drupal-mcp-connector 2.9.0 → 2.10.1

package/CHANGELOG.md

@@ -7,6 +7,67 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.10.1] - 2026-08-28
+
+### Fixed
+- **Node reads include the numeric Drupal node ID (#237).** JSON:API-backed
+  `drupal_get_node` and `drupal_entity_get` results retain
+  `fields.drupal_internal__nid`, matching schema discovery while preserving
+  entity allowlists and configured field redaction. The canonical top-level
+  `id` remains the UUID.
+
+### Deprecated
+- **Loopback `shared_bearer` inbound auth (#231).** Startup warns when
+  `resolveInboundAuthMode` is `shared_bearer`, naming removal in v3.0.0.
+  Resource-server mode is silent. `npm run verify` lists the residual.
+  This is the deprecation half only; removal waits for the next major.
+
+## [2.10.0] - 2026-08-27
+
+### Security
+- **Lab fan-down strips caller credential headers (#229).** The
+  outbound-relay lab harness framed the northbound request's headers down
+  the tenant tunnel verbatim, including `Authorization` — invisible in the
+  lab (the stub is in-process and the lab northbound carries no bearer),
+  but the wrong pattern for anyone wiring the README's optional live hop.
+  `Authorization`, `Cookie`, and `Proxy-Authorization` are now stripped,
+  with hop-by-hop headers, before framing; a test asserts marker
+  credentials never appear in any frame crossing the tunnel. The lab
+  README now states plainly that the lab northbound does not authenticate
+  the caller (the lab credential authenticates the agent channel) — the
+  product edge's northbound OAuth is DEV-294 work, not this harness.
+
+### Added
+- **Deployment documentation for the relay edge and tenant-agent entry
+  points (#232).** `docs/deployment.md` gains the outbound-path section:
+  startup requirements, credential-header stripping, channel credentials,
+  and the issuer claim requirements.
+- **Relay edge and tenant-agent entry points (#232).** `drupal-mcp-edge`
+  terminates northbound MCP on the inbound OAuth resource server — the only
+  authentication arm on this entry point; a missing issuer/audience is fatal
+  at any bind host, including loopback — and fans requests down an outbound
+  tenant channel. The edge requires a non-empty `auth.grants` table and an
+  agent channel credential store to start, resolves the authoritative target
+  per request before fan-down, strips caller credential and
+  identity-assertion headers before framing (the frame carries the validated
+  identity object only), and holds no site credentials — a catalog entry
+  carrying credential material refuses startup. `drupal-mcp-agent` dials out
+  (it never listens), authenticates the channel with its own issued,
+  revocable credential, and serves the real connector tool surface, so site
+  credentials exist only in the tenant process. Northbound is stateless MCP
+  2026-07-28 with no session ids in either direction; revocation of both the
+  northbound principal and the agent channel is per-request with no grace
+  window. The frame codec lives at `src/lib/relay/frames.js` with hard size,
+  teardown, and timeout bounds. These are entry points and libraries only;
+  nothing here is a hosted service.
+- **Lab-only outbound-relay harness (DEV-293).** Isolated under
+  `lab/outbound-relay/` with tests in `tests/lab/`. A tenant agent dials out
+  to a loopback relay; one MCP 2026-07-28 Streamable-HTTP request (stateless,
+  no `Mcp-Session-Id`) reaches an in-process stub private Drupal; reconnect
+  keeps the same tunnel identity; revocation is checked per request (next
+  request denied, no grace window). This is not a public surface, not a
+  hosted-service claim, and not DEV-294. Hosted MCP is unstarted.
+
 ## [2.9.0] - 2026-08-26
 
 ### Fixed
@@ -1268,6 +1329,7 @@ The connector is now **dual-protocol**: every tool runs against an abstract back
 - User tools gained explicit PII-access assertions.
 - Whole tree lint-clean (`npm run lint`) with object-injection sinks rewritten to safe lookups.
 
+[2.10.1]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.10.1
 [1.0.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v1.0.0
 [0.10.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v0.10.0
 [0.9.1]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v0.9.1

package/bin/drupal-mcp-agent.js

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+/**
+ * drupal-mcp-agent — relay tenant agent entry point (#232).
+ *
+ * Dials OUT to the relay edge's agent channel and serves the real connector
+ * server (the full governed tool surface, dispatched through the same
+ * middleware as every other transport) over the framed tunnel. This process
+ * never listens: southbound site credentials exist only here, tenant-side.
+ * The channel is authenticated with the agent's own issued, revocable
+ * credential — never a northbound token, never a site credential.
+ *
+ * Environment variables:
+ *   MCP_EDGE_HOST         Relay edge host. Required.
+ *   MCP_EDGE_AGENT_PORT   Relay edge agent-channel port. Required.
+ *   MCP_CHANNEL_TOKEN     Issued channel credential (or MCP_CHANNEL_TOKEN_FILE).
+ *                         Required. The edge stores only its SHA-256 digest.
+ *   MCP_EDGE_ALLOW_TCP    "1" permits a plain TCP channel to loopback only
+ *                         (dev). The default channel is TLS.
+ *
+ * On a lost channel the process exits non-zero — fail loudly and let the
+ * supervisor restart it rather than idling disconnected.
+ */
+
+import { readFileSync } from "node:fs";
+import { connect as netConnect } from "node:net";
+import { connect as tlsConnect } from "node:tls";
+import process from "node:process";
+import { CLIENT_VERSION, listSiteNames, loadConfig } from "../src/lib/config.js";
+import { callTool, listResolvableSiteConfigs } from "../src/lib/dispatch.js";
+import { filterDiscoverableTools } from "../src/lib/governance.js";
+import {
+  loadLocalSecrets,
+  secretLoadFatalMessage,
+  secretTableMismatchMessage,
+} from "../src/lib/load-secrets.js";
+import {
+  filterPromptsByPrincipal,
+  filterResourcesByPrincipal,
+  filterToolsByPrincipal,
+  getRequestIdentity,
+  visibleSiteTargets,
+} from "../src/lib/principal.js";
+import { createRelayAgent } from "../src/lib/relay/agent.js";
+import { buildToolPrompts, getToolPromptMessages } from "../src/lib/tool-prompts.js";
+import { allDefinitions, definitionsByName } from "../src/tools/index.js";
+
+function fatal(message) {
+  console.error(`[drupal-mcp-agent] FATAL: ${message}`);
+  process.exit(1);
+}
+
+const host = process.env.MCP_EDGE_HOST || "";
+const port = Number(process.env.MCP_EDGE_AGENT_PORT || 0);
+if (!host || !port) {
+  fatal("Set MCP_EDGE_HOST and MCP_EDGE_AGENT_PORT to the relay edge's agent channel.");
+}
+
+const tokenFile = process.env.MCP_CHANNEL_TOKEN_FILE || "";
+const token = process.env.MCP_CHANNEL_TOKEN
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- credential path comes from the operator's environment, not user input
+  || (tokenFile ? readFileSync(tokenFile, "utf8").trim() : "");
+if (!token) {
+  fatal(
+    "The tenant agent requires its issued channel credential: set "
+    + "MCP_CHANNEL_TOKEN or MCP_CHANNEL_TOKEN_FILE.",
+  );
+}
+
+// Apply config/secrets.map before any site resolution, exactly like the
+// primary entry point: this process is where site credentials live.
+const secretLoad = loadLocalSecrets();
+const secretFatal = secretLoadFatalMessage(secretLoad);
+if (secretFatal) fatal(secretFatal);
+const secretMismatch = secretTableMismatchMessage(secretLoad);
+if (secretMismatch) {
+  console.error(`[drupal-mcp-agent] WARNING: ${secretMismatch}`);
+} else if (secretLoad.unset.length) {
+  console.error(
+    "[drupal-mcp-agent] WARNING: config.json names secret env vars that are unset: "
+    + `${secretLoad.unset.join(", ")}. Those sites will fail closed.`,
+  );
+}
+
+try {
+  loadConfig();
+} catch (error) {
+  fatal(error instanceof Error ? error.message : "configuration load failed");
+}
+
+// ---------------------------------------------------------------------------
+// Connector surface — the real governed tool surface. Workflow prompts and
+// the templated resources stay on the primary entry point; the governed
+// surface here is tools (full), the sites resource, and per-tool prompts.
+// ---------------------------------------------------------------------------
+
+const RESOURCES = [{
+  uri: "drupal://sites",
+  name: "Configured Drupal Sites",
+  description: "All named Drupal site profiles (no credentials).",
+  mimeType: "application/json",
+}];
+
+const TOOL_PROMPTS = buildToolPrompts(allDefinitions);
+
+async function discoverableTools() {
+  const sites = listResolvableSiteConfigs();
+  const identity = getRequestIdentity();
+  const governed = await filterDiscoverableTools(allDefinitions, sites);
+  return filterToolsByPrincipal(governed, sites, identity);
+}
+
+const surface = {
+  serverInfo: { name: "drupal-mcp-connector", version: CLIENT_VERSION },
+  tools: {
+    definitions: allDefinitions,
+    list: discoverableTools,
+    call: callTool,
+  },
+  resources: {
+    definitions: RESOURCES,
+    list: async () => {
+      const sites = listResolvableSiteConfigs();
+      return filterResourcesByPrincipal(RESOURCES, getRequestIdentity(), sites);
+    },
+    read: async (uri) => {
+      if (uri === "drupal://sites") {
+        return visibleSiteTargets(
+          getRequestIdentity(),
+          listResolvableSiteConfigs(),
+          listSiteNames(),
+        );
+      }
+      throw new Error(`Unknown resource URI: ${uri}`);
+    },
+  },
+  prompts: {
+    definitions: TOOL_PROMPTS,
+    list: async () => {
+      const identity = getRequestIdentity();
+      const tools = await discoverableTools();
+      return filterPromptsByPrincipal(TOOL_PROMPTS, identity, tools);
+    },
+    get: (name, args) => getToolPromptMessages(name, args, definitionsByName),
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Channel — TLS by default; plain TCP only to loopback, by explicit opt-in.
+// ---------------------------------------------------------------------------
+
+const allowTcp = process.env.MCP_EDGE_ALLOW_TCP === "1";
+const isLoopbackEdge = host === "127.0.0.1" || host === "::1" || host === "localhost";
+let connectFn;
+if (allowTcp) {
+  if (!isLoopbackEdge) {
+    fatal("MCP_EDGE_ALLOW_TCP permits a plain channel to loopback only. Use TLS.");
+  }
+  connectFn = netConnect;
+} else {
+  connectFn = (options, onConnect) =>
+    tlsConnect({ ...options, servername: host }, onConnect);
+}
+
+const agent = createRelayAgent({
+  host,
+  port,
+  token,
+  surface,
+  connectFn,
+  onChannelClose: () => {
+    fatal("The channel to the relay edge was lost. Exiting for a supervised restart.");
+  },
+});
+
+let hello;
+try {
+  hello = await agent.dial();
+} catch (error) {
+  fatal(`Could not dial the relay edge at ${host}:${port}: `
+    + `${error instanceof Error ? error.message : "unknown error"}`);
+}
+if (!hello.ok) {
+  fatal(`The relay edge denied the channel credential (${hello.reason}).`);
+}
+
+console.error(
+  `[drupal-mcp-agent v${CLIENT_VERSION}] Outbound channel to ${host}:${port} `
+  + `established as "${hello.agent?.agentId ?? "unknown"}" · `
+  + `${allDefinitions.length} tools · ${RESOURCES.length} resources · `
+  + `${TOOL_PROMPTS.length} prompts`,
+);

package/bin/drupal-mcp-edge.js

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+/**
+ * drupal-mcp-edge — relay northbound edge entry point (#232).
+ *
+ * Terminates northbound MCP on the inbound OAuth resource server and fans
+ * requests down the outbound tenant-agent channel (see src/lib/relay/edge.js).
+ * There is no shared-bearer and no unauthenticated mode on this entry point:
+ * MCP_AUTH_TOKEN and MCP_ALLOW_UNAUTHENTICATED are ignored, and a missing
+ * issuer/audience is fatal at every bind host including loopback. The edge
+ * holds no site credentials; its site catalog is names and base URLs only.
+ *
+ * Environment variables:
+ *   MCP_RESOURCE_ISSUER / MCP_RESOURCE_AUDIENCE / MCP_RESOURCE
+ *                     Inbound OAuth resource server (or config auth.issuer /
+ *                     auth.audience / auth.resource). Required.
+ *   MCP_CHANNEL_CREDENTIALS_FILE
+ *                     Agent channel credential store (or config
+ *                     relay.channelCredentialsFile). Required. JSON:
+ *                     {"agents": {"<id>": {"tokenSha256": "<hex>"}}}
+ *   MCP_EDGE_PORT     Northbound port (default: MCP_PORT / config tls.port).
+ *   MCP_EDGE_AGENT_PORT
+ *                     Agent channel port (default: northbound port + 1).
+ *   MCP_BIND_HOST     Northbound bind when TLS is present (default 0.0.0.0).
+ *   MCP_EDGE_AGENT_BIND_HOST
+ *                     Agent channel bind (default: the northbound bind).
+ *   TLS_CERT_PATH / TLS_KEY_PATH
+ *                     TLS material for both listeners.
+ *   MCP_ALLOW_HTTP    "1" permits plain loopback listeners (dev only).
+ *   MCP_RATE_LIMIT / MCP_RATE_WINDOW_SEC
+ *                     Northbound /mcp rate limit (same defaults as the
+ *                     primary entry point).
+ *
+ * Config: auth.grants (client id -> [site names]) is mandatory; the edge
+ * refuses to start without it.
+ */
+
+import { readFileSync } from "node:fs";
+import process from "node:process";
+import { getInboundGrants, getTlsConfig, loadConfig } from "../src/lib/config.js";
+import { resolveInboundAuthConfig } from "../src/lib/http-auth.js";
+import { createRateLimiter } from "../src/lib/rate-limit.js";
+import {
+  createChannelCredentialStore,
+  startEdge,
+} from "../src/lib/relay/edge.js";
+
+function fatal(message) {
+  console.error(`[drupal-mcp-edge] FATAL: ${message}`);
+  process.exit(1);
+}
+
+let config;
+try {
+  config = loadConfig();
+} catch (error) {
+  fatal(error instanceof Error ? error.message : "configuration load failed");
+}
+
+const inboundCfg = resolveInboundAuthConfig(config);
+if (!inboundCfg.issuer || !inboundCfg.audience) {
+  fatal(
+    "The relay edge requires an inbound OAuth resource server: set auth.issuer and "
+    + "auth.audience (or MCP_RESOURCE_ISSUER / MCP_RESOURCE_AUDIENCE). There is no "
+    + "shared-bearer or unauthenticated mode on this entry point, at any bind host "
+    + "including loopback.",
+  );
+}
+
+const grants = getInboundGrants();
+if (!grants) {
+  fatal(
+    "The relay edge refuses to start without a non-empty auth.grants table "
+    + "(client id -> [site names]).",
+  );
+}
+
+const channelFile = process.env.MCP_CHANNEL_CREDENTIALS_FILE
+  || config.relay?.channelCredentialsFile
+  || "";
+if (!channelFile) {
+  fatal(
+    "The relay edge requires an agent channel credential store: set "
+    + "MCP_CHANNEL_CREDENTIALS_FILE (or relay.channelCredentialsFile).",
+  );
+}
+
+// The catalog is passed as configured; startEdge refuses any entry carrying
+// credential material, so a tenant config deployed to an edge host fails
+// closed instead of quietly holding site secrets.
+const sites = Object.entries(config.sites ?? {})
+  .map(([name, site]) => ({ _name: name, ...site }));
+
+const tlsCfg = getTlsConfig();
+let tls = null;
+if (tlsCfg.certPath && tlsCfg.keyPath) {
+  tls = {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- TLS cert/key path comes from operator-controlled config, not user input
+    cert: readFileSync(tlsCfg.certPath),
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- TLS cert/key path comes from operator-controlled config, not user input
+    key: readFileSync(tlsCfg.keyPath),
+  };
+}
+const allowHttp = process.env.MCP_ALLOW_HTTP === "1";
+const bindHost = tls ? (process.env.MCP_BIND_HOST || "0.0.0.0") : "127.0.0.1";
+const agentBindHost = process.env.MCP_EDGE_AGENT_BIND_HOST || bindHost;
+const isLoopbackBind = bindHost === "127.0.0.1" || bindHost === "::1" || bindHost === "localhost";
+
+const port = Number(process.env.MCP_EDGE_PORT || tlsCfg.port);
+const agentPort = Number(process.env.MCP_EDGE_AGENT_PORT || port + 1);
+
+// Northbound rate limiting, same defaults as the primary entry point (#141).
+const rateWindowSec = Number(process.env.MCP_RATE_WINDOW_SEC || 60);
+const rateLimitEnv = process.env.MCP_RATE_LIMIT;
+const rateLimitDefault = (tls && !isLoopbackBind) ? 120 : 0;
+const rateLimit = rateLimitEnv === undefined || rateLimitEnv === ""
+  ? rateLimitDefault
+  : Number(rateLimitEnv);
+
+let edge;
+try {
+  edge = await startEdge({
+    auth: inboundCfg,
+    grants,
+    sites,
+    defaultSite: config.defaultSite,
+    channelCredentials: createChannelCredentialStore({ filePath: channelFile }),
+    bindHost,
+    agentBindHost,
+    port,
+    agentPort,
+    tls,
+    allowHttpLoopback: allowHttp,
+    rateLimiter: rateLimit > 0
+      ? createRateLimiter({ limit: rateLimit, windowMs: rateWindowSec * 1000 })
+      : null,
+  });
+} catch (error) {
+  fatal(error instanceof Error ? error.message : "edge startup failed");
+}
+
+console.error(
+  `[drupal-mcp-edge] Northbound ${edge.northboundUrl} · `
+  + `agent channel ${agentBindHost}:${edge.agentPort} · `
+  + `issuer ${inboundCfg.issuer}`,
+);
+if (rateLimit > 0) {
+  console.error(
+    `[drupal-mcp-edge] Rate limiting: ${rateLimit} req / ${rateWindowSec}s per client IP on /mcp.`,
+  );
+}

package/package.json

@@ -1,12 +1,14 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.9.0",
+  "version": "2.10.1",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",
   "bin": {
     "drupal-mcp-connector": "src/index.js",
-    "drupal-mcp-verify": "bin/drupal-mcp-verify.js"
+    "drupal-mcp-verify": "bin/drupal-mcp-verify.js",
+    "drupal-mcp-edge": "bin/drupal-mcp-edge.js",
+    "drupal-mcp-agent": "bin/drupal-mcp-agent.js"
   },
   "files": [
     "src/",

package/src/index.js

@@ -39,6 +39,7 @@ import {
   makeBearerCheck,
   resolveInboundAuthConfig,
   resolveInboundAuthMode,
+  inboundAuthDeprecationWarning,
   createInboundHttpsAuth,
 } from "./lib/http-auth.js";
 import { createLegacySessionHandler, createMcpRequestHandler } from "./lib/http-handler.js";
@@ -404,6 +405,8 @@ if (transport === "stdio") {
     console.error(`[drupal-mcp-connector] FATAL: ${inboundMode.reason}`);
     process.exit(1);
   }
+  const deprecation = inboundAuthDeprecationWarning(inboundMode.mode);
+  if (deprecation) console.error(deprecation);
 
   let checkAuth = makeBearerCheck(inboundMode.mode === "shared_bearer" ? authToken : "");
   let authenticate = null;

package/src/lib/backends/jsonapi.js

@@ -17,8 +17,9 @@ import {
   BASE_ATTRIBUTE_FIELDS,
 } from "../canonical.js";
 
-// Drupal exposes internal numeric ids under drupal_internal__* attributes;
-// these are dropped from canonical `fields` (the canonical id is the UUID).
+// Drupal exposes internal identifiers under drupal_internal__* attributes.
+// They are dropped from canonical `fields` except for the identifiers that
+// governed read/write workflows explicitly need.
 const INTERNAL_ATTR_RE = /^drupal_internal__/;
 
 // countEntities() pagination. Drupal core JSON:API returns no total in `meta`,
@@ -194,8 +195,9 @@ export class JsonApiBackend extends Backend {
 
   /**
    * Convert a JSON:API resource object into a CanonicalEntity. Base attributes
-   * (title/status/...) are promoted; drupal_internal__* and base fields are
-   * stripped from `fields`; relationships are normalized to canonical refs.
+   * (title/status/...) are promoted; base fields and unneeded
+   * drupal_internal__* attributes are stripped from `fields`; relationships
+   * are normalized to canonical refs.
    * @param {object} resource A JSON:API resource object.
    * @returns {import("../canonical.js").CanonicalEntity}
    */
@@ -208,10 +210,13 @@ export class JsonApiBackend extends Backend {
       Object.entries(attrs).filter(([k]) => {
         if (BASE_ATTRIBUTE_FIELDS.includes(k)) return false;
         if (INTERNAL_ATTR_RE.test(k)) {
+          // Node reads expose the numeric nid advertised by schema discovery
+          // while the UUID remains the canonical top-level id (#237).
           // Paragraph ERR attach needs the current revision id (#192).
           // Node / revisionable writes need the working vs live vid (#166).
           // Other drupal_internal__* attributes stay stripped.
-          return k === "drupal_internal__vid"
+          return (entityType === "node" && k === "drupal_internal__nid")
+            || k === "drupal_internal__vid"
             || (entityType === "paragraph" && k === "drupal_internal__revision_id");
         }
         return true;

package/src/lib/http-auth.js

@@ -11,7 +11,7 @@
 
 import { timingSafeEqual } from "crypto";
 import { readFileSync, statSync } from "fs";
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
 
 /** Header names that must never become identity. */
 export const SPOOFABLE_IDENTITY_HEADERS = Object.freeze([
@@ -479,6 +479,26 @@ export function resolveInboundAuthMode({
   };
 }
 
+/**
+ * Startup deprecation warning for inbound auth mode `shared_bearer` (#231).
+ *
+ * Removal is the next major (v3.0.0). Resource-server and unauthenticated
+ * modes are silent. The warning names the issue and the removal version so
+ * a loopback install cannot miss the kill criterion.
+ *
+ * @param {string} mode
+ * @returns {?string} Warning text, or null when this mode is not deprecated.
+ */
+export function inboundAuthDeprecationWarning(mode) {
+  if (mode !== "shared_bearer") return null;
+  return (
+    "[drupal-mcp-connector] WARNING: inbound auth mode shared_bearer is deprecated " +
+    "and will be removed in v3.0.0 (#231). Configure an OAuth resource server " +
+    "(auth.issuer + auth.audience) or run unauthenticated loopback. " +
+    "MCP_ALLOW_UNAUTHENTICATED remains the explicit trusted-proxy opt-in."
+  );
+}
+
 /**
  * Merge config.auth with environment overrides.
  * @param {object} [cfg]
@@ -524,7 +544,9 @@ export async function createInboundHttpsAuth({ inboundCfg, fetchFn = fetch }) {
   const issuer = normalizeIssuer(inboundCfg.issuer);
   const asMeta = await discoverAuthorizationServer(issuer, fetchFn);
   const advertisedIssuer = asMeta.issuer || issuer;
-  const jwks = createRemoteJWKSet(new URL(asMeta.jwks_uri));
+  // JWKS retrieval goes through the same injectable fetch as issuer
+  // discovery; with the default global fetch the behavior is unchanged.
+  const jwks = createRemoteJWKSet(new URL(asMeta.jwks_uri), { [customFetch]: fetchFn });
   const resourceMetadataUrl = resourceMetadataUrlFor(resource);
   const revocationStore = inboundCfg.revocationFile
     ? createRevocationStore({ filePath: inboundCfg.revocationFile })