enigma-memory 0.1.18 → 0.1.22

package/cortex-v3/zk/setup.mjs

@@ -0,0 +1,594 @@
+/**
+ * setup.mjs — idempotent Groth16 ceremony driver for the Enigma
+ * action-transition circuit (BUILD-CONTRACT.md v3).
+ *
+ * Pipeline:
+ *   1. Poll (default up to 40 min) for circuits/build/action_transition.r1cs
+ *      (produced concurrently by CircuitBuild).
+ *   2. Read the constraint count from the r1cs binary header (authoritative);
+ *      log CircuitBuild's metadata file if one exists.
+ *   3. Acquire powersOfTau28_hez_final_<power>.ptau into ptau/:
+ *        power 18 if constraints < 260_000 (expected, ~60-100k), else 19.
+ *        Mirrors: storage.googleapis.com/zkevm/ptau/ then
+ *        hermez.s3-eu-west-1.amazonaws.com. Sanity-checked size.
+ *        Fallback: local `snarkjs powersoftau new/contribute/beacon/
+ *        prepare phase2` ceremony.
+ *   4. groth16 setup → zkey contribute (name "enigma-dev-1", random entropy)
+ *      → zkey beacon (random 32B, 10 iterations) → export verificationkey →
+ *      circuits/build/verification_key.json.
+ *   5. vkFromSnarkjs (asserts IC == 7) → circuits/build/vk_bytes.json
+ *      (raw-be-hex-v1).
+ *
+ * verification_key.json + vk_bytes.json are COMMITTABLE; ptau/, *.zkey,
+ * *.wasm, *.r1cs are gitignored.
+ *
+ * CLAIM BOUNDARY: single-party local setup = development only; production
+ * requires a multi-party ceremony.
+ *
+ * Usage:
+ *   node zk/setup.mjs [--r1cs <path>] [--build-dir <dir>] [--ptau-dir <dir>]
+ *                     [--power <18|19|...>] [--poll-minutes <n>]
+ *                     [--expected-ic <n>] [--force]
+ *                     [--local-ptau]  (skip mirrors; run the local powersoftau
+ *                     fallback ceremony — offline/dev escape hatch)
+ *
+ * Exit codes: 0 success · 3 blocked (r1cs prerequisite missing) ·
+ *             4 ptau acquisition failed · 1 other failure.
+ */
+
+import { spawnSync } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import {
+  createWriteStream,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { fileURLToPath } from "node:url";
+
+import {
+  vkFromSnarkjs,
+  EXPECTED_IC_LENGTH,
+  NUM_PUBLIC_INPUTS,
+} from "./zk-codec.mjs";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const CORTEX_V3 = path.resolve(HERE, "..");
+
+const DEFAULTS = {
+  r1cs: path.join(CORTEX_V3, "circuits", "build", "action_transition.r1cs"),
+  buildDir: path.join(CORTEX_V3, "circuits", "build"),
+  ptauDir: path.join(CORTEX_V3, "ptau"),
+  pollMinutes: 40,
+  expectedIc: EXPECTED_IC_LENGTH,
+  power: null, // auto from constraint count
+  force: false,
+  localPtau: false,
+};
+
+// ~260k constraints is the 2^18 ceiling per the build contract.
+const PTAU_18_MAX_CONSTRAINTS = 260_000;
+const PTAU_MIRRORS = (power) => [
+  `https://storage.googleapis.com/zkevm/ptau/powersOfTau28_hez_final_${power}.ptau`,
+  `https://hermez.s3-eu-west-1.amazonaws.com/powersOfTau28_hez_final_${power}.ptau`,
+];
+const MIN_PTAU_BYTES = (power) => {
+  if (power === 19) return 150 * 1024 * 1024; // >150MB mandated for 2^19
+  if (power === 18) return 100 * 1024 * 1024; // hez_final_18 ≈ 145MB
+  return 2 ** power * 400; // scaled sanity for test powers
+};
+
+const log = (msg) => console.log(`[setup ${new Date().toISOString()}] ${msg}`);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+class BlockingError extends Error {
+  constructor(message, exitCode) {
+    super(message);
+    this.exitCode = exitCode;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+function parseArgs(argv) {
+  const opts = { ...DEFAULTS };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => {
+      if (i + 1 >= argv.length) throw new Error(`missing value for ${a}`);
+      return argv[++i];
+    };
+    switch (a) {
+      case "--r1cs":
+        opts.r1cs = path.resolve(next());
+        break;
+      case "--build-dir":
+        opts.buildDir = path.resolve(next());
+        break;
+      case "--ptau-dir":
+        opts.ptauDir = path.resolve(next());
+        break;
+      case "--power":
+        opts.power = Number(next());
+        break;
+      case "--poll-minutes":
+        opts.pollMinutes = Number(next());
+        break;
+      case "--expected-ic":
+        opts.expectedIc = Number(next());
+        break;
+      case "--force":
+        opts.force = true;
+        break;
+      case "--local-ptau":
+        opts.localPtau = true;
+        break;
+      default:
+        throw new Error(`unknown argument: ${a}`);
+    }
+  }
+  if (opts.power !== null && (!Number.isInteger(opts.power) || opts.power < 4 || opts.power > 20)) {
+    throw new Error(`--power must be an integer in [4, 20], got ${opts.power}`);
+  }
+  return opts;
+}
+
+// ---------------------------------------------------------------------------
+// snarkjs CLI runner (no npx/.cmd shims — run the CLI entrypoint with node)
+// ---------------------------------------------------------------------------
+
+function snarkjsCliPath() {
+  const p = path.join(CORTEX_V3, "node_modules", "snarkjs", "build", "cli.cjs");
+  if (!existsSync(p)) {
+    throw new Error(
+      `snarkjs CLI not found at ${p} — run "npm install -D snarkjs" in cortex-v3`,
+    );
+  }
+  return p;
+}
+
+function snarkjs(args, { quiet = false } = {}) {
+  const fullArgs = [snarkjsCliPath(), ...args];
+  log(`$ node ${path.basename(snarkjsCliPath())} ${args.join(" ")}`);
+  const res = spawnSync(process.execPath, fullArgs, {
+    cwd: CORTEX_V3,
+    stdio: quiet ? "pipe" : "inherit",
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (res.error) throw res.error;
+  if (res.status !== 0) {
+    throw new Error(
+      `snarkjs ${args[0]} exited with code ${res.status}\n${res.stderr ?? ""}`,
+    );
+  }
+  return (res.stdout ?? "") + (res.stderr ?? "");
+}
+
+// ---------------------------------------------------------------------------
+// r1cs inspection — parse the binary header directly (authoritative)
+// ---------------------------------------------------------------------------
+
+function readR1csHeader(r1csPath) {
+  const fd = readFileSync(r1csPath); // r1cs for ~100-400k constraints is tens of MB; fine
+  if (fd.length < 12 || fd.toString("ascii", 0, 4) !== "r1cs") {
+    throw new Error(`${r1csPath} is not an r1cs file (bad magic)`);
+  }
+  const nSections = fd.readUInt32LE(8);
+  let offset = 12;
+  for (let s = 0; s < nSections; s++) {
+    const sectionType = fd.readUInt32LE(offset);
+    const sectionSize = Number(fd.readBigUInt64LE(offset + 4));
+    if (sectionType === 1) {
+      const base = offset + 12;
+      const fieldSize = fd.readUInt32LE(base);
+      let p = base + 4 + fieldSize;
+      const nWires = fd.readUInt32LE(p);
+      const nPubOut = fd.readUInt32LE(p + 4);
+      const nPubIn = fd.readUInt32LE(p + 8);
+      const nPrvIn = fd.readUInt32LE(p + 12);
+      const nLabels = Number(fd.readBigUInt64LE(p + 16));
+      const nConstraints = fd.readUInt32LE(p + 24);
+      return { nWires, nPubOut, nPubIn, nPrvIn, nLabels, nConstraints };
+    }
+    offset += 12 + sectionSize;
+  }
+  throw new Error(`${r1csPath}: header section (type 1) not found`);
+}
+
+function readConstraintMetadata(buildDir, r1csPath) {
+  const stem = path.basename(r1csPath).replace(/\.r1cs$/, "");
+  for (const name of [
+    `${stem}.meta.json`,
+    `${stem}.constraints.json`,
+    "build-metadata.json",
+  ]) {
+    const p = path.join(buildDir, name);
+    if (existsSync(p)) {
+      try {
+        const meta = JSON.parse(readFileSync(p, "utf8"));
+        log(`metadata file ${name}: ${JSON.stringify(meta)}`);
+        return meta;
+      } catch {
+        log(`metadata file ${name} is not valid JSON — ignoring`);
+      }
+    }
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Stage 1: wait for the r1cs
+// ---------------------------------------------------------------------------
+
+async function waitForR1cs(r1csPath, pollMinutes) {
+  if (existsSync(r1csPath)) {
+    log(`r1cs present: ${r1csPath}`);
+    return;
+  }
+  log(`waiting up to ${pollMinutes} min for ${r1csPath} (CircuitBuild runs concurrently)...`);
+  const deadline = Date.now() + pollMinutes * 60_000;
+  while (Date.now() < deadline) {
+    if (existsSync(r1csPath)) {
+      // Guard against a partially-written file: size must be stable.
+      const s1 = statSync(r1csPath).size;
+      await sleep(2000);
+      const s2 = statSync(r1csPath).size;
+      if (s1 === s2 && s2 > 0) {
+        log(`r1cs appeared (${s2} bytes, stable)`);
+        return;
+      }
+    }
+    await sleep(15_000);
+  }
+  throw new BlockingError(
+    `BLOCKED: ${r1csPath} did not appear within ${pollMinutes} minutes.\n` +
+      `Prerequisite owner: CircuitBuild (circuits/action_transition.circom → circom compile).\n` +
+      `Re-run "node zk/setup.mjs" once the r1cs exists — all completed stages are reused.`,
+    3,
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Stage 2: ptau acquisition
+// ---------------------------------------------------------------------------
+
+async function downloadPtau(url, dest, minBytes) {
+  const tmp = `${dest}.download`;
+  rmSync(tmp, { force: true });
+  log(`downloading ${url}`);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 45 * 60_000);
+  try {
+    const res = await fetch(url, { signal: controller.signal });
+    if (!res.ok || !res.body) {
+      throw new Error(`HTTP ${res.status} ${res.statusText}`);
+    }
+    const total = Number(res.headers.get("content-length") ?? 0);
+    let received = 0;
+    let lastLog = 0;
+    // Stream to disk with progress logging via a meter transform.
+    const meter = new Transform({
+      transform(chunk, _enc, cb) {
+        received += chunk.length;
+        if (received - lastLog >= 32 * 1024 * 1024) {
+          lastLog = received;
+          log(
+            `  … ${(received / 1024 / 1024).toFixed(0)}MB` +
+              (total ? ` / ${(total / 1024 / 1024).toFixed(0)}MB` : ""),
+          );
+        }
+        cb(null, chunk);
+      },
+    });
+    await pipeline(Readable.fromWeb(res.body), meter, createWriteStream(tmp));
+    const size = statSync(tmp).size;
+    if (size < minBytes) {
+      throw new Error(
+        `sanity check failed: downloaded ${size} bytes < required minimum ${minBytes} ` +
+          `(truncated or wrong file)`,
+      );
+    }
+    renameSync(tmp, dest);
+    log(`ptau saved: ${dest} (${(size / 1024 / 1024).toFixed(1)}MB) from ${url}`);
+    return { provenance: url, size };
+  } finally {
+    clearTimeout(timeout);
+    rmSync(tmp, { force: true });
+  }
+}
+
+function localPowersOfTau(power, finalPath) {
+  // Fallback ceremony when every mirror is unreachable. Development only.
+  const dir = path.dirname(finalPath);
+  const pot0 = path.join(dir, `pot${power}_0.ptau`);
+  const pot1 = path.join(dir, `pot${power}_1.ptau`);
+  const potBeacon = path.join(dir, `pot${power}_beacon.ptau`);
+  const beacon = randomBytes(32).toString("hex");
+  snarkjs(["powersoftau", "new", "bn128", String(power), pot0, "-v"]);
+  snarkjs([
+    "powersoftau", "contribute", pot0, pot1,
+    "--name=enigma-dev-pot-1",
+    `-e=${randomBytes(32).toString("hex")}`,
+  ]);
+  snarkjs(["powersoftau", "beacon", pot1, potBeacon, beacon, "10"]);
+  snarkjs(["powersoftau", "prepare", "phase2", potBeacon, finalPath, "-v"]);
+  for (const f of [pot0, pot1, potBeacon]) rmSync(f, { force: true });
+  return { provenance: `local single-party powersoftau ceremony (beacon ${beacon})`, size: statSync(finalPath).size };
+}
+
+async function acquirePtau(power, ptauDir, { localOnly = false } = {}) {
+  mkdirSync(ptauDir, { recursive: true });
+  const dest = path.join(ptauDir, `powersOfTau28_hez_final_${power}.ptau`);
+  const minBytes = MIN_PTAU_BYTES(power);
+  if (existsSync(dest)) {
+    const size = statSync(dest).size;
+    if (size >= minBytes) {
+      log(`reusing existing ptau: ${dest} (${(size / 1024 / 1024).toFixed(1)}MB)`);
+      return { path: dest, provenance: "reused existing file", size };
+    }
+    log(`existing ptau fails size sanity (${size} < ${minBytes}) — re-acquiring`);
+    rmSync(dest, { force: true });
+  }
+  const errors = [];
+  if (localOnly) {
+    log("--local-ptau: skipping mirrors, running LOCAL powersoftau ceremony (dev only)");
+    const { provenance, size } = localPowersOfTau(power, dest);
+    return { path: dest, provenance, size };
+  }
+  for (const url of PTAU_MIRRORS(power)) {
+    try {
+      const { provenance, size } = await downloadPtau(url, dest, minBytes);
+      return { path: dest, provenance, size };
+    } catch (err) {
+      errors.push(`${url}: ${err.message}`);
+      log(`mirror failed — ${url}: ${err.message}`);
+    }
+  }
+  log("all ptau mirrors failed; falling back to LOCAL powersoftau ceremony (dev only)");
+  try {
+    const { provenance, size } = localPowersOfTau(power, dest);
+    return { path: dest, provenance, size };
+  } catch (err) {
+    throw new BlockingError(
+      `BLOCKED: could not acquire a powers-of-tau for 2^${power}.\n` +
+        `Mirror failures:\n  - ${errors.join("\n  - ")}\n` +
+        `Local ceremony failure: ${err.message}`,
+      4,
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Stages 3-5: circuit-specific ceremony
+// ---------------------------------------------------------------------------
+
+function stagePaths(buildDir, r1csPath) {
+  const stem = path.basename(r1csPath).replace(/\.r1cs$/, "");
+  return {
+    zkey0: path.join(buildDir, `${stem}_0000.zkey`),
+    zkey1: path.join(buildDir, `${stem}_0001.zkey`),
+    // Final proving key name is CONTRACT: Main's e2e loads <stem>.zkey.
+    zkeyFinal: path.join(buildDir, `${stem}.zkey`),
+    vkJson: path.join(buildDir, "verification_key.json"),
+    vkBytes: path.join(buildDir, "vk_bytes.json"),
+  };
+}
+
+function runCeremony(r1csPath, ptauPath, paths, force) {
+  mkdirSync(path.dirname(paths.zkey0), { recursive: true });
+  if (force) {
+    for (const f of Object.values(paths)) rmSync(f, { force: true });
+  }
+  if (!existsSync(paths.zkey0)) {
+    snarkjs(["groth16", "setup", r1csPath, ptauPath, paths.zkey0]);
+  } else {
+    log(`reusing ${paths.zkey0}`);
+  }
+  if (!existsSync(paths.zkey1)) {
+    snarkjs([
+      "zkey", "contribute", paths.zkey0, paths.zkey1,
+      "--name=enigma-dev-1",
+      `-e=${randomBytes(32).toString("hex")}`,
+    ]);
+  } else {
+    log(`reusing ${paths.zkey1}`);
+  }
+  if (!existsSync(paths.zkeyFinal)) {
+    const beacon = randomBytes(32).toString("hex");
+    snarkjs(["zkey", "beacon", paths.zkey1, paths.zkeyFinal, beacon, "10"]);
+    log(`zkey beacon applied (dev beacon ${beacon})`);
+  } else {
+    log(`reusing ${paths.zkeyFinal}`);
+  }
+  if (!existsSync(paths.vkJson)) {
+    snarkjs(["zkey", "export", "verificationkey", paths.zkeyFinal, paths.vkJson]);
+  } else {
+    log(`reusing ${paths.vkJson}`);
+  }
+}
+
+function exportVkBytes(paths, expectedIc, meta) {
+  const vkJson = JSON.parse(readFileSync(paths.vkJson, "utf8"));
+  const vk = vkFromSnarkjs(vkJson, { expectedIc }); // throws unless IC == expectedIc
+  const hex = (b) => b.toString("hex"); // plain hex strings (Main's e2e contract)
+  const out = {
+    format: "raw-be-hex-v1",
+    curve: "bn128",
+    g2LimbOrder: "c1c0", // alt_bn128 / EIP-196 (im,re); flip only via empirical on-chain resolution
+    proofNote: "pi_a is raw — the on-chain program negates A",
+    numPublicInputs: expectedIc - 1,
+    icCount: vk.ic.length,
+    alphaG1: hex(vk.alphaG1),
+    betaG2: hex(vk.betaG2),
+    gammaG2: hex(vk.gammaG2),
+    deltaG2: hex(vk.deltaG2),
+    ic: vk.ic.map(hex),
+    ceremony: meta,
+    source: path.basename(paths.vkJson),
+    createdAt: new Date().toISOString(),
+  };
+  const tmp = `${paths.vkBytes}.tmp`;
+  writeFileSync(tmp, JSON.stringify(out, null, 2) + "\n");
+  renameSync(tmp, paths.vkBytes);
+  return out;
+}
+
+// ---------------------------------------------------------------------------
+// r1cs fingerprint — ceremony artifacts are only valid for the exact r1cs
+// they were derived from. If the r1cs changes (circuit recompile), every
+// circuit-specific stage MUST be redone; the ptau is r1cs-independent.
+// ---------------------------------------------------------------------------
+
+function sha256File(p) {
+  return createHash("sha256").update(readFileSync(p)).digest("hex");
+}
+
+function statePath(buildDir) {
+  return path.join(buildDir, "zk-setup-state.json");
+}
+
+function readState(buildDir) {
+  const p = statePath(buildDir);
+  if (!existsSync(p)) return null;
+  try {
+    return JSON.parse(readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeState(buildDir, state) {
+  const tmp = `${statePath(buildDir)}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  renameSync(tmp, statePath(buildDir));
+}
+
+/** Delete circuit-specific artifacts; returns list of removed paths. */
+function purgeStageArtifacts(paths) {
+  const removed = [];
+  for (const key of ["zkey0", "zkey1", "zkeyFinal", "vkJson", "vkBytes"]) {
+    if (existsSync(paths[key])) {
+      rmSync(paths[key], { force: true });
+      removed.push(paths[key]);
+    }
+  }
+  return removed;
+}
+
+// ---------------------------------------------------------------------------
+// main
+// ---------------------------------------------------------------------------
+
+async function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  const paths = stagePaths(opts.buildDir, opts.r1cs);
+
+  await waitForR1cs(opts.r1cs, opts.pollMinutes);
+
+  const r1csSha256 = sha256File(opts.r1cs);
+  log(`r1cs sha256: ${r1csSha256}`);
+  const priorState = readState(opts.buildDir);
+  const artifactsComplete =
+    existsSync(paths.vkJson) &&
+    existsSync(paths.vkBytes) &&
+    existsSync(paths.zkeyFinal);
+
+  if (opts.force || priorState?.r1csSha256 !== r1csSha256) {
+    const reason = opts.force
+      ? "--force"
+      : priorState
+        ? `r1cs changed (${priorState.r1csSha256} → ${r1csSha256})`
+        : "no prior setup state";
+    const removed = purgeStageArtifacts(paths);
+    if (removed.length > 0) {
+      log(
+        `${reason}: purged ${removed.length} stale circuit-specific artifact(s); ` +
+          `ptau reused (r1cs-independent)`,
+      );
+    }
+  } else if (artifactsComplete) {
+    // Idempotent fast path: artifacts complete AND bound to this exact r1cs.
+    const vk = vkFromSnarkjs(JSON.parse(readFileSync(paths.vkJson, "utf8")), {
+      expectedIc: opts.expectedIc,
+    });
+    log(
+      `setup already complete for r1cs ${r1csSha256} — ` +
+        `verification_key.json IC count ${vk.ic.length}, vk_bytes.json present. Nothing to do.`,
+    );
+    return;
+  }
+
+  const header = readR1csHeader(opts.r1cs);
+  readConstraintMetadata(opts.buildDir, opts.r1cs);
+  log(
+    `r1cs: ${header.nConstraints} constraints, ${header.nWires} wires, ` +
+      `${header.nPubIn} pub-in, ${header.nPubOut} pub-out`,
+  );
+  const impliedIc = 1 + header.nPubIn + header.nPubOut;
+  if (impliedIc !== opts.expectedIc) {
+    log(
+      `WARNING: r1cs implies IC length ${impliedIc} (1 + ${header.nPubIn} + ${header.nPubOut}) ` +
+        `but --expected-ic is ${opts.expectedIc}; export will fail if the vk disagrees`,
+    );
+  }
+
+  const power =
+    opts.power ??
+    (header.nConstraints < PTAU_18_MAX_CONSTRAINTS ? 18 : 19);
+  if (2 ** power <= header.nConstraints) {
+    throw new Error(
+      `constraint count ${header.nConstraints} does not fit in 2^${power} powers-of-tau`,
+    );
+  }
+  log(
+    `constraint count ${header.nConstraints} → powers-of-tau 2^${power}` +
+      (opts.power ? " (forced via --power)" : ""),
+  );
+
+  const ptau = await acquirePtau(power, opts.ptauDir, { localOnly: opts.localPtau });
+  log(`ptau provenance: ${ptau.provenance} (${(ptau.size / 1024 / 1024).toFixed(1)}MB)`);
+
+  runCeremony(opts.r1cs, ptau.path, paths, opts.force);
+
+  const vkBytes = exportVkBytes(paths, opts.expectedIc, {
+    type: "single-party local (DEVELOPMENT ONLY — production needs a multi-party ceremony)",
+    ptau: ptau.provenance,
+    ptauBytes: ptau.size,
+    r1csSha256,
+    constraintCount: header.nConstraints,
+    powerOfTau: power,
+    contribution: "enigma-dev-1 (random entropy) + random beacon (10 iterations)",
+  });
+  writeState(opts.buildDir, {
+    r1csSha256,
+    constraintCount: header.nConstraints,
+    powerOfTau: power,
+    ptau: ptau.provenance,
+    zkeyFinal: path.basename(paths.zkeyFinal),
+    icCount: vkBytes.icCount,
+    completedAt: new Date().toISOString(),
+  });
+  log(`verification_key.json: ${paths.vkJson}`);
+  log(`vk_bytes.json:         ${paths.vkBytes}`);
+  log(`IC count in exported vk: ${vkBytes.icCount} (expected ${opts.expectedIc})`);
+  log("setup complete.");
+}
+
+main().catch((err) => {
+  if (err instanceof BlockingError) {
+    console.error(`\n${err.message}`);
+    process.exit(err.exitCode);
+  }
+  console.error(`\nsetup.mjs FAILED: ${err.stack ?? err.message ?? err}`);
+  process.exit(1);
+});