@xemahq/xema 0.40.3 → 0.41.1

package/edition/verify-catalogue-evidence.mjs

@@ -0,0 +1,245 @@
+// verify-catalogue-evidence — the `catalogue-evidence` mode of the evidence verifier bundle.
+//
+//   <bundle> catalogue-evidence arming --channel <release|develop> --data-root <dir>
+//   <bundle> catalogue-evidence verify --channel <c> --data-root <dir> --evidence-root <abs dir>
+//     --statement-digest <sha256:..> --bundle-digest <sha256:..> --workflow-sha <40hex> --offering-id <id>
+//     --subject-digest <sha256:..> --catalogue-layer-digest <sha256:..> --lock-layer-digest <sha256:..>
+//     --cosign <abs path>
+//
+// A customer verifies the E4 statement of a release catalogue BEFORE the catalogue's kernel is adopted, so there is no
+// kernel package to load schemas from yet. The only kernel-dependent parts of the judgement are the policy schema
+// (parseSigstoreOfflineTrustPolicy) and the predicate-type/channel constants; before adoption they come from the pinned
+// bundle's own embedded kernel, through `loadVerifierKernelSchemas` and nowhere else. This mode never takes `--kernel`.
+//
+// The anchors are the customer's pinned policy and the pinned verifier itself (the bundle refuses to run unless its own
+// bytes are the ones the data-root pin records). There is NO git grading in this mode: it reads no checkout of an editions
+// root, only the declared policy and pin of the data root, both of which the pin binds by digest.
+//
+// ONE arming rule (trust-policy-arming.mjs): the policy must be ARMED on the channel with the E4 row required
+// (`consumesCatalogue: true`); `arming` stops there. `verify` then holds the statement to that policy and to the exact
+// manifest, catalogue layer and lock layer the caller read, with the kernel's own `editionCatalogueRefusal`.
+
+import { editionWorkspaceConfig, resetEditionWorkspaceConfig } from './edition-config.mjs';
+import { EDITION_CONTRACT } from './edition-constants.mjs';
+import { WorkspaceRoot, configureEditionWorkspaceFromArgv, dataRoot } from './edition-workspace.mjs';
+import {
+  assertPinnedPolicy,
+  assertPinnedVerifier,
+  loadDeclaredTrustPolicy,
+  readEvidenceTrustPin,
+  verifierDigests,
+} from './evidence-trust-pin.mjs';
+import { prepareTrustedCosignBinary, verifySigstoreEvidenceDescriptor } from './image-evidence.mjs';
+import { BUNDLE_MEDIA_TYPE } from './sigstore-bundle-media-type.mjs';
+import { TrustPolicyArmingState, assessTrustPolicyArming } from './trust-policy-arming.mjs';
+import { assertSanitizedOperatorEnvironment, readRunningVerifier } from './verifier-binding.mjs';
+import { loadVerifierKernelSchemas } from './verifier-kernel-schemas.mjs';
+
+/** The first argument that selects this mode of the bundle. */
+export const CATALOGUE_EVIDENCE_MODE = 'catalogue-evidence';
+export const CATALOGUE_EVIDENCE_USAGE =
+  'usage: catalogue-evidence arming --channel <release|develop> --data-root <dir> | ' +
+  'catalogue-evidence verify --channel <c> --data-root <dir> --evidence-root <abs dir> --statement-digest <sha256:..> ' +
+  '--bundle-digest <sha256:..> --workflow-sha <40-hex> --offering-id <id> --subject-digest <sha256:..> ' +
+  '--catalogue-layer-digest <sha256:..> --lock-layer-digest <sha256:..> --cosign <abs path>';
+
+export const CATALOGUE_EVIDENCE_STATEMENT_FILE = 'statement.json';
+export const CATALOGUE_EVIDENCE_BUNDLE_FILE = 'bundle.sigstore.json';
+/** The code of the refusal that the data root's policy is not armed (also the code of the library's error). */
+export const CATALOGUE_EVIDENCE_UNARMED_CODE = EDITION_CONTRACT.evidenceTrust.refusal.code;
+
+export const CatalogueEvidenceRefusalCode = Object.freeze({
+  SubjectMismatch: 'catalogue_evidence_subject_mismatch',
+  OfferingMismatch: 'catalogue_evidence_offering_mismatch',
+  LockDigestMismatch: 'catalogue_evidence_lock_digest_mismatch',
+});
+
+const SHA256_DIGEST = /^sha256:[a-f0-9]{64}$/;
+const COMMIT = /^[a-f0-9]{40}$/;
+const ARMING_FLAGS = Object.freeze(['--channel']);
+const VERIFY_FLAGS = Object.freeze([
+  '--channel',
+  '--evidence-root',
+  '--statement-digest',
+  '--bundle-digest',
+  '--workflow-sha',
+  '--offering-id',
+  '--subject-digest',
+  '--catalogue-layer-digest',
+  '--lock-layer-digest',
+  '--cosign',
+]);
+const ABSOLUTE_FLAGS = Object.freeze(['--evidence-root', '--cosign']);
+const DIGEST_FLAGS = Object.freeze(['--statement-digest', '--bundle-digest', '--subject-digest', '--catalogue-layer-digest', '--lock-layer-digest']);
+
+/** A bad command line: exit 2. */
+export class CatalogueEvidenceUsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'CatalogueEvidenceUsageError';
+  }
+}
+
+/** The data root's policy is not armed (or declared) for a catalogue consumer on the channel. Carries the stable code. */
+export class CatalogueEvidenceUnarmedError extends Error {
+  constructor(message) {
+    super(`${CATALOGUE_EVIDENCE_UNARMED_CODE}: ${message}`);
+    this.name = 'EvidenceTrustRequiredError';
+    this.code = CATALOGUE_EVIDENCE_UNARMED_CODE;
+  }
+}
+
+/** The statement does not bind what the caller read; `code` is the refusal's stable name. */
+export class CatalogueEvidenceRefusal extends Error {
+  constructor(code, message) {
+    super(`${code}: ${message}`);
+    this.name = 'CatalogueEvidenceRefusal';
+    this.code = code;
+  }
+}
+
+const hexOf = (digest) => digest.slice('sha256:'.length);
+
+function parseFlags(args, allowed) {
+  const flags = new Map();
+  for (let index = 0; index < args.length; index += 2) {
+    const flag = args[index];
+    const value = args[index + 1];
+    if (typeof flag !== 'string' || !allowed.includes(flag)) {
+      throw new CatalogueEvidenceUsageError(`unknown or unexpected argument ${JSON.stringify(flag)}`);
+    }
+    if (value === undefined || value.startsWith('--')) {throw new CatalogueEvidenceUsageError(`${flag} requires a value`);}
+    if (flags.has(flag)) {throw new CatalogueEvidenceUsageError(`${flag} was given twice`);}
+    flags.set(flag, value);
+  }
+  for (const flag of allowed) {
+    if (!flags.has(flag)) {throw new CatalogueEvidenceUsageError(`${flag} is required`);}
+  }
+  for (const flag of ABSOLUTE_FLAGS.filter((candidate) => flags.has(candidate))) {
+    if (!flags.get(flag).startsWith('/')) {throw new CatalogueEvidenceUsageError(`${flag} must be an absolute path`);}
+  }
+  for (const flag of DIGEST_FLAGS.filter((candidate) => flags.has(candidate))) {
+    if (!SHA256_DIGEST.test(flags.get(flag))) {throw new CatalogueEvidenceUsageError(`${flag} must be sha256:<64 lowercase hex>`);}
+  }
+  if (flags.has('--workflow-sha') && !COMMIT.test(flags.get('--workflow-sha'))) {
+    throw new CatalogueEvidenceUsageError('--workflow-sha must be a 40-character lowercase hexadecimal git commit SHA');
+  }
+  return flags;
+}
+
+/**
+ * The anchors, then the ONE arming rule: the sanitized launch, the running verifier, the declared policy held to the
+ * data-root pin of both the policy and THIS verifier, and the policy ARMED on `channel` with the E4 row required.
+ */
+async function armedAnchors({ channel, env, bundlePath }) {
+  assertSanitizedOperatorEnvironment(env);
+  const running = readRunningVerifier(bundlePath);
+  const { schemas } = await loadVerifierKernelSchemas();
+  resetEditionWorkspaceConfig();
+  const declaration = editionWorkspaceConfig().evidenceTrustPolicy;
+  if (declaration.policy === null) {
+    throw new CatalogueEvidenceUnarmedError(`${dataRoot()} declares no evidenceTrustPolicy in edition-workspace.json`);
+  }
+  const { policy, policyDigest } = loadDeclaredTrustPolicy({ dataRoot: dataRoot(), declaration, schemas });
+  const pin = readEvidenceTrustPin({ dataRoot: dataRoot(), declaration });
+  assertPinnedPolicy({ pin, policyDigest });
+  assertPinnedVerifier({ pin, actual: verifierDigests(running) });
+  const { state, unmet } = assessTrustPolicyArming(policy, schemas, channel, { consumesCatalogue: true });
+  if (state !== TrustPolicyArmingState.ARMED) {
+    throw new CatalogueEvidenceUnarmedError(
+      `the declared policy is ${state.toUpperCase()} on the ${channel} channel for a catalogue consumer: ${unmet.join('; ')}`,
+    );
+  }
+  return { schemas, policy };
+}
+
+/**
+ * Run the mode. `argv` is the bundle's arguments (`['catalogue-evidence', '<phase>', ...]`). Resolves to the JSON line to
+ * print on success; rejects with a named error otherwise.
+ */
+export async function runCatalogueEvidence({ argv, env, bundlePath }) {
+  const [mode, phase, ...tail] = argv;
+  if (mode !== CATALOGUE_EVIDENCE_MODE || (phase !== 'arming' && phase !== 'verify')) {
+    throw new CatalogueEvidenceUsageError(CATALOGUE_EVIDENCE_USAGE);
+  }
+  // `--kernel` is no root of this mode: the schemas are the bundle's own.
+  let rest;
+  try {
+    rest = configureEditionWorkspaceFromArgv(tail, [WorkspaceRoot.Data], { refuseOthers: true });
+  } catch (error) {
+    throw new CatalogueEvidenceUsageError(error.message);
+  }
+  const flags = parseFlags(rest, phase === 'arming' ? ARMING_FLAGS : VERIFY_FLAGS);
+  const channel = flags.get('--channel');
+  const { schemas, policy } = await armedAnchors({ channel, env, bundlePath });
+  if (phase === 'arming') {
+    return `${JSON.stringify({ channel, state: TrustPolicyArmingState.ARMED })}\n`;
+  }
+  const offeringId = flags.get('--offering-id');
+  const descriptor = {
+    statementPath: CATALOGUE_EVIDENCE_STATEMENT_FILE,
+    statementDigest: flags.get('--statement-digest'),
+    bundlePath: CATALOGUE_EVIDENCE_BUNDLE_FILE,
+    bundleDigest: flags.get('--bundle-digest'),
+    bundleMediaType: BUNDLE_MEDIA_TYPE,
+  };
+  const trustedCosign = prepareTrustedCosignBinary({ cosignBinary: flags.get('--cosign'), policy });
+  let statement;
+  try {
+    ({ statement } = verifySigstoreEvidenceDescriptor({
+      evidenceRoot: flags.get('--evidence-root'),
+      descriptor,
+      policy,
+      predicateType: schemas.EDITION_CATALOGUE_PREDICATE_TYPE,
+      channel,
+      expectedWorkflowSha: flags.get('--workflow-sha'),
+      parseStatement: schemas.parseEditionCatalogueStatement,
+      policyRoot: dataRoot(),
+      trustedCosign,
+    }));
+  } finally {
+    trustedCosign.dispose();
+  }
+  const [subject] = statement.subject;
+  const expectedSubject = `xema-edition-${offeringId}`;
+  if (subject.digest.sha256 !== hexOf(flags.get('--subject-digest')) || subject.name !== expectedSubject) {
+    throw new CatalogueEvidenceRefusal(
+      CatalogueEvidenceRefusalCode.SubjectMismatch,
+      `the statement is over ${subject.name}@sha256:${subject.digest.sha256}, not ${expectedSubject}@${flags.get('--subject-digest')}`,
+    );
+  }
+  const refusal = schemas.editionCatalogueRefusal(statement.predicate, {
+    channel,
+    catalogueLayerDigest: flags.get('--catalogue-layer-digest'),
+  });
+  if (refusal !== undefined) {
+    throw new CatalogueEvidenceRefusal(
+      refusal,
+      `the statement states channel ${statement.predicate.channel} and catalogue ${statement.predicate.catalogueDigest}; ` +
+        `this catalogue is on ${channel} with layer ${flags.get('--catalogue-layer-digest')}`,
+    );
+  }
+  if (statement.predicate.offeringId !== offeringId) {
+    throw new CatalogueEvidenceRefusal(
+      CatalogueEvidenceRefusalCode.OfferingMismatch,
+      `the statement is for offering ${statement.predicate.offeringId}, not ${offeringId}`,
+    );
+  }
+  if (statement.predicate.lockDigest !== hexOf(flags.get('--lock-layer-digest'))) {
+    throw new CatalogueEvidenceRefusal(
+      CatalogueEvidenceRefusalCode.LockDigestMismatch,
+      `the statement states lock digest ${statement.predicate.lockDigest}, not that of the lock layer ${flags.get('--lock-layer-digest')}`,
+    );
+  }
+  return `${JSON.stringify({ verified: true, offeringId, channel, statementDigest: descriptor.statementDigest })}\n`;
+}
+
+/** Run the mode as the bundle's entry: print its line, or the named refusal on stderr with exit 1 (usage: 2). */
+export async function runCatalogueEvidenceEntry({ argv, env, bundlePath }) {
+  try {
+    process.stdout.write(await runCatalogueEvidence({ argv, env, bundlePath }));
+  } catch (error) {
+    process.stderr.write(`catalogue-evidence: ${error.name}: ${error.message}\n`);
+    process.exitCode = error instanceof CatalogueEvidenceUsageError ? 2 : 1;
+  }
+}

package/edition/verify-image-evidence.mjs

@@ -12,6 +12,9 @@
 //   * the data root and the editions root are clean git checkouts at an exact
 //     HEAD with every file read from them bound to its HEAD blob.
 //
+// A second mode, `catalogue-evidence arming|verify` (verify-catalogue-evidence.mjs), judges a release catalogue's E4
+// statement for a customer before the catalogue's kernel is adopted; it is selected by the first argument.
+//
 // usage: verify-image-evidence <distributionId> --evidence-root <dir>
 //   --descriptor <absolute-path> --state <absolute-path> --cosign <absolute-path> --git <absolute-path>
 //   [--evidence-set <relative-path>] --data-root <dir> --editions-root <dir>
@@ -65,6 +68,10 @@ import {
   readRunningVerifier,
 } from './verifier-binding.mjs';
 import { loadVerifierKernelSchemas } from './verifier-kernel-schemas.mjs';
+import {
+  CATALOGUE_EVIDENCE_MODE,
+  runCatalogueEvidenceEntry,
+} from './verify-catalogue-evidence.mjs';
 
 const USAGE =
   'usage: verify-image-evidence <distributionId> --evidence-root <dir> --descriptor <absolute-path> --state <absolute-path> ' +
@@ -445,7 +452,14 @@ export async function verifyEvidence({ argv, env, bundlePath }) {
   }
 }
 
-if (isEntryModule(import.meta.url)) {
+if (isEntryModule(import.meta.url) && process.argv[2] === CATALOGUE_EVIDENCE_MODE) {
+  // The customer's pre-adoption mode: the E4 statement of a catalogue, judged with this bundle's own embedded kernel.
+  await runCatalogueEvidenceEntry({
+    argv: process.argv.slice(2),
+    env: process.env,
+    bundlePath: process.argv[1],
+  });
+} else if (isEntryModule(import.meta.url)) {
   await verifyEvidence({
     argv: process.argv.slice(2),
     env: process.env,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/xema",
-  "version": "0.40.3",
+  "version": "0.41.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/xema-dev/xema-cli.git",
@@ -92,6 +92,6 @@
     "typecheck": "tsc --noEmit"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:55a458c54ff157ee053b4f074068c355fb35d28f54a01b0a2662bf14b07b8323"
+    "sourceDigest": "sha256:7e8af916b8cd5c8de331d7e274a7022071e6b6ac0d9d54042c2e55461ad46bab"
   }
 }

package/edition/develop-customer-edition.mjs

@@ -1,149 +0,0 @@
-// develop-customer-edition — a DEVELOP customer edition: a customer definition
-// resolved against a catalogue, frozen at the customer's OWN repository pins.
-//
-// The pins file holds one `sources/<name>` commit per source the definition
-// declares and nothing else (the vendor repositories are the catalogue's, not
-// the customer's). The digest of the catalogue artifact the edition was
-// resolved against is frozen into the descriptor's provenance pins as
-// `catalogue`; the artifact tag (developEditionTag) covers it. The vendor image
-// rows arrive sealed from the catalogue; only the customer's own image rows are
-// sealed against the develop image repositories.
-
-import { join } from 'node:path';
-
-import { sealLock } from './biome-content.mjs';
-import { parseCatalogueRef } from './catalogue-fetch.mjs';
-import { readCataloguePin } from './catalogue-pin.mjs';
-import { developImageRef } from './develop-image-coordinate.mjs';
-import { sealDevelopImageSubjects } from './develop-seal.mjs';
-import { assertCanonicalDistributionId } from './distribution-paths.mjs';
-import { CATALOGUE_PIN_KEY, EditionChannel, EditionLockFile } from './edition-constants.mjs';
-import { loadKernelDistributionSchemas } from './lib.mjs';
-import { isSourcePinKey, sortedSnapshotPins, sourcePinKey } from './pin-source.mjs';
-import { resolveCustomerEdition } from './resolve-customer-edition.mjs';
-import { externalSourceTrees, imageRefForSubject, sourceTreeLocator } from './resolve-images.mjs';
-import { readStrictJsonFile } from './strict-json.mjs';
-
-const SHA_PATTERN = /^[0-9a-f]{40}$/;
-
-export class CustomerDevelopPinsError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'CustomerDevelopPinsError';
-  }
-}
-
-/**
- * The pins of a develop customer edition: `sources/<name>` commits for exactly
- * the definition's declared sources, plus `catalogue` = the digest of the
- * catalogue artifact. A `catalogue` entry in the file must equal that digest.
- */
-export function customerDevelopPins({ pins, declaredSourceNames, catalogueDigest }) {
-  if (pins === null || typeof pins !== 'object' || Array.isArray(pins)) {
-    throw new CustomerDevelopPinsError('--pins must be an object mapping sources/<name> -> 40-hex commit');
-  }
-  const own = {};
-  for (const [key, value] of Object.entries(pins)) {
-    if (key === CATALOGUE_PIN_KEY) {
-      if (value !== catalogueDigest) {
-        throw new CustomerDevelopPinsError(`--pins "${CATALOGUE_PIN_KEY}" is ${JSON.stringify(value)}, but the pinned develop catalogue is ${catalogueDigest}`);
-      }
-      continue;
-    }
-    if (!isSourcePinKey(key)) {
-      throw new CustomerDevelopPinsError(`--pins "${key}" is not one of the customer's own repositories: a customer develop pins only sources/<name> (the vendor's pins are the catalogue's)`);
-    }
-    if (typeof value !== 'string' || !SHA_PATTERN.test(value)) {
-      throw new CustomerDevelopPinsError(`--pins "${key}" is not a 40-hex commit SHA: ${JSON.stringify(value)}`);
-    }
-    own[key] = value;
-  }
-  const declared = new Set(declaredSourceNames.map(sourcePinKey));
-  for (const key of declared) {
-    if (!(key in own)) {throw new CustomerDevelopPinsError(`--pins is missing "${key}": the definition declares that source`);}
-  }
-  for (const key of Object.keys(own)) {
-    if (!declared.has(key)) {throw new CustomerDevelopPinsError(`--pins names "${key}", but the definition declares no such source`);}
-  }
-  return sortedSnapshotPins({ ...own, [CATALOGUE_PIN_KEY]: catalogueDigest });
-}
-
-/** The source names a raw definition declares (the pins are checked before the definition is composed). */
-export function declaredSourceNamesOf(rawDefinition) {
-  const sources = rawDefinition?.sources;
-  return Array.isArray(sources) ? sources.map((source) => source?.name) : [];
-}
-
-/** Resolve and seal the develop customer edition; returns the four locks and the frozen provenance pins. */
-export async function resolveCustomerDevelopEdition({ rawDefinition, catalogue, catalogueDigest, pins, sourceImages, env = process.env, sealOptions = {}, adoptKernel, materialize }) {
-  const frozen = customerDevelopPins({ pins, declaredSourceNames: declaredSourceNamesOf(rawDefinition), catalogueDigest });
-  const resolved = await resolveCustomerEdition({
-    rawDefinition,
-    catalogue,
-    channel: EditionChannel.Develop,
-    sourceImages,
-    pins: frozen,
-    catalogueDigest,
-    ...(adoptKernel === undefined ? {} : { adoptKernel }),
-    ...(materialize === undefined ? {} : { materialize }),
-    sealOwn: ({ distributionId, subjects }) => sealDevelopImageSubjects({ distributionId, subjects, env, ...sealOptions }),
-  });
-  // The customer edition is sealed here: every biomeContentHash is recomputed through the
-  // same code as the vendor's, vendor biomes on the CATALOGUE's authority (biome-content.mjs).
-  const schemas = await loadKernelDistributionSchemas();
-  const distributionLock = await sealLock({
-    schemas,
-    unsealed: resolved.distributionLock,
-    imageLock: resolved.imageLock,
-    locate: sourceTreeLocator(externalSourceTrees(resolved.distributionLock)),
-    vendoredCommit: (repo) => {
-      throw new Error(`customer biome source "${repo}" is first-party to no checkout; vendor biomes are taken from the catalogue`);
-    },
-    catalogue,
-    catalogueDigest,
-    storePublisherAnchorKeys: resolved.storePublisherAnchorKeys,
-  });
-  return { ...resolved, distributionLock, pins: frozen };
-}
-
-/**
- * What a develop verb of a customer edition derives from its definition file and its `--pins` file with no
- * network: the id (the definition's), the pinned develop catalogue reference and digest, and the frozen
- * provenance pins (the customer's `sources/<name>` commits plus that digest).
- */
-export function customerDevelopFrame({ definitionFile, pinsFile }) {
-  const rawDefinition = readStrictJsonFile(definitionFile);
-  assertCanonicalDistributionId(rawDefinition?.id);
-  const catalogueRef = readCataloguePin({ definitionFile, channel: EditionChannel.Develop });
-  const { digest } = parseCatalogueRef(catalogueRef);
-  const pins = customerDevelopPins({ pins: readStrictJsonFile(pinsFile), declaredSourceNames: declaredSourceNamesOf(rawDefinition), catalogueDigest: digest });
-  return { id: rawDefinition.id, rawDefinition, catalogueRef, catalogueDigest: digest, pins };
-}
-
-/**
- * The own image rows of an existing customer develop artifact are the rows this `--source-image` map composes:
- * every subject owned by a biome drawn from a declared source is `<registry>/<prefix><subject>` mapped to its
- * develop repository. The tag covers the map, but a tag is mutable registry state, so the pulled bytes are
- * compared too. Throws naming the first row that differs.
- */
-export function assertOwnImageRowsMatch({ artifactDir, sourceImages }) {
-  const lock = readStrictJsonFile(join(artifactDir, EditionLockFile.Distribution));
-  const imageLock = readStrictJsonFile(join(artifactDir, EditionLockFile.Images));
-  const sourceOf = new Map((lock.biomes ?? []).filter((biome) => biome.source !== undefined).map((biome) => [biome.id, biome.source.name]));
-  for (const subject of imageLock.subjects ?? []) {
-    const biomeId = (subject.owners ?? []).find((owner) => sourceOf.has(owner.biomeId))?.biomeId;
-    if (biomeId === undefined) {continue;}
-    const name = sourceOf.get(biomeId);
-    const image = sourceImages.get(name);
-    if (image === undefined) {
-      throw new Error(`the existing artifact draws biome "${biomeId}" from source "${name}", which has no --source-image; refusing to reuse it`);
-    }
-    const expected = developImageRef(imageRefForSubject(subject.id, image.imageRegistry, image.imageNamePrefix));
-    if (subject.imageRef !== expected) {
-      throw new Error(
-        `the existing artifact's own image row ${subject.kind}:${subject.id} is ${subject.imageRef}, not ${expected} ` +
-          '(the --source-image map differs); refusing to reuse it',
-      );
-    }
-  }
-}