@sellable/install 0.1.803 → 0.1.805

package/lib/sellable-agent/fly-customer-image/endpoint-model-selection.mjs

@@ -50,17 +50,24 @@ export function normalizeRunsApiBaseUrl(value) {
 }
 
 // One model: provider, model, effort and, for a custom Runs API, its URL.
+// A custom step may also name the workspace's own model connection
+// (modelConnectionId), which is always https. Skew: an older runtime refuses
+// that unknown key as "invalid", so Verify & save refuses a connection step
+// on a machine that cannot fetch its key per attempt.
 function compileEndpointModelStep(value, extraKeys = []) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const custom = Object.hasOwn(value, "runsApiBaseUrl");
+  const connection = Object.hasOwn(value, "modelConnectionId");
   if (
     Object.keys(value)
       .filter((key) => !extraKeys.includes(key))
       .sort()
       .join(",") !==
-    (custom
-      ? "model,provider,reasoningEffort,runsApiBaseUrl"
-      : "model,provider,reasoningEffort")
+    (connection
+      ? "model,modelConnectionId,provider,reasoningEffort,runsApiBaseUrl"
+      : custom
+        ? "model,provider,reasoningEffort,runsApiBaseUrl"
+        : "model,provider,reasoningEffort")
   )
     return null;
   const { provider, model, reasoningEffort } = value;
@@ -86,11 +93,20 @@ function compileEndpointModelStep(value, extraKeys = []) {
       !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(model))
   )
     return null;
+  const { modelConnectionId } = value;
+  if (
+    connection &&
+    (typeof modelConnectionId !== "string" ||
+      !/^[A-Za-z0-9_-]{1,128}$/.test(modelConnectionId) ||
+      !runsApiBaseUrl.startsWith("https://"))
+  )
+    return null;
   return Object.freeze({
     provider,
     model,
     reasoningEffort,
     ...(custom ? { runsApiBaseUrl } : {}),
+    ...(connection ? { modelConnectionId } : {}),
   });
 }
 
@@ -98,7 +114,8 @@ const sameStep = (left, right) =>
   left.provider === right.provider &&
   left.model === right.model &&
   left.reasoningEffort === right.reasoningEffort &&
-  left.runsApiBaseUrl === right.runsApiBaseUrl;
+  left.runsApiBaseUrl === right.runsApiBaseUrl &&
+  left.modelConnectionId === right.modelConnectionId;
 
 /**
  * The top-level fields are the endpoint's first model. An optional ordered

package/lib/sellable-agent/fly-customer-image/hermes-runs-client.mjs

@@ -244,6 +244,36 @@ export function validateOpenerOutputContract(value) {
   return JSON.parse(stableJson(value));
 }
 
+// One remote MCP server for the run, in the OpenAI Responses tool shape.
+function compileRemoteTools(value) {
+  const serverUrl = normalizeRunsApiBaseUrl(value?.serverUrl);
+  const names = value?.allowedTools;
+  if (
+    !exactObject(value) ||
+    Object.keys(value).sort().join(",") !==
+      "allowedTools,authorization,serverUrl" ||
+    !serverUrl?.startsWith("https://") ||
+    typeof value.authorization !== "string" ||
+    !/^srt_[A-Za-z0-9-]{1,128}_[A-Za-z0-9_-]{43}$/.test(value.authorization) ||
+    !Array.isArray(names) ||
+    names.length < 1 ||
+    names.length > 32 ||
+    new Set(names).size !== names.length ||
+    names.some(
+      (name) => typeof name !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(name)
+    )
+  )
+    throw new Error("hermes_runs_submit_rejected");
+  return Object.freeze({
+    type: "mcp",
+    server_label: "sellable",
+    server_url: serverUrl,
+    authorization: value.authorization,
+    allowed_tools: [...names],
+    require_approval: "never",
+  });
+}
+
 function compileCreateBody(input, openerStage = false, verification = false) {
   if (!exactObject(input)) throw new Error("hermes_runs_submit_rejected");
   const allowed = [
@@ -253,6 +283,7 @@ function compileCreateBody(input, openerStage = false, verification = false) {
     "correlation",
     "outputContract",
     ...(openerStage && !verification ? [] : ["modelSelection"]),
+    ...(openerStage ? [] : ["remoteTools"]),
   ];
   if (Object.keys(input).some((key) => !allowed.includes(key))) {
     throw new Error("hermes_runs_submit_rejected");
@@ -288,6 +319,10 @@ function compileCreateBody(input, openerStage = false, verification = false) {
     input.outputContract === undefined
       ? null
       : validateOpenerOutputContract(input.outputContract);
+  const remoteTools =
+    input.remoteTools === undefined
+      ? null
+      : compileRemoteTools(input.remoteTools);
   const modelOptions = {
     ...(modelSelection === null
       ? {}
@@ -309,6 +344,7 @@ function compileCreateBody(input, openerStage = false, verification = false) {
     ...(Object.keys(modelOptions).length === 0
       ? {}
       : { model_options: modelOptions }),
+    ...(remoteTools === null ? {} : { tools: [remoteTools] }),
   });
 }
 
@@ -585,6 +621,7 @@ function submitNotAdmitted(response, value) {
 /** @param {any} options */
 export function createHermesRunsClient(options = {}) {
   const {
+    apiKey: inMemoryKey,
     apiKeyFile,
     baseUrl = LOOPBACK_ORIGIN,
     scopeHeaders = {},
@@ -596,9 +633,22 @@ export function createHermesRunsClient(options = {}) {
   const origin = normalizeRunsApiBaseUrl(baseUrl);
   if (
     !origin ||
+    // Exactly one key source. An in-memory key (a workspace model connection)
+    // follows that key's own rule, never readApiKey's key-file rule.
+    (inMemoryKey === undefined) === (apiKeyFile === undefined) ||
+    (inMemoryKey !== undefined &&
+      (typeof inMemoryKey !== "string" ||
+        inMemoryKey.length < 16 ||
+        inMemoryKey.length > 1024 ||
+        /[\s\x00-\x1f\x7f]/.test(inMemoryKey))) ||
     !exactObject(scopeHeaders) ||
-    Object.keys(scopeHeaders).some(key => !["x-sellable-workspace-id", "x-sellable-agent-id"].includes(key)) ||
-    Object.values(scopeHeaders).some(value => typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)) ||
+    Object.keys(scopeHeaders).some(
+      (key) => !["x-sellable-workspace-id", "x-sellable-agent-id"].includes(key)
+    ) ||
+    Object.values(scopeHeaders).some(
+      (value) =>
+        typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)
+    ) ||
     typeof fetchImpl !== "function" ||
     !Number.isSafeInteger(timeoutMs) ||
     timeoutMs < 100 ||
@@ -606,7 +656,7 @@ export function createHermesRunsClient(options = {}) {
   ) {
     throw new Error("hermes_runs_client_rejected");
   }
-  const apiKey = readApiKey(apiKeyFile);
+  const apiKey = inMemoryKey ?? readApiKey(apiKeyFile);
   const request = async (path, init = {}) => {
     if (!path.startsWith("/v1/runs")) {
       throw new Error("hermes_runs_path_rejected");
@@ -624,7 +674,12 @@ export function createHermesRunsClient(options = {}) {
       signal: init.signal ?? AbortSignal.timeout(timeoutMs),
     });
   };
-  const submit = async (compiled, { signal } = {}, openerStage = false, verification = false) => {
+  const submit = async (
+    compiled,
+    { signal } = {},
+    openerStage = false,
+    verification = false
+  ) => {
     const body = compileCreateBody(compiled, openerStage, verification);
     let response;
     try {
@@ -668,7 +723,8 @@ export function createHermesRunsClient(options = {}) {
     fixtureIdentity: HERMES_RUNS_FIXTURE_IDENTITY,
     submit: (compiled, options) => submit(compiled, options),
     // Fixed operator verification uses the existing tool-free session policy.
-    submitVerification: (compiled, options) => submit(compiled, options, true, true),
+    submitVerification: (compiled, options) =>
+      submit(compiled, options, true, true),
     // Only this reserved session prefix receives the pinned tool-free bridge policy.
     submitOpenerStage: (compiled, options) => submit(compiled, options, true),
     async status(runId, { signal } = {}) {

package/lib/sellable-agent/fly-customer-image/openai-runs-client.d.mts

@@ -1,6 +1,8 @@
 import type { RunsApiConnection } from "./runs-api-connections.mjs";
 export function createOpenAiRunsClient(options: {
-  connection: RunsApiConnection;
+  connection: Omit<RunsApiConnection, "apiKeyFile"> & { apiKeyFile?: string };
+  /** Used instead of `connection.apiKeyFile` when present. */
+  apiKey?: string;
   responseSchema?: unknown;
   modelSelection?: { provider: string; model: string; reasoningEffort: string };
   fetchImpl?: typeof fetch;

package/lib/sellable-agent/fly-customer-image/openai-runs-client.mjs

@@ -30,6 +30,7 @@ export function createOpenAiRunsClient({
   connection,
   responseSchema,
   modelSelection,
+  apiKey,
   fetchImpl = fetch,
 }) {
   const runs = new Map();
@@ -265,7 +266,9 @@ export function createOpenAiRunsClient({
   };
   return createHermesRunsClient({
     baseUrl: connection.baseUrl,
-    apiKeyFile: connection.apiKeyFile,
+    ...(apiKey === undefined
+      ? { apiKeyFile: connection.apiKeyFile }
+      : { apiKey }),
     fetchImpl: bridge,
   });
 }

package/lib/sellable-agent/fly-customer-image/public-endpoint-guard.d.mts

@@ -0,0 +1,28 @@
+export type PublicEndpointGuardCode =
+  | "URL_REJECTED"
+  | "IP_LITERAL"
+  | "BLOCKED_NAME"
+  | "NON_PUBLIC_ADDRESS"
+  | "REDIRECT_REFUSED"
+  | "RESPONSE_TOO_LARGE"
+  | "DEADLINE_EXCEEDED";
+export type PublicEndpointGuardError = Error & {
+  code: PublicEndpointGuardCode;
+};
+export type PublicAddress = { address: string; family: number };
+export type PublicTarget = {
+  url: URL;
+  host: string;
+  addresses: PublicAddress[];
+};
+export function isPublicAddress(ip: string): boolean;
+export function resolvePublicTarget(
+  rawUrl: string,
+  options?: { lookup?: (host: string) => Promise<readonly PublicAddress[]> }
+): Promise<PublicTarget>;
+export function createPinnedFetch(options?: {
+  maxResponseBytes?: number;
+  deadlineMs?: number;
+  resolve?: (rawUrl: string) => Promise<PublicTarget>;
+  request?: typeof import("node:https").request;
+}): typeof fetch;

package/lib/sellable-agent/fly-customer-image/public-endpoint-guard.mjs

@@ -0,0 +1,209 @@
+// SSRF control for user-supplied endpoint URLs, shared by the Next server and
+// the agent machine. Node built-ins only.
+import { promises as dns } from "node:dns";
+import https from "node:https";
+import net from "node:net";
+import { Readable } from "node:stream";
+
+// IANA special-purpose registries (2025-10-09) plus metadata and CGNAT. There
+// is deliberately no ::ffff:0:0/96 row: a BlockList checks IPv4 addresses
+// against v4-mapped IPv6 rules, so that row would block every IPv4 answer.
+// v4-mapped answers are unwrapped and checked against the IPv4 rows instead.
+const V4 = [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4],
+];
+const V6 = [
+  ["::", 96],
+  ["64:ff9b::", 96],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001::", 23],
+  ["2001:db8::", 32],
+  ["2002::", 16],
+  ["3fff::", 20],
+  ["5f00::", 16],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8],
+];
+const blocked = new net.BlockList();
+for (const [address, prefix] of V4) blocked.addSubnet(address, prefix, "ipv4");
+for (const [address, prefix] of V6) blocked.addSubnet(address, prefix, "ipv6");
+
+// The IPv4 address an IPv4-mapped answer carries (::ffff:a.b.c.d in any
+// spelling), so its check never rests on BlockList's v4-in-v6 matching.
+function mappedIPv4(ip) {
+  let hostname;
+  try {
+    hostname = new URL(`http://[${ip}]`).hostname;
+  } catch {
+    return null;
+  }
+  const mapped = /^\[::ffff:([\da-f]{1,4}):([\da-f]{1,4})\]$/.exec(hostname);
+  if (!mapped) return null;
+  const [high, low] = [parseInt(mapped[1], 16), parseInt(mapped[2], 16)];
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+
+export function isPublicAddress(ip) {
+  const family = net.isIP(ip);
+  if (family === 0) return false;
+  const v4 = family === 4 ? ip : mappedIPv4(ip);
+  return v4 ? !blocked.check(v4, "ipv4") : !blocked.check(ip, "ipv6");
+}
+
+// Errors carry only the fixed code: never the URL, its credentials or headers.
+const refuse = (code) => Object.assign(new Error(code), { code });
+
+export async function resolvePublicTarget(
+  rawUrl,
+  { lookup = (host) => dns.lookup(host, { all: true, verbatim: true }) } = {}
+) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw refuse("URL_REJECTED");
+  }
+  // url.port is "" for the default (443) port, however it was written.
+  if (
+    url.protocol !== "https:" ||
+    url.port ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  ) {
+    throw refuse("URL_REJECTED");
+  }
+  const host = url.hostname.replace(/\.$/, "").toLowerCase();
+  if (net.isIP(host.replace(/^\[|\]$/g, ""))) throw refuse("IP_LITERAL");
+  if (/(^|\.)(localhost|local|internal|flycast|home\.arpa)$/.test(host)) {
+    throw refuse("BLOCKED_NAME");
+  }
+  const answers = await lookup(host);
+  if (!answers.length || answers.some((a) => !isPublicAddress(a.address))) {
+    throw refuse("NON_PUBLIC_ADDRESS");
+  }
+  return {
+    url,
+    host,
+    addresses: answers.map(({ address, family }) => ({ address, family })),
+  };
+}
+
+// A fetch that resolves and checks the target on every request, dials only
+// the vetted addresses (TLS SNI and certificate checks stay on the hostname)
+// and refuses every redirect. `request` is a test seam only.
+export function createPinnedFetch({
+  maxResponseBytes = 8 << 20,
+  deadlineMs = 120_000,
+  resolve = resolvePublicTarget,
+  request = https.request,
+} = {}) {
+  return async (input, init = {}) => {
+    // deadlineMs bounds DNS, connect and response headers only. Once headers
+    // arrive, only init.signal and the byte cap bound the body, so a long SSE
+    // stream or provider call is never cut here. A plain setTimeout (not
+    // AbortSignal.timeout) so it can be cleared.
+    const deadline = new AbortController();
+    const expired = new Promise((_, reject) => {
+      deadline.signal.addEventListener("abort", () =>
+        reject(deadline.signal.reason)
+      );
+    });
+    const timer = setTimeout(
+      () => deadline.abort(refuse("DEADLINE_EXCEEDED")),
+      deadlineMs
+    );
+    try {
+      const target = await Promise.race([resolve(String(input)), expired]);
+      // Both lookup shapes (Pitfall 2): net asks for { all: true } under
+      // autoSelectFamily; refuse any hostname other than the vetted one.
+      const lookup = (hostname, options, callback) => {
+        if (hostname !== target.host) return callback(refuse("ENOTFOUND"));
+        if (options?.all) return callback(null, target.addresses);
+        const [first] = target.addresses;
+        callback(null, first.address, first.family);
+      };
+      const method = (init.method ?? "GET").toUpperCase();
+      const headers =
+        init.headers instanceof Headers
+          ? Object.fromEntries(init.headers)
+          : init.headers;
+      const dial = new Promise((resolveResponse, reject) => {
+        const req = request(
+          {
+            hostname: target.host,
+            servername: target.host,
+            port: target.url.port || 443,
+            path: target.url.pathname + target.url.search,
+            method,
+            headers,
+            lookup,
+            agent: false,
+            signal: init.signal
+              ? AbortSignal.any([init.signal, deadline.signal])
+              : deadline.signal,
+          },
+          (res) => {
+            if (res.statusCode >= 300 && res.statusCode < 400) {
+              res.destroy();
+              return reject(refuse("REDIRECT_REFUSED"));
+            }
+            let seen = 0;
+            res.on("data", (chunk) => {
+              if ((seen += chunk.length) > maxResponseBytes) {
+                res.destroy(refuse("RESPONSE_TOO_LARGE"));
+              }
+            });
+            // An untrusted server can send what Response refuses (status 999):
+            // reject, never throw out of this callback (that kills the process).
+            try {
+              const responseHeaders = new Headers();
+              for (const [name, value] of Object.entries(res.headers)) {
+                for (const item of [].concat(value)) {
+                  responseHeaders.append(name, item);
+                }
+              }
+              const nullBody =
+                [204, 205].includes(res.statusCode) || method === "HEAD";
+              resolveResponse(
+                new Response(nullBody ? null : Readable.toWeb(res), {
+                  status: res.statusCode,
+                  statusText: res.statusMessage,
+                  headers: responseHeaders,
+                })
+              );
+            } catch (error) {
+              res.destroy();
+              reject(error);
+            }
+          }
+        );
+        req.on("error", reject);
+        if (init.body != null) req.write(init.body);
+        req.end();
+      });
+      return await Promise.race([dial, expired]);
+    } finally {
+      // Settles at response headers (or on any error): the deadline ends here.
+      clearTimeout(timer);
+    }
+  };
+}

package/lib/sellable-agent/fly-customer-image/runs-api-connections.d.mts

@@ -33,4 +33,4 @@ export function runsApiConnectionsForRuntime(
     agentId: string;
   }
 ): RunsApiConnection[];
-export function createConfiguredRunsClient(options: any): any;
+export function createConfiguredRunsClient(options: any): Promise<any>;

package/lib/sellable-agent/fly-customer-image/runs-api-connections.mjs

@@ -5,6 +5,8 @@ import {
 } from "./endpoint-model-selection.mjs";
 import { createHermesRunsClient } from "./hermes-runs-client.mjs";
 import { createOpenAiRunsClient } from "./openai-runs-client.mjs";
+import { createPinnedFetch } from "./public-endpoint-guard.mjs";
+import { createWorkspaceConnectionRunsClient } from "./workspace-connection-client.mjs";
 
 export const RUNS_API_CONNECTIONS_ENV =
   "SELLABLE_AGENT_RUNS_API_CONNECTIONS_JSON";
@@ -202,14 +204,107 @@ export function runsApiConnectionsForRuntime(raw, runtime) {
   );
 }
 
+// Exactly the members the endpoint-connection-key verb returns. The key follows
+// the saved key's rule (16-1024 characters), never the key-file rule; the
+// remote tool's values are checked where the create body is built.
+const connectionRelease = (value) =>
+  record(value) &&
+  Object.keys(value).sort().join(",") ===
+    "apiKey,keyGeneration,protocol,structuredOutputs,tools" &&
+  typeof value.apiKey === "string" &&
+  value.apiKey.length >= 16 &&
+  value.apiKey.length <= 1024 &&
+  !/[\s\x00-\x1f\x7f]/.test(value.apiKey) &&
+  Number.isSafeInteger(value.keyGeneration) &&
+  ["runs-api", "openai-chat", "openai-responses"].includes(value.protocol) &&
+  typeof value.structuredOutputs === "boolean" &&
+  (value.tools === null ||
+    (value.protocol === "runs-api" &&
+      record(value.tools) &&
+      Object.keys(value.tools).sort().join(",") ===
+        "allowedTools,authorization,expiresAt,serverUrl" &&
+      typeof value.tools.serverUrl === "string" &&
+      typeof value.tools.authorization === "string" &&
+      Array.isArray(value.tools.allowedTools) &&
+      typeof value.tools.expiresAt === "string"));
+
+// Adds the opener output contract (and a granted remote tool) to every submit.
+function customRunsClient(client, claim, remoteTools) {
+  return Object.freeze({
+    ...client,
+    submit(compiled, options) {
+      const request = remoteTools ? { ...compiled, remoteTools } : compiled;
+      // Public semantic endpoints have a published schema but no product tuple.
+      // Preserve that existing contract when calling a custom Runs service.
+      const schema = claim.revision?.outputSchema;
+      if (compiled.outputContract || !schema?.properties?.proposal)
+        return client.submit(request, options);
+      return client.submit(
+        {
+          ...request,
+          outputContract: {
+            schemaVersion: "sellable-opener-output-contract/v1",
+            schema,
+            nativeProposalSchemaDigest: createHash("sha256")
+              .update(stable(schema.properties.proposal))
+              .digest("hex"),
+          },
+        },
+        options
+      );
+    },
+  });
+}
+
 /** @param {any} options */
-export function createConfiguredRunsClient({
+export async function createConfiguredRunsClient({
   apiKeyFile,
   claim,
   env = process.env,
   clientFactory = createHermesRunsClient,
+  fetchConnectionKey,
+  chainStep = 0,
+  createFetch = createPinnedFetch,
 }) {
   const selection = claim?.run?.modelSelection;
+  // A workspace connection never uses the registry, even on a matching URL:
+  // its key is fetched for this attempt and lives only in these closures, and
+  // every request goes through the address guard. URL and model come from
+  // the signed claim, never from the key response.
+  if (selection?.modelConnectionId) {
+    const step = compileEndpointModelSelection(selection);
+    if (!step || step === "invalid") throw new Error("runs_api_model_rejected");
+    let release = null;
+    try {
+      release = await fetchConnectionKey(step.modelConnectionId, chainStep);
+    } catch {
+      // Every refusal is one fixed code: no server reason, no response field.
+    }
+    if (!connectionRelease(release))
+      throw new Error("runs_api_connection_unavailable");
+    const { apiKey, protocol, structuredOutputs, tools } = release;
+    const client = createWorkspaceConnectionRunsClient({
+      connection: { baseUrl: step.runsApiBaseUrl, protocol, structuredOutputs },
+      apiKey,
+      // An OpenAI-protocol provider sends its headers only when it is done, so
+      // the adapter's 750 s run signal bounds that call, not the guard.
+      fetchImpl:
+        protocol === "runs-api"
+          ? createFetch()
+          : createFetch({ deadlineMs: 760_000 }),
+      modelSelection: step,
+      responseSchema: claim.revision?.outputSchema,
+    });
+    return customRunsClient(
+      client,
+      claim,
+      tools && {
+        serverUrl: tools.serverUrl,
+        authorization: tools.authorization,
+        allowedTools: tools.allowedTools,
+      }
+    );
+  }
   if (!selection?.runsApiBaseUrl) return clientFactory({ apiKeyFile });
   const model = compileEndpointModelSelection(selection);
   if (!model || model === "invalid") throw new Error("runs_api_model_rejected");
@@ -251,27 +346,5 @@ export function createConfiguredRunsClient({
           "x-sellable-agent-id": connection.agentId,
         },
       });
-  return Object.freeze({
-    ...client,
-    submit(compiled, options) {
-      // Public semantic endpoints have a published schema but no product tuple.
-      // Preserve that existing contract when calling a custom Runs service.
-      const schema = claim.revision?.outputSchema;
-      if (compiled.outputContract || !schema?.properties?.proposal)
-        return client.submit(compiled, options);
-      return client.submit(
-        {
-          ...compiled,
-          outputContract: {
-            schemaVersion: "sellable-opener-output-contract/v1",
-            schema,
-            nativeProposalSchemaDigest: createHash("sha256")
-              .update(stable(schema.properties.proposal))
-              .digest("hex"),
-          },
-        },
-        options
-      );
-    },
-  });
+  return customRunsClient(client, claim);
 }