corporateai 0.0.1

package/server/src/services/run-log-store.ts

@@ -0,0 +1,156 @@
+import { createReadStream, promises as fs } from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { notFound } from "../errors.js";
+import { resolvePaperclipInstanceRoot } from "../home-paths.js";
+
+export type RunLogStoreType = "local_file";
+
+export interface RunLogHandle {
+  store: RunLogStoreType;
+  logRef: string;
+}
+
+export interface RunLogReadOptions {
+  offset?: number;
+  limitBytes?: number;
+}
+
+export interface RunLogReadResult {
+  content: string;
+  nextOffset?: number;
+}
+
+export interface RunLogFinalizeSummary {
+  bytes: number;
+  sha256?: string;
+  compressed: boolean;
+}
+
+export interface RunLogStore {
+  begin(input: { companyId: string; agentId: string; runId: string }): Promise<RunLogHandle>;
+  append(
+    handle: RunLogHandle,
+    event: { stream: "stdout" | "stderr" | "system"; chunk: string; ts: string },
+  ): Promise<void>;
+  finalize(handle: RunLogHandle): Promise<RunLogFinalizeSummary>;
+  read(handle: RunLogHandle, opts?: RunLogReadOptions): Promise<RunLogReadResult>;
+}
+
+function safeSegments(...segments: string[]) {
+  return segments.map((segment) => segment.replace(/[^a-zA-Z0-9._-]/g, "_"));
+}
+
+function resolveWithin(basePath: string, relativePath: string) {
+  const resolved = path.resolve(basePath, relativePath);
+  const base = path.resolve(basePath) + path.sep;
+  if (!resolved.startsWith(base) && resolved !== path.resolve(basePath)) {
+    throw new Error("Invalid log path");
+  }
+  return resolved;
+}
+
+function createLocalFileRunLogStore(basePath: string): RunLogStore {
+  async function ensureDir(relativeDir: string) {
+    const dir = resolveWithin(basePath, relativeDir);
+    await fs.mkdir(dir, { recursive: true });
+  }
+
+  async function readFileRange(filePath: string, offset: number, limitBytes: number): Promise<RunLogReadResult> {
+    const stat = await fs.stat(filePath).catch(() => null);
+    if (!stat) throw notFound("Run log not found");
+
+    const start = Math.max(0, Math.min(offset, stat.size));
+    const end = Math.max(start, Math.min(start + limitBytes - 1, stat.size - 1));
+
+    if (start > end) {
+      return { content: "", nextOffset: start };
+    }
+
+    const chunks: Buffer[] = [];
+    await new Promise<void>((resolve, reject) => {
+      const stream = createReadStream(filePath, { start, end });
+      stream.on("data", (chunk) => {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      });
+      stream.on("error", reject);
+      stream.on("end", () => resolve());
+    });
+
+    const content = Buffer.concat(chunks).toString("utf8");
+    const nextOffset = end + 1 < stat.size ? end + 1 : undefined;
+    return { content, nextOffset };
+  }
+
+  async function sha256File(filePath: string): Promise<string> {
+    return new Promise<string>((resolve, reject) => {
+      const hash = createHash("sha256");
+      const stream = createReadStream(filePath);
+      stream.on("data", (chunk) => hash.update(chunk));
+      stream.on("error", reject);
+      stream.on("end", () => resolve(hash.digest("hex")));
+    });
+  }
+
+  return {
+    async begin(input) {
+      const [companyId, agentId] = safeSegments(input.companyId, input.agentId);
+      const runId = safeSegments(input.runId)[0]!;
+      const relDir = path.join(companyId, agentId);
+      const relPath = path.join(relDir, `${runId}.ndjson`);
+      await ensureDir(relDir);
+
+      const absPath = resolveWithin(basePath, relPath);
+      await fs.writeFile(absPath, "", "utf8");
+
+      return { store: "local_file", logRef: relPath };
+    },
+
+    async append(handle, event) {
+      if (handle.store !== "local_file") return;
+      const absPath = resolveWithin(basePath, handle.logRef);
+      const line = JSON.stringify({
+        ts: event.ts,
+        stream: event.stream,
+        chunk: event.chunk,
+      });
+      await fs.appendFile(absPath, `${line}\n`, "utf8");
+    },
+
+    async finalize(handle) {
+      if (handle.store !== "local_file") {
+        return { bytes: 0, compressed: false };
+      }
+      const absPath = resolveWithin(basePath, handle.logRef);
+      const stat = await fs.stat(absPath).catch(() => null);
+      if (!stat) throw notFound("Run log not found");
+
+      const hash = await sha256File(absPath);
+      return {
+        bytes: stat.size,
+        sha256: hash,
+        compressed: false,
+      };
+    },
+
+    async read(handle, opts) {
+      if (handle.store !== "local_file") {
+        throw notFound("Run log not found");
+      }
+      const absPath = resolveWithin(basePath, handle.logRef);
+      const offset = opts?.offset ?? 0;
+      const limitBytes = opts?.limitBytes ?? 256_000;
+      return readFileRange(absPath, offset, limitBytes);
+    },
+  };
+}
+
+let cachedStore: RunLogStore | null = null;
+
+export function getRunLogStore() {
+  if (cachedStore) return cachedStore;
+  const basePath = process.env.RUN_LOG_BASE_PATH ?? path.resolve(resolvePaperclipInstanceRoot(), "data", "run-logs");
+  cachedStore = createLocalFileRunLogStore(basePath);
+  return cachedStore;
+}
+

package/server/src/services/secrets.ts

@@ -0,0 +1,370 @@
+import { and, desc, eq } from "drizzle-orm";
+import type { Db } from "@corporateai/db";
+import { companySecrets, companySecretVersions } from "@corporateai/db";
+import type { AgentEnvConfig, EnvBinding, SecretProvider } from "@corporateai/shared";
+import { envBindingSchema } from "@corporateai/shared";
+import { conflict, notFound, unprocessable } from "../errors.js";
+import { getSecretProvider, listSecretProviders } from "../secrets/provider-registry.js";
+
+const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SENSITIVE_ENV_KEY_RE =
+  /(api[-_]?key|access[-_]?token|auth(?:_?token)?|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)/i;
+const REDACTED_SENTINEL = "***REDACTED***";
+
+type CanonicalEnvBinding =
+  | { type: "plain"; value: string }
+  | { type: "secret_ref"; secretId: string; version: number | "latest" };
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
+function isSensitiveEnvKey(key: string) {
+  return SENSITIVE_ENV_KEY_RE.test(key);
+}
+
+function canonicalizeBinding(binding: EnvBinding): CanonicalEnvBinding {
+  if (typeof binding === "string") {
+    return { type: "plain", value: binding };
+  }
+  if (binding.type === "plain") {
+    return { type: "plain", value: String(binding.value) };
+  }
+  return {
+    type: "secret_ref",
+    secretId: binding.secretId,
+    version: binding.version ?? "latest",
+  };
+}
+
+export function secretService(db: Db) {
+  async function getById(id: string) {
+    return db
+      .select()
+      .from(companySecrets)
+      .where(eq(companySecrets.id, id))
+      .then((rows) => rows[0] ?? null);
+  }
+
+  async function getByName(companyId: string, name: string) {
+    return db
+      .select()
+      .from(companySecrets)
+      .where(and(eq(companySecrets.companyId, companyId), eq(companySecrets.name, name)))
+      .then((rows) => rows[0] ?? null);
+  }
+
+  async function getSecretVersion(secretId: string, version: number) {
+    return db
+      .select()
+      .from(companySecretVersions)
+      .where(
+        and(
+          eq(companySecretVersions.secretId, secretId),
+          eq(companySecretVersions.version, version),
+        ),
+      )
+      .then((rows) => rows[0] ?? null);
+  }
+
+  async function assertSecretInCompany(companyId: string, secretId: string) {
+    const secret = await getById(secretId);
+    if (!secret) throw notFound("Secret not found");
+    if (secret.companyId !== companyId) throw unprocessable("Secret must belong to same company");
+    return secret;
+  }
+
+  async function resolveSecretValue(
+    companyId: string,
+    secretId: string,
+    version: number | "latest",
+  ): Promise<string> {
+    const secret = await assertSecretInCompany(companyId, secretId);
+    const resolvedVersion = version === "latest" ? secret.latestVersion : version;
+    const versionRow = await getSecretVersion(secret.id, resolvedVersion);
+    if (!versionRow) throw notFound("Secret version not found");
+    const provider = getSecretProvider(secret.provider as SecretProvider);
+    return provider.resolveVersion({
+      material: versionRow.material as Record<string, unknown>,
+      externalRef: secret.externalRef,
+    });
+  }
+
+  async function normalizeEnvConfig(
+    companyId: string,
+    envValue: unknown,
+    opts?: { strictMode?: boolean },
+  ): Promise<AgentEnvConfig> {
+    const record = asRecord(envValue);
+    if (!record) throw unprocessable("adapterConfig.env must be an object");
+
+    const normalized: AgentEnvConfig = {};
+    for (const [key, rawBinding] of Object.entries(record)) {
+      if (!ENV_KEY_RE.test(key)) {
+        throw unprocessable(`Invalid environment variable name: ${key}`);
+      }
+
+      const parsed = envBindingSchema.safeParse(rawBinding);
+      if (!parsed.success) {
+        throw unprocessable(`Invalid environment binding for key: ${key}`);
+      }
+
+      const binding = canonicalizeBinding(parsed.data as EnvBinding);
+      if (binding.type === "plain") {
+        if (opts?.strictMode && isSensitiveEnvKey(key) && binding.value.trim().length > 0) {
+          throw unprocessable(
+            `Strict secret mode requires secret references for sensitive key: ${key}`,
+          );
+        }
+        if (binding.value === REDACTED_SENTINEL) {
+          throw unprocessable(`Refusing to persist redacted placeholder for key: ${key}`);
+        }
+        normalized[key] = binding;
+        continue;
+      }
+
+      await assertSecretInCompany(companyId, binding.secretId);
+      normalized[key] = {
+        type: "secret_ref",
+        secretId: binding.secretId,
+        version: binding.version,
+      };
+    }
+    return normalized;
+  }
+
+  async function normalizeAdapterConfigForPersistenceInternal(
+    companyId: string,
+    adapterConfig: Record<string, unknown>,
+    opts?: { strictMode?: boolean },
+  ) {
+    const normalized = { ...adapterConfig };
+    if (!Object.prototype.hasOwnProperty.call(adapterConfig, "env")) {
+      return normalized;
+    }
+    normalized.env = await normalizeEnvConfig(companyId, adapterConfig.env, opts);
+    return normalized;
+  }
+
+  return {
+    listProviders: () => listSecretProviders(),
+
+    list: (companyId: string) =>
+      db
+        .select()
+        .from(companySecrets)
+        .where(eq(companySecrets.companyId, companyId))
+        .orderBy(desc(companySecrets.createdAt)),
+
+    getById,
+    getByName,
+    resolveSecretValue,
+
+    create: async (
+      companyId: string,
+      input: {
+        name: string;
+        provider: SecretProvider;
+        value: string;
+        description?: string | null;
+        externalRef?: string | null;
+      },
+      actor?: { userId?: string | null; agentId?: string | null },
+    ) => {
+      const existing = await getByName(companyId, input.name);
+      if (existing) throw conflict(`Secret already exists: ${input.name}`);
+
+      const provider = getSecretProvider(input.provider);
+      const prepared = await provider.createVersion({
+        value: input.value,
+        externalRef: input.externalRef ?? null,
+      });
+
+      return db.transaction(async (tx) => {
+        const secret = await tx
+          .insert(companySecrets)
+          .values({
+            companyId,
+            name: input.name,
+            provider: input.provider,
+            externalRef: prepared.externalRef,
+            latestVersion: 1,
+            description: input.description ?? null,
+            createdByAgentId: actor?.agentId ?? null,
+            createdByUserId: actor?.userId ?? null,
+          })
+          .returning()
+          .then((rows) => rows[0]);
+
+        await tx.insert(companySecretVersions).values({
+          secretId: secret.id,
+          version: 1,
+          material: prepared.material,
+          valueSha256: prepared.valueSha256,
+          createdByAgentId: actor?.agentId ?? null,
+          createdByUserId: actor?.userId ?? null,
+        });
+
+        return secret;
+      });
+    },
+
+    rotate: async (
+      secretId: string,
+      input: { value: string; externalRef?: string | null },
+      actor?: { userId?: string | null; agentId?: string | null },
+    ) => {
+      const secret = await getById(secretId);
+      if (!secret) throw notFound("Secret not found");
+      const provider = getSecretProvider(secret.provider as SecretProvider);
+      const nextVersion = secret.latestVersion + 1;
+      const prepared = await provider.createVersion({
+        value: input.value,
+        externalRef: input.externalRef ?? secret.externalRef ?? null,
+      });
+
+      return db.transaction(async (tx) => {
+        await tx.insert(companySecretVersions).values({
+          secretId: secret.id,
+          version: nextVersion,
+          material: prepared.material,
+          valueSha256: prepared.valueSha256,
+          createdByAgentId: actor?.agentId ?? null,
+          createdByUserId: actor?.userId ?? null,
+        });
+
+        const updated = await tx
+          .update(companySecrets)
+          .set({
+            latestVersion: nextVersion,
+            externalRef: prepared.externalRef,
+            updatedAt: new Date(),
+          })
+          .where(eq(companySecrets.id, secret.id))
+          .returning()
+          .then((rows) => rows[0] ?? null);
+
+        if (!updated) throw notFound("Secret not found");
+        return updated;
+      });
+    },
+
+    update: async (
+      secretId: string,
+      patch: { name?: string; description?: string | null; externalRef?: string | null },
+    ) => {
+      const secret = await getById(secretId);
+      if (!secret) throw notFound("Secret not found");
+
+      if (patch.name && patch.name !== secret.name) {
+        const duplicate = await getByName(secret.companyId, patch.name);
+        if (duplicate && duplicate.id !== secret.id) {
+          throw conflict(`Secret already exists: ${patch.name}`);
+        }
+      }
+
+      return db
+        .update(companySecrets)
+        .set({
+          name: patch.name ?? secret.name,
+          description:
+            patch.description === undefined ? secret.description : patch.description,
+          externalRef:
+            patch.externalRef === undefined ? secret.externalRef : patch.externalRef,
+          updatedAt: new Date(),
+        })
+        .where(eq(companySecrets.id, secret.id))
+        .returning()
+        .then((rows) => rows[0] ?? null);
+    },
+
+    remove: async (secretId: string) => {
+      const secret = await getById(secretId);
+      if (!secret) return null;
+      await db.delete(companySecrets).where(eq(companySecrets.id, secretId));
+      return secret;
+    },
+
+    normalizeAdapterConfigForPersistence: async (
+      companyId: string,
+      adapterConfig: Record<string, unknown>,
+      opts?: { strictMode?: boolean },
+    ) => normalizeAdapterConfigForPersistenceInternal(companyId, adapterConfig, opts),
+
+    normalizeHireApprovalPayloadForPersistence: async (
+      companyId: string,
+      payload: Record<string, unknown>,
+      opts?: { strictMode?: boolean },
+    ) => {
+      const normalized = { ...payload };
+      const adapterConfig = asRecord(payload.adapterConfig);
+      if (adapterConfig) {
+        normalized.adapterConfig = await normalizeAdapterConfigForPersistenceInternal(
+          companyId,
+          adapterConfig,
+          opts,
+        );
+      }
+      return normalized;
+    },
+
+    resolveEnvBindings: async (companyId: string, envValue: unknown): Promise<{ env: Record<string, string>; secretKeys: Set<string> }> => {
+      const record = asRecord(envValue);
+      if (!record) return { env: {} as Record<string, string>, secretKeys: new Set<string>() };
+      const resolved: Record<string, string> = {};
+      const secretKeys = new Set<string>();
+
+      for (const [key, rawBinding] of Object.entries(record)) {
+        if (!ENV_KEY_RE.test(key)) {
+          throw unprocessable(`Invalid environment variable name: ${key}`);
+        }
+        const parsed = envBindingSchema.safeParse(rawBinding);
+        if (!parsed.success) {
+          throw unprocessable(`Invalid environment binding for key: ${key}`);
+        }
+        const binding = canonicalizeBinding(parsed.data as EnvBinding);
+        if (binding.type === "plain") {
+          resolved[key] = binding.value;
+        } else {
+          resolved[key] = await resolveSecretValue(companyId, binding.secretId, binding.version);
+          secretKeys.add(key);
+        }
+      }
+      return { env: resolved, secretKeys };
+    },
+
+    resolveAdapterConfigForRuntime: async (companyId: string, adapterConfig: Record<string, unknown>): Promise<{ config: Record<string, unknown>; secretKeys: Set<string> }> => {
+      const resolved = { ...adapterConfig };
+      const secretKeys = new Set<string>();
+      if (!Object.prototype.hasOwnProperty.call(adapterConfig, "env")) {
+        return { config: resolved, secretKeys };
+      }
+      const record = asRecord(adapterConfig.env);
+      if (!record) {
+        resolved.env = {};
+        return { config: resolved, secretKeys };
+      }
+      const env: Record<string, string> = {};
+      for (const [key, rawBinding] of Object.entries(record)) {
+        if (!ENV_KEY_RE.test(key)) {
+          throw unprocessable(`Invalid environment variable name: ${key}`);
+        }
+        const parsed = envBindingSchema.safeParse(rawBinding);
+        if (!parsed.success) {
+          throw unprocessable(`Invalid environment binding for key: ${key}`);
+        }
+        const binding = canonicalizeBinding(parsed.data as EnvBinding);
+        if (binding.type === "plain") {
+          env[key] = binding.value;
+        } else {
+          env[key] = await resolveSecretValue(companyId, binding.secretId, binding.version);
+          secretKeys.add(key);
+        }
+      }
+      resolved.env = env;
+      return { config: resolved, secretKeys };
+    },
+  };
+}
+

package/server/src/services/sidebar-badges.ts

@@ -0,0 +1,56 @@
+import { and, desc, eq, inArray, not, sql } from "drizzle-orm";
+import type { Db } from "@corporateai/db";
+import { agents, approvals, heartbeatRuns } from "@corporateai/db";
+import type { SidebarBadges } from "@corporateai/shared";
+
+const ACTIONABLE_APPROVAL_STATUSES = ["pending", "revision_requested"];
+const FAILED_HEARTBEAT_STATUSES = ["failed", "timed_out"];
+
+export function sidebarBadgeService(db: Db) {
+  return {
+    get: async (
+      companyId: string,
+      extra?: { joinRequests?: number; unreadTouchedIssues?: number },
+    ): Promise<SidebarBadges> => {
+      const actionableApprovals = await db
+        .select({ count: sql<number>`count(*)` })
+        .from(approvals)
+        .where(
+          and(
+            eq(approvals.companyId, companyId),
+            inArray(approvals.status, ACTIONABLE_APPROVAL_STATUSES),
+          ),
+        )
+        .then((rows) => Number(rows[0]?.count ?? 0));
+
+      const latestRunByAgent = await db
+        .selectDistinctOn([heartbeatRuns.agentId], {
+          runStatus: heartbeatRuns.status,
+        })
+        .from(heartbeatRuns)
+        .innerJoin(agents, eq(heartbeatRuns.agentId, agents.id))
+        .where(
+          and(
+            eq(heartbeatRuns.companyId, companyId),
+            eq(agents.companyId, companyId),
+            not(eq(agents.status, "terminated")),
+          ),
+        )
+        .orderBy(heartbeatRuns.agentId, desc(heartbeatRuns.createdAt));
+
+      const failedRuns = latestRunByAgent.filter((row) =>
+        FAILED_HEARTBEAT_STATUSES.includes(row.runStatus),
+      ).length;
+
+      const joinRequests = extra?.joinRequests ?? 0;
+      const unreadTouchedIssues = extra?.unreadTouchedIssues ?? 0;
+      return {
+        inbox: actionableApprovals + failedRuns + joinRequests + unreadTouchedIssues,
+        approvals: actionableApprovals,
+        failedRuns,
+        joinRequests,
+      };
+    },
+  };
+}
+

package/server/src/services/work-products.ts

@@ -0,0 +1,124 @@
+import { and, desc, eq } from "drizzle-orm";
+import type { Db } from "@corporateai/db";
+import { issueWorkProducts } from "@corporateai/db";
+import type { IssueWorkProduct } from "@corporateai/shared";
+
+type IssueWorkProductRow = typeof issueWorkProducts.$inferSelect;
+
+function toIssueWorkProduct(row: IssueWorkProductRow): IssueWorkProduct {
+  return {
+    id: row.id,
+    companyId: row.companyId,
+    projectId: row.projectId ?? null,
+    issueId: row.issueId,
+    executionWorkspaceId: row.executionWorkspaceId ?? null,
+    runtimeServiceId: row.runtimeServiceId ?? null,
+    type: row.type as IssueWorkProduct["type"],
+    provider: row.provider,
+    externalId: row.externalId ?? null,
+    title: row.title,
+    url: row.url ?? null,
+    status: row.status,
+    reviewState: row.reviewState as IssueWorkProduct["reviewState"],
+    isPrimary: row.isPrimary,
+    healthStatus: row.healthStatus as IssueWorkProduct["healthStatus"],
+    summary: row.summary ?? null,
+    metadata: (row.metadata as Record<string, unknown> | null) ?? null,
+    createdByRunId: row.createdByRunId ?? null,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+export function workProductService(db: Db) {
+  return {
+    listForIssue: async (issueId: string) => {
+      const rows = await db
+        .select()
+        .from(issueWorkProducts)
+        .where(eq(issueWorkProducts.issueId, issueId))
+        .orderBy(desc(issueWorkProducts.isPrimary), desc(issueWorkProducts.updatedAt));
+      return rows.map(toIssueWorkProduct);
+    },
+
+    getById: async (id: string) => {
+      const row = await db
+        .select()
+        .from(issueWorkProducts)
+        .where(eq(issueWorkProducts.id, id))
+        .then((rows) => rows[0] ?? null);
+      return row ? toIssueWorkProduct(row) : null;
+    },
+
+    createForIssue: async (issueId: string, companyId: string, data: Omit<typeof issueWorkProducts.$inferInsert, "issueId" | "companyId">) => {
+      const row = await db.transaction(async (tx) => {
+        if (data.isPrimary) {
+          await tx
+            .update(issueWorkProducts)
+            .set({ isPrimary: false, updatedAt: new Date() })
+            .where(
+              and(
+                eq(issueWorkProducts.companyId, companyId),
+                eq(issueWorkProducts.issueId, issueId),
+                eq(issueWorkProducts.type, data.type),
+              ),
+            );
+        }
+        return await tx
+          .insert(issueWorkProducts)
+          .values({
+            ...data,
+            companyId,
+            issueId,
+          })
+          .returning()
+          .then((rows) => rows[0] ?? null);
+      });
+      return row ? toIssueWorkProduct(row) : null;
+    },
+
+    update: async (id: string, patch: Partial<typeof issueWorkProducts.$inferInsert>) => {
+      const row = await db.transaction(async (tx) => {
+        const existing = await tx
+          .select()
+          .from(issueWorkProducts)
+          .where(eq(issueWorkProducts.id, id))
+          .then((rows) => rows[0] ?? null);
+        if (!existing) return null;
+
+        if (patch.isPrimary === true) {
+          await tx
+            .update(issueWorkProducts)
+            .set({ isPrimary: false, updatedAt: new Date() })
+            .where(
+              and(
+                eq(issueWorkProducts.companyId, existing.companyId),
+                eq(issueWorkProducts.issueId, existing.issueId),
+                eq(issueWorkProducts.type, existing.type),
+              ),
+            );
+        }
+
+        return await tx
+          .update(issueWorkProducts)
+          .set({ ...patch, updatedAt: new Date() })
+          .where(eq(issueWorkProducts.id, id))
+          .returning()
+          .then((rows) => rows[0] ?? null);
+      });
+      return row ? toIssueWorkProduct(row) : null;
+    },
+
+    remove: async (id: string) => {
+      const row = await db
+        .delete(issueWorkProducts)
+        .where(eq(issueWorkProducts.id, id))
+        .returning()
+        .then((rows) => rows[0] ?? null);
+      return row ? toIssueWorkProduct(row) : null;
+    },
+  };
+}
+
+export { toIssueWorkProduct };
+