@secrefs/node 0.1.0 → 0.2.0

package/dist/index.d.cts

@@ -1,6 +1,37 @@
 import { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
 import vaultFactory from 'node-vault';
 
+/**
+ * Why a fetch failed, and - more usefully - who has to do something
+ * about it.
+ *
+ * The distinction that matters is between a problem with *the reference*
+ * and a problem with *the environment*. They currently look identical to
+ * a caller, which produces the worst message SecRefs emits today: an
+ * expired `aws sso login` reported once per reference as
+ * `could not fetch secret "prod/db"`, blaming four healthy secrets for
+ * one dead credential.
+ */
+type SecretErrorKind = 
+/** Credentials are missing, expired, or unusable. Nothing about the
+ * reference is wrong; a human has to re-authenticate. Report once for
+ * the whole provider, never per reference. */
+"auth"
+/** Credentials worked and the backend says this path does not exist.
+ * Specific to the reference. */
+ | "not_found"
+/** Credentials worked and the backend refused *this* path. Also
+ * specific to the reference - sending someone to re-login when the
+ * real problem is an IAM policy wastes their afternoon. */
+ | "denied"
+/** Network, timeout, throttle, or 5xx. Nobody is at fault and the same
+ * call may well succeed a second later. The only kind for which
+ * serving a stale value is defensible. */
+ | "transient"
+/** Unclassified. Treated as permanent, because guessing "transient"
+ * would mean retrying something that will never succeed. */
+ | "unknown";
+
 /**
  * The provider contract every SecRefs backend (AWS, Vault, local, or a
  * custom one you bring yourself) implements. Providers never log, print,
@@ -41,6 +72,13 @@ interface ISecretProvider {
 declare class SecretFetchError extends Error {
     readonly provider: string;
     readonly path: string;
+    readonly cause: unknown;
+    /** Whose problem this is - see {@link SecretErrorKind}. Classified from
+     * `cause` so every existing throw site is categorised without having to
+     * know about categories. */
+    readonly kind: SecretErrorKind;
+    /** The action that fixes it, when there is one (auth failures). */
+    readonly remedy?: string;
     constructor(provider: string, path: string, cause: unknown);
 }
 declare abstract class BaseSecretProvider implements ISecretProvider {
@@ -78,10 +116,20 @@ interface ResolutionFailure {
     /** The original `sec://` string. */
     ref: string;
     message: string;
+    /** Whose problem this is. `undefined` when the failure came from
+     * somewhere that doesn't classify (a malformed reference, say). */
+    kind?: SecretErrorKind;
+    /** Provider alias the reference named, for grouping auth failures. */
+    provider?: string;
+    /** What to run to fix it, for auth failures. */
+    remedy?: string;
 }
 declare class SecRefsResolutionError extends Error {
     readonly errors: ResolutionFailure[];
     constructor(errors: ResolutionFailure[]);
+    /** True when every failure was an environment/auth problem, so a caller
+     * can tell "your credentials lapsed" from "your references are wrong". */
+    get isAuthOnly(): boolean;
 }
 interface CheckResult {
     key: string;
@@ -194,6 +242,32 @@ interface TtlCacheOptions {
     /** Milliseconds an entry stays fresh. `0` (default) disables caching
      * entirely - every `fetch` call goes to the source. */
     ttlMs?: number;
+    /**
+     * Milliseconds a *previously successful* value may be served after a
+     * failed refresh. `0` (default) means a failure is a failure.
+     *
+     * This exists for one narrow case: use-time resolution couples every
+     * use to the vault being reachable right now, so a two-second network
+     * blip can fail a request that would otherwise have been fine. A short
+     * grace window rides that out.
+     *
+     * It is emphatically not a general fallback, and `isStaleServable`
+     * below is what keeps it honest. Serving a stale value over an expired
+     * credential hides a change the operator has to act on; serving one
+     * over a rotation means continuing to use a key that may have been
+     * rotated *because it leaked*. Keep the window short.
+     */
+    staleGraceMs?: number;
+    /**
+     * Decides whether a given failure may be answered from the stale
+     * value. Defaults to "never". Providers pass a predicate that admits
+     * only transient faults - the cache itself stays free of any knowledge
+     * about provider error taxonomies.
+     */
+    isStaleServable?: (err: unknown) => boolean;
+    /** Called when a stale value is served, so the layer above can warn.
+     * Never receives the value - only the key and its age. */
+    onStale?: (key: string, ageMs: number, err: unknown) => void;
     /** Injected in tests so expiry doesn't require real waiting. */
     now?: () => number;
 }
@@ -206,6 +280,9 @@ declare class TtlCache<T> {
      * stays correct even with caching fully disabled. */
     private readonly inFlight;
     private readonly ttlMs;
+    private readonly staleGraceMs;
+    private readonly isStaleServable;
+    private readonly onStale?;
     private readonly now;
     constructor(options?: TtlCacheOptions);
     /**
@@ -224,6 +301,86 @@ declare class TtlCache<T> {
     clear(): void;
 }
 
+/**
+ * Project configuration: `secrefs.config.json`.
+ *
+ * The reference format has always supported arbitrary aliases -
+ * `ProviderRegistry` is a plain `Record<string, ISecretProvider>` - but
+ * only library callers could register them. The CLI was stuck with four
+ * hardcoded names, so `secrefs run` could reach exactly one AWS account
+ * and one Bitwarden vault. This closes that gap.
+ *
+ * **This file never holds a secret.** Every credential is referenced by
+ * the name of the environment variable that carries it, or by an AWS
+ * profile name. That is the whole design constraint: a config file that
+ * could hold a token would recreate the `.env` problem one level up, in
+ * the tool built to solve it. `secrefs.config.json` is meant to be
+ * committed, and nothing in this parser will read a literal credential
+ * even if someone puts one there.
+ */
+declare const CONFIG_FILENAME = "secrefs.config.json";
+interface AwsAliasConfig {
+    type: "aws";
+    /** Named profile from ~/.aws/config. Uses the ambient chain if absent. */
+    profile?: string;
+    region?: string;
+    /** Milliseconds a fetched value may be reused. Default 0 (re-fetch). */
+    cacheTtlMs?: number;
+    /** Milliseconds a stale value may answer a *transient* failure. */
+    staleGraceMs?: number;
+}
+interface BitwardenAliasConfig {
+    type: "bitwarden";
+    /** Name of the env var holding the machine account token. Never the
+     * token. Defaults to BWS_ACCESS_TOKEN. */
+    tokenEnv?: string;
+    /** Name of the env var holding the organization id. */
+    organizationIdEnv?: string;
+    apiUrl?: string;
+    identityUrl?: string;
+}
+interface VaultAliasConfig {
+    type: "vault";
+    /** Name of the env var holding the Vault token. Defaults to VAULT_TOKEN. */
+    tokenEnv?: string;
+    addr?: string;
+}
+interface LocalAliasConfig {
+    type: "local";
+    /** Path to the gitignored JSON file, relative to the config file. */
+    file?: string;
+}
+type AliasConfig = AwsAliasConfig | BitwardenAliasConfig | VaultAliasConfig | LocalAliasConfig;
+interface SecRefsConfig {
+    providers: Record<string, AliasConfig>;
+}
+declare class ConfigError extends Error {
+    constructor(message: string);
+}
+declare function parseConfig(raw: string, source?: string): SecRefsConfig;
+/**
+ * Builds a provider registry from parsed config. Aliases entirely replace
+ * the built-in defaults rather than merging with them: a config that
+ * declares `aws-prod` and `aws-staging` almost certainly does *not* want
+ * a third, differently-configured `aws` quietly still working, because
+ * that is how a reference ends up resolving against the wrong account.
+ */
+declare function buildProviders(config: SecRefsConfig, options?: {
+    configDir?: string;
+    env?: NodeJS.ProcessEnv;
+}): ProviderRegistry;
+/**
+ * Loads `secrefs.config.json` from `dir`, or from the nearest ancestor
+ * that has one - so `secrefs run` works from a subdirectory of a repo the
+ * way git and every other project tool does. Returns undefined when no
+ * config exists anywhere up the tree, which is the common case and not an
+ * error: the built-in aliases are used instead.
+ */
+declare function loadConfigFrom(dir?: string): {
+    config: SecRefsConfig;
+    path: string;
+} | undefined;
+
 /**
  * Thin HTTP client for a running control plane's credential-broker
  * endpoint (docs/control-plane-design.md §7). This is the piece §10
@@ -304,6 +461,14 @@ declare class ControlPlaneClient {
 
 interface AwsProviderOptions {
     region?: string;
+    /**
+     * Named profile from the shared AWS config, for addressing more than
+     * one account. Note this does not make a profile self-sufficient: with
+     * SSO each profile needs its own live session, and they expire
+     * independently - which is why an auth failure names the alias that
+     * failed rather than just saying "AWS".
+     */
+    profile?: string;
     /** Inject a pre-configured client (primarily for testing) - also wins
      * over `controlPlane` if both are set, since a test that supplies an
      * explicit client wants full control regardless of the mode. */
@@ -326,6 +491,17 @@ interface AwsProviderOptions {
      * ../ttlCache.ts.
      */
     cacheTtlMs?: number;
+    /**
+     * Milliseconds a previously-fetched value may be served after a *failed*
+     * refresh. Defaults to 0 (off). Only ever applies to transient faults -
+     * network, timeout, throttle, 5xx. An expired credential or a denial is
+     * never answered from a stale value, because both mean something in the
+     * environment changed that a human has to see. See ../ttlCache.ts.
+     */
+    staleGraceMs?: number;
+    /** Called when a stale value is served, so a CLI can warn. Receives the
+     * secret path and the age of the value - never the value. */
+    onStaleValue?: (path: string, ageMs: number, err: unknown) => void;
 }
 /**
  * AWS Secrets Manager provider. Two credential-sourcing modes:
@@ -350,6 +526,7 @@ declare class AwsSecretsManagerProvider extends BaseSecretProvider {
     readonly name = "aws";
     private readonly explicitClient?;
     private readonly region?;
+    private readonly profile?;
     private readonly controlPlane?;
     private readonly controlPlaneClient?;
     private ambientClient;
@@ -578,4 +755,4 @@ declare class SecRefs {
 /** Convenience singleton mirroring `secRefs.init()` / `secRefs.expandEnv()` / `secRefs.expandString()`. */
 declare const secRefs: SecRefs;
 
-export { type AwsProviderOptions, AwsSecretsManagerProvider, BaseSecretProvider, type BitwardenClientLike, BitwardenProvider, type BitwardenProviderOptions, type CheckResult, ControlPlaneClient, type ControlPlaneClientOptions, type ControlPlaneCredentialSource, ControlPlaneRequestError, type ExpandOptions, type ISecretProvider, LocalProvider, type LocalProviderOptions, type MintCredentialResponse, type MintedAwsCredentials, type MintedBitwardenCredentials, type ParsedSecretRef, type ProviderHealth, type ProviderRegistry, type ResolutionFailure, SecRefParseError, SecRefs, type SecRefsOptions, SecRefsResolutionError, SecretFetchError, type SecretFetchRequest, TtlCache, type TtlCacheOptions, VaultProvider, type VaultProviderOptions, checkReferences, createDefaultProviders, expandKeyValueMap, expandProcessEnv, extractField, isSecretRef, parseEnvFileText, parseSecretRef, recoverTruncatedSecRefs, secRefs, tryParseSecretRef };
+export { type AliasConfig, type AwsProviderOptions, AwsSecretsManagerProvider, BaseSecretProvider, type BitwardenClientLike, BitwardenProvider, type BitwardenProviderOptions, CONFIG_FILENAME, type CheckResult, ConfigError, ControlPlaneClient, type ControlPlaneClientOptions, type ControlPlaneCredentialSource, ControlPlaneRequestError, type ExpandOptions, type ISecretProvider, LocalProvider, type LocalProviderOptions, type MintCredentialResponse, type MintedAwsCredentials, type MintedBitwardenCredentials, type ParsedSecretRef, type ProviderHealth, type ProviderRegistry, type ResolutionFailure, SecRefParseError, SecRefs, type SecRefsConfig, type SecRefsOptions, SecRefsResolutionError, SecretFetchError, type SecretFetchRequest, TtlCache, type TtlCacheOptions, VaultProvider, type VaultProviderOptions, buildProviders, checkReferences, createDefaultProviders, expandKeyValueMap, expandProcessEnv, extractField, isSecretRef, loadConfigFrom, parseConfig, parseEnvFileText, parseSecretRef, recoverTruncatedSecRefs, secRefs, tryParseSecretRef };

package/dist/index.d.ts

@@ -1,6 +1,37 @@
 import { SecretsManagerClient } from '@aws-sdk/client-secrets-manager';
 import vaultFactory from 'node-vault';
 
+/**
+ * Why a fetch failed, and - more usefully - who has to do something
+ * about it.
+ *
+ * The distinction that matters is between a problem with *the reference*
+ * and a problem with *the environment*. They currently look identical to
+ * a caller, which produces the worst message SecRefs emits today: an
+ * expired `aws sso login` reported once per reference as
+ * `could not fetch secret "prod/db"`, blaming four healthy secrets for
+ * one dead credential.
+ */
+type SecretErrorKind = 
+/** Credentials are missing, expired, or unusable. Nothing about the
+ * reference is wrong; a human has to re-authenticate. Report once for
+ * the whole provider, never per reference. */
+"auth"
+/** Credentials worked and the backend says this path does not exist.
+ * Specific to the reference. */
+ | "not_found"
+/** Credentials worked and the backend refused *this* path. Also
+ * specific to the reference - sending someone to re-login when the
+ * real problem is an IAM policy wastes their afternoon. */
+ | "denied"
+/** Network, timeout, throttle, or 5xx. Nobody is at fault and the same
+ * call may well succeed a second later. The only kind for which
+ * serving a stale value is defensible. */
+ | "transient"
+/** Unclassified. Treated as permanent, because guessing "transient"
+ * would mean retrying something that will never succeed. */
+ | "unknown";
+
 /**
  * The provider contract every SecRefs backend (AWS, Vault, local, or a
  * custom one you bring yourself) implements. Providers never log, print,
@@ -41,6 +72,13 @@ interface ISecretProvider {
 declare class SecretFetchError extends Error {
     readonly provider: string;
     readonly path: string;
+    readonly cause: unknown;
+    /** Whose problem this is - see {@link SecretErrorKind}. Classified from
+     * `cause` so every existing throw site is categorised without having to
+     * know about categories. */
+    readonly kind: SecretErrorKind;
+    /** The action that fixes it, when there is one (auth failures). */
+    readonly remedy?: string;
     constructor(provider: string, path: string, cause: unknown);
 }
 declare abstract class BaseSecretProvider implements ISecretProvider {
@@ -78,10 +116,20 @@ interface ResolutionFailure {
     /** The original `sec://` string. */
     ref: string;
     message: string;
+    /** Whose problem this is. `undefined` when the failure came from
+     * somewhere that doesn't classify (a malformed reference, say). */
+    kind?: SecretErrorKind;
+    /** Provider alias the reference named, for grouping auth failures. */
+    provider?: string;
+    /** What to run to fix it, for auth failures. */
+    remedy?: string;
 }
 declare class SecRefsResolutionError extends Error {
     readonly errors: ResolutionFailure[];
     constructor(errors: ResolutionFailure[]);
+    /** True when every failure was an environment/auth problem, so a caller
+     * can tell "your credentials lapsed" from "your references are wrong". */
+    get isAuthOnly(): boolean;
 }
 interface CheckResult {
     key: string;
@@ -194,6 +242,32 @@ interface TtlCacheOptions {
     /** Milliseconds an entry stays fresh. `0` (default) disables caching
      * entirely - every `fetch` call goes to the source. */
     ttlMs?: number;
+    /**
+     * Milliseconds a *previously successful* value may be served after a
+     * failed refresh. `0` (default) means a failure is a failure.
+     *
+     * This exists for one narrow case: use-time resolution couples every
+     * use to the vault being reachable right now, so a two-second network
+     * blip can fail a request that would otherwise have been fine. A short
+     * grace window rides that out.
+     *
+     * It is emphatically not a general fallback, and `isStaleServable`
+     * below is what keeps it honest. Serving a stale value over an expired
+     * credential hides a change the operator has to act on; serving one
+     * over a rotation means continuing to use a key that may have been
+     * rotated *because it leaked*. Keep the window short.
+     */
+    staleGraceMs?: number;
+    /**
+     * Decides whether a given failure may be answered from the stale
+     * value. Defaults to "never". Providers pass a predicate that admits
+     * only transient faults - the cache itself stays free of any knowledge
+     * about provider error taxonomies.
+     */
+    isStaleServable?: (err: unknown) => boolean;
+    /** Called when a stale value is served, so the layer above can warn.
+     * Never receives the value - only the key and its age. */
+    onStale?: (key: string, ageMs: number, err: unknown) => void;
     /** Injected in tests so expiry doesn't require real waiting. */
     now?: () => number;
 }
@@ -206,6 +280,9 @@ declare class TtlCache<T> {
      * stays correct even with caching fully disabled. */
     private readonly inFlight;
     private readonly ttlMs;
+    private readonly staleGraceMs;
+    private readonly isStaleServable;
+    private readonly onStale?;
     private readonly now;
     constructor(options?: TtlCacheOptions);
     /**
@@ -224,6 +301,86 @@ declare class TtlCache<T> {
     clear(): void;
 }
 
+/**
+ * Project configuration: `secrefs.config.json`.
+ *
+ * The reference format has always supported arbitrary aliases -
+ * `ProviderRegistry` is a plain `Record<string, ISecretProvider>` - but
+ * only library callers could register them. The CLI was stuck with four
+ * hardcoded names, so `secrefs run` could reach exactly one AWS account
+ * and one Bitwarden vault. This closes that gap.
+ *
+ * **This file never holds a secret.** Every credential is referenced by
+ * the name of the environment variable that carries it, or by an AWS
+ * profile name. That is the whole design constraint: a config file that
+ * could hold a token would recreate the `.env` problem one level up, in
+ * the tool built to solve it. `secrefs.config.json` is meant to be
+ * committed, and nothing in this parser will read a literal credential
+ * even if someone puts one there.
+ */
+declare const CONFIG_FILENAME = "secrefs.config.json";
+interface AwsAliasConfig {
+    type: "aws";
+    /** Named profile from ~/.aws/config. Uses the ambient chain if absent. */
+    profile?: string;
+    region?: string;
+    /** Milliseconds a fetched value may be reused. Default 0 (re-fetch). */
+    cacheTtlMs?: number;
+    /** Milliseconds a stale value may answer a *transient* failure. */
+    staleGraceMs?: number;
+}
+interface BitwardenAliasConfig {
+    type: "bitwarden";
+    /** Name of the env var holding the machine account token. Never the
+     * token. Defaults to BWS_ACCESS_TOKEN. */
+    tokenEnv?: string;
+    /** Name of the env var holding the organization id. */
+    organizationIdEnv?: string;
+    apiUrl?: string;
+    identityUrl?: string;
+}
+interface VaultAliasConfig {
+    type: "vault";
+    /** Name of the env var holding the Vault token. Defaults to VAULT_TOKEN. */
+    tokenEnv?: string;
+    addr?: string;
+}
+interface LocalAliasConfig {
+    type: "local";
+    /** Path to the gitignored JSON file, relative to the config file. */
+    file?: string;
+}
+type AliasConfig = AwsAliasConfig | BitwardenAliasConfig | VaultAliasConfig | LocalAliasConfig;
+interface SecRefsConfig {
+    providers: Record<string, AliasConfig>;
+}
+declare class ConfigError extends Error {
+    constructor(message: string);
+}
+declare function parseConfig(raw: string, source?: string): SecRefsConfig;
+/**
+ * Builds a provider registry from parsed config. Aliases entirely replace
+ * the built-in defaults rather than merging with them: a config that
+ * declares `aws-prod` and `aws-staging` almost certainly does *not* want
+ * a third, differently-configured `aws` quietly still working, because
+ * that is how a reference ends up resolving against the wrong account.
+ */
+declare function buildProviders(config: SecRefsConfig, options?: {
+    configDir?: string;
+    env?: NodeJS.ProcessEnv;
+}): ProviderRegistry;
+/**
+ * Loads `secrefs.config.json` from `dir`, or from the nearest ancestor
+ * that has one - so `secrefs run` works from a subdirectory of a repo the
+ * way git and every other project tool does. Returns undefined when no
+ * config exists anywhere up the tree, which is the common case and not an
+ * error: the built-in aliases are used instead.
+ */
+declare function loadConfigFrom(dir?: string): {
+    config: SecRefsConfig;
+    path: string;
+} | undefined;
+
 /**
  * Thin HTTP client for a running control plane's credential-broker
  * endpoint (docs/control-plane-design.md §7). This is the piece §10
@@ -304,6 +461,14 @@ declare class ControlPlaneClient {
 
 interface AwsProviderOptions {
     region?: string;
+    /**
+     * Named profile from the shared AWS config, for addressing more than
+     * one account. Note this does not make a profile self-sufficient: with
+     * SSO each profile needs its own live session, and they expire
+     * independently - which is why an auth failure names the alias that
+     * failed rather than just saying "AWS".
+     */
+    profile?: string;
     /** Inject a pre-configured client (primarily for testing) - also wins
      * over `controlPlane` if both are set, since a test that supplies an
      * explicit client wants full control regardless of the mode. */
@@ -326,6 +491,17 @@ interface AwsProviderOptions {
      * ../ttlCache.ts.
      */
     cacheTtlMs?: number;
+    /**
+     * Milliseconds a previously-fetched value may be served after a *failed*
+     * refresh. Defaults to 0 (off). Only ever applies to transient faults -
+     * network, timeout, throttle, 5xx. An expired credential or a denial is
+     * never answered from a stale value, because both mean something in the
+     * environment changed that a human has to see. See ../ttlCache.ts.
+     */
+    staleGraceMs?: number;
+    /** Called when a stale value is served, so a CLI can warn. Receives the
+     * secret path and the age of the value - never the value. */
+    onStaleValue?: (path: string, ageMs: number, err: unknown) => void;
 }
 /**
  * AWS Secrets Manager provider. Two credential-sourcing modes:
@@ -350,6 +526,7 @@ declare class AwsSecretsManagerProvider extends BaseSecretProvider {
     readonly name = "aws";
     private readonly explicitClient?;
     private readonly region?;
+    private readonly profile?;
     private readonly controlPlane?;
     private readonly controlPlaneClient?;
     private ambientClient;
@@ -578,4 +755,4 @@ declare class SecRefs {
 /** Convenience singleton mirroring `secRefs.init()` / `secRefs.expandEnv()` / `secRefs.expandString()`. */
 declare const secRefs: SecRefs;
 
-export { type AwsProviderOptions, AwsSecretsManagerProvider, BaseSecretProvider, type BitwardenClientLike, BitwardenProvider, type BitwardenProviderOptions, type CheckResult, ControlPlaneClient, type ControlPlaneClientOptions, type ControlPlaneCredentialSource, ControlPlaneRequestError, type ExpandOptions, type ISecretProvider, LocalProvider, type LocalProviderOptions, type MintCredentialResponse, type MintedAwsCredentials, type MintedBitwardenCredentials, type ParsedSecretRef, type ProviderHealth, type ProviderRegistry, type ResolutionFailure, SecRefParseError, SecRefs, type SecRefsOptions, SecRefsResolutionError, SecretFetchError, type SecretFetchRequest, TtlCache, type TtlCacheOptions, VaultProvider, type VaultProviderOptions, checkReferences, createDefaultProviders, expandKeyValueMap, expandProcessEnv, extractField, isSecretRef, parseEnvFileText, parseSecretRef, recoverTruncatedSecRefs, secRefs, tryParseSecretRef };
+export { type AliasConfig, type AwsProviderOptions, AwsSecretsManagerProvider, BaseSecretProvider, type BitwardenClientLike, BitwardenProvider, type BitwardenProviderOptions, CONFIG_FILENAME, type CheckResult, ConfigError, ControlPlaneClient, type ControlPlaneClientOptions, type ControlPlaneCredentialSource, ControlPlaneRequestError, type ExpandOptions, type ISecretProvider, LocalProvider, type LocalProviderOptions, type MintCredentialResponse, type MintedAwsCredentials, type MintedBitwardenCredentials, type ParsedSecretRef, type ProviderHealth, type ProviderRegistry, type ResolutionFailure, SecRefParseError, SecRefs, type SecRefsConfig, type SecRefsOptions, SecRefsResolutionError, SecretFetchError, type SecretFetchRequest, TtlCache, type TtlCacheOptions, VaultProvider, type VaultProviderOptions, buildProviders, checkReferences, createDefaultProviders, expandKeyValueMap, expandProcessEnv, extractField, isSecretRef, loadConfigFrom, parseConfig, parseEnvFileText, parseSecretRef, recoverTruncatedSecRefs, secRefs, tryParseSecretRef };