octopize.deploy_tool 2.2.0__tar.gz → 2.3.1__tar.gz

{octopize_deploy_tool-2.2.0 → octopize_deploy_tool-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: octopize.deploy_tool
-Version: 2.2.0
+Version: 2.3.1
 Summary: Deployment configuration tool for Octopize Avatar platform
 Project-URL: Homepage, https://octopize.io
 Project-URL: Documentation, https://docs.octopize.io/docs/deploying/self-hosted
@@ -56,7 +56,7 @@ curl -LsSf https://astral.sh/uv/install.sh | sh
 Then run any command directly:
 
 ```bash
-uvx octopize-deploy-tool deploy --output-dir /app/avatar
+uvx octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 ### Option 2 — virtual environment
@@ -68,7 +68,7 @@ Modern Linux distributions and macOS prevent installing packages into the system
 python -m venv .venv
 source .venv/bin/activate   # Windows: .venv\Scripts\activate
 pip install octopize-deploy-tool
-octopize-deploy-tool deploy --output-dir /app/avatar
+octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 ### Option 3 — global pip
@@ -121,13 +121,13 @@ docker run --rm \
 Generate a Docker deployment configuration interactively:
 
 ```bash
-octopize-deploy-tool deploy --output-dir /app/avatar
+octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 Then start the deployment:
 
 ```bash
-cd /app/avatar
+cd ./app/avatar
 docker compose down --volumes --remove-orphans
 docker compose up -d
 ```
@@ -155,7 +155,7 @@ Use `deploy` to generate a full Docker Compose deployment.
 Example:
 
 ```bash
-octopize-deploy-tool deploy --output-dir /app/avatar
+octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 Common `deploy` options:
@@ -217,7 +217,7 @@ Then run:
 
 ```bash
 octopize-deploy-tool deploy \
-  --output-dir /app/avatar \
+  --output-dir ./app/avatar \
   --config config.yaml \
   --non-interactive
 ```
@@ -227,7 +227,7 @@ octopize-deploy-tool deploy \
 The `deploy` command typically writes:
 
 ```text
-/app/avatar/
+./app/avatar/
 ├── .env
 ├── docker-compose.yml
 ├── nginx/nginx.conf
@@ -252,13 +252,13 @@ for example:
 1. Generate configuration:
 
    ```bash
-   octopize-deploy-tool deploy --output-dir /app/avatar
+   octopize-deploy-tool deploy --output-dir ./app/avatar
    ```
 
 2. Review the generated files:
 
    ```bash
-   cd /app/avatar
+   cd ./app/avatar
    cat .env
    ls -la .secrets/
    ```
@@ -285,7 +285,7 @@ for example:
 Retry with verbose output:
 
 ```bash
-octopize-deploy-tool deploy --output-dir /app/avatar --verbose
+octopize-deploy-tool deploy --output-dir ./app/avatar --verbose
 ```
 
 ### Existing containers cause bind-mount or startup issues

{octopize_deploy_tool-2.2.0 → octopize_deploy_tool-2.3.1}/README.md

@@ -25,7 +25,7 @@ curl -LsSf https://astral.sh/uv/install.sh | sh
 Then run any command directly:
 
 ```bash
-uvx octopize-deploy-tool deploy --output-dir /app/avatar
+uvx octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 ### Option 2 — virtual environment
@@ -37,7 +37,7 @@ Modern Linux distributions and macOS prevent installing packages into the system
 python -m venv .venv
 source .venv/bin/activate   # Windows: .venv\Scripts\activate
 pip install octopize-deploy-tool
-octopize-deploy-tool deploy --output-dir /app/avatar
+octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 ### Option 3 — global pip
@@ -90,13 +90,13 @@ docker run --rm \
 Generate a Docker deployment configuration interactively:
 
 ```bash
-octopize-deploy-tool deploy --output-dir /app/avatar
+octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 Then start the deployment:
 
 ```bash
-cd /app/avatar
+cd ./app/avatar
 docker compose down --volumes --remove-orphans
 docker compose up -d
 ```
@@ -124,7 +124,7 @@ Use `deploy` to generate a full Docker Compose deployment.
 Example:
 
 ```bash
-octopize-deploy-tool deploy --output-dir /app/avatar
+octopize-deploy-tool deploy --output-dir ./app/avatar
 ```
 
 Common `deploy` options:
@@ -186,7 +186,7 @@ Then run:
 
 ```bash
 octopize-deploy-tool deploy \
-  --output-dir /app/avatar \
+  --output-dir ./app/avatar \
   --config config.yaml \
   --non-interactive
 ```
@@ -196,7 +196,7 @@ octopize-deploy-tool deploy \
 The `deploy` command typically writes:
 
 ```text
-/app/avatar/
+./app/avatar/
 ├── .env
 ├── docker-compose.yml
 ├── nginx/nginx.conf
@@ -221,13 +221,13 @@ for example:
 1. Generate configuration:
 
    ```bash
-   octopize-deploy-tool deploy --output-dir /app/avatar
+   octopize-deploy-tool deploy --output-dir ./app/avatar
    ```
 
 2. Review the generated files:
 
    ```bash
-   cd /app/avatar
+   cd ./app/avatar
    cat .env
    ls -la .secrets/
    ```
@@ -254,7 +254,7 @@ for example:
 Retry with verbose output:
 
 ```bash
-octopize-deploy-tool deploy --output-dir /app/avatar --verbose
+octopize-deploy-tool deploy --output-dir ./app/avatar --verbose
 ```
 
 ### Existing containers cause bind-mount or startup issues

{octopize_deploy_tool-2.2.0 → octopize_deploy_tool-2.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "octopize.deploy_tool"
-version = "2.2.0"
+version = "2.3.1"
 description = "Deployment configuration tool for Octopize Avatar platform"
 readme = "README.md"
 requires-python = ">=3.13"

{octopize_deploy_tool-2.2.0 → octopize_deploy_tool-2.3.1}/src/octopize_avatar_deploy/__init__.py

@@ -11,7 +11,7 @@ from .version_compat import (
     validate_template_version,
 )
 
-__version__ = "2.2.0"
+__version__ = "2.3.1"
 __all__ = [
     "main",
     "DeploymentRunner",

{octopize_deploy_tool-2.2.0 → octopize_deploy_tool-2.3.1}/src/octopize_avatar_deploy/defaults.yaml

@@ -1,6 +1,6 @@
 version: 1.0.0
 images:
-  api: 2.73.0
+  api: 2.77.0
   web: 0.63.0
   pdfgenerator: 0.2.3
   seaweedfs: "4.22"

octopize_deploy_tool-2.3.1/src/octopize_avatar_deploy/steps/authentik.py

@@ -0,0 +1,92 @@
+"""Authentik configuration step."""
+
+import secrets
+from typing import Any
+
+from .base import DeploymentStep, PromptConfig
+
+
+class AuthentikStep(DeploymentStep):
+    """Handles Authentik SSO configuration and credentials."""
+
+    name = "authentik"
+    description = "Configure Authentik SSO authentication credentials"
+
+    def collect_config(self) -> dict[str, Any]:
+        """Collect Authentik configuration."""
+        config = {}
+
+        self.printer.print("\n--- Authentik Configuration ---")
+        self.printer.print(
+            "This section configures Authentik, the identity and access management "
+            "service bundled with the Avatar deployment.\n"
+            "\n"
+            "Authentik is used to:\n"
+            "  - store and manage users\n"
+            "  - handle authentication and permissions\n"
+            "  - provide the login flow for Avatar\n"
+            "  - optionally connect to an existing identity provider or directory "
+            "service\n"
+            "\n"
+            "Depending on your setup, Authentik can also be integrated with existing "
+            "user management and SSO systems such as Microsoft Entra ID, Active "
+            "Directory, and other external identity providers.\n"
+            "\n"
+            "Authentik documentation:\n"
+            "https://docs.goauthentik.io/"
+        )
+
+        # Authentik database name and user
+        # These are typically set to default values unless customized
+        authentik_db_name = self.get_config("AUTHENTIK_DATABASE_NAME", "authentik")
+        authentik_db_user = self.get_config("AUTHENTIK_DATABASE_USER", "authentik")
+
+        config["AUTHENTIK_DATABASE_NAME"] = authentik_db_name
+        config["AUTHENTIK_DATABASE_USER"] = authentik_db_user
+
+        # Bootstrap configuration for automated install (skip OOBE)
+        # Default email for akadmin user
+        authentik_bootstrap_email = self.get_config_or_prompt_generic(
+            PromptConfig(
+                config_key="AUTHENTIK_BOOTSTRAP_EMAIL",
+                prompt_message="Enter email address for Authentik admin user (akadmin)",
+                default_value="admin@example.com",
+                prompt_key="authentik.bootstrap_email",
+                help_text=(
+                    "Email address of the initial Authentik administrator account created "
+                    "during bootstrap.\n"
+                    "\n"
+                    "This user will have full administrative access to the Authentik "
+                    "application. It can manage users, authentication flows, providers, "
+                    "integrations, and permissions.\n"
+                    "\n"
+                    "You can create additional super-admin users later if needed.\n"
+                    "\n"
+                    "No signup email is sent to this bootstrap administrator during "
+                    "installation. It is still recommended to use a real, reachable email "
+                    "address for operational clarity and future account management, but this "
+                    "is not strictly required.\n"
+                    "\n"
+                    "This email address can also be used to log in."
+                ),
+            )
+        )
+        config["AUTHENTIK_BOOTSTRAP_EMAIL"] = authentik_bootstrap_email
+
+        # Generate bootstrap credentials (these go in .env, not as secrets)
+        config["AUTHENTIK_BOOTSTRAP_PASSWORD"] = secrets.token_urlsafe(32)
+        config["AUTHENTIK_BOOTSTRAP_TOKEN"] = secrets.token_urlsafe(32)
+
+        # Update self.config so generate_secrets() can access these values
+        self.config.update(config)
+
+        return config
+
+    def generate_secrets(self) -> dict[str, str]:
+        """Generate Authentik-related secrets."""
+        return {
+            "authentik_database_name": self.config["AUTHENTIK_DATABASE_NAME"],
+            "authentik_database_user": self.config["AUTHENTIK_DATABASE_USER"],
+            "authentik_database_password": secrets.token_hex(),
+            "authentik_secret_key": secrets.token_hex(),
+        }

octopize_deploy_tool-2.3.1/src/octopize_avatar_deploy/steps/email.py

@@ -0,0 +1,178 @@
+"""Email configuration step."""
+
+import ipaddress
+from typing import Any
+
+from .base import (
+    DefaultKey,
+    DeploymentStep,
+    PromptConfig,
+    ValidationError,
+    ValidationSuccess,
+    parse_str,
+)
+
+
+def validate_smtp_host(value: str) -> ValidationSuccess[str] | ValidationError:
+    """
+    Validate that the SMTP host is a hostname or domain name, not a raw IP address.
+
+    An empty value is allowed (it means SMTP is not yet configured).
+
+    Args:
+        value: The SMTP host value to validate
+
+    Returns:
+        ValidationSuccess with the host string, or ValidationError with a message
+    """
+    host = str(value).strip()
+
+    if not host:
+        # Empty is allowed — the operator can leave SMTP unconfigured
+        return ValidationSuccess(host)
+
+    # Reject raw IP addresses (both IPv4 and IPv6)
+    try:
+        ipaddress.ip_address(host)
+        return ValidationError(
+            f"'{host}' is a raw IP address. "
+            "SMTP_HOST must be a hostname or domain name, not an IP address. "
+            "Examples: 'smtp.example.com', 'smtp.sendgrid.net', 'mail.example.com'."
+        )
+    except ValueError:
+        pass
+
+    return ValidationSuccess(host)
+
+
+class EmailStep(DeploymentStep):
+    """Handles email configuration and credentials."""
+
+    name = "email"
+    description = "Configure SMTP email settings and credentials"
+
+    def collect_config(self) -> dict[str, Any]:
+        """Collect email configuration."""
+        config = {}
+
+        print("\n--- Email Configuration ---")
+        self.printer.print(
+            "This section configures how the deployment sends outbound emails, mainly "
+            "for Authentik account and password workflows.\n"
+            "\n"
+            "The deployment needs an SMTP server to send emails such as account setup, "
+            "password reset, and other authentication-related messages.\n"
+            "\n"
+            "You can use:\n"
+            "  - your own SMTP provider or mail server\n"
+            "  - an SMTP service provided by Octopize, based on AWS\n"
+            "\n"
+            "If Octopize provides the SMTP service, we will give you the SMTP "
+            "credentials. In that case, the tool could eventually prefill the standard "
+            "connection settings and only ask you for the username and password we "
+            "provide."
+        )
+
+        # SMTP configuration
+        config["SMTP_HOST"] = self.get_config_or_prompt_generic(
+            PromptConfig(
+                config_key="SMTP_HOST",
+                prompt_message="SMTP host",
+                default_value=self.get_default_value("email.smtp.host"),
+                prompt_key="email.smtp_host",
+                parse_and_validate=validate_smtp_host,
+                help_text=(
+                    "Hostname of the outbound SMTP server used to send emails from the "
+                    "deployment.\n"
+                    "\n"
+                    "Use a mail server hostname or domain name, for example:\n"
+                    "  - smtp.gmail.com\n"
+                    "  - smtp.sendgrid.net\n"
+                    "  - mail.example.com\n"
+                    "\n"
+                    "Do not use an IP address here.\n"
+                    "\n"
+                    "This SMTP server is used by Authentik to send emails such as account "
+                    "setup and password reset messages."
+                ),
+            )
+        )
+        config["SMTP_PORT"] = self.get_config_or_prompt_generic(
+            PromptConfig(
+                config_key="SMTP_PORT",
+                prompt_message="SMTP port",
+                default_value=self.get_default_value("email.smtp.port"),
+                prompt_key="email.smtp_port",
+                parse_and_validate=parse_str,
+                help_text=(
+                    "TCP port for the SMTP connection.\n"
+                    "Common values:\n"
+                    "  587  — STARTTLS (recommended)\n"
+                    "  465  — TLS/SSL\n"
+                    "  25   — plain SMTP (often blocked by ISPs)"
+                ),
+            )
+        )
+        config["SMTP_USE_TLS"] = self.get_config("SMTP_USE_TLS", DefaultKey("email.smtp.use_tls"))
+        config["SMTP_START_TLS"] = self.get_config(
+            "SMTP_START_TLS", DefaultKey("email.smtp.start_tls")
+        )
+        config["SMTP_VERIFY"] = self.get_config("SMTP_VERIFY", DefaultKey("email.smtp.verify"))
+        config["SMTP_SENDER_EMAIL"] = self.get_config_or_prompt_generic(
+            PromptConfig(
+                config_key="SMTP_SENDER_EMAIL",
+                prompt_message="SMTP sender email",
+                default_value=self.get_default_value("email.smtp.sender_email"),
+                prompt_key="email.smtp_sender_email",
+                help_text=(
+                    "The From: address used for all outbound emails sent by the deployment.\n"
+                    "\n"
+                    "This address must be authorized to send through the configured SMTP "
+                    "server.\n"
+                    "\n"
+                    "In most cases, you should keep the default or the value recommended for "
+                    "your SMTP setup. Only change it if you have a specific need, for example "
+                    "if your SMTP provider requires the sender address to be the same as the "
+                    "SMTP username.\n"
+                    "\n"
+                    "Example:\n"
+                    "  - noreply@avatar.example.com"
+                ),
+            )
+        )
+        config["SMTP_USERNAME"] = self.get_config_or_prompt_generic(
+            PromptConfig(
+                config_key="SMTP_USERNAME",
+                prompt_message="SMTP username",
+                default_value="",
+                prompt_key="email.smtp_username",
+                help_text=(
+                    "Username for SMTP authentication. Leave blank if your server\n"
+                    "does not require authentication."
+                ),
+            )
+        )
+
+        self.config.update(config)
+
+        return config
+
+    def generate_secrets(self) -> dict[str, str]:
+        """Generate email-related secrets."""
+        secrets_dict = {}
+
+        if self.interactive:
+            smtp_password = self.prompt(
+                "SMTP password (press Enter to skip)",
+                default="",
+                key="email.smtp_password",
+                help_text=(
+                    "Password for SMTP authentication.\n"
+                    "\n"
+                    "Leave blank if your SMTP server does not require a password."
+                ),
+            )
+            if smtp_password:
+                secrets_dict["smtp_password"] = smtp_password
+
+        return secrets_dict

octopize_deploy_tool-2.3.1/src/octopize_avatar_deploy/steps/nginx.py

@@ -0,0 +1,188 @@
+"""Nginx TLS configuration step."""
+
+import socket
+from typing import Any
+
+from .base import DeploymentStep, PromptConfig, parse_bool
+
+
+def is_port_in_use(port: int) -> bool:
+    """Return True if something is already listening on *port* on localhost."""
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.settimeout(1)
+        return sock.connect_ex(("127.0.0.1", port)) == 0
+
+
+class NginxTlsStep(DeploymentStep):
+    """Handles Nginx TLS configuration."""
+
+    name = "nginx_tls"
+    description = "Configure Nginx TLS and HTTP settings"
+
+    def collect_config(self) -> dict[str, Any]:
+        """Collect Nginx TLS and HTTP configuration."""
+        config: dict[str, Any] = {}
+
+        self.printer.print("\n--- Nginx / TLS Configuration ---")
+        self.printer.print(
+            "This section defines how users will reach the deployment through the Nginx "
+            "reverse proxy.\n"
+            "\n"
+            "Here you decide whether Nginx serves plain HTTP or terminates HTTPS/TLS "
+            "directly. If you enable TLS, you will need to provide the certificate and "
+            "private key files used by Nginx.\n"
+            "\n"
+            "If you plan to enable TLS here, the public URL you entered earlier should be "
+            "an HTTPS URL and should match the DNS name covered by your certificate."
+        )
+
+        default_tls_enabled = bool(self.get_default_value("nginx.tls_enabled"))
+        default_http_port = str(self.get_default_value("nginx.http_port"))
+        default_cert_path = self.get_default_value("nginx.ssl_certificate_path")
+        default_key_path = self.get_default_value("nginx.ssl_certificate_key_path")
+
+        # Use generic prompt with boolean parser and yes/no prompt
+        tls_enabled = self.get_config_or_prompt_generic(
+            PromptConfig(
+                config_key="NGINX_TLS_ENABLED",
+                prompt_message="Enable TLS for Nginx?",
+                default_value=default_tls_enabled,
+                prompt_key="nginx_tls.enabled",
+                prompt_function=self.prompt_yes_no,
+                parse_and_validate=parse_bool,
+                help_text=(
+                    "Enable this if Nginx should terminate HTTPS/TLS for the deployment.\n"
+                    "\n"
+                    "Choose yes only if:\n"
+                    "  - the public URL entered earlier is an https:// URL\n"
+                    "  - the DNS name for that URL points to this deployment\n"
+                    "  - you have a valid certificate and private key for that hostname\n"
+                    "\n"
+                    "If you enable TLS, the next prompts will ask for the certificate and "
+                    "key file paths used by Nginx.\n"
+                    "\n"
+                    "If your setup handles TLS elsewhere and Nginx should serve only plain "
+                    "HTTP locally, choose no."
+                ),
+            )
+        )
+
+        config["NGINX_TLS_ENABLED"] = tls_enabled
+
+        if tls_enabled:
+            cert_path = self.get_config_or_prompt_generic(
+                PromptConfig(
+                    config_key="NGINX_SSL_CERTIFICATE_PATH",
+                    prompt_message="Path to TLS certificate (full chain)",
+                    default_value=default_cert_path,
+                    prompt_key="nginx_tls.ssl_certificate_path",
+                    help_text=(
+                        "Path to the TLS certificate file that Nginx will present to clients.\n"
+                        "\n"
+                        "Use a PEM-formatted full-chain certificate file. This should include "
+                        "the server certificate and the intermediate certificates needed by "
+                        "clients.\n"
+                        "\n"
+                        "Expected input:\n"
+                        "  - a readable file path on the current machine\n"
+                        "  - PEM format\n"
+                        "  - full chain certificate\n"
+                        "\n"
+                        "If your certificate is currently in PKCS#12 format, convert it first:\n"
+                        "https://docs.octopize.io/docs/deploying/self-hosted/self_installation#convert-pkcs12-certificate-to-pem-format\n"
+                        "\n"
+                        "Recommended permissions:\n"
+                        "  - certificate file readable by the current user\n"
+                        "  - for example:\n"
+                        "      chmod 644 /app/avatar/tls/server.fullchain.crt\n"
+                        "\n"
+                        "Make sure the file exists and is readable by the current user running "
+                        "the deployment commands."
+                    ),
+                )
+            )
+
+            key_path = self.get_config_or_prompt_generic(
+                PromptConfig(
+                    config_key="NGINX_SSL_CERTIFICATE_KEY_PATH",
+                    prompt_message="Path to TLS private key (decrypted)",
+                    default_value=default_key_path,
+                    prompt_key="nginx_tls.ssl_certificate_key_path",
+                    help_text=(
+                        "Path to the TLS private key file that matches the certificate "
+                        "configured in the previous step.\n"
+                        "\n"
+                        "Use a decrypted private key in PEM format.\n"
+                        "\n"
+                        "Expected input:\n"
+                        "  - a readable file path on the current machine\n"
+                        "  - PEM format\n"
+                        "  - an unencrypted private key that Nginx can read at startup\n"
+                        "  - a key matching the configured certificate\n"
+                        "\n"
+                        "If your key is currently encrypted or bundled in a PKCS#12 archive, "
+                        "convert/export it first using the deployment documentation:\n"
+                        "https://docs.octopize.io/docs/deploying/self-hosted/self_installation#convert-pkcs12-certificate-to-pem-format\n"
+                        "\n"
+                        "Recommended permissions:\n"
+                        "  - private key readable by the current user\n"
+                        "  - private key kept as restrictive as possible\n"
+                        "  - for example:\n"
+                        "      chmod 600 /app/avatar/tls/private/server.decrypted.key\n"
+                        "\n"
+                        "Make sure the file exists and is readable by the current user running "
+                        "the deployment commands."
+                    ),
+                )
+            )
+
+            config["NGINX_SSL_CERTIFICATE_PATH"] = cert_path
+            config["NGINX_SSL_CERTIFICATE_KEY_PATH"] = key_path
+        else:
+            http_port = self.get_config_or_prompt_generic(
+                PromptConfig(
+                    config_key="NGINX_HTTP_PORT",
+                    prompt_message="HTTP port for Nginx",
+                    default_value=default_http_port,
+                    prompt_key="nginx_tls.http_port",
+                    help_text=(
+                        "TCP port on which Nginx will listen for plain HTTP traffic when TLS "
+                        "is disabled.\n"
+                        "\n"
+                        "If you press Enter, the default shown in the prompt will be used.\n"
+                        "\n"
+                        "Common choices:\n"
+                        "  - 8080 for a local or reverse-proxied setup\n"
+                        "  - 80 for a directly exposed HTTP service\n"
+                        "\n"
+                        "Choose a port that is reachable in your deployment setup and not "
+                        "already reserved by another service.\n"
+                        "\n"
+                        "This setting is only used when TLS is disabled in this tool."
+                    ),
+                )
+            )
+
+            config["NGINX_HTTP_PORT"] = http_port
+            config["NGINX_SSL_CERTIFICATE_PATH"] = "/dev/null"
+            config["NGINX_SSL_CERTIFICATE_KEY_PATH"] = "/dev/null"
+
+            try:
+                port_number = int(http_port)
+                if is_port_in_use(port_number):
+                    self.printer.print_warning(
+                        f"Port {http_port} appears to be already in use. "
+                        "This is expected if you are re-running the tool for an existing "
+                        "deployment, but may cause startup failures otherwise."
+                    )
+            except (ValueError, OSError):
+                # ValueError: http_port is not a valid integer (validation handled elsewhere).
+                # OSError: the socket probe itself failed (e.g. unusual network config).
+                # Neither case should block configuration; skip the check silently.
+                pass
+
+        return config
+
+    def generate_secrets(self) -> dict[str, str]:
+        """No secrets needed for Nginx TLS paths."""
+        return {}