your-attention 0.1.0 → 0.1.1

package/dist/src/cloudflare/inbox-object.js

@@ -0,0 +1,338 @@
+// One inbox as one Durable Object. All its changes go through this object one
+// at a time, and it hibernates when idle: agent sockets stay open, and the
+// object rebuilds each connection from the socket's attachment when it wakes.
+import { COOKIE, createHandler } from '../core/http.js';
+import { Inbox } from '../core/inbox.js';
+import { pinKeyError,             } from '../core/pin.js';
+import { agentSocket, pageSocket,                  } from '../core/socket.js';
+import { dataPoint } from '../core/telemetry.js';
+                                             
+import { DurableSqlStorage, R2Blobs } from './storage.js';
+                                       
+
+/** What each agent socket keeps across hibernation. */
+                            
+                                                                    
+                 
+                              
+                                                                                  
+                  
+                              
+                
+                                                           
+                                
+                 
+              
+                                                                                               
+                              
+                                                                                       
+                       
+                                                                                                        
+                                                                                                           
+                    
+ 
+
+/** An unset limit means none. A value that is not a byte count blocks every upload, so a typo never lifts the cap. */
+export function uploadLimit(value                    )                     {
+  if (value === undefined || value.trim() === '') return undefined;
+  const n = Number(value);
+  return Number.isFinite(n) && n >= 0 ? n : 0;
+}
+
+/** A socket closes when it has not answered a heartbeat for this long. Each check wakes the object,
+ * so the limit trades how soon a silent agent shows offline against wakes: about 300 a day with a socket open. */
+const HEARTBEAT_LIMIT_MS = 5 * 60_000;
+                                                        
+
+/** A socket that has not signed in this long after it opened closes. */
+const AUTH_LIMIT_MS = 10_000;
+/** The most agent sockets one inbox serves at once. The platform's own ceiling is 32,768 hibernating sockets per
+ * object, so this is headroom we choose, not a limit we inherit. */
+const MAX_AGENT_SOCKETS = 512;
+/** The most page sockets. They are counted apart from the agents' budget, so no fleet of agents can take the slot the
+ * owner's page needs. */
+const MAX_PAGE_SOCKETS = 16;
+/** A stamp of the object's own ping clock re-writes the socket's attachment at most this often. A page
+ * pings every 2 seconds and the deadline is minutes away, so a finer stamp buys nothing. */
+const PING_STAMP_MS = 10_000;
+
+/** Read a numeric limit from the environment. */
+function limit(value                    )                     {
+  return uploadLimit(value);
+}
+
+/** Redeems invite codes one at a time, so a code with one use left creates one inbox, however many requests race.
+ * The operator sets the uses in KV; this object counts the uses taken. */
+export class RegistryObject {
+                   ctx                    ;
+                   env     ;
+
+  constructor(ctx                    , env     ) {
+    this.ctx = ctx;
+    this.env = env;
+  }
+
+  async fetch(req         )                    {
+    const { code } = (await req.json())                     ;
+    const allowed = Number(await this.env.INVITES.get(`invite:${String(code ?? '')}`)) || 0;
+    // Durable Object storage calls queue behind each other, so this read and write cannot interleave with another request's.
+    const used = (await this.ctx.storage.get        (`used:${code}`)) ?? 0;
+    if (!code || used >= allowed) return Response.json({ ok: false });
+    await this.ctx.storage.put(`used:${code}`, used + 1);
+    return Response.json({ ok: true, left: allowed - used - 1 });
+  }
+}
+
+export class InboxObject {
+                   ctx                    ;
+                   env     ;
+                   inbox       ;
+                   handle                                     ;
+                   sockets = new Map                 ();
+
+  constructor(ctx                    , env     ) {
+    this.ctx = ctx;
+    this.env = env;
+    this.inbox = new Inbox(new DurableSqlStorage(ctx.storage.sql), Date.now, new R2Blobs(env.FILES, ctx.id.toString()), {
+      keepPresence: true,
+      uploadLimitBytes: uploadLimit(env.UPLOAD_LIMIT_BYTES),
+      storageLimitBytes: limit(env.STORAGE_LIMIT_BYTES),
+      shownCardLimit: limit(env.SHOWN_CARDS_LIMIT),
+      attachmentReadsPerDay: limit(env.ATTACHMENT_READS_PER_DAY),
+      // A request gets 10 ms of CPU time on the Workers Free plan, too little to parse a large body or a diagram.
+      // So the posting client checks them, and the page reports what it cannot draw. See SPEC.md, "Checks on the client".
+      clientChecks: true,
+      // The hosted service always counts usage. A single-inbox deployment sends nothing.
+      usageAlwaysOn: env.MODE === 'hosted',
+    });
+    // Open requests keep the object awake and billed, so events go over hibernating WebSockets only.
+    this.handle = createHandler(this.inbox, { heartbeatMs: 2000, streams: false, telemetry: { source: 'hosted', destination: 'the operator of this hosted service', blocked: () => this.usageBlocked() } });
+    // Heartbeats get their answer without waking the object.
+    ctx.setWebSocketAutoResponse(new WebSocketRequestResponsePair('{"type":"ping"}', '{"type":"pong"}'));
+    // Each socket here was open before the object hibernated, and its client already got its hello.
+    for (const ws of ctx.getWebSockets()) this.attach(ws, true);
+  }
+
+  /** `resumed` is set for a socket the object rebuilds after waking, as opposed to one it just accepted. */
+          attach(ws           , resumed = false)       {
+    const a = ws.deserializeAttachment()                    ;
+    if (a.page) {
+      const conn = pageSocket(this.inbox, { send: (t) => ws.send(t), close: (c, r) => ws.close(c, r) }, a.viewer, a.gated ? { unlock: a.unlock } : undefined);
+      this.sockets.set(ws, conn);
+      return conn;
+    }
+    const caller = a.token && a.role ? { token: a.token, role: a.role } : undefined;
+    const conn = agentSocket(this.inbox, a.agent, { send: (t) => ws.send(t), close: (c, r) => ws.close(c, r) }, caller, a.instance, resumed, a.channel === 'off');
+    this.sockets.set(ws, conn);
+    return conn;
+  }
+
+  /** Why this deployment sends no usage counts. Only the hosted service sends them, to its own operator. */
+          usageBlocked()                     {
+    if (this.env.MODE !== 'hosted') return 'a single-inbox deployment sends nothing';
+    if (!this.env.TELEMETRY) return 'this deployment has no usage dataset';
+    return undefined;
+  }
+
+  /** Write each finished day to Analytics Engine. A hosted inbox always sends: its Usage reads as enabled whatever is stored. */
+          sendUsage()       {
+    const usage = this.inbox.usage;
+    const due = usage.due();
+    if (!due.length) return;
+    const s = usage.settings();
+    for (const d of due) {
+      if (s.enabled && !this.usageBlocked()) this.env.TELEMETRY?.writeDataPoint(dataPoint(usage.report(d, 'hosted')));
+      usage.done(d.day);
+    }
+  }
+
+  /** When this socket closes unless it signs in or answers a heartbeat first, and the clock that set that moment.
+   * Two clocks track a socket: the platform's timestamp of the last auto-response pong, and the object's stamp of
+   * the last ping it answered itself. Each covers the time the other may not see, so the later one counts. */
+          socketClock(ws           , now        )                                                                                                            {
+    const a = ws.deserializeAttachment()                    ;
+    const opened = a.connectedAt ?? now;
+    const ping = a.lastPing ?? null;
+    const pong = this.ctx.getWebSocketAutoResponseTimestamp(ws)?.getTime() ?? null;
+    let seen = opened;
+    let source                           = 'open';
+    if (pong !== null) { seen = pong; source = 'pong'; }
+    if (ping !== null && ping >= seen) { seen = ping; source = 'ping'; }
+    // A socket that answers pings but never signed in would stay open for free, so it gets a deadline.
+    const auth = a.token ? Infinity : opened + AUTH_LIMIT_MS;
+    if (auth < seen + HEARTBEAT_LIMIT_MS) return { deadline: auth, source: 'auth', ping, pong };
+    return { deadline: seen + HEARTBEAT_LIMIT_MS, source, ping, pong };
+  }
+
+  /** When this socket closes unless it signs in or answers a heartbeat first. */
+          socketDeadline(ws           , now        )         {
+    return this.socketClock(ws, now).deadline;
+  }
+
+  /** Set the alarm for the next moment `sweep()` has work or a socket reaches its deadline. */
+          async schedule()                {
+    this.sendUsage();
+    const now = Date.now();
+    const at = Math.min(this.inbox.nextDeadline() ?? Infinity, ...this.ctx.getWebSockets().map((ws) => this.socketDeadline(ws, now)));
+    if (at !== Infinity) await this.ctx.storage.setAlarm(Math.max(at, now + 50));
+  }
+
+  /** The open sockets of one kind. A page socket carries its tag from the day it was accepted; one accepted before the
+   * tags existed is an agent's, which is what it was. */
+          socketsOf(kind                  )              {
+    return this.ctx.getWebSockets().filter((ws) => (this.ctx.getTags(ws).includes('page') ? 'page' : 'agent') === kind);
+  }
+
+  async fetch(req         )                    {
+    const url = new URL(req.url);
+    if (url.pathname === '/_init') {
+      // The Worker calls this once per inbox. The object is never reachable from outside without the Worker.
+      const { ownerToken, usage, pin, neverAsk } = (await req.json())                                                                                          ;
+      // A hosted inbox learns its invite id here.
+      if (usage) this.inbox.usage.update({ invite: String(usage.invite ?? '') });
+      if (ownerToken) {
+        try {
+          if (!(await this.inbox.authenticate(ownerToken))) await this.inbox.adoptToken(ownerToken, 'owner from the deployment', 'owner');
+        } catch (e) {
+          return Response.json({ error: `the OWNER_TOKEN secret is wrong: ${(e         ).message}` }, { status: 500 });
+        }
+        return Response.json({ ok: true });
+      }
+      // The Worker checked the key's form already. A key the object refuses creates no inbox.
+      const pinError = pin === undefined ? undefined : pinKeyError(pin, this.inbox.pin.iterations);
+      if (pinError) return Response.json({ error: `pin: ${pinError}` }, { status: 400 });
+      const { token, secret } = await this.inbox.createToken('owner of this hosted inbox', 'owner');
+      // The landing page set the PIN as it created the inbox, and the tab it opens in starts unlocked.
+      if (neverAsk === true) this.inbox.pin.setNeverAsk(true);
+      if (pin === undefined) return Response.json({ owner: secret });
+      // The landing page derived the key. The object stores only its SHA-256.
+      await this.inbox.pin.setKey(pin);
+      return Response.json({ owner: secret, unlock: await this.inbox.pin.issue(token.id) });
+    }
+    if (url.pathname === '/v1/ws' && req.headers.get('upgrade')?.toLowerCase() === 'websocket') {
+      if (url.searchParams.get('page') === '1') {
+        // The page signs in with its cookie, which the browser sends with the upgrade.
+        const auth = req.headers.get('authorization');
+        const secret = auth?.startsWith('Bearer ') ? auth.slice(7).trim() : cookieValue(req.headers.get('cookie'), COOKIE);
+        const token = await this.inbox.authenticate(secret);
+        if (token?.role !== 'owner') return new Response('the page needs the owner token', { status: 401 });
+        // A browser cannot set headers on a WebSocket, so the page sends its unlock token in the address.
+        const gate = await this.inbox.pinGate(token, !auth?.startsWith('Bearer '), url.searchParams.get('unlock'));
+        if (gate.locked) return new Response('this inbox is locked: type its PIN to open it', { status: 423 });
+        // A page is never refused for an agent's sake: the two budgets are counted apart, and nothing active is
+        // killed to admit a newcomer.
+        if (this.socketsOf('page').length >= MAX_PAGE_SOCKETS) return new Response('too many open page sockets', { status: 503 });
+        const pair = new WebSocketPair();
+        const server = pair[1];
+        this.ctx.acceptWebSocket(server, ['page']);
+        const viewer = url.searchParams.get('viewer') ?? undefined;
+        server.serializeAttachment({ page: true, viewer: viewer && /^[\w-]{4,64}$/.test(viewer) ? viewer : undefined, gated: gate.gated, unlock: gate.unlock, agent: '', token: token.id, role: token.role, connectedAt: Date.now() }                           );
+        this.attach(server);
+        await this.schedule();
+        return new Response(null, { status: 101, webSocket: pair[0] });
+      }
+      const agent = url.searchParams.get('agent');
+      if (!agent || agent.length > 80) return new Response('agent is required, at most 80 characters', { status: 400 });
+      const auth = req.headers.get('authorization');
+      const token = auth?.startsWith('Bearer ') ? await this.inbox.authenticate(auth.slice(7).trim()) : undefined;
+      if (auth && !token) return new Response('unknown token', { status: 401 });
+      // Over budget, the newcomer is refused and its client retries; no working session is disconnected to admit it.
+      // Closing an active socket is a denial of service on the agent that holds it, and what it would lose is only
+      // a link: the answers it missed are in storage.
+      if (this.socketsOf('agent').length >= MAX_AGENT_SOCKETS) return new Response('too many open sockets', { status: 503 });
+      const pair = new WebSocketPair();
+      const server = pair[1];
+      this.ctx.acceptWebSocket(server, ['agent']);
+      server.serializeAttachment({ agent, instance: url.searchParams.get('instance') ?? undefined, channel: url.searchParams.get('channel') === 'off' ? 'off' : undefined, token: token?.id, role: token?.role, connectedAt: Date.now() }                           );
+      this.attach(server);
+      await this.schedule();
+      return new Response(null, { status: 101, webSocket: pair[0] });
+    }
+    // The page probes this address with a plain request to classify a failed upgrade, which a browser reports without
+    // a status. 200 says this build serves a page socket here.
+    if (url.pathname === '/v1/ws' && req.method === 'GET' && req.headers.get('upgrade') === null) {
+      await this.schedule();
+      return Response.json({ webSocket: true });
+    }
+    const res = await this.handle(req);
+    await this.schedule();
+    // An answer calls its webhook at once. When the call fails, the alarm moves to its retry.
+    const calls = [...this.inbox.deliveries];
+    if (calls.length) this.ctx.waitUntil?.(Promise.allSettled(calls).then(() => this.schedule()));
+    return res;
+  }
+
+  async webSocketMessage(ws           , message                      )                {
+    const conn = this.sockets.get(ws) ?? this.attach(ws, true);
+    const agent = 'caller' in conn ? conn : undefined;
+    const before = agent?.authenticated ?? true;
+    const text = typeof message === 'string' ? message : new TextDecoder().decode(message);
+    // An awake object answers the ping itself, and the platform may not move its auto-response clock then,
+    // so the object stamps its own clock on the socket before it answers.
+    if (text.includes('"ping"')) {
+      const a = ws.deserializeAttachment()                    ;
+      const now = Date.now();
+      if (now - (a.lastPing ?? 0) >= PING_STAMP_MS) ws.serializeAttachment({ ...a, lastPing: now }                           );
+    }
+    await conn.message(text);
+    // A client that authenticated in its first frame keeps that across hibernation.
+    if (!before && agent?.caller) {
+      const a = ws.deserializeAttachment()                    ;
+      ws.serializeAttachment({ ...a, token: agent.caller.token, role: agent.caller.role }                           );
+    }
+    await this.schedule();
+  }
+
+  async webSocketClose(ws           )                {
+    this.sockets.get(ws)?.close();
+    this.sockets.delete(ws);
+    await this.schedule();
+  }
+
+  async webSocketError(ws           )                {
+    await this.webSocketClose(ws);
+  }
+
+  /** The platform alarm: sweep the inbox, purge old cards, call the answer webhooks that are due, and close sockets that did
+   * not sign in or stopped answering heartbeats. */
+  async alarm()                {
+    // Everything runs inside try/finally: a throw in the sweep used to skip the rescheduling below, and once the
+    // platform's six retries ran out nothing swept again, so a socket it had stopped tracking stayed counted for good.
+    try {
+      this.inbox.sweep();
+      await this.inbox.purge();
+      await this.inbox.deliverAnswers();
+      const now = Date.now();
+      for (const ws of this.ctx.getWebSockets()) {
+        const clock = this.socketClock(ws, now);
+        if (clock.deadline > now) continue;
+        const a = ws.deserializeAttachment()                    ;
+        // One structured line per close. It records both clocks, so a production close shows whether the platform's
+        // pong timestamp moves while the object is awake, which the WebSocket hibernation docs leave open.
+        console.log(JSON.stringify({
+          event: 'socket-close',
+          ...(a.page ? { page: true } : { agent: a.agent, instance: a.instance }),
+          deadline: clock.deadline,
+          now,
+          clock: clock.source,
+          ping: clock.ping,
+          pong: clock.pong,
+        }));
+        this.sockets.get(ws)?.close();
+        this.sockets.delete(ws);
+        ws.close(1001, 'missed heartbeats');
+      }
+    } finally {
+      await this.schedule();
+    }
+  }
+}
+
+function cookieValue(header               , name        )                     {
+  for (const part of (header ?? '').split(';')) {
+    const [k, ...v] = part.trim().split('=');
+    if (k !== name) continue;
+    try { return decodeURIComponent(v.join('=')); } catch { return undefined; }
+  }
+  return undefined;
+}

package/dist/src/cloudflare/storage.js

@@ -0,0 +1,151 @@
+// Storage for the Cloudflare build: the SQLite database of a Durable Object, and R2 for file bytes.
+                                                                                    
+
+/** The part of a Durable Object's SqlStorage this adapter uses. Its calls are synchronous. */
+                          
+                                                                                        
+ 
+
+export class DurableSqlStorage                    {
+                   sql         ;
+                   fts         ;
+  /** The bytes of values and search text, counted once and then kept current with each write. */
+          used                    ;
+
+  constructor(sql         ) {
+    this.sql = sql;
+    sql.exec('CREATE TABLE IF NOT EXISTS docs (collection TEXT NOT NULL, id TEXT NOT NULL, value TEXT NOT NULL, PRIMARY KEY (collection, id))');
+    // Each entry of an index on the collection ends with the rowid, so `first` reads a collection in write order and stops.
+    sql.exec('CREATE INDEX IF NOT EXISTS docs_order ON docs (collection)');
+    let fts = true;
+    try {
+      sql.exec('CREATE VIRTUAL TABLE IF NOT EXISTS search USING fts5(card UNINDEXED, text)');
+      // FTS5 finds a row fast only by its row id, so `search_rows` gives each card the row id of its entry. An inbox
+      // indexed before the map existed fills it once, the first time this table is created.
+      try {
+        sql.exec('CREATE TABLE search_rows (row INTEGER PRIMARY KEY, card TEXT NOT NULL UNIQUE)');
+        sql.exec('INSERT OR IGNORE INTO search_rows (row, card) SELECT rowid, card FROM search');
+      } catch {
+        // The map exists already.
+      }
+    } catch {
+      // Without FTS5, search falls back to a table matched with LIKE.
+      fts = false;
+      sql.exec('CREATE TABLE IF NOT EXISTS search (card TEXT PRIMARY KEY, text TEXT NOT NULL)');
+    }
+    this.fts = fts;
+  }
+
+  get   (collection            , id        )                {
+    const row = this.sql.exec('SELECT value FROM docs WHERE collection = ? AND id = ?', collection, id).toArray()[0];
+    return row ? (JSON.parse(String(row['value']))     ) : undefined;
+  }
+
+  bytes()         {
+    this.used ??= Number(this.sql.exec('SELECT (SELECT COALESCE(SUM(length(value)), 0) FROM docs) + (SELECT COALESCE(SUM(length(text)), 0) FROM search) AS n').toArray()[0]?.['n'] ?? 0);
+    return this.used;
+  }
+
+          change(delta        )       {
+    if (this.used !== undefined) this.used = Math.max(0, this.used + delta);
+  }
+
+          size(collection            , id        )         {
+    return Number(this.sql.exec('SELECT length(value) AS n FROM docs WHERE collection = ? AND id = ?', collection, id).toArray()[0]?.['n'] ?? 0);
+  }
+
+  put   (collection            , id        , value   )       {
+    const text = JSON.stringify(value);
+    // SQLite measures the sizes before and after, so the count matches what length() reports.
+    const old = this.used === undefined ? 0 : this.size(collection, id);
+    this.sql.exec('INSERT INTO docs (collection, id, value) VALUES (?, ?, ?) ON CONFLICT (collection, id) DO UPDATE SET value = excluded.value', collection, id, text);
+    if (this.used !== undefined) this.change(this.size(collection, id) - old);
+  }
+
+  delete(collection            , id        )       {
+    if (this.used !== undefined) this.change(-this.size(collection, id));
+    this.sql.exec('DELETE FROM docs WHERE collection = ? AND id = ?', collection, id);
+  }
+
+  list   (collection            )      {
+    return this.sql.exec('SELECT value FROM docs WHERE collection = ? ORDER BY rowid', collection).toArray().map((r) => JSON.parse(String(r['value']))     );
+  }
+
+  first   (collection            , limit        )      {
+    return this.sql.exec('SELECT value FROM docs WHERE collection = ? ORDER BY rowid LIMIT ?', collection, limit).toArray().map((r) => JSON.parse(String(r['value']))     );
+  }
+
+  count(collection            )         {
+    return Number(this.sql.exec('SELECT COUNT(*) AS n FROM docs WHERE collection = ?', collection).toArray()[0]?.['n'] ?? 0);
+  }
+
+  index(card        , text        )       {
+    if (!this.fts) return this.indexPlain(card, text);
+    const row = this.sql.exec('SELECT row FROM search_rows WHERE card = ?', card).toArray()[0]?.['row'];
+    const indexed = ()         => Number(this.sql.exec('SELECT length(text) AS n FROM search WHERE rowid = (SELECT row FROM search_rows WHERE card = ?)', card).toArray()[0]?.['n'] ?? 0);
+    const old = this.used === undefined || row === undefined ? 0 : indexed();
+    if (row !== undefined) this.sql.exec('DELETE FROM search WHERE rowid = ?', row);
+    if (text) {
+      this.sql.exec('INSERT INTO search_rows (card) VALUES (?) ON CONFLICT (card) DO NOTHING', card);
+      this.sql.exec('INSERT INTO search (rowid, card, text) VALUES ((SELECT row FROM search_rows WHERE card = ?), ?, ?)', card, card, text);
+    } else if (row !== undefined) {
+      this.sql.exec('DELETE FROM search_rows WHERE card = ?', card);
+    }
+    if (this.used !== undefined) this.change((text ? indexed() : 0) - old);
+  }
+
+  /** The search table without FTS5 has the card as its key. */
+          indexPlain(card        , text        )       {
+    const indexed = ()         => Number(this.sql.exec('SELECT COALESCE(SUM(length(text)), 0) AS n FROM search WHERE card = ?', card).toArray()[0]?.['n'] ?? 0);
+    const old = this.used === undefined ? 0 : indexed();
+    this.sql.exec('DELETE FROM search WHERE card = ?', card);
+    if (text) this.sql.exec('INSERT INTO search (card, text) VALUES (?, ?)', card, text);
+    if (this.used !== undefined) this.change(indexed() - old);
+  }
+
+  search(query        , limit        )              {
+    const words = query.split(/\s+/).map((w) => w.replace(/["%_]/g, '')).filter(Boolean);
+    if (!words.length) return [];
+    if (this.fts) {
+      return this.sql.exec('SELECT card, rank FROM search WHERE search MATCH ? ORDER BY rank LIMIT ?', words.map((w) => `"${w}"*`).join(' '), limit)
+        .toArray().map((r) => ({ card: String(r['card']), rank: Number(r['rank']) }));
+    }
+    const where = words.map(() => 'text LIKE ?').join(' AND ');
+    return this.sql.exec(`SELECT card FROM search WHERE ${where} LIMIT ?`, ...words.map((w) => `%${w}%`), limit)
+      .toArray().map((r) => ({ card: String(r['card']), rank: 0 }));
+  }
+
+  close()       {}
+}
+
+/** The part of an R2 bucket this adapter uses. */
+                             
+                                                                                                            
+                                                                                                                     
+                                     
+ 
+
+/** File bytes in R2, under one prefix per inbox. */
+export class R2Blobs                      {
+                   bucket            ;
+                   prefix        ;
+
+  constructor(bucket            , prefix        ) {
+    this.bucket = bucket;
+    this.prefix = prefix;
+  }
+
+  async put(key        , bytes                         , type        )                {
+    await this.bucket.put(`${this.prefix}/${key}`, bytes, { httpMetadata: { contentType: type } });
+  }
+
+  async get(key        )                                                                        {
+    const obj = await this.bucket.get(`${this.prefix}/${key}`);
+    if (!obj) return undefined;
+    return { bytes: new Uint8Array(await obj.arrayBuffer()), type: obj.httpMetadata?.contentType ?? 'application/octet-stream' };
+  }
+
+  async delete(key        )                {
+    await this.bucket.delete(`${this.prefix}/${key}`);
+  }
+}