@pikku/core 0.12.13 → 0.12.14

package/dist/wirings/cli/cli-runner.js

@@ -110,7 +110,7 @@ function registerCLICommands(commands, path = [], inheritedOptions = {}, program
                 programs[program].commandMiddleware[commandId] = command.middleware;
             }
         }
-        addFunction(funcName, unwrapFunc(command));
+        addFunction(funcName, unwrapFunc(command), currentMeta?.packageName);
         // Register renderer if provided
         if (typeof command === 'object' && command.render) {
             if (programs[program]) {

package/dist/wirings/http/http-runner.js

@@ -3,7 +3,6 @@ import { closeWireServices, createWeakUID, isSerializable, } from '../../utils.j
 import { getSingletonServices, getCreateWireServices, } from '../../pikku-state.js';
 import { PikkuSessionService } from '../../services/user-session-service.js';
 import { getErrorResponse } from '../../errors/error-handler.js';
-import { PikkuCredentialWireService, createMiddlewareCredentialWireProps, } from '../../services/credential-wire-service.js';
 import { handleHTTPError } from '../../handle-error.js';
 import { pikkuState } from '../../pikku-state.js';
 import { PikkuFetchHTTPResponse } from './pikku-fetch-http-response.js';
@@ -198,7 +197,6 @@ export const createHTTPWire = (request, response) => {
  */
 const executeRoute = async (services, matchedRoute, http, options) => {
     const userSession = new PikkuSessionService();
-    const credentialWire = new PikkuCredentialWireService();
     const { params, route, meta } = matchedRoute;
     const { singletonServices, createWireServices, skipUserSession, requestId } = services;
     // Attach URL parameters to the request object
@@ -259,7 +257,6 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         setSession: (s) => userSession.setInitial(s),
         getSession: () => userSession.get(),
         hasSessionChanged: () => userSession.sessionChanged,
-        ...createMiddlewareCredentialWireProps(credentialWire),
     };
     result = await runPikkuFunc('http', `${meta.method}:${meta.route}`, meta.pikkuFuncId, {
         singletonServices,
@@ -274,7 +271,6 @@ const executeRoute = async (services, matchedRoute, http, options) => {
         tags: route.tags,
         wire,
         sessionService: userSession,
-        credentialWireService: credentialWire,
         packageName: meta.packageName,
     });
     if (!matchedRoute.route.sse) {

package/dist/wirings/queue/queue-runner.js

@@ -89,6 +89,7 @@ export async function runQueueJob({ job, updateProgress, }) {
     const queue = {
         queueName: job.queueName,
         jobId: job.id,
+        pikkuUserId: job.pikkuUserId,
         updateProgress: updateProgress ||
             (async (progress) => {
                 logger.info(`Job ${job.id} progress: ${progress}`);

package/dist/wirings/queue/queue.types.d.ts

@@ -87,6 +87,8 @@ export interface QueueJob<T = any, R = any> {
     result?: R;
     waitForCompletion?: (ttl?: number) => Promise<R>;
     metadata?: () => Promise<QueueJobMetadata> | QueueJobMetadata;
+    /** Pikku user ID propagated from the job producer */
+    pikkuUserId?: string;
 }
 /**
  * Job options for queue operations
@@ -102,6 +104,8 @@ export interface JobOptions {
     removeOnComplete?: number;
     removeOnFail?: number;
     jobId?: string;
+    /** Pikku user ID to propagate to the queue worker for credential resolution */
+    pikkuUserId?: string;
 }
 /**
  * Queue provider interface for job publishing operations
@@ -154,6 +158,8 @@ export interface PikkuQueue {
     queueName: string;
     /** The current job ID */
     jobId: string;
+    /** Pikku user ID propagated from the job producer for credential resolution */
+    pikkuUserId?: string;
     /** Update job progress (0-100 or custom value) */
     updateProgress: (progress: number | string | object) => Promise<void>;
     /** Fail the current job with optional reason */

package/dist/wirings/rpc/rpc-runner.js

@@ -178,6 +178,7 @@ export class ContextAwareRPCService {
             type: this.wire.wireType ?? 'unknown',
             id: this.wire.wireId,
             ...(parentRunId ? { parentRunId } : {}),
+            ...(this.wire.pikkuUserId ? { pikkuUserId: this.wire.pikkuUserId } : {}),
         };
         return this.services.workflowService.startWorkflow(workflowName, input, wire, this, options);
     }

package/dist/wirings/workflow/dsl/workflow-dsl.types.d.ts

@@ -281,6 +281,8 @@ export interface PikkuWorkflowWire {
     name: string;
     /** The current run ID */
     runId: string;
+    /** Pikku user ID propagated from the originating request for credential resolution */
+    pikkuUserId?: string;
     /** Get the current workflow run */
     getRun: () => Promise<WorkflowRun>;
     /** Execute a workflow step (overloaded - RPC or inline form) */

package/dist/wirings/workflow/pikku-workflow-service.js

@@ -258,8 +258,10 @@ export class PikkuWorkflowService {
         }
         await this.withRunLock(runId, async () => {
             const workflowWire = this.createWorkflowWire(run.workflow, runId, rpcService);
+            workflowWire.pikkuUserId = run.wire?.pikkuUserId;
             const wire = {
                 workflow: workflowWire,
+                pikkuUserId: run.wire?.pikkuUserId,
                 session: rpcService.wire?.session,
                 rpc: rpcService.wire?.rpc,
             };

package/dist/wirings/workflow/workflow.types.d.ts

@@ -8,6 +8,8 @@ export interface WorkflowRunWire {
     id?: string;
     parentRunId?: string;
     parentStepId?: string;
+    /** Pikku user ID propagated from the originating request for credential resolution */
+    pikkuUserId?: string;
 }
 export interface WorkflowServiceConfig {
     retries: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.13",
+  "version": "0.12.14",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/index.js",

package/src/errors/errors.ts

@@ -76,6 +76,38 @@ addError(ForbiddenError, {
     'The client does not have permission to access the requested resource.',
 })
 
+/**
+ * A required credential is missing. The payload contains metadata
+ * about the credential so the client can initiate a connect flow.
+ * @group Error
+ */
+export class MissingCredentialError extends PikkuError {
+  public payload: {
+    error: 'missing_credential'
+    credentialName: string
+    credentialType: 'oauth2' | 'apikey'
+    connectUrl?: string
+  }
+
+  constructor(
+    credentialName: string,
+    credentialType: 'oauth2' | 'apikey',
+    connectUrl?: string
+  ) {
+    super(`Missing credential: ${credentialName}`)
+    this.payload = {
+      error: 'missing_credential',
+      credentialName,
+      credentialType,
+      connectUrl,
+    }
+  }
+}
+addError(MissingCredentialError, {
+  status: 403,
+  message: 'A required credential is not configured.',
+})
+
 /**
  * The session is readonly and cannot access a non-readonly function.
  * @group Error

package/src/function/function-runner.ts

@@ -28,8 +28,10 @@ import { parseVersionedId } from '../version.js'
 import type { SessionService } from '../services/user-session-service.js'
 import { createFunctionSessionWireProps } from '../services/user-session-service.js'
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js'
-import type { PikkuCredentialWireService } from '../services/credential-wire-service.js'
-import { createWireServicesCredentialWireProps } from '../services/credential-wire-service.js'
+import {
+  PikkuCredentialWireService,
+  createWireServicesCredentialWireProps,
+} from '../services/credential-wire-service.js'
 import { rpcService } from '../wirings/rpc/rpc-runner.js'
 import { closeWireServices } from '../utils.js'
 
@@ -226,6 +228,21 @@ export const runPikkuFunc = async <In = any, Out = any>(
         )
       : wire
 
+  // Set up credential wire service early so middleware can use setCredential.
+  // Skip if already set up (e.g. addon functions reuse the parent wire).
+  if (!resolvedWire.getCredentials) {
+    const resolvedCredentialWireService =
+      credentialWireService ??
+      new PikkuCredentialWireService(
+        resolvedSingletonServices.credentialService,
+        resolvedWire
+      )
+    Object.assign(
+      resolvedWire,
+      createWireServicesCredentialWireProps(resolvedCredentialWireService)
+    )
+  }
+
   // Convert tags to PermissionMetadata and merge with inheritedPermissions
   let mergedInheritedPermissions: PermissionMetadata[]
   if (tags && tags.length > 0) {
@@ -316,13 +333,6 @@ export const runPikkuFunc = async <In = any, Out = any>(
       })
     }
 
-    if (credentialWireService) {
-      Object.assign(
-        resolvedWire,
-        createWireServicesCredentialWireProps(credentialWireService)
-      )
-    }
-
     const wireServices = await resolvedCreateWireServices?.(
       resolvedSingletonServices,
       resolvedWire

package/src/pikku-state.ts

@@ -157,6 +157,7 @@ const createEmptyPackageState = (): PikkuPackageState => ({
     factories: null,
     singletonServices: null,
     metaDir: null,
+    credentialsMeta: null,
   },
 })
 

package/src/services/credential-service.ts

@@ -41,4 +41,17 @@ export interface CredentialService {
    * @returns A record of credential name to value.
    */
   getAll(userId: string): Promise<Record<string, unknown>>
+
+  /**
+   * Lists all user IDs that have a specific credential configured.
+   * @param name - The credential name.
+   * @returns Array of user IDs.
+   */
+  getUsersWithCredential(name: string): Promise<string[]>
+
+  /**
+   * Lists all unique user IDs that have any credential configured.
+   * @returns Array of user IDs.
+   */
+  getAllUsers(): Promise<string[]>
 }

package/src/services/credential-wire-service.test.ts

@@ -0,0 +1,174 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert'
+import {
+  PikkuCredentialWireService,
+  createMiddlewareCredentialWireProps,
+  createWireServicesCredentialWireProps,
+} from './credential-wire-service.js'
+import type { CredentialService } from './credential-service.js'
+import type { PikkuWire } from '../types/core.types.js'
+
+const mockCredentialService = (
+  creds: Record<string, unknown>
+): CredentialService => ({
+  get: async (name: string) => creds[name] ?? null,
+  set: async () => {},
+  delete: async () => {},
+  has: async (name: string) => name in creds,
+  getAll: async () => creds,
+})
+
+describe('PikkuCredentialWireService', () => {
+  test('should set and get credentials manually', async () => {
+    const service = new PikkuCredentialWireService()
+    service.set('stripe', { apiKey: 'sk_test' })
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, { stripe: { apiKey: 'sk_test' } })
+  })
+
+  test('should return sync after first load (no credential service)', async () => {
+    const service = new PikkuCredentialWireService()
+    service.set('foo', 'bar')
+    // First call triggers lazy load (no-op without credentialService)
+    await service.getAll()
+    // Second call should be sync
+    const result = service.getAll()
+    assert.ok(!(result instanceof Promise), 'expected sync return')
+    assert.deepStrictEqual(result, { foo: 'bar' })
+  })
+
+  test('should lazy-load from credential service on first getAll', async () => {
+    const credService = mockCredentialService({
+      stripe: { apiKey: 'sk_live' },
+      github: { token: 'ghp_abc' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, {
+      stripe: { apiKey: 'sk_live' },
+      github: { token: 'ghp_abc' },
+    })
+  })
+
+  test('should set pikkuUserId on wire after lazy load', async () => {
+    const credService = mockCredentialService({})
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    await service.getAll()
+    assert.strictEqual(wire.pikkuUserId, 'user-1')
+  })
+
+  test('should not overwrite manually set credentials during lazy load', async () => {
+    const credService = mockCredentialService({
+      stripe: { apiKey: 'from-db' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    service.set('stripe', { apiKey: 'from-middleware' })
+    const result = await service.getAll()
+    assert.deepStrictEqual(result.stripe, { apiKey: 'from-middleware' })
+  })
+
+  test('should return sync on subsequent calls after lazy load', async () => {
+    const credService = mockCredentialService({ stripe: { key: '123' } })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    await service.getAll()
+    const result = service.getAll()
+    assert.ok(!(result instanceof Promise), 'expected sync return')
+    assert.deepStrictEqual(result, { stripe: { key: '123' } })
+  })
+
+  test('should not load when no userId resolvable', async () => {
+    let called = false
+    const credService: CredentialService = {
+      get: async () => null,
+      set: async () => {},
+      delete: async () => {},
+      has: async () => false,
+      getAll: async () => {
+        called = true
+        return {}
+      },
+    }
+    const wire: PikkuWire = {}
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, {})
+    assert.strictEqual(called, false)
+  })
+
+  test('should deduplicate concurrent lazy load calls', async () => {
+    let callCount = 0
+    const credService: CredentialService = {
+      get: async () => null,
+      set: async () => {},
+      delete: async () => {},
+      has: async () => false,
+      getAll: async () => {
+        callCount++
+        return { stripe: { key: 'test' } }
+      },
+    }
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const [r1, r2] = await Promise.all([service.getAll(), service.getAll()])
+    assert.strictEqual(callCount, 1)
+    assert.deepStrictEqual(r1, r2)
+  })
+
+  test('getScoped should only return allowed names', async () => {
+    const credService = mockCredentialService({
+      stripe: { key: '1' },
+      github: { token: '2' },
+      slack: { webhook: '3' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+
+    const result = await service.getScoped(['stripe', 'slack'])
+    assert.deepStrictEqual(result, {
+      stripe: { key: '1' },
+      slack: { webhook: '3' },
+    })
+  })
+})
+
+describe('createMiddlewareCredentialWireProps', () => {
+  test('should provide setCredential that writes to service', async () => {
+    const service = new PikkuCredentialWireService()
+    const props = createMiddlewareCredentialWireProps(service)
+    props.setCredential('stripe', { apiKey: 'test' })
+    const result = await service.getAll()
+    assert.deepStrictEqual(result, { stripe: { apiKey: 'test' } })
+  })
+})
+
+describe('createWireServicesCredentialWireProps', () => {
+  test('should provide both setCredential and getCredentials', async () => {
+    const service = new PikkuCredentialWireService()
+    const props = createWireServicesCredentialWireProps(service)
+    props.setCredential('stripe', { apiKey: 'test' })
+    const result = await props.getCredentials()
+    assert.deepStrictEqual(result, { stripe: { apiKey: 'test' } })
+  })
+
+  test('should scope getCredentials when allowedNames provided', async () => {
+    const credService = mockCredentialService({
+      stripe: { key: '1' },
+      github: { token: '2' },
+    })
+    const wire: PikkuWire = { session: { userId: 'user-1' } as any }
+    const service = new PikkuCredentialWireService(credService, wire)
+    const props = createWireServicesCredentialWireProps(service, ['stripe'])
+    const result = await props.getCredentials()
+    assert.deepStrictEqual(result, { stripe: { key: '1' } })
+  })
+})

package/src/services/credential-wire-service.ts

@@ -1,22 +1,65 @@
+import type { CredentialService } from './credential-service.js'
+import { defaultPikkuUserIdResolver } from './pikku-user-id.js'
+import type { PikkuWire } from '../types/core.types.js'
+
 export class PikkuCredentialWireService {
   private credentials: Record<string, unknown> = {}
+  private loaded = false
+  private loadPromise: Promise<void> | undefined
+
+  constructor(
+    private credentialService?: CredentialService,
+    private wire?: PikkuWire
+  ) {}
 
   set(name: string, value: unknown): void {
     this.credentials[name] = value
   }
 
-  getAll(): Record<string, unknown> {
-    return this.credentials
+  get<T = unknown>(name: string): T | null | Promise<T | null> {
+    if (this.loaded) return (this.credentials[name] as T) ?? null
+    return this.lazyLoad().then(() => (this.credentials[name] as T) ?? null)
+  }
+
+  getAll(): Record<string, unknown> | Promise<Record<string, unknown>> {
+    if (this.loaded) return this.credentials
+    return this.lazyLoad().then(() => this.credentials)
+  }
+
+  getScoped(
+    allowedNames: string[]
+  ): Record<string, unknown> | Promise<Record<string, unknown>> {
+    const buildScoped = () => {
+      const scoped: Record<string, unknown> = {}
+      for (const name of allowedNames) {
+        if (name in this.credentials) {
+          scoped[name] = this.credentials[name]
+        }
+      }
+      return scoped
+    }
+    if (this.loaded) return buildScoped()
+    return this.lazyLoad().then(buildScoped)
+  }
+
+  private lazyLoad(): Promise<void> {
+    if (this.loadPromise) return this.loadPromise
+    this.loadPromise = this.doLoad()
+    return this.loadPromise
   }
 
-  getScoped(allowedNames: string[]): Record<string, unknown> {
-    const scoped: Record<string, unknown> = {}
-    for (const name of allowedNames) {
-      if (name in this.credentials) {
-        scoped[name] = this.credentials[name]
+  private async doLoad(): Promise<void> {
+    this.loaded = true
+    if (!this.credentialService || !this.wire) return
+    const userId = defaultPikkuUserIdResolver(this.wire)
+    if (!userId) return
+    this.wire.pikkuUserId = userId
+    const allCreds = await this.credentialService.getAll(userId)
+    for (const [name, value] of Object.entries(allCreds)) {
+      if (!(name in this.credentials)) {
+        this.credentials[name] = value
       }
     }
-    return scoped
   }
 }
 
@@ -36,6 +79,7 @@ export function createWireServicesCredentialWireProps(
   return {
     setCredential: (name: string, value: unknown) =>
       credentialWire.set(name, value),
+    getCredential: <T = unknown>(name: string) => credentialWire.get<T>(name),
     getCredentials: () =>
       allowedNames
         ? credentialWire.getScoped(allowedNames)

package/src/services/local-credential-service.ts

@@ -38,4 +38,26 @@ export class LocalCredentialService implements CredentialService {
     }
     return result
   }
+
+  async getUsersWithCredential(name: string): Promise<string[]> {
+    const suffix = `:${name}`
+    const users: string[] = []
+    for (const key of this.store.keys()) {
+      if (key.endsWith(suffix)) {
+        users.push(key.slice(0, -suffix.length))
+      }
+    }
+    return users
+  }
+
+  async getAllUsers(): Promise<string[]> {
+    const users = new Set<string>()
+    for (const key of this.store.keys()) {
+      const colonIndex = key.indexOf(':')
+      if (colonIndex > 0) {
+        users.add(key.slice(0, colonIndex))
+      }
+    }
+    return [...users]
+  }
 }

package/src/services/pikku-user-id.test.ts

@@ -0,0 +1,62 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert'
+import { defaultPikkuUserIdResolver } from './pikku-user-id.js'
+import type { PikkuWire } from '../types/core.types.js'
+
+describe('defaultPikkuUserIdResolver', () => {
+  test('should return pikkuUserId from wire', () => {
+    const wire: PikkuWire = { pikkuUserId: 'user-1' }
+    assert.strictEqual(defaultPikkuUserIdResolver(wire), 'user-1')
+  })
+
+  test('should return userId from session', () => {
+    const wire: PikkuWire = { session: { userId: 'session-user' } as any }
+    assert.strictEqual(defaultPikkuUserIdResolver(wire), 'session-user')
+  })
+
+  test('should prefer pikkuUserId over session', () => {
+    const wire: PikkuWire = {
+      pikkuUserId: 'explicit',
+      session: { userId: 'session-user' } as any,
+    }
+    assert.strictEqual(defaultPikkuUserIdResolver(wire), 'explicit')
+  })
+
+  test('should return pikkuUserId from queue', () => {
+    const wire: PikkuWire = {
+      queue: {
+        queueName: 'test',
+        jobId: '1',
+        pikkuUserId: 'queue-user',
+        updateProgress: async () => {},
+        fail: async () => {},
+        discard: async () => {},
+      },
+    }
+    assert.strictEqual(defaultPikkuUserIdResolver(wire), 'queue-user')
+  })
+
+  test('should return pikkuUserId from workflow', () => {
+    const wire: PikkuWire = {
+      workflow: {
+        name: 'test',
+        runId: '1',
+        pikkuUserId: 'workflow-user',
+        getRun: async () => ({}) as any,
+        do: (() => {}) as any,
+        sleep: (() => {}) as any,
+      } as any,
+    }
+    assert.strictEqual(defaultPikkuUserIdResolver(wire), 'workflow-user')
+  })
+
+  test('should return undefined when no identity source', () => {
+    const wire: PikkuWire = {}
+    assert.strictEqual(defaultPikkuUserIdResolver(wire), undefined)
+  })
+
+  test('should ignore non-string session userId', () => {
+    const wire: PikkuWire = { session: { userId: 123 } as any }
+    assert.strictEqual(defaultPikkuUserIdResolver(wire), undefined)
+  })
+})

package/src/services/pikku-user-id.ts

@@ -0,0 +1,17 @@
+import type { PikkuWire } from '../types/core.types.js'
+
+export type PikkuUserIdResolver = (wire: PikkuWire) => string | undefined
+
+export const defaultPikkuUserIdResolver: PikkuUserIdResolver = (wire) => {
+  // Explicit pikkuUserId on wire (set by earlier middleware or runner)
+  if (wire.pikkuUserId) return wire.pikkuUserId
+  // Session userId (from auth middleware — user-defined session shape)
+  const session = wire.session as Record<string, unknown> | undefined
+  if (session?.userId && typeof session.userId === 'string')
+    return session.userId
+  // Queue job: carried in job metadata
+  if (wire.queue?.pikkuUserId) return wire.queue.pikkuUserId
+  // Workflow: carried in run wire metadata
+  if (wire.workflow?.pikkuUserId) return wire.workflow.pikkuUserId
+  return undefined
+}

package/src/services/typed-credential-service.ts

@@ -52,6 +52,14 @@ export class TypedCredentialService<TMap = Record<string, unknown>>
     return this.credentials.getAll(userId)
   }
 
+  async getUsersWithCredential(name: string): Promise<string[]> {
+    return this.credentials.getUsersWithCredential(name)
+  }
+
+  async getAllUsers(): Promise<string[]> {
+    return this.credentials.getAllUsers()
+  }
+
   async getAllStatus(userId?: string): Promise<CredentialStatusInfo[]> {
     const results: CredentialStatusInfo[] = []
 

package/src/types/core.types.ts

@@ -273,10 +273,16 @@ export type PikkuWire<
   getSession: () => Promise<UserSession> | UserSession | undefined
   /** Whether the session was modified during this run */
   hasSessionChanged: () => boolean
+  /** The resolved user identity for credential lookups */
+  pikkuUserId: string
   /** Set a credential value (available in middleware) */
   setCredential: (name: string, value: unknown) => void
-  /** Get all resolved credentials (only available in pikkuWireServices) */
-  getCredentials: () => Record<string, unknown>
+  /** Get a single credential by name — lazy-loads from CredentialService on first call, sync thereafter */
+  getCredential: <T = unknown>(name: string) => T | null | Promise<T | null>
+  /** Get all resolved credentials — lazy-loads from CredentialService on first call, sync thereafter */
+  getCredentials: () =>
+    | Record<string, unknown>
+    | Promise<Record<string, unknown>>
 }>
 
 /**

package/src/types/state.types.ts

@@ -184,5 +184,10 @@ export interface PikkuPackageState {
     singletonServices: CoreSingletonServices | null
     /** Absolute path to this package's .pikku directory */
     metaDir: string | null
+    /** Credential metadata for this addon package */
+    credentialsMeta: Record<
+      string,
+      { name: string; displayName: string; type: string; oauth2?: boolean }
+    > | null
   }
 }