forma-diagrams 0.5.2

package/packages/cli/src/agent-access.ts

@@ -0,0 +1,232 @@
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { readFile, writeFile, rename, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { HttpError } from './file-library';
+import type { Identity } from './google';
+
+const hash = (value: string) => createHash('sha256').update(value).digest('hex');
+export const ownerId = (identity: Identity) => hash(`google:${identity.sub}`);
+
+export function relativePath(path: string, folder = false) {
+  if (
+    typeof path !== 'string' ||
+    path.length > 1024 ||
+    path.includes('\\') ||
+    /[\x00-\x1f]/.test(path) ||
+    (path !== '' && path.split('/').some((p) => !p || p.startsWith('.'))) ||
+    path.split('/').length > 13 ||
+    (!folder && !path.endsWith('.forma.json')) ||
+    (!folder && !path)
+  )
+    throw new HttpError(400, 'Use a relative path without empty, hidden or parent segments.');
+  return path;
+}
+
+const recordSchema = z.object({
+  id: z.string(),
+  digest: z.string().regex(/^[a-f0-9]{64}$/),
+  identity: z.object({
+    sub: z.string(),
+    email: z.string(),
+    email_verified: z.literal(true),
+    hd: z.string().optional(),
+    name: z.string().optional(),
+  }),
+  name: z.string(),
+  permission: z.enum(['read', 'write']),
+  folder: z.string(),
+  created: z.number(),
+  expires: z.number(),
+});
+export type Grant = z.infer<typeof recordSchema>;
+const fileSchema = z.object({ version: z.literal(1), tokens: z.array(recordSchema).max(10000) });
+
+export type TokenIO = { load(): Promise<string | null>; save(text: string): Promise<void> };
+function fileTokenIO(directory: string): TokenIO {
+  const path = join(directory, 'agent-tokens.json');
+  return {
+    async load() {
+      try {
+        return await readFile(path, 'utf8');
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code === 'ENOENT') return null;
+        throw new Error(
+          'Cannot read agent token registry. Restore or repair it before starting hosted mode.',
+        );
+      }
+    },
+    async save(text) {
+      const tmp = join(directory, `.tokens-${randomBytes(8).toString('hex')}.tmp`);
+      try {
+        await writeFile(tmp, text, { flag: 'wx', mode: 0o600 });
+        await rename(tmp, path);
+      } finally {
+        await unlink(tmp).catch(() => {});
+      }
+    },
+  };
+}
+export async function createTokenStore(source: string | TokenIO, now: () => number = Date.now) {
+  const io = typeof source === 'string' ? fileTokenIO(source) : source;
+  let records: Grant[] = [];
+  const loaded = await io.load();
+  if (loaded) {
+    records = fileSchema.parse(JSON.parse(loaded)).tokens;
+    for (const r of records) relativePath(r.folder, true);
+  }
+  let mutations = Promise.resolve();
+  const publicRecord = ({ digest: _digest, identity: _identity, ...value }: Grant) => value;
+  const update = <T>(operation: () => Promise<T>) => {
+    const result = mutations.then(operation);
+    mutations = result.then(
+      () => {},
+      () => {},
+    );
+    return result;
+  };
+  const persist = async (next: Grant[]) => {
+    await io.save(JSON.stringify({ version: 1, tokens: next }) + '\n');
+    records = next;
+  };
+  return {
+    list: (identity: Identity) =>
+      records.filter((r) => r.identity.sub === identity.sub).map(publicRecord),
+    create: (identity: Identity, input: unknown) =>
+      update(async () => {
+        if (!identity.email || identity.email_verified !== true)
+          throw new HttpError(403, 'This account cannot issue agent tokens.');
+        const data = z
+          .object({
+            name: z.string().trim().min(1).max(80),
+            permission: z.enum(['read', 'write']),
+            folder: z.string().trim().default(''),
+            days: z.number().int().min(1).max(90).default(30),
+          })
+          .strict()
+          .parse(input);
+        relativePath(data.folder, true);
+        const current = records.filter((r) => r.expires > now());
+        if (
+          current.filter((r) => r.identity.sub === identity.sub).length >= 20 ||
+          current.length >= 10000
+        )
+          throw new HttpError(409, 'Revoke an existing token before creating another.');
+        const id = randomBytes(12).toString('hex'),
+          secret = `forma_${id}_${randomBytes(32).toString('hex')}`;
+        const record: Grant = {
+          id,
+          digest: hash(secret),
+          identity: {
+            sub: identity.sub,
+            email: identity.email,
+            email_verified: true,
+            ...(identity.hd ? { hd: identity.hd } : {}),
+            ...(identity.name ? { name: identity.name } : {}),
+          },
+          name: data.name,
+          permission: data.permission,
+          folder: data.folder,
+          created: now(),
+          expires: now() + data.days * 86400000,
+        };
+        await persist([...current, record]);
+        return { token: secret, ...publicRecord(record) };
+      }),
+    revoke: (identity: Identity, id: string) =>
+      update(async () => {
+        if (!records.some((r) => r.id === id && r.identity.sub === identity.sub))
+          throw new HttpError(404, 'Token not found.');
+        await persist(records.filter((r) => r.id !== id || r.identity.sub !== identity.sub));
+        return { ok: true };
+      }),
+    authenticate: (authorization: string | undefined) => {
+      const match = /^Bearer (forma_([a-f0-9]{24})_[a-f0-9]{64})$/.exec(authorization ?? '');
+      const grant = match && records.find((r) => r.id === match[2]);
+      const digest = grant?.digest ?? '0'.repeat(64);
+      const presented = hash(match?.[1] ?? '');
+      let equal = false;
+      try {
+        equal = timingSafeEqual(Buffer.from(digest, 'hex'), Buffer.from(presented, 'hex'));
+      } catch {
+        equal = false;
+      }
+      if (!match || !grant || grant.expires <= now() || !equal)
+        throw new HttpError(401, 'A valid, unexpired Forma agent token is required.');
+      return grant;
+    },
+  };
+}
+
+export function createAgentService(
+  getGrant: () => Grant,
+  libraryFor: (identity: Identity) => Promise<{
+    workspace: string;
+    list: () => Promise<{ items: { path: string }[]; folders: string[] }>;
+    read: (path: string, workspace: string) => Promise<{ document: unknown; revision: string }>;
+    save: (data: {
+      path: string;
+      document: unknown;
+      revision: string | null;
+      workspace: string;
+    }) => Promise<{ path: string; revision: string; workspace: string }>;
+  }>,
+) {
+  const check = (path: string, write = false) => {
+    relativePath(path);
+    const grant = getGrant();
+    if (grant.folder && !path.startsWith(grant.folder + '/'))
+      throw new HttpError(403, 'This path is outside the token’s folder scope.');
+    if (write && grant.permission !== 'write') throw new HttpError(403, 'This token is read-only.');
+    return grant;
+  };
+  return {
+    me: () => {
+      const grant = getGrant();
+      return {
+        owner: ownerId(grant.identity),
+        email: grant.identity.email,
+        permission: grant.permission,
+        folder: grant.folder,
+        expires: grant.expires,
+      };
+    },
+    list: async () => {
+      const grant = getGrant(),
+        library = await libraryFor(grant.identity),
+        value = await library.list();
+      const inside = (path: string) => !grant.folder || path.startsWith(grant.folder + '/');
+      return {
+        items: value.items.filter((i) => inside(i.path)),
+        folders: value.folders.filter(inside),
+      };
+    },
+    read: async (path: string) => {
+      const grant = check(path),
+        library = await libraryFor(grant.identity);
+      return {
+        ...(await library.read(path, library.workspace)),
+        path,
+        owner: ownerId(grant.identity),
+      };
+    },
+    write: async (data: unknown) => {
+      const input = z
+        .object({
+          path: z.string(),
+          revision: z
+            .string()
+            .regex(/^[a-f0-9]{64}$/)
+            .nullable(),
+          document: z.unknown(),
+        })
+        .strict()
+        .parse(data);
+      const grant = check(input.path, true),
+        library = await libraryFor(grant.identity);
+      const result = await library.save({ ...input, workspace: library.workspace });
+      return { path: result.path, revision: result.revision, owner: ownerId(grant.identity) };
+    },
+  };
+}
+export type AgentService = ReturnType<typeof createAgentService>;

package/packages/cli/src/blob-store.ts

@@ -0,0 +1,241 @@
+import { createHash } from 'node:crypto';
+import { parseDocument, serializeDocument } from '../../core/src/index';
+import { HttpError, type createFileLibrary } from './file-library';
+import { relativePath } from './agent-access';
+import type { Identity } from './google';
+
+export type BlobObject = { pathname: string; size: number; uploadedAt: Date; text?: string };
+export type BlobStore = {
+  get(pathname: string): Promise<{ text: string; size: number; uploadedAt: Date } | null>;
+  put(pathname: string, text: string): Promise<void>;
+  list(prefix: string): Promise<BlobObject[]>;
+};
+
+const revision = (text: string) => createHash('sha256').update(text).digest('hex');
+export const ownerKey = (identity: Identity) =>
+  createHash('sha256').update(`google:${identity.sub}`).digest('hex');
+
+async function vercelBlobStore(): Promise<BlobStore> {
+  const { get, put, list, BlobNotFoundError } = await import('@vercel/blob');
+  const streamText = async (stream: ReadableStream<Uint8Array>) => {
+    const reader = stream.getReader();
+    const chunks: Uint8Array[] = [];
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      chunks.push(value);
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c))).toString('utf8');
+  };
+  return {
+    async get(pathname) {
+      try {
+        const result = await get(pathname, { access: 'private', useCache: false });
+        if (!result || result.statusCode !== 200) return null;
+        const text = await streamText(result.stream);
+        return { text, size: result.blob.size, uploadedAt: result.blob.uploadedAt };
+      } catch (error) {
+        if (error instanceof BlobNotFoundError) return null;
+        throw error;
+      }
+    },
+    async put(pathname, text) {
+      await put(pathname, text, {
+        access: 'private',
+        addRandomSuffix: false,
+        allowOverwrite: true,
+        cacheControlMaxAge: 0,
+        contentType: 'application/json',
+      });
+    },
+    async list(prefix) {
+      const items: BlobObject[] = [];
+      let cursor: string | undefined;
+      do {
+        const page = await list({ prefix, cursor, limit: 1000 });
+        items.push(
+          ...page.blobs.map((b) => ({
+            pathname: b.pathname,
+            size: b.size,
+            uploadedAt: b.uploadedAt,
+          })),
+        );
+        cursor = page.hasMore ? page.cursor : undefined;
+      } while (cursor);
+      return items;
+    },
+  };
+}
+
+export async function createBlobLibrary(
+  store: BlobStore,
+  prefix: string,
+  limits?: { bytes: number; files: number },
+) {
+  const workspace = `blob:${prefix}`;
+  let mutations = Promise.resolve();
+  const key = (path: string) => `${prefix}${path}`;
+  const list = async () => {
+    const blobs = await store.list(prefix);
+    const items: { path: string; title: string; modified: string; error?: string }[] = [],
+      folders = new Set<string>();
+    let bytes = 0;
+    for (const blob of blobs) {
+      if (!blob.pathname.startsWith(prefix) || !blob.pathname.endsWith('.forma.json')) continue;
+      const path = blob.pathname.slice(prefix.length);
+      if (!path || path.split('/').some((p) => !p || p.startsWith('.'))) continue;
+      bytes += blob.size;
+      const parts = path.split('/');
+      for (let i = 1; i < parts.length; i++) folders.add(parts.slice(0, i).join('/'));
+      let title = parts.at(-1)!,
+        error: string | undefined;
+      try {
+        const file = await store.get(blob.pathname);
+        if (!file) throw new Error('Missing diagram.');
+        if (file.size > 5_000_000) throw new Error('File exceeds 5 MB.');
+        title = parseDocument(JSON.parse(file.text)).title;
+      } catch (e) {
+        error = (e as Error).message;
+      }
+      items.push({
+        path,
+        title,
+        modified: blob.uploadedAt.toISOString(),
+        ...(error ? { error } : {}),
+      });
+    }
+    return {
+      mode: 'hosted',
+      bytes,
+      directory: 'Your private library',
+      workspace,
+      items: items.sort((a, b) => a.path.localeCompare(b.path)),
+      folders: [...folders].sort(),
+    };
+  };
+  const read = async (path: string, expectedWorkspace: string) => {
+    if (expectedWorkspace !== workspace)
+      throw new HttpError(409, 'Library changed. Refresh the library before opening a file.');
+    relativePath(path);
+    const file = await store.get(key(path));
+    if (!file) {
+      const err = new Error('Not found.') as NodeJS.ErrnoException;
+      err.code = 'ENOENT';
+      throw err;
+    }
+    if (file.size > 5_000_000) throw new HttpError(413, 'File exceeds 5 MB.');
+    return { document: parseDocument(JSON.parse(file.text)), revision: revision(file.text) };
+  };
+  const save = (data: {
+    path: string;
+    document: unknown;
+    revision: string | null;
+    workspace: string;
+  }) => {
+    const operation = async () => {
+      if (data.workspace !== workspace)
+        throw new HttpError(409, 'Library changed. Reopen the diagram from the current library.');
+      relativePath(data.path);
+      let content: string;
+      try {
+        content = serializeDocument(parseDocument(data.document));
+      } catch {
+        throw new HttpError(400, 'Invalid diagram document.');
+      }
+      if (Buffer.byteLength(content) > 5_000_000)
+        throw new HttpError(413, 'Document exceeds 5 MB.');
+      const existing = await store.get(key(data.path));
+      if ((existing === null ? null : revision(existing.text)) !== data.revision)
+        throw new HttpError(
+          409,
+          'This file changed on disk. Your edits are still here. Open the disk version from Library or save your edits under a new path.',
+        );
+      if (limits) {
+        const inventory = await list();
+        if (
+          (existing === null && inventory.items.length >= limits.files) ||
+          inventory.bytes - Buffer.byteLength(existing?.text ?? '') + Buffer.byteLength(content) >
+            limits.bytes
+        )
+          throw new HttpError(
+            413,
+            'Your library storage quota is full. Contact your administrator.',
+          );
+      }
+      await store.put(key(data.path), content);
+      return { path: data.path, revision: revision(content), workspace };
+    };
+    const result = mutations.then(operation);
+    mutations = result.then(
+      () => {},
+      () => {},
+    );
+    return result;
+  };
+  return { list, read, save, workspace, root: prefix };
+}
+
+export async function blobLibraryFor(
+  store: BlobStore,
+  identity: Identity,
+  limits: { bytes: number; files: number },
+  maxUsers: number,
+) {
+  const id = ownerKey(identity);
+  const prefix = `users/${id}/diagrams/`;
+  const identities = (await store.list('users/')).filter((b) =>
+    b.pathname.endsWith('/identity.json'),
+  );
+  if (
+    !identities.some((b) => b.pathname === `users/${id}/identity.json`) &&
+    identities.length >= maxUsers
+  )
+    throw new HttpError(
+      503,
+      'This workspace has reached its user limit. Contact your administrator.',
+    );
+  await store.put(
+    `users/${id}/identity.json`,
+    JSON.stringify(
+      {
+        provider: 'google',
+        subject: identity.sub,
+        email: identity.email,
+        name: identity.name ?? '',
+      },
+      null,
+      2,
+    ) + '\n',
+  );
+  return createBlobLibrary(store, prefix, limits);
+}
+
+export async function defaultVercelBlobStore() {
+  return vercelBlobStore();
+}
+
+export function memoryBlobStore(seed: Map<string, string> = new Map()): BlobStore {
+  const files = new Map(seed);
+  return {
+    async get(pathname) {
+      const text = files.get(pathname);
+      if (text === undefined) return null;
+      return { text, size: Buffer.byteLength(text), uploadedAt: new Date(0) };
+    },
+    async put(pathname, text) {
+      files.set(pathname, text);
+    },
+    async list(prefix) {
+      return [...files]
+        .filter(([pathname]) => pathname.startsWith(prefix))
+        .map(([pathname, text]) => ({
+          pathname,
+          size: Buffer.byteLength(text),
+          uploadedAt: new Date(0),
+          text,
+        }));
+    },
+  };
+}
+
+export type DiagramLibrary = Awaited<ReturnType<typeof createFileLibrary>>;

package/packages/cli/src/file-library.ts

@@ -0,0 +1,179 @@
+import {
+  readFile,
+  writeFile,
+  rename,
+  unlink,
+  mkdir,
+  realpath,
+  lstat,
+  readdir,
+} from 'node:fs/promises';
+import { resolve, join, dirname, isAbsolute } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { parseDocument, serializeDocument } from '../../core/src/index';
+
+const revision = (text: string) => createHash('sha256').update(text).digest('hex');
+export class HttpError extends Error {
+  constructor(
+    public status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+export async function createFileLibrary(
+  directory: string,
+  limits?: { bytes: number; files: number },
+) {
+  await mkdir(resolve(directory), { recursive: true, mode: 0o700 });
+  const root = await realpath(resolve(directory)),
+    workspace = randomUUID();
+  let mutations = Promise.resolve();
+  const safePath = async (path: string, createParents = false, allowMissing = false) => {
+    if (
+      !path ||
+      path.length > 1024 ||
+      path.split('/').length > 13 ||
+      isAbsolute(path) ||
+      path.includes('\\') ||
+      path.split('/').some((p) => !p || p === '.' || p === '..' || p.startsWith('.')) ||
+      !path.endsWith('.forma.json')
+    )
+      throw new HttpError(
+        400,
+        'Use a relative .forma.json path, such as architecture/checkout.forma.json.',
+      );
+    const parts = path.split('/');
+    let current = root;
+    for (const [i, part] of parts.entries()) {
+      current = join(current, part);
+      try {
+        const stat = await lstat(current);
+        if (stat.isSymbolicLink())
+          throw new HttpError(400, 'Symbolic links are not supported in the library.');
+        if (i < parts.length - 1 && !stat.isDirectory())
+          throw new HttpError(400, 'Parent is not a folder.');
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+        if (i < parts.length - 1 && createParents) await mkdir(current);
+        else if (i < parts.length - 1 && !allowMissing)
+          throw new HttpError(404, 'Folder not found.');
+      }
+    }
+    return current;
+  };
+  const list = async () => {
+    let bytes = 0;
+    const items: { path: string; title: string; modified: string; error?: string }[] = [],
+      folders: string[] = [];
+    const walk = async (relative = '', depth = 0) => {
+      if (depth > 12 || items.length >= 1000) return;
+      for (const entry of await readdir(join(root, relative), { withFileTypes: true })) {
+        if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.isSymbolicLink())
+          continue;
+        const path = relative ? `${relative}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+          folders.push(path);
+          await walk(path, depth + 1);
+        } else if (entry.isFile() && entry.name.endsWith('.forma.json') && items.length < 1000) {
+          const stat = await lstat(join(root, path));
+          bytes += stat.size;
+          let title = entry.name,
+            error: string | undefined;
+          try {
+            if (stat.size > 5_000_000) throw new Error('File exceeds 5 MB.');
+            title = parseDocument(JSON.parse(await readFile(join(root, path), 'utf8'))).title;
+          } catch (e) {
+            error = (e as Error).message;
+          }
+          items.push({
+            path,
+            title,
+            modified: stat.mtime.toISOString(),
+            ...(error ? { error } : {}),
+          });
+        }
+      }
+    };
+    await walk();
+    return {
+      mode: 'local',
+      bytes,
+      directory: root,
+      workspace,
+      items: items.sort((a, b) => a.path.localeCompare(b.path)),
+      folders: folders.sort(),
+    };
+  };
+
+  const read = async (path: string, expectedWorkspace: string) => {
+    if (expectedWorkspace !== workspace)
+      throw new HttpError(409, 'Library changed. Refresh the library before opening a file.');
+    const target = await safePath(path);
+    const stat = await lstat(target);
+    if (stat.size > 5_000_000) throw new HttpError(413, 'File exceeds 5 MB.');
+    const text = await readFile(target, 'utf8');
+    return { document: parseDocument(JSON.parse(text)), revision: revision(text) };
+  };
+  const save = (data: {
+    path: string;
+    document: unknown;
+    revision: string | null;
+    workspace: string;
+  }) => {
+    const operation = async () => {
+      if (data.workspace !== workspace)
+        throw new HttpError(409, 'Library changed. Reopen the diagram from the current library.');
+      if (typeof data.path !== 'string') throw new HttpError(400, 'A file path is required.');
+      let content: string;
+      try {
+        content = serializeDocument(parseDocument(data.document));
+      } catch {
+        throw new HttpError(400, 'Invalid diagram document.');
+      }
+      if (Buffer.byteLength(content) > 5_000_000)
+        throw new HttpError(413, 'Document exceeds 5 MB.');
+      // Resolve without creating directories until validation and quota checks pass.
+      const path = await safePath(data.path, false, true);
+      let existing: string | null = null;
+      try {
+        existing = await readFile(path, 'utf8');
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code !== 'ENOENT') throw e;
+      }
+      if ((existing === null ? null : revision(existing)) !== data.revision)
+        throw new HttpError(
+          409,
+          'This file changed on disk. Your edits are still here. Open the disk version from Library or save your edits under a new path.',
+        );
+      if (limits) {
+        const inventory = await list();
+        if (
+          (existing === null && inventory.items.length >= limits.files) ||
+          inventory.bytes - Buffer.byteLength(existing ?? '') + Buffer.byteLength(content) >
+            limits.bytes
+        )
+          throw new HttpError(
+            413,
+            'Your library storage quota is full. Contact your administrator.',
+          );
+      }
+      await safePath(data.path, true);
+      const temp = join(dirname(path), `.forma-${randomUUID()}.tmp`);
+      try {
+        await writeFile(temp, content, { flag: 'wx', mode: 0o600 });
+        await rename(temp, path);
+      } finally {
+        await unlink(temp).catch(() => {});
+      }
+      return { path: data.path, revision: revision(content), workspace };
+    };
+    const result = mutations.then(operation);
+    mutations = result.then(
+      () => {},
+      () => {},
+    );
+    return result;
+  };
+  return { list, read, save, workspace, root };
+}

package/packages/cli/src/google.ts

@@ -0,0 +1,51 @@
+import { OAuth2Client, CodeChallengeMethod } from 'google-auth-library';
+export type Identity = {
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  hd?: string;
+  nonce?: string;
+};
+export type LoginAttempt = { state: string; nonce: string; verifier: string; challenge: string };
+/** Dependency boundary for deterministic tests; the shipped command always uses Google. */
+export interface IdentityProvider {
+  authorize(attempt: LoginAttempt): string;
+  exchange(code: string, attempt: LoginAttempt): Promise<Identity>;
+}
+export function googleProvider(
+  clientId: string,
+  clientSecret: string,
+  redirectUri: string,
+): IdentityProvider {
+  if (!clientId || !clientSecret)
+    throw new Error('Set FORMA_GOOGLE_CLIENT_ID and FORMA_GOOGLE_CLIENT_SECRET.');
+  const client = new OAuth2Client({
+    clientId,
+    clientSecret,
+    redirectUri,
+    transporterOptions: { timeout: 15_000 },
+  });
+  return {
+    authorize: ({ state, nonce, challenge }) =>
+      client.generateAuthUrl({
+        scope: ['openid', 'email', 'profile'],
+        state,
+        nonce,
+        code_challenge: challenge,
+        code_challenge_method: CodeChallengeMethod.S256,
+        prompt: 'select_account',
+        access_type: 'online',
+      }),
+    async exchange(code, attempt) {
+      const { tokens } = await client.getToken({ code, codeVerifier: attempt.verifier });
+      if (!tokens.id_token) throw new Error('Missing ID token.');
+      // The maintained Google library validates the signature, issuer, audience and expiry.
+      const ticket = await client.verifyIdToken({ idToken: tokens.id_token, audience: clientId });
+      const payload = ticket.getPayload();
+      if (!payload) throw new Error('Missing identity.');
+      // Do not persist access or refresh tokens: this application needs identity only.
+      return payload as Identity;
+    },
+  };
+}