praxis-sec 1.0.0

package/cli/utils/autofix-rules.js

@@ -0,0 +1,74 @@
+/**
+ * Auto-Fix Rules
+ * ================
+ *
+ * Pure functions that transform a source line to fix a security issue.
+ * Each rule maps to a finding rule name from the agents.
+ *
+ * Used by `praxis remediate --all` to auto-fix agent-detected issues
+ * beyond just secrets.
+ */
+
+export const AUTOFIX_RULES = [
+  {
+    rule: 'TLS_REJECT_UNAUTHORIZED',
+    match: /rejectUnauthorized\s*:\s*false/g,
+    replace: (line) => line.replace(/rejectUnauthorized\s*:\s*false/, 'rejectUnauthorized: true // TODO: configure proper CA bundle'),
+    description: 'Enable TLS certificate verification',
+  },
+  {
+    rule: 'DOCKER_LATEST_TAG',
+    match: /FROM\s+(\S+):latest/gi,
+    replace: (line) => {
+      return line.replace(/FROM\s+(\S+):latest/i, (_, image) => {
+        const pinned = { node: 'node:20-alpine', python: 'python:3.12-slim', nginx: 'nginx:1.25-alpine', ruby: 'ruby:3.3-slim' };
+        return `FROM ${pinned[image] || image + ':latest'} # TODO: pin to specific version`;
+      });
+    },
+    description: 'Pin Docker base image to a specific version',
+  },
+  {
+    rule: 'DEBUG_MODE_PRODUCTION',
+    match: /(?:DEBUG|debug)\s*[:=]\s*(?:true|True|1|['"]true['"])/g,
+    replace: (line) => line
+      .replace(/DEBUG\s*=\s*True/, 'DEBUG = False')
+      .replace(/DEBUG\s*=\s*true/, 'DEBUG = false')
+      .replace(/debug\s*:\s*true/, 'debug: false')
+      .replace(/debug\s*=\s*['"]true['"]/, "debug = 'false'"),
+    description: 'Disable debug mode for production',
+  },
+  {
+    rule: 'XSS_DANGEROUS_INNER_HTML',
+    match: /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*([^}]+)\}\s*\}/g, // praxis-ignore: autofix pattern
+    replace: (line) => {
+      return line.replace(
+        /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*([^}]+)\}\s*\}/,
+        (_, value) => `dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(${value.trim()}) }}` // praxis-ignore: replacement template
+      );
+    },
+    description: 'Wrap dangerouslySetInnerHTML value in DOMPurify.sanitize()',
+  },
+  {
+    rule: 'CMD_INJECTION_SHELL_TRUE',
+    match: /shell\s*:\s*true/g,
+    replace: (line) => line.replace(/shell\s*:\s*true/, 'shell: false // TODO: ensure command works without shell'),
+    description: 'Disable shell execution in spawn/exec',
+  },
+];
+
+/**
+ * Check if a finding's rule has an autofix available.
+ */
+export function hasAutofix(rule) {
+  return AUTOFIX_RULES.some(r => r.rule === rule);
+}
+
+/**
+ * Apply an autofix rule to a line.
+ * Returns the fixed line, or the original if no rule matches.
+ */
+export function applyAutofix(rule, line) {
+  const fixRule = AUTOFIX_RULES.find(r => r.rule === rule);
+  if (!fixRule) return line;
+  return fixRule.replace(line);
+}

package/cli/utils/cache-manager.js

@@ -0,0 +1,310 @@
+/**
+ * Cache Manager
+ * =============
+ *
+ * Provides incremental scanning by caching file hashes and findings.
+ * On subsequent runs, only changed files are re-scanned.
+ *
+ * Cache location: .praxis/context.json
+ *
+ * USAGE:
+ *   import { CacheManager } from './cache-manager.js';
+ *   const cache = new CacheManager(rootPath);
+ *   const { changedFiles, cachedFindings } = await cache.getChangedFiles(currentFiles);
+ *   // ... scan only changedFiles ...
+ *   cache.save(allFiles, allFindings, recon, scoreResult);
+ */
+
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
+import { toolVersion } from '../core/version.js';
+
+// The cache is keyed on the tool version, so a stale one would silently reuse stale
+// findings. It comes from the single source in `cli/core/version.js`, which reports
+// 'unknown' rather than guessing if package.json is unreadable — and a cache written
+// under 'unknown' simply never matches, which is the safe direction.
+const PACKAGE_VERSION = toolVersion();
+
+// Cache TTL: 24 hours
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+
+export class CacheManager {
+  /**
+   * @param {string} rootPath — Absolute path to project root
+   */
+  constructor(rootPath) {
+    this.rootPath = rootPath;
+    this.cacheDir = path.join(rootPath, '.praxis');
+    this.cachePath = path.join(this.cacheDir, 'context.json');
+    this.cache = null;
+  }
+
+  /**
+   * Load the cache from disk. Returns null if cache is missing, expired, or invalid.
+   */
+  load() {
+    try {
+      if (!fs.existsSync(this.cachePath)) return null;
+
+      const raw = fs.readFileSync(this.cachePath, 'utf-8');
+      const cache = JSON.parse(raw);
+
+      // Version mismatch — patterns may have changed
+      if (cache.version !== PACKAGE_VERSION) return null;
+
+      // TTL expired
+      const age = Date.now() - new Date(cache.generatedAt).getTime();
+      if (age > CACHE_TTL_MS) return null;
+
+      this.cache = cache;
+      return cache;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Compute SHA-256 hash of a file's contents.
+   */
+  hashFile(filePath) {
+    try {
+      const content = fs.readFileSync(filePath);
+      return crypto.createHash('sha256').update(content).digest('hex');
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Compare current files against cached file index to find what changed.
+   *
+   * @param {string[]} currentFiles — Array of absolute file paths
+   * @returns {{ changedFiles: string[], cachedFindings: object[], unchangedCount: number, newCount: number, modifiedCount: number, deletedCount: number }}
+   */
+  diff(currentFiles) {
+    if (!this.cache || !this.cache.fileIndex) {
+      return {
+        changedFiles: currentFiles,
+        cachedFindings: [],
+        unchangedCount: 0,
+        newCount: currentFiles.length,
+        modifiedCount: 0,
+        deletedCount: 0,
+      };
+    }
+
+    const cachedIndex = this.cache.fileIndex;
+    const cachedFindings = this.cache.lastFindings || {};
+    const changedFiles = [];
+    const reusedFindings = [];
+    let unchangedCount = 0;
+    let newCount = 0;
+    let modifiedCount = 0;
+
+    const currentSet = new Set(currentFiles);
+
+    for (const file of currentFiles) {
+      const relPath = path.relative(this.rootPath, file).replace(/\\/g, '/');
+      const cached = cachedIndex[relPath];
+
+      if (!cached) {
+        // New file — needs scanning
+        changedFiles.push(file);
+        newCount++;
+        continue;
+      }
+
+      // Quick size check before expensive hash
+      try {
+        const stats = fs.statSync(file);
+        if (stats.size !== cached.size) {
+          changedFiles.push(file);
+          modifiedCount++;
+          continue;
+        }
+      } catch {
+        changedFiles.push(file);
+        modifiedCount++;
+        continue;
+      }
+
+      // Hash check
+      const currentHash = this.hashFile(file);
+      if (currentHash !== cached.hash) {
+        changedFiles.push(file);
+        modifiedCount++;
+        continue;
+      }
+
+      // File unchanged — reuse cached findings
+      unchangedCount++;
+      if (cachedFindings[relPath]) {
+        // Restore absolute paths for cached findings
+        for (const finding of cachedFindings[relPath]) {
+          reusedFindings.push({ ...finding, file });
+        }
+      }
+    }
+
+    // Count deleted files (in cache but not in current)
+    const currentRelPaths = new Set(
+      currentFiles.map(f => path.relative(this.rootPath, f).replace(/\\/g, '/'))
+    );
+    const deletedCount = Object.keys(cachedIndex).filter(p => !currentRelPaths.has(p)).length;
+
+    return {
+      changedFiles,
+      cachedFindings: reusedFindings,
+      unchangedCount,
+      newCount,
+      modifiedCount,
+      deletedCount,
+    };
+  }
+
+  /**
+   * Save the cache to disk.
+   *
+   * @param {string[]} allFiles — All scanned file paths
+   * @param {object[]} allFindings — All findings from the scan
+   * @param {object} recon — ReconAgent output
+   * @param {object} [scoreResult] — Optional score result
+   */
+  save(allFiles, allFindings, recon, scoreResult) {
+    try {
+      // Ensure .praxis directory exists
+      if (!fs.existsSync(this.cacheDir)) {
+        fs.mkdirSync(this.cacheDir, { recursive: true });
+      }
+
+      // Build file index with hashes
+      const fileIndex = {};
+      for (const file of allFiles) {
+        const relPath = path.relative(this.rootPath, file).replace(/\\/g, '/');
+        const hash = this.hashFile(file);
+        if (hash) {
+          try {
+            const stats = fs.statSync(file);
+            fileIndex[relPath] = {
+              hash,
+              size: stats.size,
+              lastScanned: new Date().toISOString(),
+            };
+          } catch {
+            // Skip files we can't stat
+          }
+        }
+      }
+
+      // Group findings by file (relative paths)
+      const lastFindings = {};
+      for (const f of allFindings) {
+        const relPath = path.relative(this.rootPath, f.file).replace(/\\/g, '/');
+        if (!lastFindings[relPath]) lastFindings[relPath] = [];
+        // Store a lightweight copy (no absolute paths)
+        lastFindings[relPath].push({
+          line: f.line,
+          column: f.column,
+          severity: f.severity,
+          category: f.category,
+          rule: f.rule,
+          title: f.title,
+          description: f.description,
+          matched: f.matched,
+          confidence: f.confidence,
+          cwe: f.cwe,
+          owasp: f.owasp,
+          fix: f.fix,
+        });
+      }
+
+      const cache = {
+        version: PACKAGE_VERSION,
+        generatedAt: new Date().toISOString(),
+        rootPath: this.rootPath,
+        recon: recon || null,
+        fileIndex,
+        lastFindings,
+        stats: {
+          totalFiles: allFiles.length,
+          totalFindings: allFindings.length,
+          lastScore: scoreResult?.score ?? null,
+          lastGrade: scoreResult?.grade?.letter ?? null,
+        },
+      };
+
+      fs.writeFileSync(this.cachePath, JSON.stringify(cache, null, 2));
+    } catch {
+      // Silent failure — caching should never break a scan
+    }
+  }
+
+  /**
+   * Delete the cache file.
+   */
+  invalidate() {
+    try {
+      if (fs.existsSync(this.cachePath)) {
+        fs.unlinkSync(this.cachePath);
+      }
+    } catch {
+      // Silent
+    }
+  }
+
+  // ===========================================================================
+  // LLM CLASSIFICATION CACHE
+  // ===========================================================================
+
+  get llmCachePath() {
+    return path.join(this.cacheDir, 'llm-cache.json');
+  }
+
+  /**
+   * Generate a cache key for an LLM classification.
+   */
+  getLLMCacheKey(finding) {
+    const data = `${finding.file}:${finding.line}:${finding.rule}:${finding.matched || ''}`;
+    return crypto.createHash('sha256').update(data).digest('hex').slice(0, 16);
+  }
+
+  /**
+   * Load cached LLM classifications. Returns {} if none or expired.
+   */
+  loadLLMClassifications() {
+    const LLM_CACHE_TTL = 7 * 24 * 60 * 60 * 1000; // 7 days
+    try {
+      if (!fs.existsSync(this.llmCachePath)) return {};
+      const raw = JSON.parse(fs.readFileSync(this.llmCachePath, 'utf-8'));
+      const now = Date.now();
+      const valid = {};
+      for (const [key, entry] of Object.entries(raw)) {
+        if (now - new Date(entry.cachedAt).getTime() < LLM_CACHE_TTL) {
+          valid[key] = entry;
+        }
+      }
+      return valid;
+    } catch {
+      return {};
+    }
+  }
+
+  /**
+   * Save LLM classifications to cache.
+   */
+  saveLLMClassifications(classifications) {
+    try {
+      if (!fs.existsSync(this.cacheDir)) {
+        fs.mkdirSync(this.cacheDir, { recursive: true });
+      }
+      const existing = this.loadLLMClassifications();
+      const merged = { ...existing, ...classifications };
+      fs.writeFileSync(this.llmCachePath, JSON.stringify(merged, null, 2));
+    } catch {
+      // Silent
+    }
+  }
+}
+
+export default CacheManager;

package/cli/utils/compliance-map.js

@@ -0,0 +1,191 @@
+/**
+ * Compliance Mapping Utility
+ * ===========================
+ *
+ * Maps CWE/OWASP findings to compliance frameworks:
+ *   - SOC 2 Type II (Trust Service Criteria)
+ *   - ISO 27001:2022 (Annex A controls)
+ *   - NIST AI Risk Management Framework (AI RMF 1.0)
+ */
+
+// =============================================================================
+// CWE → COMPLIANCE CONTROL MAPPING
+// =============================================================================
+
+const CWE_MAP = {
+  'CWE-74':  { soc2: ['CC6.1', 'CC7.1'], iso27001: ['A.8.28'], nistAiRmf: ['MAP 1.5', 'MEASURE 2.6'] },
+  'CWE-78':  { soc2: ['CC6.1', 'CC7.1'], iso27001: ['A.8.28'], nistAiRmf: ['MAP 1.5'] },
+  'CWE-79':  { soc2: ['CC6.1'], iso27001: ['A.8.28'], nistAiRmf: [] },
+  'CWE-89':  { soc2: ['CC6.1'], iso27001: ['A.8.28'], nistAiRmf: [] },
+  'CWE-94':  { soc2: ['CC6.1', 'CC7.1'], iso27001: ['A.8.28', 'A.8.9'], nistAiRmf: ['MAP 1.5'] },
+  'CWE-116': { soc2: ['CC6.1'], iso27001: ['A.8.28'], nistAiRmf: ['MEASURE 2.6'] },
+  'CWE-200': { soc2: ['CC6.5', 'CC6.1'], iso27001: ['A.8.11', 'A.5.33'], nistAiRmf: ['GOVERN 1.7', 'MAP 5.1'] },
+  'CWE-250': { soc2: ['CC6.3'], iso27001: ['A.8.2'], nistAiRmf: ['GOVERN 1.4'] },
+  'CWE-269': { soc2: ['CC6.3', 'CC6.1'], iso27001: ['A.8.2', 'A.5.15'], nistAiRmf: ['GOVERN 1.4'] },
+  'CWE-287': { soc2: ['CC6.1', 'CC6.2'], iso27001: ['A.8.5'], nistAiRmf: [] },
+  'CWE-306': { soc2: ['CC6.1', 'CC6.2'], iso27001: ['A.8.5'], nistAiRmf: ['GOVERN 1.4'] },
+  'CWE-311': { soc2: ['CC6.7'], iso27001: ['A.8.24'], nistAiRmf: [] },
+  'CWE-312': { soc2: ['CC6.7', 'CC6.1'], iso27001: ['A.8.24', 'A.5.33'], nistAiRmf: ['MAP 5.1'] },
+  'CWE-326': { soc2: ['CC6.7'], iso27001: ['A.8.24'], nistAiRmf: [] },
+  'CWE-327': { soc2: ['CC6.7'], iso27001: ['A.8.24'], nistAiRmf: [] },
+  'CWE-502': { soc2: ['CC6.1'], iso27001: ['A.8.28'], nistAiRmf: [] },
+  'CWE-522': { soc2: ['CC6.1', 'CC6.7'], iso27001: ['A.8.5', 'A.8.24'], nistAiRmf: [] },
+  'CWE-611': { soc2: ['CC6.1'], iso27001: ['A.8.28'], nistAiRmf: [] },
+  'CWE-668': { soc2: ['CC6.1', 'CC6.6'], iso27001: ['A.8.9', 'A.8.20'], nistAiRmf: ['GOVERN 1.4'] },
+  'CWE-798': { soc2: ['CC6.1', 'CC6.7'], iso27001: ['A.5.33', 'A.8.24'], nistAiRmf: [] },
+  'CWE-918': { soc2: ['CC6.1', 'CC6.6'], iso27001: ['A.8.20', 'A.8.28'], nistAiRmf: [] },
+};
+
+// OWASP Agentic → NIST AI RMF mapping (agent-specific)
+const AGENTIC_MAP = {
+  'ASI01': { soc2: ['CC6.1', 'CC7.2'], iso27001: ['A.8.28', 'A.8.9'], nistAiRmf: ['MAP 1.5', 'MEASURE 2.6', 'MANAGE 2.2'] },
+  'ASI02': { soc2: ['CC6.1', 'CC6.3'], iso27001: ['A.8.2', 'A.8.9'], nistAiRmf: ['MAP 1.5', 'GOVERN 1.4', 'MANAGE 2.2'] },
+  'ASI03': { soc2: ['CC6.3'], iso27001: ['A.8.2', 'A.5.15'], nistAiRmf: ['GOVERN 1.4', 'MAP 3.4'] },
+  'ASI04': { soc2: ['CC6.6', 'CC7.1'], iso27001: ['A.5.19', 'A.5.21'], nistAiRmf: ['MAP 1.5', 'GOVERN 6.1'] },
+  'ASI05': { soc2: ['CC6.1', 'CC7.1'], iso27001: ['A.8.28', 'A.8.9'], nistAiRmf: ['MAP 1.5'] },
+  'ASI06': { soc2: ['CC6.1'], iso27001: ['A.8.11'], nistAiRmf: ['MEASURE 2.6', 'MANAGE 2.2'] },
+  'ASI07': { soc2: ['CC6.1', 'CC6.7'], iso27001: ['A.8.20', 'A.8.24'], nistAiRmf: ['MAP 1.5'] },
+  'ASI08': { soc2: ['CC7.4', 'CC7.5'], iso27001: ['A.5.30'], nistAiRmf: ['MANAGE 4.1'] },
+  'ASI09': { soc2: ['CC6.2'], iso27001: ['A.8.5', 'A.5.15'], nistAiRmf: ['GOVERN 1.7'] },
+  'ASI10': { soc2: ['CC7.2', 'CC7.4'], iso27001: ['A.8.9', 'A.5.30'], nistAiRmf: ['MANAGE 2.2', 'MANAGE 4.1'] },
+};
+
+// =============================================================================
+// OWASP AGENTIC AI TOP 10 (December 2025)
+// =============================================================================
+
+const OWASP_AGENTIC_TOP_10 = {
+  ASI01: { id: 'ASI01', title: 'Agent Goal Hijacking',          description: 'Manipulation of agent objectives through prompt injection, memory poisoning, or instruction override.' },
+  ASI02: { id: 'ASI02', title: 'Tool Misuse',                   description: 'Agent uses tools in unintended or dangerous ways — shell execution, file deletion, network access beyond scope.' },
+  ASI03: { id: 'ASI03', title: 'Privilege Abuse',               description: 'Agent operates with excessive permissions — writes outside project, accesses secrets, escalates access.' },
+  ASI04: { id: 'ASI04', title: 'Agentic Supply Chain',          description: 'Compromised skills, MCP servers, or tool packages that the agent depends on.' },
+  ASI05: { id: 'ASI05', title: 'Memory & Context Poisoning',    description: 'Malicious data persisted in agent memory, rules files, or context that survives sessions.' },
+  ASI06: { id: 'ASI06', title: 'Uncontrolled Data Exposure',    description: 'Agent leaks code, secrets, or PII through tool outputs, logs, or external API calls.' },
+  ASI07: { id: 'ASI07', title: 'Insecure Communication',        description: 'Unencrypted MCP transport, HTTP model endpoints, or plaintext inter-agent messaging.' },
+  ASI08: { id: 'ASI08', title: 'Missing Human Oversight',       description: 'Agent takes destructive or irreversible actions without user confirmation — proactive mode risks.' },
+  ASI09: { id: 'ASI09', title: 'Weak Identity & Auth',          description: 'Agent sessions without authentication, shared API keys, or no audit trail of actions.' },
+  ASI10: { id: 'ASI10', title: 'Rogue Agent Behavior',          description: 'Agent deviates from intended behavior — self-modification, stealth mode, output suppression.' },
+};
+
+/**
+ * Enrich a finding with OWASP Agentic Top 10 metadata.
+ * Attaches `agenticRisk` object if the finding maps to ASI01–ASI10.
+ * @param {object} finding
+ * @returns {object} — finding with agenticRisk attached (or unchanged)
+ */
+export function enrichAgenticRisk(finding) {
+  const owasp = finding.owasp;
+  if (!owasp || !OWASP_AGENTIC_TOP_10[owasp]) return finding;
+
+  const risk = OWASP_AGENTIC_TOP_10[owasp];
+  finding.agenticRisk = {
+    id: risk.id,
+    title: risk.title,
+    description: risk.description,
+  };
+  return finding;
+}
+
+/**
+ * Get OWASP Agentic Top 10 summary across all findings.
+ * @param {object[]} findings
+ * @returns {{ risks: object[], coverage: number }}
+ */
+export function getAgenticSummary(findings) {
+  const counts = {};
+  for (const f of findings) {
+    const owasp = f.owasp;
+    if (owasp && OWASP_AGENTIC_TOP_10[owasp]) {
+      counts[owasp] = (counts[owasp] || 0) + 1;
+    }
+  }
+
+  const risks = Object.entries(OWASP_AGENTIC_TOP_10).map(([id, info]) => ({
+    ...info,
+    findingCount: counts[id] || 0,
+    status: counts[id] ? 'flagged' : 'clear',
+  }));
+
+  const flagged = risks.filter(r => r.findingCount > 0).length;
+
+  return {
+    risks,
+    flagged,
+    total: 10,
+    coverage: `${flagged}/10`,
+  };
+}
+
+// =============================================================================
+// PUBLIC API
+// =============================================================================
+
+/**
+ * Map a single finding to compliance controls.
+ * @param {object} finding - A finding with `cwe` and `owasp` fields.
+ * @returns {{ soc2: string[], iso27001: string[], nistAiRmf: string[] }}
+ */
+export function mapFindingToCompliance(finding) {
+  const result = { soc2: new Set(), iso27001: new Set(), nistAiRmf: new Set() };
+
+  // Map from CWE
+  const cwe = finding.cwe || finding.CWE;
+  if (cwe && CWE_MAP[cwe]) {
+    const m = CWE_MAP[cwe];
+    m.soc2.forEach(c => result.soc2.add(c));
+    m.iso27001.forEach(c => result.iso27001.add(c));
+    m.nistAiRmf.forEach(c => result.nistAiRmf.add(c));
+  }
+
+  // Map from OWASP Agentic
+  const owasp = finding.owasp || finding.OWASP;
+  if (owasp && AGENTIC_MAP[owasp]) {
+    const m = AGENTIC_MAP[owasp];
+    m.soc2.forEach(c => result.soc2.add(c));
+    m.iso27001.forEach(c => result.iso27001.add(c));
+    m.nistAiRmf.forEach(c => result.nistAiRmf.add(c));
+  }
+
+  return {
+    soc2: [...result.soc2].sort(),
+    iso27001: [...result.iso27001].sort(),
+    nistAiRmf: [...result.nistAiRmf].sort(),
+  };
+}
+
+/**
+ * Aggregate compliance mappings across all findings.
+ * @param {object[]} findings - Array of findings.
+ * @returns {{ soc2: object, iso27001: object, nistAiRmf: object, summary: object }}
+ */
+export function getComplianceSummary(findings) {
+  const soc2 = {};
+  const iso27001 = {};
+  const nistAiRmf = {};
+
+  for (const f of findings) {
+    const mapped = mapFindingToCompliance(f);
+
+    for (const ctrl of mapped.soc2) {
+      soc2[ctrl] = (soc2[ctrl] || 0) + 1;
+    }
+    for (const ctrl of mapped.iso27001) {
+      iso27001[ctrl] = (iso27001[ctrl] || 0) + 1;
+    }
+    for (const ctrl of mapped.nistAiRmf) {
+      nistAiRmf[ctrl] = (nistAiRmf[ctrl] || 0) + 1;
+    }
+  }
+
+  return {
+    soc2,
+    iso27001,
+    nistAiRmf,
+    summary: {
+      soc2Controls: Object.keys(soc2).length,
+      iso27001Controls: Object.keys(iso27001).length,
+      nistAiRmfControls: Object.keys(nistAiRmf).length,
+      totalFindings: findings.length,
+    },
+  };
+}