@oxyhq/core 20.1.0 → 21.0.0

package/dist/types/session/sharedDeviceCredential.d.ts

@@ -0,0 +1,202 @@
+/**
+ * The shared native DeviceSession credential — one device, one session, many apps.
+ *
+ * ## What this is, and what it deliberately is NOT
+ *
+ * Two different secrets can make a native Oxy app boot signed in, and conflating
+ * them is the bug this module exists to end:
+ *
+ *   Commons private identity key   → identity and signed approval ONLY. It is
+ *                                    self-custody, irreplaceable, and must never
+ *                                    become the general app session transport.
+ *   Shared DeviceSession credential → THIS module. An ordinary `deviceId` +
+ *                                    `deviceSecret` pair that restores ordinary
+ *                                    official apps, follows the device's active
+ *                                    context, and is individually rotatable and
+ *                                    revocable server-side.
+ *
+ * An ordinary app needs the second one. Handing it the first — which is what the
+ * `shared-key-signin` lane does today — gives every sibling app the ability to
+ * sign as the user's cryptographic identity to obtain something as mundane as a
+ * session. That lane stays as a recovery/compatibility path; this one supersedes
+ * it for the ordinary case.
+ *
+ * ## Why sharing one credential is safe against the server
+ *
+ * `POST /session/device/token` does NOT rotate: the response echoes the presented
+ * secret back as `nextDeviceSecret` precisely so several first-party apps sharing
+ * one `DeviceSession` can refresh concurrently without invalidating one another.
+ * So N apps holding one credential is a supported server state, not a race — and
+ * because they then share ONE `DeviceSession`, they automatically share its
+ * `activeContextId` and its token-free `session_state` broadcasts.
+ *
+ * ## The one safety rule everything here is built around
+ *
+ * A read that FAILED and a slot that is EMPTY must never be the same value. The
+ * empty answer authorises writes (seed the slot); the failed answer must
+ * authorise nothing. {@link SharedDeviceCredentialRead} keeps them apart at the
+ * type level, and every decision below fails closed on anything that is not a
+ * positive `absent`/`present`.
+ *
+ * Platform-agnostic: the actual keychain / keystore access is injected as a
+ * {@link SharedDeviceCredentialStore} by `@oxyhq/services`. ESM-safe, no
+ * `require()`, no react/react-native/expo imports.
+ */
+import type { AuthStateStore, PersistedAuthState } from './authStateStore';
+/**
+ * The zero-cookie device credential, as shared between apps. Exactly the pair
+ * `POST /session/device/token` takes — nothing else travels through the shared
+ * slot: no access token, no account id, no user id, no identity key.
+ */
+export interface SharedDeviceCredential {
+    deviceId: string;
+    deviceSecret: string;
+}
+/**
+ * The outcome of reading the shared slot. FOUR states, and the distinction
+ * between the last two is load-bearing:
+ *
+ * - `present`     — a well-formed credential was read.
+ * - `absent`      — the read SUCCEEDED and the slot is empty. The only state that
+ *                   may authorise seeding the slot.
+ * - `unavailable` — the read failed (keychain locked, keystore unreadable, the
+ *                   bridge returned something unrecognisable). Authorises
+ *                   nothing: not adoption, and above all not a write.
+ * - `unsupported` — this build has no shared slot at all (web, or a native app
+ *                   without the module linked). Not an error; simply means the
+ *                   app keeps its own per-app credential.
+ */
+export type SharedDeviceCredentialRead = {
+    state: 'present';
+    credential: SharedDeviceCredential;
+} | {
+    state: 'absent';
+} | {
+    state: 'unavailable';
+    cause: unknown;
+} | {
+    state: 'unsupported';
+};
+/**
+ * The platform seam. `@oxyhq/services` implements this over the iOS Keychain
+ * Access Group (a dedicated `keychainService`) or the Android signature-protected
+ * `OxyDeviceSession` broker.
+ */
+export interface SharedDeviceCredentialStore {
+    /** Never throws — a failure is reported as `unavailable`, never as `absent`. */
+    read(): Promise<SharedDeviceCredentialRead>;
+    /**
+     * Publish the credential. Resolves `true` only when a read-back confirmed the
+     * exact bytes landed; `false` on any failure. Never throws.
+     */
+    publish(credential: SharedDeviceCredential): Promise<boolean>;
+    /** Drop this app's copy of the shared credential. Never throws. */
+    clear(): Promise<void>;
+}
+/** Why {@link decideSharedDeviceJoin} declined to adopt the shared credential. */
+export type SharedDeviceJoinSkipReason = 'shared-unsupported' | 'shared-unreadable' | 'shared-empty' | 'local-credential-present';
+/** What a booting app should do with the shared slot it just read. */
+export type SharedDeviceJoinDecision = {
+    action: 'adopt';
+    credential: SharedDeviceCredential;
+} | {
+    action: 'skip';
+    reason: SharedDeviceJoinSkipReason;
+};
+/** Why {@link decideSharedDevicePublish} declined to write the shared slot. */
+export type SharedDevicePublishSkipReason = 'shared-unsupported' | 'shared-unreadable' | 'already-current' | 'owned-by-another-device';
+/** What an app that just PROVED a credential should do with the shared slot. */
+export type SharedDevicePublishDecision = {
+    action: 'publish';
+} | {
+    action: 'skip';
+    reason: SharedDevicePublishSkipReason;
+};
+/** The usable `{deviceId, deviceSecret}` pair in a persisted state, or null. */
+export declare function readLocalDeviceCredential(state: PersistedAuthState | null): SharedDeviceCredential | null;
+/**
+ * Narrow an UNTRUSTED bridge payload into a {@link SharedDeviceCredentialRead}.
+ *
+ * Anything unrecognised resolves to `unavailable`, never `absent`. A native
+ * module returning a shape this build does not understand (an older app in the
+ * signing group, a partially-applied upgrade) means we do not KNOW whether the
+ * device has a shared session — and "do not know" must never authorise a write
+ * that would overwrite one.
+ */
+export declare function normalizeSharedDeviceSessionRead(raw: unknown): SharedDeviceCredentialRead;
+/**
+ * Should this app adopt the shared credential? Pure.
+ *
+ * Adoption happens in exactly ONE case: the shared slot holds a credential and
+ * this app has none of its own. That single rule delivers the product
+ * requirement — a newly installed official app joins the device's existing
+ * session without another QR — while making the two failure modes that matter
+ * unreachable:
+ *
+ *  - An app that is already signed in is NEVER moved onto another credential, so
+ *    "no user is signed out merely because one app updates first" holds by
+ *    construction, in both upgrade directions.
+ *  - A failed read never looks like an empty slot, so a locked keychain resolves
+ *    to "keep what I have" rather than "this is a fresh device".
+ *
+ * The cost is stated plainly: two apps that each already own a DIFFERENT device
+ * session stay on their own until one of them loses its credential. Converging
+ * them would mean signing one of them out or a server-side device merge, and
+ * neither is something a boot path may do silently.
+ */
+export declare function decideSharedDeviceJoin(local: PersistedAuthState | null, shared: SharedDeviceCredentialRead): SharedDeviceJoinDecision;
+/**
+ * Should this app write the credential it just proved into the shared slot? Pure.
+ *
+ * `proven` means the server accepted it moments ago — a successful sign-in or a
+ * successful mint. Only a proven credential is ever published, so the slot can
+ * never be seeded with something no app could use.
+ *
+ * A slot already held by a DIFFERENT `deviceId` is left alone. Overwriting it
+ * would silently migrate every other app on this device onto our session at their
+ * next cold boot — a real, user-visible change of who they are signed in as, and
+ * not something a background persist may decide.
+ */
+export declare function decideSharedDevicePublish(proven: SharedDeviceCredential, shared: SharedDeviceCredentialRead): SharedDevicePublishDecision;
+/** The result of {@link publishProvenDeviceCredential}, for logs and tests. */
+export type SharedDevicePublishOutcome = {
+    status: 'published';
+} | {
+    status: 'publish-failed';
+} | {
+    status: 'skipped';
+    reason: SharedDevicePublishSkipReason;
+};
+/**
+ * Read the shared slot, apply {@link decideSharedDevicePublish}, and write when
+ * it says so. Best-effort by contract: the caller's own durable credential is
+ * already persisted, so a failure here only means a future install will have to
+ * sign in interactively.
+ */
+export declare function publishProvenDeviceCredential(deps: {
+    shared: SharedDeviceCredentialStore;
+    credential: SharedDeviceCredential;
+}): Promise<SharedDevicePublishOutcome>;
+/**
+ * Wrap a platform {@link AuthStateStore} so that every durable credential it
+ * persists is ALSO mirrored into the shared slot.
+ *
+ * Writes mirror automatically; reads do NOT adopt. That split is deliberate:
+ *
+ *  - Mirroring on write is the right place because `save()` is where a proven
+ *    credential lands, on every lane there is — interactive sign-in, the cold
+ *    boot mint, the refresh scheduler, the 401 re-mint, shared-key recovery. One
+ *    seam, no lane left out, and no new call site to forget.
+ *  - Adopting on read would hide a change of WHO THIS APP IS SIGNED IN AS inside
+ *    a storage primitive, and would run on every `load()`. Adoption is an
+ *    explicit, once-per-boot cold-boot step instead (`shared-device-adopt`).
+ *
+ * `clear()` deliberately does NOT clear the shared slot. This app signing out is
+ * not authority over the device-wide join point: other apps may still be signed
+ * in on that same credential, and once the server session is really gone the
+ * credential mints `no_active_session` for everyone anyway.
+ */
+export declare function createSharedMirroringAuthStateStore(deps: {
+    local: AuthStateStore;
+    shared: SharedDeviceCredentialStore;
+}): AuthStateStore;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "20.1.0",
+  "version": "21.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -116,7 +116,7 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxyhq/contracts": "^0.25.0",
+    "@oxyhq/contracts": "^0.26.0",
     "@oxyhq/protocol": "^0.2.0",
     "@scure/bip39": "^1.6.0",
     "@types/elliptic": "^6.4.18",
@@ -127,7 +127,7 @@
     "invariant": "^2.2.4",
     "jwt-decode": "^4.0.0",
     "socket.io-client": "^4.8.1",
-    "tldts": "^7.4.8",
+    "tldts": "^7.4.10",
     "zod": "^3.25.64"
   },
   "peerDependencies": {

package/src/boot/__tests__/sessionColdBoot.sharedDevice.test.ts

@@ -0,0 +1,325 @@
+/**
+ * `shared-device-adopt` — the cold-boot lane that lets a freshly installed
+ * official app join the device's EXISTING session with no QR and, crucially,
+ * with no access to the Commons private identity key.
+ *
+ * What is pinned here:
+ *   - a fresh install adopts the shared credential and mints;
+ *   - an app that already has a credential is never moved (upgrade order cannot
+ *     sign anyone out, in either direction);
+ *   - an UNREADABLE shared slot is not a fresh device — the lane skips and the
+ *     legacy identity-key lane still gets its turn;
+ *   - a failed adoption leaves the local store byte-for-byte as it was;
+ *   - `sessionMode: 'identity'` never runs the lane at all;
+ *   - web never runs it.
+ */
+import type { OxyServices } from '../../OxyServices';
+import type { DeviceTokenMintResponse } from '@oxyhq/contracts';
+import type { SessionLoginResponse } from '../../models/session';
+import { runSessionColdBoot } from '../sessionColdBoot';
+import type { DeviceSecretMintOutcome } from '../../session/refresh';
+import { createMemoryAuthStateStore, type PersistedAuthState } from '../../session/authStateStore';
+import type {
+  SharedDeviceCredentialRead,
+  SharedDeviceCredentialStore,
+} from '../../session/sharedDeviceCredential';
+import { createMemoryIdentityPinStore } from '../../session/identityPin';
+import type { IdentityBinding } from '../../session/identitySession';
+
+const WEB = { isWeb: true, isNative: false };
+const NATIVE = { isWeb: false, isNative: true };
+
+const SHARED_CRED = { deviceId: 'dev-shared', deviceSecret: 'ds-shared' };
+const OWN_CRED = { deviceId: 'dev-own', deviceSecret: 'ds-own' };
+
+const MINT: DeviceTokenMintResponse = {
+  accessToken: 'access-joined',
+  expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+  nextDeviceSecret: SHARED_CRED.deviceSecret,
+  state: {
+    deviceId: SHARED_CRED.deviceId,
+    accounts: [{ accountId: 'user-shared', sessionId: 'sess-shared', authuser: 0 }],
+    activeAccountId: 'user-shared',
+    revision: 9,
+    updatedAt: 1_700_000_000_000,
+  },
+};
+
+/** A real device-secret mint single-flight matching HttpService's. */
+function makeMintSingleFlight(): (mint: () => Promise<DeviceSecretMintOutcome>) => Promise<DeviceSecretMintOutcome> {
+  let inFlight: Promise<DeviceSecretMintOutcome> | null = null;
+  return (mint) => {
+    if (!inFlight) {
+      inFlight = mint().finally(() => {
+        inFlight = null;
+      });
+    }
+    return inFlight;
+  };
+}
+
+/** A 401 error shaped like `HttpService`/`handleError` output for the given body. */
+function mint401(body: string): Error & { status: number } {
+  return Object.assign(new Error(body), { status: 401 });
+}
+
+function makeOxy(overrides: {
+  mintFromDeviceSecret?: OxyServices['mintFromDeviceSecret'];
+  signInWithSharedIdentity?: OxyServices['signInWithSharedIdentity'];
+} = {}) {
+  const setTokens = jest.fn();
+  const mintFromDeviceSecret = jest.fn(
+    overrides.mintFromDeviceSecret ?? (async () => MINT),
+  ) as unknown as OxyServices['mintFromDeviceSecret'];
+  const signInWithSharedIdentity = jest.fn(
+    overrides.signInWithSharedIdentity ?? (async () => null),
+  ) as unknown as OxyServices['signInWithSharedIdentity'];
+  const oxy = {
+    getBaseURL: () => 'https://api.oxy.so',
+    setTokens,
+    mintFromDeviceSecret,
+    signInWithSharedIdentity,
+    httpService: { runSingleFlightDeviceSecretMint: makeMintSingleFlight() },
+  } as unknown as OxyServices;
+  return { oxy, setTokens, mintFromDeviceSecret, signInWithSharedIdentity };
+}
+
+function makeSharedSlot(initial: SharedDeviceCredentialRead) {
+  let current = initial;
+  const read = jest.fn(async () => current);
+  const publish = jest.fn(async () => true);
+  const clear = jest.fn(async () => {
+    current = { state: 'absent' };
+  });
+  const store: SharedDeviceCredentialStore = { read, publish, clear };
+  return { store, read, publish, clear };
+}
+
+/** An identity binding that resolves a local key, for the identity-mode case. */
+function makeIdentityBinding(): IdentityBinding {
+  return {
+    pinStore: createMemoryIdentityPinStore(),
+    getPublicKey: async () => 'pub-identity',
+    signMessage: async () => 'sig-identity',
+  };
+}
+
+describe('cold boot — shared-device-adopt', () => {
+  test('a fresh install adopts the shared credential and mints a session', async () => {
+    const store = createMemoryAuthStateStore();
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy, mintFromDeviceSecret, setTokens } = makeOxy();
+
+    const outcome = await runSessionColdBoot({
+      oxy,
+      store,
+      platform: NATIVE,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(outcome).toMatchObject({ kind: 'session', via: 'shared-device-adopt' });
+    expect(mintFromDeviceSecret).toHaveBeenCalledWith(SHARED_CRED.deviceId, SHARED_CRED.deviceSecret);
+    expect(setTokens).toHaveBeenCalledWith(MINT.accessToken);
+    // The adopted credential is now this app's own, so the next boot takes the
+    // faster `device-secret-mint` lane.
+    expect(await store.load()).toMatchObject({
+      deviceId: SHARED_CRED.deviceId,
+      deviceSecret: SHARED_CRED.deviceSecret,
+      sessionId: 'sess-shared',
+      userId: 'user-shared',
+    });
+  });
+
+  test('the identity key is never touched when the shared credential works', async () => {
+    // The whole point of the separation: an ordinary app joins the device session
+    // without ever asking for the key that signs identity approvals.
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy, signInWithSharedIdentity } = makeOxy();
+
+    await runSessionColdBoot({
+      oxy,
+      store: createMemoryAuthStateStore(),
+      platform: NATIVE,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(signInWithSharedIdentity).not.toHaveBeenCalled();
+  });
+
+  test('an app that already holds its own credential is not moved onto the shared one', async () => {
+    // Upgrade order must not sign anyone out. This app's own session wins.
+    const store = createMemoryAuthStateStore();
+    await store.save({ sessionId: 'sess-own', userId: 'user-own', ...OWN_CRED });
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy, mintFromDeviceSecret } = makeOxy({
+      mintFromDeviceSecret: (async () => ({
+        ...MINT,
+        nextDeviceSecret: OWN_CRED.deviceSecret,
+        state: { ...MINT.state, deviceId: OWN_CRED.deviceId },
+      })) as unknown as OxyServices['mintFromDeviceSecret'],
+    });
+
+    const outcome = await runSessionColdBoot({
+      oxy,
+      store,
+      platform: NATIVE,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(outcome).toMatchObject({ kind: 'session', via: 'device-secret-mint' });
+    expect(mintFromDeviceSecret).toHaveBeenCalledWith(OWN_CRED.deviceId, OWN_CRED.deviceSecret);
+    expect(mintFromDeviceSecret).not.toHaveBeenCalledWith(SHARED_CRED.deviceId, SHARED_CRED.deviceSecret);
+    expect(await store.load()).toMatchObject({ deviceId: OWN_CRED.deviceId });
+  });
+
+  test('an UNREADABLE shared slot is not treated as a fresh device', async () => {
+    // A locked keystore must never authorise anything. The lane skips, the store
+    // is untouched, and the legacy identity lane still gets its turn — which is
+    // what keeps a momentarily-locked device from silently onboarding again.
+    const store = createMemoryAuthStateStore();
+    const slot = makeSharedSlot({ state: 'unavailable', cause: new Error('keystore locked') });
+    const sharedKeySession = {
+      sessionId: 'sess-legacy',
+      user: { id: 'user-legacy' },
+      accessToken: 'access-legacy',
+      expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+      deviceId: 'dev-legacy',
+      deviceSecret: 'ds-legacy',
+    } as unknown as SessionLoginResponse;
+    const { oxy, signInWithSharedIdentity } = makeOxy({
+      signInWithSharedIdentity: (async () => sharedKeySession) as unknown as OxyServices['signInWithSharedIdentity'],
+    });
+
+    const outcome = await runSessionColdBoot({
+      oxy,
+      store,
+      platform: NATIVE,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(slot.publish).not.toHaveBeenCalled();
+    expect(slot.clear).not.toHaveBeenCalled();
+    expect(signInWithSharedIdentity).toHaveBeenCalled();
+    expect(outcome).toMatchObject({ kind: 'session', via: 'shared-key-signin' });
+  });
+
+  test('an empty shared slot falls through to the legacy identity lane', async () => {
+    const slot = makeSharedSlot({ state: 'absent' });
+    const { oxy, signInWithSharedIdentity } = makeOxy();
+
+    const outcome = await runSessionColdBoot({
+      oxy,
+      store: createMemoryAuthStateStore(),
+      platform: NATIVE,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(signInWithSharedIdentity).toHaveBeenCalled();
+    expect(outcome).toEqual({ kind: 'unauthenticated' });
+  });
+
+  test('a rejected shared credential is reverted locally and cleared from the slot', async () => {
+    // `invalid_device_secret` is the one positive proof that the exact shared
+    // bytes are dead. Reverting keeps this app where it was; clearing the slot is
+    // what stops a dead credential from blocking every future install.
+    const store = createMemoryAuthStateStore();
+    const before: PersistedAuthState = { sessionId: 'sess-stale', userId: 'user-stale' };
+    await store.save(before);
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy } = makeOxy({
+      mintFromDeviceSecret: (async () => {
+        throw mint401('invalid_device_secret');
+      }) as unknown as OxyServices['mintFromDeviceSecret'],
+    });
+
+    const outcome = await runSessionColdBoot({
+      oxy,
+      store,
+      platform: NATIVE,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(outcome).toEqual({ kind: 'unauthenticated' });
+    expect(slot.clear).toHaveBeenCalledTimes(1);
+    expect(await store.load()).toEqual(before);
+  });
+
+  test('a transient mint failure reverts without clearing the shared slot', async () => {
+    // A network blip says nothing about the credential. Wiping the device-wide
+    // join point on an ambiguous failure is the deploy-window bug, one layer up.
+    const store = createMemoryAuthStateStore();
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy } = makeOxy({
+      mintFromDeviceSecret: (async () => {
+        throw new Error('network down');
+      }) as unknown as OxyServices['mintFromDeviceSecret'],
+    });
+
+    await runSessionColdBoot({ oxy, store, platform: NATIVE, sharedDeviceCredential: slot.store });
+
+    expect(slot.clear).not.toHaveBeenCalled();
+    expect(await store.load()).toBeNull();
+  });
+
+  test('the lane does not run on web', async () => {
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy, mintFromDeviceSecret } = makeOxy();
+
+    const outcome = await runSessionColdBoot({
+      oxy,
+      store: createMemoryAuthStateStore(),
+      platform: WEB,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(slot.read).not.toHaveBeenCalled();
+    expect(mintFromDeviceSecret).not.toHaveBeenCalled();
+    expect(outcome).toEqual({ kind: 'unauthenticated' });
+  });
+
+  test('the lane does not run when the device reports itself offline', async () => {
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy } = makeOxy();
+
+    await runSessionColdBoot({
+      oxy,
+      store: createMemoryAuthStateStore(),
+      platform: NATIVE,
+      isOffline: () => true,
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(slot.read).not.toHaveBeenCalled();
+  });
+
+  test('identity mode never reads the shared slot', async () => {
+    // The slot belongs to whichever principal signed in on this device. An
+    // identity-bound client resolves its session from the local key alone —
+    // adopting a device credential is the drift that mode exists to prevent.
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy } = makeOxy();
+
+    await runSessionColdBoot({
+      oxy,
+      store: createMemoryAuthStateStore(),
+      platform: NATIVE,
+      sessionMode: 'identity',
+      identity: makeIdentityBinding(),
+      sharedDeviceCredential: slot.store,
+    });
+
+    expect(slot.read).not.toHaveBeenCalled();
+    expect(slot.publish).not.toHaveBeenCalled();
+  });
+
+  test('omitting the slot leaves the boot chain exactly as it was', async () => {
+    const slot = makeSharedSlot({ state: 'present', credential: SHARED_CRED });
+    const { oxy, signInWithSharedIdentity } = makeOxy();
+
+    const outcome = await runSessionColdBoot({ oxy, store: createMemoryAuthStateStore(), platform: NATIVE });
+
+    expect(slot.read).not.toHaveBeenCalled();
+    expect(signInWithSharedIdentity).toHaveBeenCalled();
+    expect(outcome).toEqual({ kind: 'unauthenticated' });
+  });
+});