chainlesschain 0.165.4 → 0.165.6

package/src/lib/plugin-runtime/marketplace-archive-source.js

@@ -0,0 +1,331 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { gunzipSync } from "node:zlib";
+import { getElectronUserDataDir } from "../paths.js";
+import {
+  assertSafeInstalledPluginStructure,
+  buildMarketplacePayloadSbom,
+} from "./marketplace-artifact-readback.js";
+import { createMarketplaceNetworkTransport } from "./marketplace-network.js";
+import { fetchMarketplaceRemoteArtifact } from "./marketplace-remote-artifacts.js";
+
+export const MARKETPLACE_ARCHIVE_SOURCE_SCHEMA =
+  "cc-plugin-marketplace-archive-source/v1";
+export const MARKETPLACE_ARCHIVE_LIMITS = Object.freeze({
+  compressedBytes: 64 * 1024 * 1024,
+  expandedBytes: 256 * 1024 * 1024,
+  entries: 10_000,
+});
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+
+function octal(header, offset, length) {
+  const text = header
+    .subarray(offset, offset + length)
+    .toString("ascii")
+    .replace(/\0.*$/u, "")
+    .trim();
+  return text ? Number.parseInt(text, 8) : 0;
+}
+
+function cString(header, offset, length) {
+  const bytes = header.subarray(offset, offset + length);
+  const end = bytes.indexOf(0);
+  return bytes.subarray(0, end < 0 ? bytes.length : end).toString("utf8");
+}
+
+function checksumValid(header) {
+  const expected = octal(header, 148, 8);
+  let actual = 0;
+  for (let index = 0; index < 512; index += 1) {
+    actual += index >= 148 && index < 156 ? 0x20 : header[index];
+  }
+  return expected === actual;
+}
+
+function safeArchivePath(raw) {
+  const value = String(raw || "");
+  if (
+    !value ||
+    value.includes("\\") ||
+    value.includes("\0") ||
+    value.startsWith("/") ||
+    /^[a-z]:/iu.test(value)
+  ) {
+    throw new Error("archive contains an unsafe path");
+  }
+  const segments = value.split("/").filter((part) => part && part !== ".");
+  const unsafePortableSegment = (part) =>
+    part === ".." ||
+    Buffer.byteLength(part, "utf8") > 255 ||
+    /[\u0000-\u001f:]/u.test(part) ||
+    /[ .]$/u.test(part) ||
+    /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(part);
+  if (
+    value.length > 4096 ||
+    segments.some(unsafePortableSegment) ||
+    segments[0] !== "package"
+  ) {
+    throw new Error("archive must contain only a package/ root");
+  }
+  return segments.slice(1);
+}
+
+function parsePax(data) {
+  const values = {};
+  let offset = 0;
+  while (offset < data.length) {
+    const space = data.indexOf(0x20, offset);
+    if (space < 0) throw new Error("archive PAX header is malformed");
+    const length = Number.parseInt(data.toString("ascii", offset, space), 10);
+    if (
+      !Number.isSafeInteger(length) ||
+      length <= 0 ||
+      offset + length > data.length
+    ) {
+      throw new Error("archive PAX record length is invalid");
+    }
+    const record = data.toString("utf8", space + 1, offset + length - 1);
+    const equals = record.indexOf("=");
+    if (equals > 0) values[record.slice(0, equals)] = record.slice(equals + 1);
+    offset += length;
+  }
+  return values;
+}
+
+function extractVerifiedTgz(bytes, destination) {
+  let tar;
+  try {
+    tar = gunzipSync(bytes, {
+      maxOutputLength: MARKETPLACE_ARCHIVE_LIMITS.expandedBytes,
+    });
+  } catch {
+    throw new Error("Marketplace archive is not a bounded valid gzip stream");
+  }
+  const seen = new Set();
+  let offset = 0;
+  let records = 0;
+  let extractedEntries = 0;
+  let extractedBytes = 0;
+  let pendingLongName = null;
+  let pendingPax = null;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((value) => value === 0)) break;
+    if (!checksumValid(header))
+      throw new Error("archive tar checksum mismatch");
+    const size = octal(header, 124, 12);
+    if (!Number.isSafeInteger(size) || size < 0) {
+      throw new Error("archive tar entry size is invalid");
+    }
+    const typeByte = header[156];
+    const type = typeByte === 0 ? "0" : String.fromCharCode(typeByte);
+    const dataStart = offset + 512;
+    const dataEnd = dataStart + size;
+    if (dataEnd > tar.length) throw new Error("archive tar entry is truncated");
+    const data = tar.subarray(dataStart, dataEnd);
+    offset = dataStart + Math.ceil(size / 512) * 512;
+    records += 1;
+    if (records > MARKETPLACE_ARCHIVE_LIMITS.entries) {
+      throw new Error("archive contains too many entries");
+    }
+
+    if (type === "L") {
+      pendingLongName = data.toString("utf8").replace(/\0+$/u, "");
+      continue;
+    }
+    if (type === "x" || type === "X") {
+      pendingPax = parsePax(data);
+      continue;
+    }
+    if (type === "g") continue;
+    if (!new Set(["0", "5"]).has(type)) {
+      throw new Error(
+        "archive links, devices, and special entries are rejected",
+      );
+    }
+
+    const name = cString(header, 0, 100);
+    const prefix = cString(header, 345, 155);
+    let archivePath = prefix ? `${prefix}/${name}` : name;
+    if (pendingLongName != null) archivePath = pendingLongName;
+    if (typeof pendingPax?.path === "string" && pendingPax.path) {
+      archivePath = pendingPax.path;
+    }
+    pendingLongName = null;
+    pendingPax = null;
+    const parts = safeArchivePath(archivePath);
+    if (parts.length === 0) continue;
+    const relativePath = parts.join("/");
+    const collisionKey = relativePath.normalize("NFC").toLowerCase();
+    if (seen.has(collisionKey)) {
+      throw new Error("archive contains duplicate or case-colliding paths");
+    }
+    seen.add(collisionKey);
+    extractedEntries += 1;
+    const target = path.join(destination, ...parts);
+    const relative = path.relative(destination, target);
+    if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
+      throw new Error("archive extraction escaped its package root");
+    }
+    if (type === "5") {
+      fs.mkdirSync(target, { recursive: true, mode: 0o755 });
+      continue;
+    }
+    extractedBytes += data.length;
+    if (extractedBytes > MARKETPLACE_ARCHIVE_LIMITS.expandedBytes) {
+      throw new Error("archive expanded payload exceeds its byte limit");
+    }
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o755 });
+    const mode = octal(header, 100, 8) & 0o111 ? 0o755 : 0o644;
+    fs.writeFileSync(target, data, { flag: "wx", mode });
+  }
+  if (extractedEntries === 0) throw new Error("archive package is empty");
+  assertSafeInstalledPluginStructure(destination);
+  return buildMarketplacePayloadSbom(destination);
+}
+
+function cacheRoot(configured) {
+  return (
+    configured || path.join(getElectronUserDataDir(), "plugin-archive-sources")
+  );
+}
+
+function readAuthority(root, expected) {
+  const authorityPath = path.join(root, "authority.json");
+  const packagePath = path.join(root, "package");
+  const rootStat = fs.lstatSync(root);
+  const authorityStat = fs.lstatSync(authorityPath);
+  if (
+    !rootStat.isDirectory() ||
+    rootStat.isSymbolicLink() ||
+    !authorityStat.isFile() ||
+    authorityStat.isSymbolicLink() ||
+    authorityStat.nlink !== 1 ||
+    authorityStat.size <= 0 ||
+    authorityStat.size > 64 * 1024
+  ) {
+    throw new Error("Marketplace archive source cache structure is unsafe");
+  }
+  const authority = JSON.parse(fs.readFileSync(authorityPath, "utf8"));
+  if (
+    authority.schemaVersion !== MARKETPLACE_ARCHIVE_SOURCE_SCHEMA ||
+    authority.status !== "digest-verified-and-extracted" ||
+    authority.url !== expected.url ||
+    authority.registryOrigin !== expected.registryOrigin ||
+    authority.archiveSha256 !== expected.archiveSha256 ||
+    authority.compressedBytes !== expected.compressedBytes
+  ) {
+    throw new Error("Marketplace archive source cache authority mismatch");
+  }
+  assertSafeInstalledPluginStructure(packagePath);
+  const payload = buildMarketplacePayloadSbom(packagePath);
+  if (
+    payload.digest !== authority.payloadSha256 ||
+    payload.fileCount !== authority.fileCount ||
+    payload.totalBytes !== authority.totalBytes
+  ) {
+    throw new Error("Marketplace archive extracted payload digest mismatch");
+  }
+  return { authority, packagePath };
+}
+
+export async function fetchAndMaterializeMarketplaceArchive(options = {}) {
+  const networkTransport =
+    options.offline !== true &&
+    typeof options.fetchImpl !== "function" &&
+    (options.proxyUrl || options.pacFile || options.caFile)
+      ? createMarketplaceNetworkTransport(options)
+      : null;
+  let artifact;
+  try {
+    artifact = await fetchMarketplaceRemoteArtifact({
+      kind: "archive",
+      url: options.url,
+      expectedSha256: options.sha256,
+      registryOrigin: new URL(options.registryUrl).origin,
+      authorizationOrigin: new URL(options.registryUrl).origin,
+      token: options.token,
+      allowInsecure: options.allowInsecure === true,
+      offline: options.offline === true,
+      cacheDir: options.artifactCacheDir,
+      timeoutMs: options.timeoutMs,
+      fetchImpl: options.fetchImpl || networkTransport?.fetch,
+      resolveHostname: options.resolveHostname,
+    });
+  } finally {
+    await networkTransport?.close();
+  }
+  if (artifact.bytes.length > MARKETPLACE_ARCHIVE_LIMITS.compressedBytes) {
+    throw new Error("Marketplace archive exceeds its compressed byte limit");
+  }
+
+  const root = cacheRoot(options.sourceCacheDir);
+  fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+  const rootStat = fs.lstatSync(root);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+    throw new Error("Marketplace archive source cache root is unsafe");
+  }
+  const key = sha256(`${artifact.url}\0${artifact.sha256}`);
+  const finalRoot = path.join(root, key);
+  const expected = {
+    url: artifact.url,
+    registryOrigin: new URL(options.registryUrl).origin,
+    archiveSha256: artifact.sha256,
+    compressedBytes: artifact.bytes.length,
+  };
+  if (fs.existsSync(finalRoot)) {
+    try {
+      const cached = readAuthority(finalRoot, expected);
+      return {
+        dir: cached.packagePath,
+        authority: { ...cached.authority, fromCache: artifact.fromCache },
+      };
+    } catch (error) {
+      const stat = fs.lstatSync(finalRoot);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) throw error;
+      fs.rmSync(finalRoot, { recursive: true, force: true });
+    }
+  }
+
+  const temporary = fs.mkdtempSync(path.join(root, `.tmp-${key}-`));
+  try {
+    const packagePath = path.join(temporary, "package");
+    fs.mkdirSync(packagePath, { mode: 0o755 });
+    const payload = extractVerifiedTgz(artifact.bytes, packagePath);
+    const authority = {
+      schemaVersion: MARKETPLACE_ARCHIVE_SOURCE_SCHEMA,
+      status: "digest-verified-and-extracted",
+      url: artifact.url,
+      registryOrigin: new URL(options.registryUrl).origin,
+      archiveSha256: artifact.sha256,
+      compressedBytes: artifact.bytes.length,
+      payloadSha256: payload.digest,
+      fileCount: payload.fileCount,
+      totalBytes: payload.totalBytes,
+      fromCache: artifact.fromCache,
+    };
+    fs.writeFileSync(
+      path.join(temporary, "authority.json"),
+      `${JSON.stringify(authority)}\n`,
+      { encoding: "utf8", flag: "wx", mode: 0o600 },
+    );
+    try {
+      fs.renameSync(temporary, finalRoot);
+    } catch (error) {
+      if (!fs.existsSync(finalRoot)) throw error;
+    }
+    const cached = readAuthority(finalRoot, expected);
+    return {
+      dir: cached.packagePath,
+      authority: { ...cached.authority, fromCache: artifact.fromCache },
+    };
+  } finally {
+    if (fs.existsSync(temporary)) {
+      fs.rmSync(temporary, { recursive: true, force: true });
+    }
+  }
+}

package/src/lib/plugin-runtime/marketplace-catalog.js

@@ -16,6 +16,7 @@ import {
 import { describeCapabilities, normalizeCapabilities } from "./capabilities.js";
 import { normalizePublisherDeclaration } from "./publisher-trust.js";
 import { normalizeMarketplaceNetworkAuthority } from "./marketplace-network.js";
+import { normalizeMarketplacePackageSource } from "./marketplace-source-adapter.js";
 
 export const PLUGIN_MARKETPLACE_CATALOG_SCHEMA =
   "cc-plugin-marketplace-catalog/v1";
@@ -461,22 +462,50 @@ function normalizeCandidate(entry, context) {
       ? boundedString(raw.version, 128) || null
       : null;
   const description = boundedString(raw.description, 2048);
-  const sourceValue =
-    typeof raw.source === "string" ? boundedString(raw.source, 4096) : "";
-  const sourceUrl = sanitizeUrl(sourceValue) || sourceValue || null;
-  const ref = boundedString(raw.ref, 256) || null;
   const blockers = [];
   const warnings = [];
+  let packageSource = null;
+  try {
+    packageSource = normalizeMarketplacePackageSource(raw);
+  } catch (error) {
+    blockers.push(issue(error?.code || "INVALID_PACKAGE_SOURCE"));
+  }
+  if (packageSource?.type === "dynamic-disabled") {
+    blockers.push(
+      issue("DYNAMIC_SOURCE_DISABLED", packageSource.requestedType),
+    );
+  }
+  const sourceValue =
+    packageSource?.type === "archive"
+      ? packageSource.url
+      : packageSource?.type === "git"
+        ? packageSource.source
+        : "";
+  const sourceUrl = sanitizeUrl(sourceValue) || sourceValue || null;
+  const ref = packageSource?.type === "git" ? packageSource.ref : null;
 
   if (!rawName || !/^[a-zA-Z0-9._@/-]+$/.test(rawName)) {
     blockers.push(issue("INVALID_NAME"));
   }
   if (!version || !semver.valid(version))
     blockers.push(issue("INVALID_VERSION"));
-  if (!sourceValue) blockers.push(issue("MISSING_PACKAGE_SOURCE"));
+  if (!sourceValue && packageSource?.type !== "dynamic-disabled") {
+    blockers.push(issue("MISSING_PACKAGE_SOURCE"));
+  }
   if (hasUrlCredentials(sourceValue)) {
     blockers.push(issue("SOURCE_CREDENTIALS_EMBEDDED"));
   }
+  if (packageSource?.type === "archive") {
+    try {
+      if (
+        new URL(packageSource.url).origin !== new URL(context.source.url).origin
+      ) {
+        blockers.push(issue("ARCHIVE_SOURCE_ORIGIN_MISMATCH"));
+      }
+    } catch {
+      blockers.push(issue("ARCHIVE_SOURCE_ORIGIN_MISMATCH"));
+    }
+  }
 
   const integrity = normalizeIntegrity(raw, blockers, warnings);
   const license = normalizeLicense(raw.license);
@@ -601,7 +630,24 @@ function normalizeCandidate(entry, context) {
         ? { networkAuthority: context.source.networkAuthority }
         : {}),
     },
-    package: { source: sourceUrl, ref },
+    package:
+      packageSource?.type === "archive"
+        ? {
+            type: "archive",
+            source: sourceUrl,
+            ref: null,
+            archiveSha256: packageSource.sha256,
+            format: packageSource.format,
+          }
+        : packageSource?.type === "dynamic-disabled"
+          ? {
+              type: "dynamic-disabled",
+              source: null,
+              ref: null,
+              requestedType: packageSource.requestedType,
+              enabled: false,
+            }
+          : { source: sourceUrl, ref },
     integrity,
     license,
     capabilities: {

package/src/lib/plugin-runtime/marketplace-remote-artifacts.js

@@ -21,6 +21,7 @@ export const MAX_MARKETPLACE_ARTIFACT_REDIRECTS = 3;
 export const DEFAULT_MARKETPLACE_ARTIFACT_TIMEOUT_MS = 15_000;
 export const MAX_MARKETPLACE_ARTIFACT_URL_LENGTH = 4096;
 export const MARKETPLACE_REMOTE_ARTIFACT_LIMITS = Object.freeze({
+  archive: 64 * 1024 * 1024,
   signature: 16 * 1024,
   publicKey: 64 * 1024,
   sbom: 16 * 1024 * 1024,

package/src/lib/plugin-runtime/marketplace-source-adapter.js

@@ -0,0 +1,163 @@
+const SHA256_RE = /^[a-f0-9]{64}$/u;
+const DYNAMIC_SOURCE_TYPES = new Set([
+  "command",
+  "headers-helper",
+  "headershelper",
+]);
+
+export const MARKETPLACE_DYNAMIC_SOURCE_DISABLED_CODE =
+  "CC_MARKETPLACE_DYNAMIC_SOURCE_DISABLED";
+
+function sourceError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function bounded(value, max) {
+  const text = typeof value === "string" ? value.trim() : "";
+  return text.length > 0 && text.length <= max ? text : null;
+}
+
+function safeUrl(value, label) {
+  const raw = bounded(value, 4096);
+  if (!raw) throw sourceError("INVALID_SOURCE_URL", `${label} URL is missing`);
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw sourceError("INVALID_SOURCE_URL", `${label} URL is invalid`);
+  }
+  if (url.username || url.password) {
+    throw sourceError(
+      "SOURCE_CREDENTIALS_REJECTED",
+      `${label} URL must not contain credentials`,
+    );
+  }
+  if (!new Set(["https:", "http:"]).has(url.protocol)) {
+    throw sourceError(
+      "INVALID_SOURCE_URL",
+      `${label} URL must use HTTPS or loopback HTTP`,
+    );
+  }
+  const requestUrl = url.href;
+  url.search = "";
+  url.hash = "";
+  return { url: url.href, requestUrl };
+}
+
+function disabledDynamicSource(type) {
+  return Object.freeze({
+    type: "dynamic-disabled",
+    requestedType: type,
+    enabled: false,
+    code: MARKETPLACE_DYNAMIC_SOURCE_DISABLED_CODE,
+    reason:
+      "dynamic Marketplace source/auth adapters are disabled by product policy",
+  });
+}
+
+/**
+ * Normalize one registry package source without executing it. Git strings keep
+ * the legacy shape. Archive sources require an HTTPS URL and exact compressed
+ * byte digest. Dynamic command/helper adapters remain representable for UI
+ * diagnostics but can never become executable materialization authority.
+ */
+export function normalizeMarketplacePackageSource(entry, options = {}) {
+  const row = entry && typeof entry === "object" ? entry : {};
+  if (row.command != null || row.headersHelper != null) {
+    const disabled = disabledDynamicSource(
+      row.command != null ? "command" : "headers-helper",
+    );
+    if (options.forExecution === true) {
+      throw sourceError(disabled.code, disabled.reason);
+    }
+    return disabled;
+  }
+
+  const source = row.source;
+  if (typeof source === "string") {
+    const value = bounded(source, 4096);
+    if (!value) {
+      throw sourceError("MISSING_PACKAGE_SOURCE", "plugin source is missing");
+    }
+    return Object.freeze({
+      type: "git",
+      source: value,
+      ref: bounded(row.ref, 256),
+    });
+  }
+  if (!source || typeof source !== "object" || Array.isArray(source)) {
+    throw sourceError("MISSING_PACKAGE_SOURCE", "plugin source is missing");
+  }
+  if (source.command != null || source.headersHelper != null) {
+    const disabled = disabledDynamicSource(
+      source.command != null ? "command" : "headers-helper",
+    );
+    if (options.forExecution === true) {
+      throw sourceError(disabled.code, disabled.reason);
+    }
+    return disabled;
+  }
+
+  const type = String(source.type || "")
+    .trim()
+    .toLowerCase();
+  if (DYNAMIC_SOURCE_TYPES.has(type)) {
+    const disabled = disabledDynamicSource(type);
+    if (options.forExecution === true) {
+      throw sourceError(disabled.code, disabled.reason);
+    }
+    return disabled;
+  }
+  if (type === "git") {
+    const value = bounded(source.url ?? source.source, 4096);
+    if (!value) {
+      throw sourceError("MISSING_PACKAGE_SOURCE", "git source URL is missing");
+    }
+    return Object.freeze({
+      type: "git",
+      source: value,
+      ref: bounded(source.ref ?? row.ref, 256),
+    });
+  }
+  if (type !== "archive") {
+    throw sourceError(
+      "UNSUPPORTED_PACKAGE_SOURCE",
+      `unsupported Marketplace source type: ${type || "unknown"}`,
+    );
+  }
+
+  const archiveUrl = safeUrl(source.url, "archive source");
+  const sha256 = String(source.sha256 || "")
+    .trim()
+    .toLowerCase();
+  if (!SHA256_RE.test(sha256)) {
+    throw sourceError(
+      "ARCHIVE_DIGEST_REQUIRED",
+      "archive source requires a 64-character lowercase SHA-256 digest",
+    );
+  }
+  const format = String(source.format || "tgz").toLowerCase();
+  if (!new Set(["tgz", "tar.gz"]).has(format)) {
+    throw sourceError(
+      "ARCHIVE_FORMAT_UNSUPPORTED",
+      "archive source format must be tgz or tar.gz",
+    );
+  }
+  const normalized = {
+    type: "archive",
+    url: archiveUrl.url,
+    sha256,
+    format: "tgz",
+  };
+  Object.defineProperty(normalized, "requestUrl", {
+    value: archiveUrl.requestUrl,
+    enumerable: false,
+  });
+  return Object.freeze(normalized);
+}
+
+export function assertMarketplaceSourceExecutable(entry) {
+  return normalizeMarketplacePackageSource(entry, { forExecution: true });
+}

package/src/lib/plugin-runtime/marketplace-source-cache.js

@@ -29,6 +29,9 @@ export function marketplaceSourceCacheSpec(
   if (sourceMetadata?.type !== "registry") return null;
   const source = cleanString(sourceMetadata.resolvedSource, 4096);
   const ref = cleanString(sourceMetadata.ref, 256);
+  const sourceDigest =
+    normalizeSha256(sourceMetadata.resolvedSourceDigest) ||
+    (source ? sha256Canonical({ source, ref }) : null);
   const expectations = sourceMetadata.catalogAuthority?.artifactExpectations;
   const manifestSha256 = normalizeSha256(expectations?.manifest?.sha256);
   let payloadSchemaVersion = cleanString(expectations?.sbom?.format, 128);
@@ -57,6 +60,7 @@ export function marketplaceSourceCacheSpec(
   }
   if (
     !source ||
+    !sourceDigest ||
     !manifestSha256 ||
     !payloadSha256 ||
     !isMarketplacePayloadSbomFormat(payloadSchemaVersion)
@@ -66,6 +70,7 @@ export function marketplaceSourceCacheSpec(
   const keyAuthority = {
     schemaVersion: PLUGIN_MARKETPLACE_SOURCE_CACHE_SCHEMA,
     source,
+    sourceDigest,
     ref,
     manifestSha256,
     payload: {
@@ -180,6 +185,7 @@ function buildCacheAuthority(payload, spec) {
     schemaVersion: PLUGIN_MARKETPLACE_SOURCE_CACHE_SCHEMA,
     cacheKey: spec.cacheKey,
     source: spec.source,
+    sourceDigest: spec.sourceDigest,
     ref: spec.ref,
     manifestSha256,
     payload: {
@@ -279,7 +285,11 @@ function readAuthority(file) {
     } catch {
       throw new Error("Marketplace source cache authority is not valid UTF-8");
     }
-    return JSON.parse(text);
+    try {
+      return JSON.parse(text);
+    } catch {
+      throw new Error("Marketplace source cache authority is invalid JSON");
+    }
   } finally {
     if (descriptor != null) fs.closeSync(descriptor);
   }