/** `GROUP` exists on the backend; v1 renders it read-only (no group-grant UI). */
+export type ExtensionVisibility = "PRIVATE" | "GROUP" | "PUBLIC";
+/**
+ * Extension *version* lifecycle. Deliberately distinct from
+ * {@link SkillVersionStatus} — a skill version reaching `ACTIVE` and its
+ * `ai-skill` extension version reaching `PUBLISHED` are independent events.
+ */
+export type ExtensionVersionStatus = "DRAFT" | "IN_REVIEW" | "PUBLISHED" | "REJECTED" | "YANKED";
+/** `PINNED` requires a strict `x.y.z` version; `ai-skill` entries must be pinned. */
+export type VersionPolicy = "LATEST" | "PINNED";
+export type PrincipalType = "USER" | "GROUP";
+/** `GET /api/extensions?scope=` */
+export type CatalogScope = "mine" | "shared" | "public";
+/**
+ * Why a scene-composed extension could not be resolved for the current viewer.
+ * `null` when the entry is available.
+ *
+ * The tool side used to collapse three distinct failures into the single value
+ * `reference_revoked` (`ExtensionKindReferenceValidator.java:106-112`). W2's T1
+ * splits them into `tool_missing` / `tool_disabled` / `tool_forbidden`, and
+ * routes a geoanalysis outage to the existing `dependency_unavailable` via a
+ * new `dependencyAvailable` component on `ToolReferenceStatus`.
+ *
+ * **`reference_revoked` stays in the union** (W2.1): it stops being emitted but
+ * older clients and any cached payload may still carry it, so neither the type
+ * nor its `Market.reasons.reference_revoked` key is removed this wave.
+ *
+ * The naming asymmetry is deliberate — `tool_disabled` names the tool's actual
+ * `enabled` field where the skill side's `skill_not_active` names its `status`
+ * column. Do not harmonize one into the other.
+ *
+ * Because every UI looks these up through `Market.reasons.*`, the rename stayed
+ * a one-file change.
+ */
+export type SceneResolveReason = "extension_forbidden" | "no_published_version" | "extension_version_yanked" | "version_policy_required" | "skill_missing" | "skill_not_active" | "skill_forbidden" | "dependency_unavailable" | "tool_missing" | "tool_disabled" | "tool_forbidden"
+/** Legacy tool-side value — no longer emitted as of T1, kept for one wave. */
+ | "reference_revoked";
+export interface ExtensionSummaryDto {
+    extId: string;
+    kind: ExtensionKind;
+    ownerId: string;
+    displayName: string;
+    summary: string | null;
+    iconKey: string | null;
+    category: string | null;
+    /** Free-form `JsonNode` on the wire — do not assume `string[]`. */
+    tags: unknown;
+    visibility: ExtensionVisibility;
+    status: ExtensionStatus;
+    latestPublishedVersion: string | null;
+    /**
+     * The **latest PUBLISHED version's** declared scopes (Stage 13 XB1) — what
+     * the market card renders. Empty when nothing is published.
+     *
+     * Optional because a payload from a gateway predating XB1 omits it entirely,
+     * and "the server did not say" must stay distinguishable from "asks for
+     * nothing": the card renders no scope line at all in the first case.
+     */
+    permissions?: string[];
+    /**
+     * ZB1's additive social members (F15.6/F15.11), shipped on the wire 2026-08-11.
+     *
+     * **Optional, and deliberately so.** The server always sends them now, but a
+     * summary reconstructed from a pre-Stage-15 cached payload — or from a gateway
+     * that has not been redeployed — omits them, and "the server did not say" must
+     * stay distinguishable from "zero installs, unrated, unverified". Render the
+     * absent case as no line at all, exactly as `permissions` already does.
+     *
+     * `rating` is `null` until the first rating and its `mean` is `null` whenever
+     * `count` is 0 — **never render a 0 mean; there is no such score.**
+     */
+    installCount?: number;
+    rating?: RatingAggregateDto | null;
+    publisherVerified?: boolean;
+}
+export interface ExtensionVersionSummaryDto {
+    /** Strict `x.y.z`. Contrast with a skill version, which is an integer. */
+    version: string;
+    status: ExtensionVersionStatus;
+    minNgisVersion: string;
+    bundleSize: number | null;
+    bundleSha256: string | null;
+    publishedAt: string | null;
+    createdAt: string;
+    /**
+     * This version's declared scopes (Stage 13 XB1) — **per version**, which is
+     * what makes a scope escalation between two versions visible from the
+     * detail page without fetching each one. Optional for the same reason as
+     * {@link ExtensionSummaryDto.permissions}.
+     */
+    permissions?: string[];
+}
+/** `GET /api/extensions/{extId}` — note the nesting, this is not a flat summary. */
+export interface ExtensionDetailDto {
+    extension: ExtensionSummaryDto;
+    versions: ExtensionVersionSummaryDto[];
+}
+/** Populated only for `tool` / `ai-skill` kinds; every field is nullable. */
+export interface ExtensionReferenceDto {
+    provider: string | null;
+    toolId: string | null;
+    toolVersion: number | null;
+    skillId: string | null;
+    /** Skill versions are integers. */
+    skillVersion: number | null;
+}
+export interface ExtensionVersionDetailDto {
+    extId: string;
+    version: string;
+    status: ExtensionVersionStatus;
+    /** The package manifest as stored; shape-checked by the loader (F6), not here. */
+    manifest: PackageManifestDto | null;
+    minNgisVersion: string;
+    capabilitySummary: unknown;
+    /** Fixed to `"bundle.mjs"` in v1. */
+    entry: string | null;
+    bundleSize: number | null;
+    bundleSha256: string | null;
+    changelog: string | null;
+    submittedBy: string | null;
+    reviewedBy: string | null;
+    reviewNote: string | null;
+    publishedAt: string | null;
+    createdAt: string;
+    reference: ExtensionReferenceDto | null;
+    /** This version's declared scopes (Stage 13 XB1) — a projection of
+     *  `manifest.permissions`, not separate storage. */
+    permissions?: string[];
+}
+/**
+ * The `manifest.json` / boot-payload `manifest` shape.
+ *
+ * **F1 types it; F1 does not validate it** — validation belongs to F6 at load
+ * time, against the bundle actually being executed.
+ */
+export interface PackageManifestDto {
+    /** Matches `^[a-z0-9-]+(\.[a-z0-9-]+)+$`; `ngis.*` is reserved first-party. */
+    id: string;
+    kind: ExtensionKind;
+    name: string;
+    /** Strict `x.y.z`. */
+    version: string;
+    /** Strict `x.y.z`. */
+    minNgisVersion: string;
+    /** Fixed to `"bundle.mjs"` in v1. */
+    entry: string;
+    capabilities?: {
+        panels?: unknown;
+        railTools?: unknown;
+        layerTypes?: unknown;
+        /** E7 — `{id, paramsSchema}[]`, consumed by the codeenv plugin bridge. */
+        commands?: unknown;
+    };
+    description?: string;
+    icon?: string;
+    category?: string;
+    tags?: unknown;
+    homepage?: string;
+    publisher?: string;
+    changelog?: string;
+}
+export interface ExtensionInstallDto {
+    extId: string;
+    enabled: boolean;
+    versionPolicy: VersionPolicy;
+    pinnedVersion: string | null;
+    installedAt: string;
+    updatedAt: string | null;
+    /**
+     * Scopes the installer consented to (Stage 13 XB2, V4's `granted_scopes`).
+     * `null` for an install row that predates consent, which is **not** the same
+     * as `[]` — the former has never been asked, the latter refused everything.
+     *
+     * **Never trust this as the effective grant set (`V-85`).** The server
+     * intersects with the resolved version's `permissions` when it *writes*, and
+     * does not recompute when a later version **narrows** them, so a stale scope
+     * outlives the declaration that justified it. X5 intersects at read time; see
+     * `src/sdk/scopes.ts`.
+     */
+    grantedScopes: string[] | null;
+    /** The user-leg storage blob (F13.7). Free-form; the schema is the plugin's. */
+    settings?: unknown;
+}
+/**
+ * `GET|PUT /api/extensions/{extId}/settings` (Stage 13 XB2, W2 kickoff §8).
+ *
+ * The **user** storage leg of F13.7 — per (user, extension), backed by
+ * `ngis_extension_install.settings` (`JSONB`, V4). `settings` is free-form JSON
+ * and deliberately typed `unknown`: the settings *schema* lives in the
+ * extension's manifest, not in this DTO, and this client never normalizes it.
+ *
+ * **The envelope is asymmetric, and settled** (XB2, confirmed after the W2
+ * kickoff): the `PUT` takes the settings object **bare** as its body and
+ * answers `{"settings": <stored>}` — enveloped *out*, bare *in*. Both verbs
+ * `404` when the caller has no install row (and for an unknown `extId`), and
+ * `PUT null` clears the value and answers `{"settings": null}`.
+ *
+ * **Never byte-compare the echo against what was written.** The column is
+ * Postgres `jsonb`, which normalizes key order, whitespace, duplicate keys and
+ * number formatting, so a byte-identical round-trip is not achievable even when
+ * nothing is lost. A client that diffed stored-vs-written to decide whether to
+ * re-save would loop forever (XB2 row V-83).
+ */
+export interface ExtensionSettingsResponse {
+    settings: unknown | null;
+}
+export interface ExtensionShareDto {
+    principalType: PrincipalType;
+    principalId: string;
+    grantedBy: string;
+    grantedAt: string;
+}
+export interface ExtensionReviewQueueEntryDto {
+    extId: string;
+    displayName: string;
+    kind: ExtensionKind;
+    version: string;
+    status: ExtensionVersionStatus;
+    minNgisVersion: string;
+    bundleSize: number | null;
+    bundleSha256: string | null;
+    submittedBy: string | null;
+    createdAt: string;
+    /**
+     * ZB3's upload-scan result (F15.10), **advisory to the reviewer and never
+     * blocking**. `null` for every row uploaded before scanning existed and for
+     * every non-`ui-plugin` row — a `tool` or `ai-skill` version has no bundle to
+     * scan. `null` means *not scanned*; it does not mean *clean*, and the reviewer
+     * UI must say so rather than showing an empty findings list (Z6, W3).
+     */
+    scan?: VersionScanResultDto | null;
+}
+/** One entry of `GET /api/extensions/me?ngisVersion=`. */
+export interface BootExtensionEntryDto {
+    extId: string;
+    kind: ExtensionKind;
+    version: string;
+    enabled: boolean;
+    compatible: boolean;
+    yanked: boolean;
+    manifest: PackageManifestDto;
+    bundleUrl: string;
+    integrity: string;
+    /**
+     * The resolved version's declared scopes — a projection of
+     * `manifest.permissions` (Stage 13 XB1), where an absent key and `[]` mean
+     * the same thing.
+     *
+     * Optional here because the *field* can be absent from an older payload,
+     * which is not the same as "declares nothing": `readDeclaredPermissions`
+     * (`src/store/plugin-grants.ts`) falls back to the manifest, which every
+     * entry carries.
+     */
+    permissions?: string[];
+    /**
+     * The resolved version's `contributes` block, projected out of the manifest by
+     * the server (`BootExtensionEntryDto.java:23`, `SceneExtensionEntryDto.java`).
+     *
+     * **Declared at the Stage 15 W3 kickoff, additively — the wire has carried it
+     * since Stage 13 and the TypeScript said nothing** (`V15-244`, the `V15-235`
+     * pattern again: a field on the Java DTO with no TypeScript twin).
+     *
+     * `unknown` rather than a parsed type on purpose: the only supported reader is
+     * `parseManifestContributes(manifest)` (`src/sdk/contributions/parse.ts:893`),
+     * which takes `unknown`, validates, and reports paths rooted at
+     * `manifest.contributes`. **Read the manifest, not this field** — it is a
+     * redundant projection, and a second parse path is how the two disagree.
+     */
+    contributes?: unknown;
+    /**
+     * The caller's own consented scopes for this install (Stage 13 XB2).
+     *
+     * **Not a manifest projection** — install-row state, which is why it appears
+     * here and *deliberately not* on a scene-resolve entry: a viewer of a shared
+     * scene is not the installer and has no install row to read. That asymmetry
+     * is the one field-level difference between the two otherwise identical
+     * entry shapes, and `SceneExtensionEntryDto` omits it below so the types say
+     * so rather than leaving an always-`undefined` property to be misread.
+     *
+     * The server reports `[]` (never `null`) for an install nobody has consented
+     * for. `undefined` therefore means the field was absent from the payload —
+     * treated the same as "never asked", i.e. no effective grants until consent.
+     *
+     * **Never the effective grant set (`V-85`)** — see `resolveEffectiveGrants`.
+     */
+    grantedScopes?: string[] | null;
+}
+export interface BootPayloadDto {
+    ngisVersionEcho: string;
+    extensions: BootExtensionEntryDto[];
+}
+/**
+ * One entry of `GET /api/extensions/scene/{sceneId}?ngisVersion=`.
+ *
+ * Structurally a boot entry plus `available`/`reason`, but an **unavailable**
+ * entry is far emptier than the kickoff's "boot DTO + two fields" wording
+ * suggests. `ExtensionSceneResolveService.java:100` constructs it as
+ * `new SceneExtensionEntryDto(extId, null, null, true, false, false, null,
+ * null, null, false, reason)` — so `kind` and `version` are `null` too, not
+ * just `manifest`/`bundleUrl`/`integrity`, and `enabled` is hard-coded `true`.
+ * Only `extId`, the three booleans and `reason` are meaningful when
+ * `available === false`.
+ *
+ * Practical consequence for every consumer: **narrow on `available` before
+ * reading `kind`**, because the `kind === "ui-plugin"` load filter cannot be
+ * applied to an unavailable entry at all.
+ *
+ * Disabled entries are omitted from the payload entirely; absence is not an
+ * error state and must not render a "missing" placeholder.
+ */
+export interface SceneExtensionEntryDto extends Omit<BootExtensionEntryDto, "kind" | "version" | "manifest" | "bundleUrl" | "integrity" | "grantedScopes"> {
+    kind: ExtensionKind | null;
+    version: string | null;
+    manifest: PackageManifestDto | null;
+    bundleUrl: string | null;
+    integrity: string | null;
+    /**
+     * The scene-leg storage blob for this entry (F13.7's viewer-read leg).
+     *
+     * **Frozen by the W3 kickoff ahead of its backend (`V-49`, option 1).** W2's
+     * X3 found that "a viewer of a shared scene reads the owner's settings" had
+     * no endpoint behind it: the composition `GET` is owner-only (`403`) and the
+     * gRPC `ScenePluginSummary` carried no settings, so the value never left
+     * `ngis-scene` and a viewer read `null`. **XB3 (W3) delivers the backend leg**
+     * — proto field, `ngis-scene` populate, `ngis-extension` map — and X9 wires
+     * the read. Until XB3 is deployed the field is simply absent, which is why it
+     * is optional rather than `unknown | null`.
+     *
+     * Owner-only on the **write** path regardless: writes ride the composition
+     * `PUT` and its `revision`, and that ACL is unchanged this stage.
+     */
+    settings?: unknown;
+    available: boolean;
+    reason: SceneResolveReason | null;
+}
+export interface SceneResolvePayloadDto {
+    sceneId: string;
+    ngisVersionEcho: string;
+    extensions: SceneExtensionEntryDto[];
+}
+export interface SceneExtensionCompositionEntry {
+    /** Matches `^[a-z0-9-]+(\.[a-z0-9-]+)+$`, unique per scene. */
+    extId: string;
+    enabled: boolean;
+    versionPolicy: VersionPolicy;
+    /** Required and strict `x.y.z` when `versionPolicy === "PINNED"`. */
+    pinnedVersion?: string | null;
+    settings?: unknown;
+}
+export interface SceneExtensionComposition {
+    plugins: SceneExtensionCompositionEntry[];
+    /** Reserved/opaque. **Round-trip it verbatim** — never interpret it. */
+    layout?: unknown;
+    /**
+     * Opaque optimistic-concurrency token (Stage 12 V-17). Returned by GET/PUT; **echo it back on
+     * PUT** and a stale save is refused with `409` instead of silently erasing the other editor's
+     * entry — which is what happened before, verified live.
+     *
+     * Compare for equality only: it is a content digest, not an ordinal. Omitting it restores the
+     * old last-write-wins behaviour, so never drop it to "fix" a conflict.
+     */
+    revision?: string | null;
+}
+export interface CreateExtensionRequest {
+    extId: string;
+    kind?: ExtensionKind;
+    displayName: string;
+    summary?: string;
+    description?: string;
+    homepage?: string;
+    category?: string;
+    tags?: unknown;
+    visibility?: ExtensionVisibility;
+}
+export interface UpdateExtensionRequest {
+    displayName?: string;
+    summary?: string;
+    description?: string;
+    homepage?: string;
+    category?: string;
+    tags?: unknown;
+    visibility?: ExtensionVisibility;
+    status?: ExtensionStatus;
+}
+/**
+ * `POST /api/extensions/{extId}/versions/reference` — the JSON reference tuple
+ * that stands in for a multipart bundle on `tool` / `ai-skill` kinds. Supply
+ * either the tool triple or the skill pair, never both.
+ */
+export interface CreateReferenceVersionRequest {
+    version: string;
+    minNgisVersion: string;
+    /**
+     * Free text carried onto the DRAFT and rendered on the version row.
+     *
+     * **Added by Stage 14 Y6 (W4).** The backend DTO has always had it
+     * (`CreateReferenceVersionRequest.java:22`) and this type did not, so no
+     * caller could send one — a `tool`-kind listing published through the
+     * self-serve wizard had no way to say what changed between two versions of a
+     * recipe, and the omission was invisible because an absent optional field is
+     * not an error anywhere.
+     */
+    changelog?: string;
+    provider?: string;
+    toolId?: string;
+    toolVersion?: number;
+    skillId?: string;
+    /** Integer — the exact ACTIVE skill version being referenced. */
+    skillVersion?: number;
+}
+export interface InstallExtensionRequest {
+    versionPolicy?: VersionPolicy;
+    pinnedVersion?: string;
+    /**
+     * The consent decision (Stage 13 XB2). The server **intersects it with the
+     * resolved version's declared `permissions`** and stores the intersection —
+     * extras are dropped silently rather than failing the install, so read
+     * `grantedScopes` back off the response instead of assuming an echo.
+     *
+     * An ungrantable scope (`layers:write`, `net:<origin>`), an unknown string
+     * or a duplicate is a `400`.
+     */
+    grantedScopes?: string[];
+}
+export interface UpdateInstallRequest {
+    enabled?: boolean;
+    versionPolicy?: VersionPolicy;
+    pinnedVersion?: string;
+    /**
+     * Re-consent (Stage 13 XB2). **`null`/absent leaves the stored grants
+     * unchanged; `[]` revokes everything** — unlike the manifest's
+     * `permissions`, where empty ≡ absent. The asymmetry exists so a
+     * `PATCH {enabled:false}` cannot silently wipe consent while "revoke all"
+     * stays sayable.
+     */
+    grantedScopes?: string[] | null;
+}
+export type ScopeAuditEventKind = "SCOPE_CONSENT" | "SCOPE_DENIAL";
+/**
+ * `POST /api/extensions/{extId}/scope-events` → `202`, empty body.
+ *
+ * The actor is always the authenticated caller — there is no actor field, and
+ * a client cannot attribute an event to somebody else. `scopes` is required,
+ * non-empty, duplicate-free and must contain only grantable scopes: the body is
+ * client-reported, so an arbitrary string must not be mintable into the audit
+ * trail. An extension the caller cannot see answers `404`, not `403`.
+ */
+export interface ScopeAuditRequest {
+    event: ScopeAuditEventKind;
+    scopes: string[];
+    /** ≤120 chars, meaningful on a denial — the refused facet member. */
+    member?: string;
+    /** Strict `x.y.z` when present. */
+    version?: string;
+}
+export interface ShareExtensionRequest {
+    principalType: PrincipalType;
+    principalId: string;
+}
+/** Body of `publish` and `approve` — both optional-note. */
+export interface PublishVersionRequest {
+    reviewNote?: string;
+}
+/** `reviewNote` is required and must be non-blank. */
+export interface RejectVersionRequest {
+    reviewNote: string;
+}
+export interface YankVersionRequest {
+    reason: string;
+}
+/**
+ * The preview's fixed host identity. **Never the previewed extension's own id**
+ * — a preview running under the real id would read and write that install row's
+ * grants and settings and pollute an identity the user may later actually adopt
+ * (F15.9). Mirrors `ExtensionPreviewService.PREVIEW_EXT_ID` on the wire; the
+ * fixture gate asserts the two agree rather than trusting this constant.
+ */
+export declare const PREVIEW_EXT_ID = "ngis.market-preview";
+/**
+ * The F13.5 scopes a preview can **never** hold, whatever the version declares
+ * (F15.9): nothing a preview does may persist beyond its disposal, and a preview
+ * may not raise host chrome outside its own surface.
+ *
+ * Verified at the W3 kickoff against `NgisPermissionScope`'s frozen union
+ * (`src/sdk/contributions/types.ts:218-228`) rather than copied from prose —
+ * that check *was* backlog row `V15-061`, and both spellings reproduce exactly.
+ * The remaining eight scopes are grantable to a preview if the version declares
+ * them; the intersection is computed server-side and arrives as `grantedScopes`.
+ */
+export declare const PREVIEW_EXCLUDED_SCOPES: readonly ["storage:user", "ui:notify"];
+/**
+ * `sceneId` / `expectedGeneration` are the Stage 19 lab fence, echoed from the
+ * caller's own lab read — a stale generation is refused `409`, and Z5 must
+ * surface that rather than retrying under a generation the user did not see.
+ * `version` absent means the latest PUBLISHED version (v1 previews PUBLISHED
+ * only; a reviewer-side `IN_REVIEW` preview is a recorded open tension, not a
+ * silent extension of F15.9).
+ */
+export interface ExtensionPreviewRequest {
+    sceneId: string;
+    expectedGeneration: number;
+    version?: string;
+    ngisVersion: string;
+}
+/**
+ * A previewed version composed into the caller's `PLUGIN_UI_LAB` scene.
+ *
+ * **Nothing here is persisted** — no install row, no stored consent, no scene
+ * write. The `POST` is a read that has a consent meaning: `grantedScopes` is
+ * what launching consents to, and F15.9 requires Z5 to show that set *before*
+ * the launch, not after.
+ *
+ * `entry.extId` is {@link PREVIEW_EXT_ID}; `sourceExtId` is what is being
+ * previewed. Everything else on `entry` — version, manifest, contributes,
+ * bundle, integrity — is the previewed version verbatim.
+ *
+ * The three scope lists are disjoint by construction server-side:
+ * `declaredScopes` = `grantedScopes` ∪ `excludedScopes`. Render `excludedScopes`
+ * as *withheld*, never as absent — a preview silently missing a scope the
+ * version declares is exactly the confusion F15.9's visible refusal exists to
+ * prevent.
+ */
+export interface ExtensionPreviewDto {
+    previewId: string;
+    sourceExtId: string;
+    sceneId: string;
+    generation: number;
+    /** ISO-8601. The lab's TTL, not a second clock — the preview dies with the lab. */
+    expiresAt: string | null;
+    entry: SceneExtensionEntryDto;
+    declaredScopes: string[];
+    grantedScopes: string[];
+    excludedScopes: string[];
+}