@stsepelin/checktrail 0.1.0-alpha.1

package/dist/src/task-store.js

@@ -0,0 +1,349 @@
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, constants, lstatSync, mkdirSync, openSync, readdirSync, realpathSync, } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { projectReport } from "./output.js";
+import { reportSchema, reportSummarySchema } from "./schemas.js";
+const MAX_TASKS = 32;
+const MAX_RESULT_BYTES = 256 * 1024;
+const MAX_DATABASE_BYTES = 16 * 1024 * 1024;
+const MAX_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+const APPLICATION_ID = 0x52565453;
+const interruptedResult = {
+    content: [
+        {
+            type: "text",
+            text: "Validation interrupted before a durable result was stored. Execution was not resumed.",
+        },
+    ],
+    isError: true,
+};
+const idSchema = z.string().uuid();
+const fingerprintSchema = z.string().regex(/^[a-f0-9]{64}$/);
+const rowSchema = z.strictObject({
+    id: idSchema,
+    source: fingerprintSchema,
+    created: z.number().int().nonnegative(),
+    updated: z.number().int().nonnegative(),
+    expires: z.number().int().nonnegative(),
+    status: z.enum(["working", "completed", "cancelled"]),
+    cancelling: z.union([z.literal(0), z.literal(1)]),
+    result: z.string().nullable(),
+});
+function privateFile(filename, maximum) {
+    let stat;
+    try {
+        stat = lstatSync(filename);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        const fd = openSync(filename, constants.O_CREAT |
+            constants.O_EXCL |
+            constants.O_RDWR |
+            constants.O_NOFOLLOW, 0o600);
+        closeSync(fd);
+        stat = lstatSync(filename);
+    }
+    // Closing another descriptor for an existing SQLite file releases this process's POSIX locks.
+    if (!stat.isFile() ||
+        stat.nlink !== 1 ||
+        stat.uid !== process.getuid() ||
+        (stat.mode & 0o777) !== 0o600 ||
+        stat.size > maximum)
+        throw new Error("Task store requires bounded, private, singly linked regular files");
+}
+function applicationId(db) {
+    return Number(db.prepare("PRAGMA application_id").get().application_id);
+}
+function transaction(db, action) {
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        const result = action();
+        db.exec("COMMIT");
+        return result;
+    }
+    catch (error) {
+        // SQLite can roll back the transaction itself on SQLITE_FULL or an I/O error.
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch {
+            /* Already rolled back. */
+        }
+        throw error;
+    }
+}
+function decodeTask(row, detailed) {
+    const task = {
+        taskId: row.id,
+        status: row.status,
+        createdAt: new Date(row.created).toISOString(),
+        lastUpdatedAt: new Date(row.updated).toISOString(),
+        ttlMs: row.expires - row.created,
+    };
+    if (row.result !== null) {
+        if (Buffer.byteLength(row.result) > MAX_RESULT_BYTES)
+            throw new Error("Stored task result exceeds the byte limit");
+        const value = JSON.parse(row.result);
+        if (JSON.stringify(value) === JSON.stringify(interruptedResult)) {
+            task.result = structuredClone(interruptedResult);
+        }
+        else {
+            const envelope = z
+                .strictObject({
+                content: z.tuple([
+                    z.strictObject({ type: z.literal("text"), text: z.string() }),
+                ]),
+                structuredContent: z.record(z.string(), z.unknown()),
+            })
+                .parse(value);
+            const schema = detailed ? reportSchema : reportSummarySchema;
+            schema.parse(envelope.structuredContent);
+            if (envelope.content[0].text !== JSON.stringify(envelope.structuredContent))
+                throw new Error("Stored task result representations disagree");
+            task.result = envelope;
+        }
+    }
+    if ((row.status === "completed") !== (row.result !== null) ||
+        row.expires <= row.created ||
+        row.expires - row.created > MAX_TTL_MS ||
+        row.updated < row.created)
+        throw new Error("Invalid stored task state");
+    return task;
+}
+/** Bounded validation-result persistence; this component does not execute or stop workers. */
+export class ValidationTaskStore {
+    database;
+    ownership;
+    detailed;
+    closed = false;
+    constructor(database, ownership, detailed) {
+        this.database = database;
+        this.ownership = ownership;
+        this.detailed = detailed;
+    }
+    active() {
+        if (this.closed)
+            throw new Error("Task store is closed");
+    }
+    prune() {
+        this.database
+            .prepare("DELETE FROM tasks WHERE expires <= ?")
+            .run(Date.now());
+    }
+    row(taskId) {
+        this.active();
+        idSchema.parse(taskId);
+        const row = this.database
+            .prepare("SELECT * FROM tasks WHERE id = ? AND expires > ?")
+            .get(taskId, Date.now());
+        if (!row)
+            throw new Error("Unknown or expired validation task");
+        return rowSchema.parse(row);
+    }
+    create(sourceFingerprint, ttlMs = 24 * 60 * 60 * 1000) {
+        this.active();
+        fingerprintSchema.parse(sourceFingerprint);
+        z.number().int().min(1).max(MAX_TTL_MS).parse(ttlMs);
+        return transaction(this.database, () => {
+            this.prune();
+            const count = Number(this.database.prepare("SELECT count(*) AS count FROM tasks").get()
+                .count);
+            if (count >= MAX_TASKS)
+                throw new Error("Task store capacity reached");
+            const taskId = randomUUID();
+            const now = Date.now();
+            this.database
+                .prepare("INSERT INTO tasks VALUES (?, ?, ?, ?, ?, 'working', 0, NULL)")
+                .run(taskId, sourceFingerprint, now, now, now + ttlMs);
+            return decodeTask(rowSchema.parse(this.database.prepare("SELECT * FROM tasks WHERE id = ?").get(taskId)), this.detailed);
+        });
+    }
+    get(taskId) {
+        return decodeTask(this.row(taskId), this.detailed);
+    }
+    complete(taskId, report) {
+        this.active();
+        return transaction(this.database, () => {
+            const row = this.row(taskId);
+            if (row.status !== "working")
+                return "terminal";
+            if (row.cancelling)
+                return "cancellation-requested";
+            reportSchema.parse(report);
+            if (report.sourceFingerprint !== row.source)
+                throw new Error("Task and report source fingerprints differ");
+            const projected = projectReport(report, this.detailed);
+            const result = JSON.stringify({
+                content: [{ type: "text", text: JSON.stringify(projected) }],
+                structuredContent: projected,
+            });
+            if (Buffer.byteLength(result) > MAX_RESULT_BYTES)
+                throw new Error("Task result exceeds the byte limit");
+            this.database
+                .prepare("UPDATE tasks SET status = 'completed', result = ?, updated = ? WHERE id = ? AND status = 'working'")
+                .run(result, Math.max(row.updated, Date.now()), taskId);
+            return "updated";
+        });
+    }
+    interrupt(taskId) {
+        this.active();
+        return transaction(this.database, () => {
+            const row = this.row(taskId);
+            if (row.status !== "working")
+                return "terminal";
+            if (row.cancelling)
+                return "cancellation-requested";
+            this.database
+                .prepare("UPDATE tasks SET status = 'completed', result = ?, updated = ? WHERE id = ?")
+                .run(JSON.stringify(interruptedResult), Math.max(row.updated, Date.now()), taskId);
+            return "updated";
+        });
+    }
+    requestCancellation(taskId) {
+        this.active();
+        return transaction(this.database, () => {
+            const row = this.row(taskId);
+            if (row.status !== "working")
+                return "terminal";
+            if (row.cancelling)
+                return "cancellation-requested";
+            this.database
+                .prepare("UPDATE tasks SET cancelling = 1, updated = ? WHERE id = ?")
+                .run(Math.max(row.updated, Date.now()), taskId);
+            return "updated";
+        });
+    }
+    /** Call only after the executor has confirmed its workers have stopped. */
+    finishCancellation(taskId) {
+        this.active();
+        return transaction(this.database, () => {
+            const row = this.row(taskId);
+            if (row.status !== "working")
+                return "terminal";
+            if (!row.cancelling)
+                throw new Error("Cancellation was not requested");
+            this.database
+                .prepare("UPDATE tasks SET status = 'cancelled', updated = ? WHERE id = ?")
+                .run(Math.max(row.updated, Date.now()), taskId);
+            return "updated";
+        });
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        try {
+            this.database.close();
+        }
+        finally {
+            this.ownership.close();
+        }
+    }
+}
+/** Open an exclusively owned, root- and disclosure-bound local validation store. */
+export async function openTaskStore(options) {
+    if (!["darwin", "linux"].includes(process.platform))
+        throw new Error("Task storage is supported only on macOS and Linux");
+    const root = realpathSync(options.root);
+    if (!lstatSync(root).isDirectory())
+        throw new Error("Task root must be a directory");
+    const directory = path.resolve(options.directory);
+    if (realpathSync(path.dirname(directory)) !== path.dirname(directory))
+        throw new Error("Task store parent must be canonical");
+    try {
+        mkdirSync(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() ||
+        stat.isSymbolicLink() ||
+        stat.uid !== process.getuid() ||
+        (stat.mode & 0o777) !== 0o700)
+        throw new Error("Task store directory must be private and owned by this user");
+    const limits = {
+        "owner.sqlite": 4096,
+        "owner.sqlite-journal": 16384,
+        "tasks.sqlite": MAX_DATABASE_BYTES,
+        "tasks.sqlite-journal": MAX_DATABASE_BYTES + 1024 * 1024,
+    };
+    for (const entry of readdirSync(directory)) {
+        const limit = limits[entry];
+        if (typeof limit !== "number")
+            throw new Error("Unexpected file in task store directory");
+        privateFile(path.join(directory, entry), limit);
+    }
+    privateFile(path.join(directory, "owner.sqlite"), 4096);
+    const { DatabaseSync } = await import("node:sqlite");
+    const ownership = new DatabaseSync(path.join(directory, "owner.sqlite"), {
+        allowExtension: false,
+    });
+    let database;
+    try {
+        ownership.exec("PRAGMA busy_timeout = 0; BEGIN EXCLUSIVE");
+        if (applicationId(ownership) === 0 &&
+            !ownership.prepare("SELECT name FROM sqlite_schema LIMIT 1").get()) {
+            ownership.exec(`PRAGMA application_id = ${APPLICATION_ID}; PRAGMA user_version = 1; COMMIT; BEGIN EXCLUSIVE`);
+        }
+        if (applicationId(ownership) !== APPLICATION_ID ||
+            ownership.prepare("PRAGMA user_version").get().user_version !== 1)
+            throw new Error("Unrecognized task ownership database");
+        privateFile(path.join(directory, "tasks.sqlite"), MAX_DATABASE_BYTES);
+        database = new DatabaseSync(path.join(directory, "tasks.sqlite"), {
+            allowExtension: false,
+        });
+        const db = database;
+        const detailed = options.detailed === true;
+        const scope = createHash("sha256")
+            .update(JSON.stringify([root, detailed]))
+            .digest("hex");
+        const id = applicationId(db);
+        if (id !== APPLICATION_ID &&
+            !(id === 0 && !db.prepare("SELECT name FROM sqlite_schema LIMIT 1").get()))
+            throw new Error("Unrecognized validation task database");
+        if (db.prepare("PRAGMA page_size").get().page_size !== 4096)
+            throw new Error("Unsupported task database page size");
+        db.exec("PRAGMA journal_mode = DELETE; PRAGMA synchronous = FULL; PRAGMA trusted_schema = OFF; PRAGMA secure_delete = ON; PRAGMA max_page_count = 4096");
+        if (id === 0)
+            transaction(db, () => {
+                db.exec(`PRAGMA application_id = ${APPLICATION_ID}; PRAGMA user_version = 1;
+        CREATE TABLE metadata (scope TEXT NOT NULL);
+        CREATE TABLE tasks (id TEXT PRIMARY KEY, source TEXT NOT NULL, created INTEGER NOT NULL, updated INTEGER NOT NULL, expires INTEGER NOT NULL, status TEXT NOT NULL, cancelling INTEGER NOT NULL, result TEXT);
+      `);
+                db.prepare("INSERT INTO metadata VALUES (?)").run(scope);
+            });
+        const metadata = db.prepare("SELECT scope FROM metadata").all();
+        if (db.prepare("PRAGMA user_version").get().user_version !== 1 ||
+            metadata.length !== 1 ||
+            metadata[0].scope !== scope)
+            throw new Error("Task store version, root or disclosure mode does not match");
+        if (db.prepare("PRAGMA quick_check").get().quick_check !== "ok")
+            throw new Error("Task database integrity check failed");
+        const store = new ValidationTaskStore(db, ownership, detailed);
+        transaction(db, () => {
+            const rows = db.prepare("SELECT * FROM tasks LIMIT 33").all();
+            if (rows.length > MAX_TASKS)
+                throw new Error("Task store exceeds task capacity");
+            for (const row of rows) {
+                const parsed = rowSchema.parse(row);
+                decodeTask(parsed, detailed);
+            }
+            db.prepare("DELETE FROM tasks WHERE expires <= ?").run(Date.now());
+            db.prepare("UPDATE tasks SET status = 'completed', result = ?, updated = max(updated, ?) WHERE status = 'working'").run(JSON.stringify(interruptedResult), Date.now());
+        });
+        return store;
+    }
+    catch (error) {
+        try {
+            database?.close();
+        }
+        finally {
+            ownership.close();
+        }
+        throw error;
+    }
+}

package/dist/src/tool-versions.d.ts

@@ -0,0 +1,3 @@
+import type { Check, Command, ProcessResult, ToolEvidence, ToolSpec } from "./types.js";
+export declare function toolsFor(root: string, check: Check): Promise<ToolSpec[]>;
+export declare function identifyTool(root: string, tool: ToolSpec, execute: (command: Command) => Promise<ProcessResult | undefined>): Promise<ToolEvidence>;

package/dist/src/tool-versions.js

@@ -0,0 +1,260 @@
+import { externalInvocationSchema } from "./external-adapter.js";
+import { clangVersion } from "./clang-protocol.js";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { readProjectFile } from "./inventory.js";
+import { localTool } from "./local-tool.js";
+const packages = {
+    "javascript.typescript": "typescript",
+    "javascript.typescript-build": "typescript",
+    "javascript.vue-tsc": "vue-tsc",
+    "javascript.vue-router": "vue-router",
+    "javascript.eslint": "eslint",
+    "javascript.vitest": "vitest",
+    "javascript.jest": "jest",
+    "javascript.playwright": "playwright",
+};
+export async function toolsFor(root, check) {
+    const command = (name, executable, args) => ({
+        name,
+        source: "version-command",
+        command: {
+            executable,
+            args,
+            cwd: check.project,
+            ...(check.commands[0]?.env ? { env: check.commands[0].env } : {}),
+        },
+    });
+    if (check.external) {
+        const result = [{ name: "node", source: "engine-runtime" }];
+        if (check.commands[0]) {
+            const invocation = externalInvocationSchema.parse(JSON.parse(check.commands[0].args[2]));
+            result.push(command(invocation.identity.id, process.execPath, [
+                fileURLToPath(new URL("./external-runner.js", import.meta.url)),
+                "--version",
+                JSON.stringify(invocation.reference),
+            ]));
+            if (invocation.runtime === "python3")
+                result.push(command("python", "python3", ["-I", "--version"]));
+            if (invocation.runtime === "php")
+                result.push(command("php", "php", ["-n", "--version"]));
+        }
+        return result;
+    }
+    if (check.adapter === "javascript") {
+        const tools = [{ name: "node", source: "engine-runtime" }];
+        if (check.id === "javascript.nuxt-runtime" && check.commands[0]) {
+            const metadata = JSON.parse(check.commands[0].args[2]);
+            tools.push(...Object.entries(metadata).map(([name, path]) => ({
+                name,
+                path,
+                source: "package-metadata",
+            })));
+        }
+        if (check.id === "javascript.vue-router")
+            tools.push({
+                name: "vue",
+                source: "package-metadata",
+                path: check.commands[0]?.args[2] ?? null,
+            });
+        const name = packages[check.id];
+        if (name)
+            tools.push({
+                name,
+                source: "package-metadata",
+                path: (await localTool(root, check.project, `${name}/package.json`)) ??
+                    null,
+            });
+        return tools;
+    }
+    if (check.adapter === "python") {
+        const tools = [command("python", "python3", ["--version"])];
+        if (check.id === "python.pytest" || check.id === "python.mypy") {
+            const name = check.id.slice("python.".length);
+            tools.push(command(name, "python3", [
+                "-c",
+                `from importlib.metadata import version; print(version(${JSON.stringify(name)}))`,
+            ]));
+        }
+        if (check.id === "python.ruff")
+            tools.push(command("ruff", "ruff", ["--version"]));
+        if (check.id === "python.fastapi-routes")
+            for (const name of ["fastapi", "starlette"])
+                tools.push(command(name, "python3", [
+                    "-c",
+                    `from importlib.metadata import version; print(version(${JSON.stringify(name)}))`,
+                ]));
+        if (check.id === "python.django-routes")
+            tools.push(command("django", "python3", [
+                "-c",
+                "from importlib.metadata import version; print(version('Django'))",
+            ]));
+        return tools;
+    }
+    if (check.adapter === "go")
+        return [
+            command("go", "go", ["version"]),
+            ...(check.id === "go.golangci-lint"
+                ? [
+                    { name: "node", source: "engine-runtime" },
+                    command("golangci-lint", "golangci-lint", ["version", "--short"]),
+                ]
+                : []),
+            ...(check.id === "go.staticcheck"
+                ? [command("staticcheck", "staticcheck", ["-version"])]
+                : []),
+        ];
+    if (check.adapter === "rust")
+        return [
+            { name: "node", source: "engine-runtime" },
+            command("rustc", "rustc", ["--version"]),
+            command("cargo", "cargo", ["--version"]),
+        ];
+    if (check.adapter === "cpp") {
+        const tools = [{ name: "node", source: "engine-runtime" }];
+        if (check.commands[0]?.args[2]) {
+            const invocation = JSON.parse(check.commands[0].args[2]);
+            for (const name of new Set(invocation.units.map((unit) => unit.compiler)))
+                tools.push(command(name, name, ["--no-default-config", "--version"]));
+        }
+        return tools;
+    }
+    if (check.adapter === "swift")
+        return [command("swift", "swiftc", ["--version"])];
+    if (check.adapter === "jvm")
+        return [
+            { name: "node", source: "engine-runtime" },
+            command("java", process.execPath, [
+                fileURLToPath(new URL("./java-runner.js", import.meta.url)),
+                "--version",
+            ]),
+        ];
+    if (check.adapter === "ruby")
+        return [command("ruby", "ruby", ["--disable-gems", "--version"])];
+    if (check.id === "infrastructure.actionlint")
+        return [
+            { name: "node", source: "engine-runtime" },
+            command("actionlint", process.execPath, [
+                fileURLToPath(new URL("./actionlint-runner.js", import.meta.url)),
+                "--version",
+            ]),
+        ];
+    if (check.adapter === "dotnet")
+        return [
+            { name: "node", source: "engine-runtime" },
+            command("dotnet", process.execPath, [
+                fileURLToPath(new URL("./dotnet-runner.js", import.meta.url)),
+                "--version",
+            ]),
+        ];
+    if (check.adapter === "php") {
+        const tools = [command("php", "php", ["-n", "--version"])];
+        if (check.id === "php.laravel-runtime" && check.commands[0]?.args[2])
+            tools.push(command("laravel", "php", [
+                "-r",
+                "require $argv[1]; echo Illuminate\\Foundation\\Application::VERSION;",
+                check.commands[0].args[2],
+            ]));
+        if (check.id === "php.pint" && check.commands[0]?.args[3])
+            tools.push(command("pint", "php", [
+                check.commands[0].args[3],
+                "--version",
+                "--no-ansi",
+            ]));
+        if (["php.phpstan", "php.phpunit", "php.pest"].includes(check.id) &&
+            check.commands[0]?.args[0])
+            tools.push(command(check.id.slice("php.".length), "php", [
+                check.commands[0].args[0],
+                ...(check.id === "php.pest" ? ["--colors=never"] : []),
+                "--version",
+            ]));
+        return tools;
+    }
+    return [];
+}
+const versionPattern = /^\d+\.\d+\.\d+(?:[-+a-zA-Z0-9.]+)?$/;
+export async function identifyTool(root, tool, execute) {
+    const result = {
+        name: tool.name,
+        source: tool.source,
+        version: null,
+        status: "inconclusive",
+    };
+    if (tool.source === "engine-runtime")
+        return { ...result, version: process.versions.node, status: "identified" };
+    if (tool.source === "package-metadata") {
+        if (!tool.path)
+            return { ...result, status: "unavailable" };
+        result.path = tool.path;
+        try {
+            const value = JSON.parse(await readProjectFile(root, path.relative(root, tool.path)));
+            if (typeof value === "object" &&
+                value !== null &&
+                "name" in value &&
+                value.name === tool.name &&
+                "version" in value &&
+                typeof value.version === "string" &&
+                value.version.length <= 128 &&
+                versionPattern.test(value.version))
+                return { ...result, version: value.version, status: "identified" };
+        }
+        catch {
+            return result;
+        }
+        return result;
+    }
+    const execution = await execute(tool.command);
+    if (!execution)
+        return result;
+    result.process = execution;
+    if (execution.errorCode === "ENOENT")
+        return { ...result, status: "unavailable" };
+    if (execution.exitCode !== 0 ||
+        execution.signal ||
+        execution.errorCode ||
+        execution.cancelled ||
+        execution.timedOut ||
+        execution.truncated)
+        return result;
+    const output = execution.stdout.trim();
+    const version = tool.name === "java"
+        ? /^openjdk (\d+\.\d+\.\d+) \d{4}-\d{2}-\d{2} LTS\nOpenJDK Runtime Environment [^\n]+\nOpenJDK 64-Bit Server VM [^\n]+$/.exec(output)?.[1]
+        : tool.name === "clang" || tool.name === "clang++"
+            ? clangVersion(output)
+            : tool.name === "swift"
+                ? /^(?:Apple )?Swift version (\d+\.\d+(?:\.\d+)?) \([^\r\n]+\)\r?\nTarget: [a-zA-Z0-9_.-]+$/.exec(output)?.[1]
+                : tool.name === "ruby"
+                    ? /^ruby (\d+\.\d+\.\d+)(?:p\d+)? /.exec(output)?.[1]
+                    : tool.name === "cargo" || tool.name === "rustc"
+                        ? output.startsWith(`${tool.name} `)
+                            ? /^(?:cargo|rustc) (\S+) \([a-f0-9]+ [0-9-]+\)$/.exec(output)?.[1]
+                            : undefined
+                        : tool.name === "pint"
+                            ? /^Pint (\S+)$/.exec(output)?.[1]
+                            : tool.name === "pest"
+                                ? /^Pest Testing Framework (\S+)\.$/.exec(output)?.[1]
+                                : tool.name === "phpunit"
+                                    ? /^PHPUnit (\S+) by .+$/.exec(output)?.[1]
+                                    : tool.name === "phpstan"
+                                        ? /^PHPStan - PHP Static Analysis Tool (\S+)$/.exec(output)?.[1]
+                                        : tool.name === "staticcheck"
+                                            ? /^staticcheck \S+ \((\d+\.\d+\.\d+)\)$/.exec(output)?.[1]
+                                            : tool.name === "go"
+                                                ? /^go version go(\S+) \S+$/.exec(output)?.[1]
+                                                : tool.name === "php"
+                                                    ? /^PHP (\S+) /.exec(output)?.[1]
+                                                    : tool.name === "python"
+                                                        ? /^Python (\S+)$/.exec(output)?.[1]
+                                                        : tool.name === "ruff"
+                                                            ? /^ruff (\S+)$/.exec(output)?.[1]
+                                                            : output;
+    if (version &&
+        (tool.name === "swift"
+            ? /^\d+\.\d+(?:\.\d+)?$/.test(version)
+            : versionPattern.test(version)) &&
+        (!execution.stderr.trim() ||
+            (tool.name === "swift" &&
+                /^swift-driver version: \d+\.\d+\.\d+$/.test(execution.stderr.trim()))))
+        return { ...result, version, status: "identified" };
+    return result;
+}