clearhand 0.1.0

package/dist/server/secrets/redaction.js

@@ -0,0 +1,62 @@
+/**
+ * Defense-in-depth: no route or MCP tool is supposed to return a credential,
+ * but if a bug ever leaks one, this middleware turns the leak into a visible
+ * non-event. It scrubs:
+ *
+ * 1. any secret value that has actually been decrypted in this process
+ *    (SecretStore.redactableValues), and
+ * 2. generic secret-shaped tokens (Stripe keys, GitHub tokens, app passwords
+ *    in obvious key=value shapes), whether or not ClearHand stored them.
+ */
+const PATTERN_REDACTIONS = [
+    { name: 'stripe_secret_key', re: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{8,}\b/g },
+    { name: 'stripe_webhook_secret', re: /\bwhsec_[A-Za-z0-9]{8,}\b/g },
+    { name: 'github_token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g },
+    { name: 'bearer_token', re: /\b(Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/-]{12,}=*/gi },
+];
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function redactText(body, store) {
+    let out = body;
+    for (const [key, value] of store.redactableValues()) {
+        if (value.length < 6)
+            continue; // too short to scrub without mangling text
+        out = out.replaceAll(value, `[REDACTED:${key}]`);
+        // JSON-encoded occurrences (e.g. value embedded inside a serialized string)
+        const jsonEncoded = JSON.stringify(value).slice(1, -1);
+        if (jsonEncoded !== value) {
+            out = out.replaceAll(jsonEncoded, `[REDACTED:${key}]`);
+        }
+    }
+    for (const { name, re } of PATTERN_REDACTIONS) {
+        out = out.replace(re, (m, prefix) => typeof prefix === 'string' ? `${prefix}[REDACTED:${name}]` : `[REDACTED:${name}]`);
+    }
+    return out;
+}
+/**
+ * Express middleware. Buffers JSON/text responses and scrubs them before they
+ * leave the server. Static assets and streams pass through untouched.
+ */
+export function redactionMiddleware(store) {
+    return (_req, res, next) => {
+        const originalJson = res.json.bind(res);
+        const originalSend = res.send.bind(res);
+        res.json = (payload) => {
+            const scrubbed = JSON.parse(redactText(JSON.stringify(payload), store));
+            return originalJson(scrubbed);
+        };
+        res.send = (payload) => {
+            if (typeof payload === 'string')
+                return originalSend(redactText(payload, store));
+            if (Buffer.isBuffer(payload)) {
+                const type = res.getHeader('content-type');
+                if (typeof type === 'string' && /json|text/i.test(type)) {
+                    return originalSend(redactText(payload.toString('utf8'), store));
+                }
+            }
+            return originalSend(payload);
+        };
+        next();
+    };
+}

package/dist/server/secrets/store.js

@@ -0,0 +1,238 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { userHome, ensureDir } from '../../shared/paths.js';
+const KEYRING_SERVICE = 'clearhand';
+class KeychainBackend {
+    name = 'keychain';
+    // Loaded lazily so environments without the native module can still run
+    // with other backends.
+    EntryCtor;
+    constructor(entryCtor) {
+        this.EntryCtor = entryCtor;
+    }
+    get(key) {
+        try {
+            return new this.EntryCtor(KEYRING_SERVICE, key).getPassword();
+        }
+        catch {
+            return null;
+        }
+    }
+    set(key, value) {
+        new this.EntryCtor(KEYRING_SERVICE, key).setPassword(value);
+    }
+    delete(key) {
+        try {
+            new this.EntryCtor(KEYRING_SERVICE, key).deletePassword();
+        }
+        catch {
+            // deleting a missing entry is fine
+        }
+    }
+}
+class EncryptedFileBackend {
+    name = 'encrypted-file';
+    file;
+    masterKey;
+    constructor(masterKey) {
+        this.file = path.join(ensureDir(userHome(), 0o700), 'credentials.enc');
+        this.masterKey = masterKey;
+    }
+    load() {
+        try {
+            return JSON.parse(fs.readFileSync(this.file, 'utf8'));
+        }
+        catch {
+            const salt = crypto.randomBytes(16).toString('base64');
+            return { version: 1, kdf: { algo: 'scrypt', salt, N: 16384, r: 8, p: 1 }, entries: {} };
+        }
+    }
+    save(shape) {
+        fs.writeFileSync(this.file, JSON.stringify(shape, null, 2), { mode: 0o600 });
+    }
+    deriveKey(shape) {
+        const { salt, N, r, p } = shape.kdf;
+        return crypto.scryptSync(this.masterKey, Buffer.from(salt, 'base64'), 32, { N, r, p });
+    }
+    get(key) {
+        const shape = this.load();
+        const entry = shape.entries[key];
+        if (!entry)
+            return null;
+        const k = this.deriveKey(shape);
+        const decipher = crypto.createDecipheriv('aes-256-gcm', k, Buffer.from(entry.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(entry.tag, 'base64'));
+        const out = Buffer.concat([decipher.update(Buffer.from(entry.data, 'base64')), decipher.final()]);
+        return out.toString('utf8');
+    }
+    set(key, value) {
+        const shape = this.load();
+        const k = this.deriveKey(shape);
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv('aes-256-gcm', k, iv);
+        const data = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
+        shape.entries[key] = {
+            iv: iv.toString('base64'),
+            tag: cipher.getAuthTag().toString('base64'),
+            data: data.toString('base64'),
+        };
+        this.save(shape);
+    }
+    delete(key) {
+        const shape = this.load();
+        delete shape.entries[key];
+        this.save(shape);
+    }
+}
+class PlainFileBackend {
+    name = 'plain';
+    file;
+    constructor() {
+        this.file = path.join(ensureDir(userHome(), 0o700), 'credentials.json');
+    }
+    load() {
+        try {
+            return JSON.parse(fs.readFileSync(this.file, 'utf8'));
+        }
+        catch {
+            return {};
+        }
+    }
+    get(key) {
+        return this.load()[key] ?? null;
+    }
+    set(key, value) {
+        const all = this.load();
+        all[key] = value;
+        fs.writeFileSync(this.file, JSON.stringify(all, null, 2), { mode: 0o600 });
+    }
+    delete(key) {
+        const all = this.load();
+        delete all[key];
+        fs.writeFileSync(this.file, JSON.stringify(all, null, 2), { mode: 0o600 });
+    }
+}
+async function probeKeychain() {
+    try {
+        const mod = await import('@napi-rs/keyring');
+        const backend = new KeychainBackend(mod.Entry);
+        const probeKey = `__probe_${process.pid}`;
+        backend.set(probeKey, 'ok');
+        const ok = backend.get(probeKey) === 'ok';
+        backend.delete(probeKey);
+        return ok ? backend : null;
+    }
+    catch {
+        return null;
+    }
+}
+export class SecretStore {
+    backend;
+    metaFile;
+    onAccess;
+    /**
+     * Values decrypted during this process lifetime. Used by the redaction
+     * middleware: anything that has actually been in memory gets scrubbed from
+     * every outgoing response as defense-in-depth.
+     */
+    hotValues = new Map();
+    constructor(backend, onAccess) {
+        this.backend = backend;
+        this.metaFile = path.join(ensureDir(userHome(), 0o700), 'secrets-meta.json');
+        this.onAccess = onAccess;
+    }
+    static async create(opts) {
+        const masterKey = process.env.CLEARHAND_MASTER_KEY;
+        let backend = null;
+        if (opts.storage === 'keychain' || opts.storage === 'auto') {
+            backend = await probeKeychain();
+            if (!backend && opts.storage === 'keychain') {
+                throw new Error('Keychain storage requested but no OS keychain is available.');
+            }
+        }
+        if (!backend && (opts.storage === 'encrypted-file' || opts.storage === 'auto')) {
+            if (masterKey)
+                backend = new EncryptedFileBackend(masterKey);
+            else if (opts.storage === 'encrypted-file') {
+                throw new Error('encrypted-file storage requires CLEARHAND_MASTER_KEY to be set.');
+            }
+        }
+        if (!backend && opts.storage === 'plain') {
+            backend = new PlainFileBackend();
+        }
+        if (!backend) {
+            throw new Error('No secure secret storage available. Options: run on a machine with an OS keychain, ' +
+                'set CLEARHAND_MASTER_KEY for encrypted-file storage, or explicitly opt in to plaintext ' +
+                'with `clearhand init --storage plain` (not recommended).');
+        }
+        return new SecretStore(backend, opts.onAccess);
+    }
+    get backendName() {
+        return this.backend.name;
+    }
+    loadMeta() {
+        try {
+            return JSON.parse(fs.readFileSync(this.metaFile, 'utf8'));
+        }
+        catch {
+            return {};
+        }
+    }
+    saveMeta(meta) {
+        fs.writeFileSync(this.metaFile, JSON.stringify(meta, null, 2), { mode: 0o600 });
+    }
+    set(key, value) {
+        this.backend.set(key, value);
+        const meta = this.loadMeta();
+        const now = new Date().toISOString();
+        const entry = {
+            key,
+            backend: this.backend.name,
+            hint: value.length > 4 ? `…${value.slice(-4)}` : '…',
+            createdAt: meta[key]?.createdAt ?? now,
+            updatedAt: now,
+        };
+        meta[key] = entry;
+        this.saveMeta(meta);
+        // A set implies the value transited memory; make it redactable immediately.
+        this.hotValues.set(key, value);
+        return entry;
+    }
+    /**
+     * Just-in-time access. The ONLY way to read a secret value. Callers must
+     * state a purpose; every call is reported to the access log.
+     */
+    use(key, purpose, ref) {
+        const value = this.backend.get(key);
+        if (value === null)
+            throw new Error(`Secret not configured: ${key}`);
+        this.onAccess?.({
+            key,
+            purpose,
+            ref,
+            backend: this.backend.name,
+            at: new Date().toISOString(),
+        });
+        this.hotValues.set(key, value);
+        return value;
+    }
+    has(key) {
+        return this.loadMeta()[key] !== undefined;
+    }
+    delete(key) {
+        this.backend.delete(key);
+        const meta = this.loadMeta();
+        delete meta[key];
+        this.saveMeta(meta);
+        this.hotValues.delete(key);
+    }
+    /** Metadata only — safe for status endpoints. Never returns values. */
+    list() {
+        return Object.values(this.loadMeta());
+    }
+    /** Secret values currently in process memory, for the redaction middleware. */
+    redactableValues() {
+        return this.hotValues;
+    }
+}

package/dist/server/services/approval.js

@@ -0,0 +1,206 @@
+import { audit, countPendingFinancialActions, now } from '../db/index.js';
+import { effectiveProposal, FINANCIAL_ACTION_TYPES, } from '../../shared/actions.js';
+import { lintAndNormalizeAction } from './lint.js';
+import { executeAction } from './executor.js';
+// One in-flight enrichment per case: concurrent approvals of the same case
+// share one run (a duplicate-run race saturated the single-threaded server
+// in the ancestor system).
+const inflightEnrich = new Map();
+/**
+ * Enrichment freshness — NOT time-based. Staleness = thinness: re-enrich when
+ * the prepared context has no Stripe customer data. Fails OPEN on hard
+ * failure (better an approval on slightly-stale data than a wedged queue),
+ * logged loudly.
+ */
+export async function ensureFreshEnrichmentForCase(ctx, caseId) {
+    if (!ctx.enrichCase)
+        return;
+    const row = ctx.db
+        .prepare(`SELECT prepared_context_json FROM cases WHERE id = ?`)
+        .get(caseId);
+    let thin = true;
+    if (row?.prepared_context_json) {
+        try {
+            const c = JSON.parse(row.prepared_context_json);
+            thin = !Array.isArray(c.stripe?.customers) || c.stripe.customers.length === 0;
+        }
+        catch {
+            thin = true;
+        }
+    }
+    if (!thin)
+        return;
+    let p = inflightEnrich.get(caseId);
+    if (!p) {
+        p = ctx.enrichCase(caseId).finally(() => inflightEnrich.delete(caseId));
+        inflightEnrich.set(caseId, p);
+    }
+    try {
+        await p;
+    }
+    catch (err) {
+        console.error(`[clearhand] freshness re-enrich FAILED for case ${caseId} — proceeding on possibly-stale data:`, err);
+    }
+}
+/**
+ * Lint-on-approve. Re-linting here (creation already linted) catches legacy
+ * proposals created before a rule existed — the last gate before money.
+ * Lint ERRORS fail closed; a lint EXCEPTION fails open (deliberate
+ * availability choice, logged loudly).
+ */
+export function lintAndApproveAction(db, actionId, modifiedParams, approvedBy = 'human') {
+    const action = db.prepare(`SELECT * FROM actions WHERE id = ?`).get(actionId);
+    if (!action)
+        return { ok: false, reason: 'not_found', errors: [`action ${actionId} not found`] };
+    if (!['proposed', 'approved', 'failed'].includes(action.status)) {
+        return {
+            ok: false,
+            reason: 'not_approvable',
+            errors: [`action ${actionId} is '${action.status}' — not approvable`],
+        };
+    }
+    const original = effectiveProposal(action);
+    const candidate = modifiedParams ?? original;
+    let normalized = candidate;
+    let warnings = [];
+    try {
+        const res = lintAndNormalizeAction(action.action_type, candidate);
+        if (res.errors.length > 0)
+            return { ok: false, reason: 'lint', errors: res.errors };
+        normalized = res.proposal;
+        warnings = res.warnings;
+    }
+    catch (err) {
+        console.error(`[clearhand] lint EXCEPTION on action ${actionId} — failing open:`, err);
+    }
+    const modifiedJson = JSON.stringify(normalized) !== action.proposal_json ? JSON.stringify(normalized) : null;
+    db.prepare(`UPDATE actions SET status = 'approved', approved_by = ?, approved_at = ?, modified_json = ?
+      WHERE id = ?`).run(approvedBy, now(), modifiedJson ?? action.modified_json, actionId);
+    if (modifiedParams) {
+        const diff = Object.keys({ ...original, ...modifiedParams })
+            .filter((k) => JSON.stringify(original[k]) !== JSON.stringify(modifiedParams[k]))
+            .map((k) => `${k}: ${JSON.stringify(original[k])} → ${JSON.stringify(modifiedParams[k])}`)
+            .join('; ');
+        db.prepare(`INSERT INTO feedback_events (case_id, action_id, event_type, original_json, modified_json, diff_summary, created_at)
+       VALUES (?, ?, 'action_modify', ?, ?, ?, ?)`).run(action.case_id, actionId, JSON.stringify(original), JSON.stringify(modifiedParams), diff, now());
+    }
+    audit(db, 'human', 'action_approved', { caseId: action.case_id, actionId, detail: { warnings } });
+    const updated = db.prepare(`SELECT * FROM actions WHERE id = ?`).get(actionId);
+    return { ok: true, action: updated, warnings };
+}
+export function rejectAction(db, actionId, reason) {
+    const action = db.prepare(`SELECT * FROM actions WHERE id = ?`).get(actionId);
+    if (!action)
+        return false;
+    db.prepare(`UPDATE actions SET status = 'rejected', error_message = ? WHERE id = ?`).run(reason ?? 'rejected by operator', actionId);
+    db.prepare(`INSERT INTO feedback_events (case_id, action_id, event_type, original_json, diff_summary, created_at)
+     VALUES (?, ?, 'action_reject', ?, ?, ?)`).run(action.case_id, actionId, action.proposal_json, reason ?? null, now());
+    audit(db, 'human', 'action_rejected', { caseId: action.case_id, actionId, detail: { reason } });
+    return true;
+}
+export function setCaseStatus(db, caseId, status) {
+    db.prepare(`UPDATE cases SET status = ?, updated_at = ? WHERE id = ?`).run(status, now(), caseId);
+}
+/**
+ * Batch approve + ordered execute.
+ *
+ * Phase 0: freshness (financial actions only).
+ * Phase 1: lint+approve every id; failures don't strand the rest.
+ * Phase 2: sort by execution_order ASC and execute STRICTLY SEQUENTIALLY so
+ *   refund/cancel run before send_reply/set_case_status on the same case.
+ *   `Promise.all` here would be a money bug, not an optimization: status
+ *   actions participate in the same sorted pass so the resolve-guard sees
+ *   the true post-execution state.
+ */
+export async function approveAndExecuteActions(ctx, caseId, actionIds, opts = {}) {
+    const { db } = ctx;
+    const rows = actionIds
+        .map((id) => db.prepare(`SELECT * FROM actions WHERE id = ?`).get(id))
+        .filter((a) => a !== undefined);
+    // Defense in depth: every id must belong to this case.
+    const foreign = rows.filter((a) => a.case_id !== caseId);
+    if (foreign.length > 0) {
+        return {
+            approvedIds: [],
+            lintFailures: foreign.map((a) => ({
+                actionId: a.id,
+                errors: [`action ${a.id} belongs to case ${a.case_id}, not ${caseId}`],
+            })),
+            results: [],
+        };
+    }
+    // Phase 0 — freshness, once per batch, only when money is involved.
+    if (rows.some((a) => FINANCIAL_ACTION_TYPES.has(a.action_type))) {
+        await ensureFreshEnrichmentForCase(ctx, caseId);
+    }
+    // Phase 1 — lint + approve.
+    const lintFailures = [];
+    const approved = [];
+    for (const row of rows) {
+        const outcome = lintAndApproveAction(db, row.id, opts.perActionParams?.[row.id], opts.approvedBy ?? 'human');
+        if (outcome.ok)
+            approved.push(outcome.action);
+        else
+            lintFailures.push({ actionId: row.id, errors: outcome.errors });
+    }
+    // Phase 2 — ordered, strictly sequential execution.
+    approved.sort((a, b) => a.execution_order - b.execution_order || a.id - b.id);
+    const results = [];
+    for (const action of approved) {
+        try {
+            if (action.action_type === 'escalate' || action.action_type === 'set_case_status') {
+                results.push({ actionId: action.id, ...runInlineStatusAction(db, action, opts.allowPendingFinancial) });
+                continue;
+            }
+            const res = await executeAction(ctx.executorDeps, action.id, { sendMode: opts.sendMode });
+            results.push({ actionId: action.id, ...res });
+        }
+        catch (err) {
+            // One failure must not strand the rest of the batch.
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`[clearhand] execution exception for action ${action.id}:`, err);
+            results.push({ actionId: action.id, success: false, message });
+        }
+    }
+    return { approvedIds: approved.map((a) => a.id), lintFailures, results };
+}
+/**
+ * escalate / set_case_status execute inline (never via the external executor)
+ * so they honor execution_order within the same sequential pass — and so the
+ * RESOLVE-GUARD evaluates after the money actions in the batch have run.
+ *
+ * The guard: a case must never be marked resolved while a refund/cancel is
+ * still owed (proposed, approved, executing, or FAILED — an approved-then-
+ * failed refund is still owed; see countPendingFinancialActions).
+ */
+function runInlineStatusAction(db, action, allowPendingFinancial) {
+    const proposal = effectiveProposal(action);
+    const targetStatus = action.action_type === 'escalate' ? 'escalated' : String(proposal.target_status ?? '');
+    if (!['resolved', 'pending', 'ignored', 'escalated'].includes(targetStatus)) {
+        const message = `invalid target_status "${targetStatus}"`;
+        db.prepare(`UPDATE actions SET status = 'failed', error_message = ? WHERE id = ?`).run(message, action.id);
+        return { success: false, message };
+    }
+    if (targetStatus === 'resolved' && !allowPendingFinancial) {
+        const pending = countPendingFinancialActions(db, action.case_id);
+        if (pending > 0) {
+            const message = `refusing to resolve case ${action.case_id}: ${pending} financial action(s) not yet executed. ` +
+                `Execute or reject them first (this guard exists because a case was once closed while its refund silently never ran).`;
+            db.prepare(`UPDATE actions SET status = 'failed', error_message = ? WHERE id = ?`).run(message, action.id);
+            audit(db, 'system', 'resolve_guard_blocked', {
+                caseId: action.case_id,
+                actionId: action.id,
+                detail: { pending_financial: pending },
+            });
+            return { success: false, message, details: { pending_financial: pending } };
+        }
+    }
+    db.prepare(`UPDATE actions SET status = 'executed', executed_at = ? WHERE id = ?`).run(now(), action.id);
+    setCaseStatus(db, action.case_id, targetStatus);
+    audit(db, 'system', 'case_status_changed', {
+        caseId: action.case_id,
+        actionId: action.id,
+        detail: { status: targetStatus, reason: proposal.reason },
+    });
+    return { success: true, message: `case status → ${targetStatus}`, details: { status: targetStatus } };
+}

package/dist/server/services/connections.js

@@ -0,0 +1,99 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { now } from '../db/index.js';
+import { projectDir } from '../../shared/paths.js';
+export function getConnection(db, id) {
+    return db.prepare(`SELECT * FROM connections WHERE id = ?`).get(id);
+}
+export function setConnection(db, id, status, config, error) {
+    db.prepare(`INSERT INTO connections (id, status, config, last_verified, last_error, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(id) DO UPDATE SET
+       status = excluded.status,
+       config = COALESCE(excluded.config, connections.config),
+       last_verified = excluded.last_verified,
+       last_error = excluded.last_error,
+       updated_at = excluded.updated_at`).run(id, status, config ? JSON.stringify(config) : null, status === 'connected' ? now() : null, error ?? null, now());
+}
+export function mailboxConfig(db) {
+    const row = getConnection(db, 'mailbox');
+    if (!row?.config || row.status !== 'connected')
+        return null;
+    try {
+        return JSON.parse(row.config);
+    }
+    catch {
+        return null;
+    }
+}
+export function githubConfig(db) {
+    const row = getConnection(db, 'github');
+    if (!row?.config || row.status !== 'connected')
+        return null;
+    try {
+        return JSON.parse(row.config);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The agent-facing capability map: metadata only, NEVER values. Also written
+ * to .clearhand/connections.json (server-owned manifest) so file-greppable
+ * agent docs stay truthful.
+ */
+export function connectionsStatus(db, secrets) {
+    const dashboard = 'http://localhost:' + (process.env.CLEARHAND_PORT ?? '3117');
+    const rows = Object.fromEntries(db.prepare(`SELECT * FROM connections`).all().map((r) => [r.id, r]));
+    const meta = Object.fromEntries(secrets.list().map((m) => [m.key, m]));
+    const shape = (id, secretKey, extra) => {
+        const row = rows[id];
+        const connected = row?.status === 'connected' && meta[secretKey] !== undefined;
+        let cfg = {};
+        try {
+            cfg = row?.config ? JSON.parse(row.config) : {};
+        }
+        catch {
+            // ignore malformed config
+        }
+        return connected
+            ? {
+                connected: true,
+                storage: meta[secretKey]?.backend,
+                secret_hint: meta[secretKey]?.hint,
+                last_verified: row?.last_verified,
+                last_used: row?.last_used,
+                health: row?.status === 'connected' ? 'ok' : row?.status,
+                ...extra(cfg),
+            }
+            : {
+                connected: false,
+                connect_url: `${dashboard}/connections#${id}`,
+                ...(row?.last_error ? { last_error: row.last_error } : {}),
+            };
+    };
+    return {
+        stripe: shape('stripe', 'stripe_api_key', (cfg) => ({
+            key_type: cfg.keyType ?? 'unknown',
+            account_hint: cfg.accountHint,
+        })),
+        mailbox: shape('mailbox', 'mailbox_password', (cfg) => ({
+            protocol: 'imap',
+            address: cfg.address,
+        })),
+        github: shape('github', 'github_token', (cfg) => ({ repo: cfg.repo })),
+    };
+}
+export function writeConnectionsManifest(db, secrets) {
+    const manifest = {
+        _note: 'Server-written metadata manifest. Contains NO secret values, ever.',
+        updated_at: now(),
+        connections: connectionsStatus(db, secrets),
+    };
+    try {
+        fs.writeFileSync(path.join(projectDir(), 'connections.json'), JSON.stringify(manifest, null, 2) + '\n');
+    }
+    catch {
+        // manifest is best-effort
+    }
+}