react-native-nitro-logger 0.1.0

package/src/privacy.ts

@@ -0,0 +1,389 @@
+import type {
+  LogMetadata,
+  LogPrimitive,
+  LogValue,
+  RedactedMetadata,
+} from './types';
+
+/**
+ * The privacy layer, deliberately a single module.
+ *
+ * Marker inspection and redaction live together so that payload recovery
+ * stays closure-private. If `inspectMarker` were exported, anyone could deep
+ * import the compiled module and read back a `priv()` payload in production,
+ * which would defeat the whole no-reveal contract regardless of what the
+ * package entry point re-exports. Nothing here that can return a payload
+ * crosses the module boundary.
+ */
+
+/** What a redacted value renders as in a log line. */
+export const PRIVATE_PLACEHOLDER = '<private>';
+
+/** What a marker renders as if it is stringified directly (interpolated into
+ * a message, spread, inspected). Never the payload — a marker leaking its
+ * value through `String()` would defeat the whole contract. */
+const MARKER_PLACEHOLDER = '<redacted>';
+
+/**
+ * Metadata keys are structural, never data. Anything outside this shape is
+ * a sign a value was used as a key — the classic `patient123: …` leak.
+ *
+ * The enforcing RegExp is module-private and only its source is exported. A
+ * shared RegExp object is mutable: a consumer could assign an own `test`
+ * method or call `RegExp.prototype.compile` on it and silently disable key
+ * validation for the whole process. Callers that want to pre-check a key
+ * build their own from {@link METADATA_KEY_PATTERN_SOURCE}.
+ */
+const METADATA_KEY_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+
+/** Source text of the key rule, for callers that want their own RegExp. */
+export const METADATA_KEY_PATTERN_SOURCE = '^[A-Za-z0-9._-]{1,64}$';
+
+function isValidMetadataKey(key: string): boolean {
+  return METADATA_KEY_PATTERN.test(key);
+}
+
+/** Reserved key carrying the fixed diagnostic: how many entries this call
+ * dropped. A count only — never which keys, never why, never the values. */
+export const DROPPED_COUNT_KEY = 'droppedMetadataCount';
+
+/** Upper bound on catalog size. A hostile or accidental infinite iterable
+ * must not be able to hang the JS thread inside a logging config call. */
+export const MAX_CATALOG_SIZE = 4096;
+
+declare const publicBrand: unique symbol;
+declare const privateBrand: unique symbol;
+
+/** A value explicitly marked safe to render. Opaque: the payload lives in a
+ * module-private WeakMap, never on the object. */
+export interface PublicValue {
+  readonly [publicBrand]: true;
+}
+
+/** A value explicitly marked sensitive. Renders as `<private>` outside dev. */
+export interface PrivateValue {
+  readonly [privateBrand]: true;
+}
+
+// Membership in these maps is the ONLY proof that an object is a marker.
+// A foreign lookalike — same shape, same toString — fails naturally because
+// it was never registered here, and no code outside this module can register
+// one. WeakMaps also keep the payload unreachable: there is no enumerable
+// field to spread, stringify, or inspect.
+const publicPayloads = new WeakMap<object, LogPrimitive>();
+const privatePayloads = new WeakMap<object, LogPrimitive>();
+const invalidMarkers = new WeakSet<object>();
+
+/**
+ * Exactly the primitives the pipeline can render. Objects, arrays, proxies,
+ * functions, symbols, null/undefined, NaN and the infinities are all
+ * rejected — an object payload is the classic way PHI slips into a log.
+ */
+function isLogPrimitive(value: unknown): value is LogPrimitive {
+  const kind = typeof value;
+  return (
+    kind === 'string' ||
+    kind === 'boolean' ||
+    (kind === 'number' && Number.isFinite(value))
+  );
+}
+
+function createMarker(): object {
+  const marker = {};
+  const hide = (key: PropertyKey, value: unknown): void => {
+    Object.defineProperty(marker, key, {
+      value,
+      enumerable: false,
+      writable: false,
+      configurable: false,
+    });
+  };
+  const placeholder = (): string => MARKER_PLACEHOLDER;
+  // Non-enumerable, so `{...marker}` and `Object.keys(marker)` see nothing.
+  hide('toString', placeholder);
+  hide('toJSON', placeholder);
+  hide(Symbol.toPrimitive, placeholder);
+  hide(Symbol.for('nodejs.util.inspect.custom'), placeholder);
+  hide(Symbol.toStringTag, 'RedactedLogValue');
+  return Object.freeze(marker);
+}
+
+/**
+ * Mark a value safe to render even under a `'private'` privacy default.
+ *
+ * The payload is validated here AND again at emit: `pub(patient as any)`
+ * must not smuggle an object past the primitive check. An invalid payload
+ * does not throw — logging never crashes the caller — it produces a marker
+ * that is dropped at emit and counted in the fixed diagnostic.
+ */
+export function pub(value: LogPrimitive): PublicValue {
+  const marker = createMarker();
+  if (isLogPrimitive(value)) {
+    publicPayloads.set(marker, value);
+  } else {
+    invalidMarkers.add(marker);
+  }
+  return marker as PublicValue;
+}
+
+/** Mark a value sensitive: renders as `<private>` outside dev builds, even
+ * under a `'public'` privacy default. Same fail-closed validation as `pub`. */
+export function priv(value: LogPrimitive): PrivateValue {
+  const marker = createMarker();
+  if (isLogPrimitive(value)) {
+    privatePayloads.set(marker, value);
+  } else {
+    invalidMarkers.add(marker);
+  }
+  return marker as PrivateValue;
+}
+
+/**
+ * Stands in for a value that could not be read when a snapshot was taken —
+ * a getter that threw while a scope was being constructed.
+ *
+ * It is registered as an invalid marker, so redaction drops it and counts
+ * it like any other rejected value. Without it the key would vanish at
+ * snapshot time and never appear in `droppedMetadataCount`, which is the
+ * one thing a silent drop must never do. It carries no payload.
+ */
+export const UNREADABLE_VALUE: LogValue = (() => {
+  const marker = createMarker();
+  invalidMarkers.add(marker);
+  return marker as LogValue;
+})();
+
+type MarkerInspection =
+  | { readonly kind: 'public'; readonly payload: LogPrimitive }
+  | { readonly kind: 'private'; readonly payload: LogPrimitive }
+  | { readonly kind: 'invalid' };
+
+/** Module-private by design — see the note at the top of this file. */
+function inspectMarker(value: unknown): MarkerInspection | null {
+  if (value === null || typeof value !== 'object') return null;
+  const candidate = value as object;
+
+  if (publicPayloads.has(candidate)) {
+    const payload = publicPayloads.get(candidate);
+    return isLogPrimitive(payload)
+      ? { kind: 'public', payload }
+      : { kind: 'invalid' };
+  }
+  if (privatePayloads.has(candidate)) {
+    const payload = privatePayloads.get(candidate);
+    return isLogPrimitive(payload)
+      ? { kind: 'private', payload }
+      : { kind: 'invalid' };
+  }
+  if (invalidMarkers.has(candidate)) return { kind: 'invalid' };
+  return null;
+}
+
+// The reveal branch exists only in dev builds. Metro substitutes a literal
+// for `__DEV__`, so in a release bundle the whole block — sentinel string
+// included — is dead code and gets stripped. M7's CI job greps the release
+// bundle for the sentinel to prove it.
+let revealBranchSentinel = '';
+
+/** True when private values may render as themselves: dev builds only.
+ * There is deliberately no runtime switch to turn this on in production. */
+function privateRevealAllowed(): boolean {
+  if (typeof __DEV__ !== 'undefined' && __DEV__) {
+    revealBranchSentinel = '__NITRO_LOGGER_PRIVATE_REVEAL__';
+    return true;
+  }
+  return false;
+}
+
+/** @internal Test/CI hook — non-empty only once the dev reveal branch ran.
+ * Returns a build-time marker, never a payload. */
+export function __revealBranchSentinel(): string {
+  return revealBranchSentinel;
+}
+
+// ── Configuration ───────────────────────────────────────────────────────────
+
+export type PrivacyDefault = 'public' | 'private';
+
+export interface PrivacySettings {
+  /** `'private'` redacts bare values outside dev; `'public'` renders them. */
+  readonly privacyDefault: PrivacyDefault;
+  /** Kill switch: redact every value regardless of marker or build type. */
+  readonly redactAll: boolean;
+  /** Approved metadata keys. Undefined means "no catalog configured". */
+  readonly keyCatalog: ReadonlySet<string> | undefined;
+}
+
+/**
+ * Coerce a caller-supplied privacy default. TypeScript's union is not a
+ * runtime guarantee — JS callers, JSON config, and `any` all reach here — so
+ * anything that is not exactly `'public'` or `'private'` resolves to
+ * `'private'`. Ambiguity must never resolve toward disclosure.
+ */
+export function normalizePrivacyDefault(value: unknown): PrivacyDefault {
+  return value === 'public' ? 'public' : 'private';
+}
+
+/**
+ * Build a catalog from caller-supplied input without trusting it. A
+ * non-iterable, an iterator that throws mid-way, a non-string entry, or an
+ * iterable longer than {@link MAX_CATALOG_SIZE} all yield an empty set: the
+ * caller's tighten-only intent is honored in the safest possible direction,
+ * and a runaway iterable cannot hang the JS thread.
+ */
+export function buildCatalog(keys: unknown): Set<string> {
+  const result = new Set<string>();
+  if (keys === null || typeof keys !== 'object') return result;
+  try {
+    // Bound on entries CONSUMED, not on set size: an iterator that yields
+    // the same valid key forever never grows the set, so a size-based bound
+    // would spin the JS thread indefinitely.
+    let consumed = 0;
+    for (const key of keys as Iterable<unknown>) {
+      if (++consumed > MAX_CATALOG_SIZE) return new Set();
+      if (typeof key !== 'string' || !isValidMetadataKey(key)) {
+        return new Set();
+      }
+      result.add(key);
+    }
+  } catch {
+    return new Set();
+  }
+  return result;
+}
+
+/**
+ * Whether an unconfigured catalog blocks everything.
+ *
+ * Under a `'private'` default — the telehealth/strict profile — the catalog
+ * is mandatory and fail-closed: rejecting computed keys is not enough, since
+ * a literal key like `patient123` is still PHI. With no catalog configured,
+ * no key is approved and all metadata drops. That is deliberate; it forces
+ * the app to declare its keys rather than failing open.
+ */
+function catalogRequired(settings: PrivacySettings): boolean {
+  return settings.privacyDefault === 'private';
+}
+
+// ── Redaction ───────────────────────────────────────────────────────────────
+
+type Resolution =
+  | { readonly kind: 'value'; readonly value: LogPrimitive }
+  | { readonly kind: 'drop' };
+
+const DROP: Resolution = { kind: 'drop' };
+
+/** Record which source owns each of its keys, without reading any value. */
+function claimKeys(
+  owner: Map<string, Record<string, unknown>>,
+  source: LogMetadata | undefined
+): void {
+  if (!source) return;
+  let keys: string[];
+  try {
+    keys = Object.keys(source);
+  } catch {
+    return;
+  }
+  for (const key of keys) {
+    owner.set(key, source as Record<string, unknown>);
+  }
+}
+
+function resolveValue(raw: unknown, settings: PrivacySettings): Resolution {
+  let visibility: PrivacyDefault;
+  let payload: LogPrimitive;
+
+  const marker = inspectMarker(raw);
+  if (marker !== null) {
+    // A marker whose payload failed validation at construction or here —
+    // `pub(someObject as any)` — fails closed rather than rendering.
+    if (marker.kind === 'invalid') return DROP;
+    visibility = marker.kind;
+    payload = marker.payload;
+  } else if (isLogPrimitive(raw)) {
+    visibility = settings.privacyDefault;
+    payload = raw;
+  } else {
+    // Objects, arrays, proxies, functions, symbols, null, NaN, Infinity.
+    return DROP;
+  }
+
+  if (settings.redactAll) return { kind: 'value', value: PRIVATE_PLACEHOLDER };
+  if (visibility === 'public') return { kind: 'value', value: payload };
+  return {
+    kind: 'value',
+    value: privateRevealAllowed() ? payload : PRIVATE_PLACEHOLDER,
+  };
+}
+
+/**
+ * Resolve caller metadata into what destinations may see.
+ *
+ * Takes metadata as ordered sources — a scope's defaults followed by the
+ * call site's — rather than a pre-merged object. Merging eagerly would read
+ * every value before any key was checked, which is exactly what this
+ * function exists to avoid: precedence is settled per key first, then the
+ * winning key is validated, and only a key that survives has its value read.
+ * A getter behind a malformed, reserved, or unapproved key therefore never
+ * runs, and neither does a getter the call site overrode.
+ *
+ * Every rejection — bad key, throwing getter, unsupported value —
+ * increments one count. The count is all that is reported: the diagnostic
+ * itself must not become the leak.
+ *
+ * The result is a frozen null-prototype object. A source whose keys cannot
+ * be enumerated at all (a Proxy with a throwing `ownKeys` trap) contributes
+ * nothing, since there is no key that could be safely counted or described.
+ */
+export function redactMetadata(
+  scopeMetadata: LogMetadata | undefined,
+  callSiteMetadata: LogMetadata | undefined,
+  settings: PrivacySettings
+): RedactedMetadata | undefined {
+  // Two explicit positional sources rather than a collection. A container
+  // in the signature would itself be caller-controlled — a hostile array
+  // could throw from Symbol.iterator, iterate forever, or be a revoked
+  // Proxy — and guarding it is strictly more work than not having one.
+  const owner = new Map<string, Record<string, unknown>>();
+  claimKeys(owner, scopeMetadata);
+  // Second wins on collision: the call site overrides the scope's default.
+  claimKeys(owner, callSiteMetadata);
+  if (owner.size === 0) return undefined;
+
+  const catalog = settings.keyCatalog;
+  const requireCatalog = catalogRequired(settings);
+
+  const result: Record<string, LogPrimitive> = Object.create(null);
+  let dropped = 0;
+
+  for (const [key, source] of owner) {
+    if (key === DROPPED_COUNT_KEY || !isValidMetadataKey(key)) {
+      dropped += 1;
+      continue;
+    }
+    if (catalog !== undefined ? !catalog.has(key) : requireCatalog) {
+      dropped += 1;
+      continue;
+    }
+
+    // Only now — after the key has earned it — is the value touched.
+    let raw: unknown;
+    try {
+      raw = source[key];
+    } catch {
+      dropped += 1;
+      continue;
+    }
+
+    const resolution = resolveValue(raw, settings);
+    if (resolution.kind === 'drop') {
+      dropped += 1;
+      continue;
+    }
+    result[key] = resolution.value;
+  }
+
+  if (dropped > 0) result[DROPPED_COUNT_KEY] = dropped;
+  return Object.freeze(result);
+}

package/src/specs/FileSink.nitro.ts

@@ -0,0 +1,144 @@
+import type { HybridObject } from 'react-native-nitro-modules';
+
+/**
+ * Rotation and retention policy for one log file.
+ *
+ * All numeric fields are validated in TypeScript (finite safe integers,
+ * positive sizes, bounded counts) AND re-clamped natively before integer
+ * conversion — a NaN/Infinity/negative must never trap a Swift/Kotlin cast.
+ */
+export interface RotationConfig {
+  /** Soft threshold; overshoot bounded by one batch. */
+  maxFileSizeBytes: number;
+  /** Archives to retain by count; 0 keeps none. */
+  maxArchivedFilesCount: number;
+  /** Rotate the current file once this old, regardless of size. */
+  maxFileAgeSeconds?: number;
+  /** Gzip archives as they rotate out. */
+  compressArchives: boolean;
+  /** Delete archives older than this even if under the count cap. */
+  maxArchiveAgeSeconds?: number;
+  /** Bound on current file + all archives combined. */
+  maxTotalLogBytes?: number;
+}
+
+/** Why an appendBatch was not accepted. */
+export type RejectReason = 'full' | 'staleGeneration' | 'closed' | 'failed';
+
+/**
+ * Snapshot of sink health. MUST be served from atomics / a short non-I/O
+ * lock — never from the writer queue — so a paused Batcher can poll it while
+ * the writer is stalled on disk.
+ *
+ * Loss fields are per-handle observed counters (monotonic writer totals with
+ * per-handle cursors underneath); observing a loss here does NOT acknowledge
+ * it — acknowledgement happens only after the consolidated loss notice has
+ * durably flushed.
+ */
+export interface SinkStatus {
+  queuedBytes: number;
+  lostBytes: number;
+  lostEntries: number;
+  /** Payload-free degradation bitmask: rotation|gzip|prune|sidecar|protection. */
+  degraded: number;
+}
+
+export interface AppendResult {
+  accepted: boolean;
+  /** Present only when accepted is false. */
+  rejectReason?: RejectReason;
+  queuedBytes: number;
+  lostBytes: number;
+  lostEntries: number;
+  degraded: number;
+}
+
+export interface FlushOutcome {
+  /** True when every previously accepted byte reached storage and fsync. */
+  durable: boolean;
+  timedOut: boolean;
+  pendingBytes: number;
+  queuedBytes: number;
+  lostBytes: number;
+  lostEntries: number;
+  degraded: number;
+}
+
+export interface ClearOutcome {
+  deletedCount: number;
+  failedPaths: string[];
+  /** False when any artifact survived or the deadline elapsed. */
+  durable: boolean;
+  /**
+   * Whether the writer came back with a usable file afterwards.
+   *
+   * Separate from `durable` because they are separate facts and the caller
+   * needs both. A purge can delete everything it was asked to — `durable` —
+   * and still fail to reopen, on a directory that has become unwritable or a
+   * volume that filled. Resuming on `durable` alone hands records to a writer
+   * with nowhere to put them: every one is accepted, then rejected as
+   * `staleGeneration`, then dropped.
+   *
+   * Resume only when both are true. `durable && !rebound` means the deletion
+   * is genuinely complete — which is what a compliance caller asked — but the
+   * destination must stay fenced until an explicit retry gets a live file back.
+   */
+  rebound: boolean;
+}
+
+/**
+ * Dumb native file sink. All intelligence (batching, backpressure, drop
+ * accounting, formatting, redaction) lives in TypeScript; this object only
+ * appends pre-batched text, rotates, compresses, and reports counters.
+ *
+ * One JS FileDestination = one FileSink handle; handles for the same
+ * canonical path share one process-global writer (registry, refcounted,
+ * generation-fenced). Batch = atomic loss unit.
+ */
+export interface FileSink extends HybridObject<{
+  ios: 'swift';
+  android: 'kotlin';
+}> {
+  readonly defaultLogDirectory: string;
+
+  /**
+   * Throws on open failure OR on config conflict with an existing writer.
+   *
+   * `lineFramed` declares that every batch handed to `appendBatch` contains
+   * whole records terminated by `\n`, with no raw newline inside a record.
+   * Only then may the startup scan trim an incomplete trailing record: with
+   * opaque multi-line text a writer cannot tell a torn record from an
+   * intentional one, and trimming would destroy good data. Absent — the
+   * default for a custom formatter that does not declare `framing: 'line'` —
+   * the file is left exactly as the crash left it and recovery is reduced.
+   */
+  open(path: string, rotation?: RotationConfig, lineFramed?: boolean): void;
+
+  /**
+   * Enqueue only — never performs I/O inline. Atomic accept/reject BEFORE
+   * enqueue against the hard shared payload cap; accepted bytes stay
+   * reserved until terminal write completion. entryCount travels with the
+   * queued item for exact loss accounting.
+   */
+  appendBatch(batch: string, entryCount: number): AppendResult;
+
+  /** Non-enqueuing health probe; safe to poll while the writer is stalled. */
+  getStatus(): SinkStatus;
+
+  /** Wall-clock-bounded synchronous drain + fsync. */
+  flush(deadlineMs: number): FlushOutcome;
+
+  /** Deadline-aware disposal; a hung write cannot block forever. */
+  close(deadlineMs: number): FlushOutcome;
+
+  /** Active file + archives, newest first. */
+  getLogFilePaths(): string[];
+
+  /**
+   * Registry-serialized purge of the COMPLETE artifact set (current file,
+   * sidecar, archives, gzip temporaries, staging/recovery files). Bumps the
+   * writer generation; the invoking handle rebinds only after durable
+   * success. Reached via the Logger-layer purge flow, never called ad hoc.
+   */
+  clearLogs(deadlineMs: number): ClearOutcome;
+}

package/src/specs/NativeConsoleSink.nitro.ts

@@ -0,0 +1,21 @@
+import type { HybridObject } from 'react-native-nitro-modules';
+
+/**
+ * Routes pre-formatted lines to the platform's native log stream so JS logs
+ * interleave with native ones — os_log on iOS (Console.app / Xcode), logcat
+ * on Android.
+ *
+ * Levels cross as numeric codes 0–5 (verbose…todo) and map natively:
+ * verbose/debug → .debug, info → .info, warning → .default, error → .error,
+ * todo → .fault (iOS); Log.println priorities on Android.
+ *
+ * Batched like the file sink: one logBatch call per Batcher drain, parallel
+ * primitive arrays, no per-entry struct marshaling.
+ */
+export interface NativeConsoleSink extends HybridObject<{
+  ios: 'swift';
+  android: 'kotlin';
+}> {
+  install(subsystem: string, category: string): void;
+  logBatch(levels: number[], messages: string[]): void;
+}

package/src/types.ts

@@ -0,0 +1,45 @@
+import type { PrivateValue, PublicValue } from './privacy';
+
+export type { PrivateValue, PublicValue };
+
+/** Severity levels, least to most severe. `todo` marks incomplete work and
+ * sorts highest so it always surfaces (SwiftLogger parity). */
+export type LogLevel =
+  'verbose' | 'debug' | 'info' | 'warning' | 'error' | 'todo';
+
+/** Messages accept a thunk so hot-path callers can defer interpolation —
+ * the `@autoclosure` equivalent. The thunk is NOT invoked when the entry is
+ * filtered out or no destination is eligible. */
+export type LazyMessage = string | (() => string);
+
+/** The only value shapes the pipeline can render. */
+export type LogPrimitive = string | number | boolean;
+
+/** Metadata values: a bare primitive, whose visibility follows the privacy
+ * default, or one explicitly marked with `pub()` / `priv()`. */
+export type LogValue = LogPrimitive | PublicValue | PrivateValue;
+
+export type LogMetadata = Record<string, LogValue>;
+
+/** Metadata after redaction — what formatters and destinations see. Privacy
+ * markers are unrepresentable here by construction: every value has already
+ * been resolved to a primitive or replaced by a placeholder. */
+export type RedactedMetadata = Readonly<Record<string, LogPrimitive>>;
+
+/** A single log event, post-redaction. Readonly and frozen at runtime: one
+ * entry fans out to every destination, so no destination may mutate what its
+ * siblings receive. No file/function/line: JS has no `#fileID`, and Hermes
+ * stack parsing is unreliable — subsystems are the filtering mechanism
+ * instead. */
+export interface LogEntry {
+  /** Epoch milliseconds, not a `Date`: `Object.freeze` does not protect a
+   * Date's internal slots, so a destination could `setTime()` the entry its
+   * siblings are about to receive. A number is immutable by construction and
+   * crosses the native bridge unchanged. */
+  readonly timestamp: number;
+  readonly level: LogLevel;
+  readonly message: string;
+  readonly metadata?: RedactedMetadata;
+  readonly correlation?: string;
+  readonly subsystem?: string;
+}

package/src/utf8.ts

@@ -0,0 +1,39 @@
+/**
+ * UTF-8 byte length, without allocating an encoder.
+ *
+ * `TextEncoder` is not guaranteed on every Hermes build this package targets,
+ * and counting is cheaper than encoding when the answer is all that is
+ * wanted. Every byte budget in this package — the sink's payload cap, the
+ * batcher's pending cap, a formatter's truncation limit — is a UTF-8 budget,
+ * because that is what actually reaches the file.
+ *
+ * An unpaired surrogate counts as 3, matching every standard encoder: it has
+ * no UTF-8 form of its own, so encoders substitute U+FFFD, which is three
+ * bytes.
+ */
+export function utf8Length(text: string): number {
+  let bytes = 0;
+  for (let i = 0; i < text.length; i += 1) {
+    const code = text.charCodeAt(i);
+    if (code < 0x80) {
+      bytes += 1;
+    } else if (code < 0x800) {
+      bytes += 2;
+    } else if (code >= 0xd800 && code <= 0xdbff) {
+      const next = text.charCodeAt(i + 1);
+      if (next >= 0xdc00 && next <= 0xdfff) {
+        bytes += 4;
+        i += 1;
+      } else {
+        // Lone high surrogate: encodes as U+FFFD.
+        bytes += 3;
+      }
+    } else if (code >= 0xdc00 && code <= 0xdfff) {
+      // Lone low surrogate: likewise.
+      bytes += 3;
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}