@mycadet/credential-executor 0.0.1 → 0.12.6-dev.202610080043.b727a33

package/src/__tests__/managed-reconnect.test.ts

@@ -0,0 +1,250 @@
+/**
+ * Managed CES reconnection test (real entrypoint subprocess).
+ *
+ * Spawns the actual `main.ts` entrypoint and verifies that the CES
+ * sidecar survives the assistant disconnecting and accepts a reconnection,
+ * rather than shutting down when the RPC stream ends.
+ *
+ * This guards the core invariant that CES runs independently of whether the
+ * assistant is actively connected: the assistant container can crash and be
+ * restarted (Kubernetes restarts containers, not the whole pod), and the
+ * restarted assistant must be able to reconnect to a still-running CES.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { createConnection, createServer, type Socket } from "node:net";
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { resolveIpcEndpoint } from "@mycadet/ipc-server-utils";
+import {
+  CES_PROTOCOL_VERSION,
+  type HandshakeAck,
+} from "@mycadet/service-contracts/credential-rpc";
+
+import type { Subprocess } from "bun";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Sleep for the given number of milliseconds. */
+function delay(ms: number): Promise<void> {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+/** Pick a currently-free TCP port by binding to port 0 and reading it back. */
+function pickFreePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.listen(0, () => {
+      const address = srv.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      srv.close(() => (port ? resolve(port) : reject(new Error("no port"))));
+    });
+    srv.on("error", reject);
+  });
+}
+
+/** Poll the health endpoint until it responds OK or the deadline passes. */
+async function waitForHealth(port: number, timeoutMs = 15_000): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const resp = await fetch(`http://127.0.0.1:${port}/healthz`);
+      if (resp.ok) return;
+    } catch {
+      // not up yet
+    }
+    await delay(100);
+  }
+  throw new Error(`CES health endpoint did not come up within ${timeoutMs}ms`);
+}
+
+/** Read the `rpcConnected` field from /readyz. */
+async function readyzRpcConnected(port: number): Promise<boolean> {
+  const resp = await fetch(`http://127.0.0.1:${port}/readyz`);
+  const body = (await resp.json()) as { rpcConnected?: boolean };
+  return body.rpcConnected === true;
+}
+
+/** Wait until the socket path exists (CES has bound the bootstrap socket). */
+async function waitForSocket(
+  socketPath: string,
+  timeoutMs = 10_000,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(socketPath)) return;
+    await delay(50);
+  }
+  throw new Error(`Bootstrap socket did not appear within ${timeoutMs}ms`);
+}
+
+/** Connect to the bootstrap socket, retrying past the listen/connect race. */
+function connectToSocket(
+  socketPath: string,
+  { maxRetries = 40, baseDelayMs = 25 } = {},
+): Promise<Socket> {
+  return new Promise((resolveConn, reject) => {
+    let attempt = 0;
+    const tryConnect = () => {
+      const sock = createConnection(socketPath, () => {
+        sock.removeAllListeners("error");
+        resolveConn(sock);
+      });
+      sock.on("error", (err: NodeJS.ErrnoException) => {
+        sock.destroy();
+        attempt++;
+        if (
+          attempt < maxRetries &&
+          (err.code === "ENOENT" || err.code === "ECONNREFUSED")
+        ) {
+          setTimeout(tryConnect, baseDelayMs);
+        } else {
+          reject(err);
+        }
+      });
+    };
+    tryConnect();
+  });
+}
+
+/** Send a handshake and resolve the resulting ack. */
+function handshake(sock: Socket, sessionId: string): Promise<HandshakeAck> {
+  return new Promise((resolveAck, reject) => {
+    let buffer = "";
+    const timer = setTimeout(() => {
+      sock.removeAllListeners("data");
+      reject(new Error("Timed out waiting for handshake ack"));
+    }, 5_000);
+
+    sock.on("data", (chunk: Buffer) => {
+      buffer += chunk.toString("utf-8");
+      const idx = buffer.indexOf("\n");
+      if (idx === -1) return;
+      const line = buffer.slice(0, idx).trim();
+      clearTimeout(timer);
+      sock.removeAllListeners("data");
+      try {
+        resolveAck(JSON.parse(line) as HandshakeAck);
+      } catch (err) {
+        reject(err as Error);
+      }
+    });
+    sock.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+
+    sock.write(
+      JSON.stringify({
+        type: "handshake_request",
+        protocolVersion: CES_PROTOCOL_VERSION,
+        sessionId,
+      }) + "\n",
+    );
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Test
+// ---------------------------------------------------------------------------
+
+let tmpDir: string | undefined;
+let proc: Subprocess | undefined;
+
+afterEach(async () => {
+  if (proc) {
+    proc.kill("SIGTERM");
+    await Promise.race([proc.exited, delay(3_000)]);
+    proc = undefined;
+  }
+  if (tmpDir) {
+    try {
+      rmSync(tmpDir, { recursive: true, force: true });
+    } catch {
+      /* ok */
+    }
+    tmpDir = undefined;
+  }
+});
+
+describe("managed CES reconnection (real entrypoint)", () => {
+  test("survives an assistant disconnect and accepts a reconnection", async () => {
+    tmpDir = mkdtempSync(join(tmpdir(), "ces-reconnect-"));
+    const dataDir = join(tmpDir, "ces-data");
+    const socketDir = join(tmpDir, "bootstrap");
+    const socketPath = resolveIpcEndpoint("ces", {
+      workspaceDir: socketDir,
+    }).path;
+    const assistantDataMount = join(tmpDir, "assistant-data-ro");
+    mkdirSync(dataDir, { recursive: true });
+    mkdirSync(socketDir, { recursive: true });
+    mkdirSync(join(assistantDataMount, ".cadet"), { recursive: true });
+
+    const healthPort = await pickFreePort();
+    const managedMain = resolve(__dirname, "..", "main.ts");
+
+    proc = Bun.spawn({
+      cmd: [process.execPath, managedMain],
+      env: {
+        ...process.env,
+        CES_MODE: "managed",
+        CES_DATA_DIR: dataDir,
+        CES_BOOTSTRAP_SOCKET_DIR: socketDir,
+        CES_HEALTH_PORT: String(healthPort),
+        CES_ASSISTANT_DATA_MOUNT: assistantDataMount,
+      },
+      stdout: "ignore",
+      stderr: "ignore",
+    });
+
+    // Sidecar comes up and binds the bootstrap socket.
+    await waitForHealth(healthPort);
+    await waitForSocket(socketPath);
+    expect(await readyzRpcConnected(healthPort)).toBe(false);
+
+    // First assistant session connects and completes a handshake.
+    const first = await connectToSocket(socketPath);
+    const ack1 = await handshake(first, "session-1");
+    expect(ack1.accepted).toBe(true);
+
+    // Give /readyz a moment to flip, then confirm CES sees the connection.
+    await delay(200);
+    expect(await readyzRpcConnected(healthPort)).toBe(true);
+
+    // Simulate the assistant pod crashing: drop the connection hard.
+    first.destroy();
+
+    // CES must NOT exit. It should stay healthy, flip rpcConnected back to
+    // false, and re-bind the bootstrap socket to await a reconnection.
+    await waitForSocket(socketPath);
+    expect(proc.killed).toBe(false);
+    const resp = await fetch(`http://127.0.0.1:${healthPort}/healthz`);
+    expect(resp.ok).toBe(true);
+
+    // Wait for the new session's rpcConnected to clear before reconnecting.
+    const cleared = await (async () => {
+      const deadline = Date.now() + 5_000;
+      while (Date.now() < deadline) {
+        if (!(await readyzRpcConnected(healthPort))) return true;
+        await delay(100);
+      }
+      return false;
+    })();
+    expect(cleared).toBe(true);
+
+    // The restarted assistant reconnects and handshakes successfully.
+    const second = await connectToSocket(socketPath);
+    const ack2 = await handshake(second, "session-2");
+    expect(ack2.accepted).toBe(true);
+    expect(ack2.sessionId).toBe("session-2");
+
+    await delay(200);
+    expect(await readyzRpcConnected(healthPort)).toBe(true);
+
+    second.destroy();
+  }, 30_000);
+});

package/src/__tests__/transport.test.ts

@@ -0,0 +1,439 @@
+/**
+ * CES transport tests.
+ *
+ * Verifies:
+ * 1. The managed entrypoint never opens a general localhost command API —
+ *    the only command transport is via the accepted Unix socket stream.
+ * 2. Health probes are served on a dedicated HTTP port, separate from
+ *    the command transport.
+ * 3. Local stdio transports are not accidentally inherited by shell
+ *    subprocesses (the entrypoint does not open TCP listeners).
+ * 4. The CES RPC server correctly performs handshake and dispatches methods.
+ * 5. CES private data paths are correctly resolved for both modes.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { PassThrough } from "node:stream";
+
+import { resolveIpcEndpoint } from "@mycadet/ipc-server-utils";
+import {
+  CES_PROTOCOL_VERSION,
+  type HandshakeAck,
+  type RpcEnvelope,
+} from "@mycadet/service-contracts/credential-rpc";
+
+import {
+  getCesDataRoot,
+  getBootstrapSocketPath,
+  getHealthPort,
+} from "../paths.js";
+import { CesRpcServer, type RpcHandlerRegistry } from "../server.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/**
+ * Create a CesRpcServer wired to in-memory PassThrough streams for testing.
+ */
+function createTestServer(handlers: RpcHandlerRegistry = {}) {
+  const input = new PassThrough();
+  const output = new PassThrough();
+  const logs: string[] = [];
+
+  const server = new CesRpcServer({
+    input,
+    output,
+    handlers,
+    logger: {
+      log: (msg: string) => logs.push(`LOG: ${msg}`),
+      warn: (msg: string) => logs.push(`WARN: ${msg}`),
+      error: (msg: string) => logs.push(`ERROR: ${msg}`),
+    },
+  });
+
+  /**
+   * Collect all output lines from the server.
+   */
+  function collectOutputLines(): string[] {
+    const data = output.read();
+    if (!data) return [];
+    const text = typeof data === "string" ? data : data.toString("utf-8");
+    return text.split("\n").filter((l: string) => l.trim().length > 0);
+  }
+
+  /**
+   * Send a JSON message to the server (newline-delimited).
+   */
+  function send(msg: unknown): void {
+    input.write(JSON.stringify(msg) + "\n");
+  }
+
+  /**
+   * Send a handshake request and read the response.
+   */
+  async function handshake(sessionId = "test-session"): Promise<HandshakeAck> {
+    send({
+      type: "handshake_request",
+      protocolVersion: CES_PROTOCOL_VERSION,
+      sessionId,
+    });
+    // Give the server a tick to process
+    await new Promise((r) => setTimeout(r, 10));
+    const lines = collectOutputLines();
+    expect(lines.length).toBeGreaterThanOrEqual(1);
+    return JSON.parse(lines[0]) as HandshakeAck;
+  }
+
+  /**
+   * Send an RPC request and read the response.
+   */
+  async function rpc(
+    method: string,
+    payload: unknown,
+    id = "1",
+  ): Promise<RpcEnvelope> {
+    send({
+      type: "rpc",
+      id,
+      kind: "request",
+      method,
+      payload,
+      timestamp: new Date().toISOString(),
+    });
+    await new Promise((r) => setTimeout(r, 10));
+    const lines = collectOutputLines();
+    expect(lines.length).toBeGreaterThanOrEqual(1);
+    return JSON.parse(lines[lines.length - 1]) as RpcEnvelope;
+  }
+
+  return {
+    server,
+    input,
+    output,
+    send,
+    collectOutputLines,
+    handshake,
+    rpc,
+    logs,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// 1. Managed entrypoint never opens a generic localhost command API
+// ---------------------------------------------------------------------------
+
+describe("managed entrypoint transport isolation", () => {
+  test("main.ts uses Bun.serve only for health probes (managed mode)", () => {
+    const src = readFileSync(resolve(__dirname, "..", "main.ts"), "utf-8");
+    // Bun.serve is used for the health server in managed mode
+    const bunServeMatches = src.match(/Bun\.serve\(/g);
+    expect(bunServeMatches).not.toBeNull();
+    // There should be exactly 1 Bun.serve call — for health probes only
+    expect(bunServeMatches!.length).toBe(1);
+  });
+
+  test("main.ts uses createNetServer for Unix socket transport", () => {
+    const src = readFileSync(resolve(__dirname, "..", "main.ts"), "utf-8");
+    // Uses node:net createServer for the socket transport (both modes)
+    expect(src).toMatch(/createNetServer/);
+    // The net server never listens on a TCP port (only a socket path)
+    expect(src).not.toMatch(/netServer\.listen\(\d+/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 2. Health probes on dedicated port
+// ---------------------------------------------------------------------------
+
+describe("health probes", () => {
+  test("main.ts serves /healthz and /readyz in managed mode", () => {
+    const src = readFileSync(resolve(__dirname, "..", "main.ts"), "utf-8");
+    expect(src).toMatch(/\/healthz/);
+    expect(src).toMatch(/\/readyz/);
+    // Health server uses Bun.serve on a dedicated port, not the socket
+    expect(src).toMatch(/startHealthServer\(\s*healthPort/);
+    // Kubelet httpGet targets the pod IP, so the probe listener must not
+    // bind loopback-only. Credential routes are gated with isLoopbackAddress.
+    expect(src).not.toMatch(/hostname:\s*"127\.0\.0\.1"/);
+    expect(src).toMatch(/isLoopbackAddress\(/);
+  });
+
+  test("getHealthPort defaults to 8090", () => {
+    // Save and clear env
+    const saved = process.env["CES_HEALTH_PORT"];
+    delete process.env["CES_HEALTH_PORT"];
+    try {
+      expect(getHealthPort()).toBe(8090);
+    } finally {
+      if (saved !== undefined) process.env["CES_HEALTH_PORT"] = saved;
+    }
+  });
+
+  test("getHealthPort respects CES_HEALTH_PORT env var", () => {
+    const saved = process.env["CES_HEALTH_PORT"];
+    process.env["CES_HEALTH_PORT"] = "9999";
+    try {
+      expect(getHealthPort()).toBe(9999);
+    } finally {
+      if (saved !== undefined) {
+        process.env["CES_HEALTH_PORT"] = saved;
+      } else {
+        delete process.env["CES_HEALTH_PORT"];
+      }
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 3. Local socket transport not inherited by subprocesses
+// ---------------------------------------------------------------------------
+
+describe("local entrypoint transport isolation", () => {
+  test("main.ts serves over a Unix socket, never stdio or a TCP listener", () => {
+    const src = readFileSync(resolve(__dirname, "..", "main.ts"), "utf-8");
+    // Socket transport only — no stdio-child transport.
+    expect(src).not.toMatch(/process\.stdin/);
+    expect(src).not.toMatch(/process\.stdout/);
+    // Bun.serve is only used inside the managed-mode health server block
+    // (startHealthServer), never for RPC transport. The RPC transport uses
+    // node:net createServer listening on a Unix socket path.
+    const bunServeMatches = src.match(/Bun\.serve\(/g);
+    expect(bunServeMatches).not.toBeNull();
+    expect(bunServeMatches!.length).toBe(1);
+    // The Bun.serve call must be inside the startHealthServer function, which
+    // is only invoked in managed mode.
+    expect(src).toMatch(/function startHealthServer/);
+    // Never listens on a numeric TCP port for RPC transport.
+    expect(src).not.toMatch(/\.listen\(\d+/);
+  });
+
+  test("main.ts logs to stderr, not stdout (avoids polluting transport)", () => {
+    const src = readFileSync(resolve(__dirname, "..", "main.ts"), "utf-8");
+    // All log output goes to stderr
+    expect(src).toMatch(/process\.stderr\.write/);
+    // Should not use console.log (which writes to stdout)
+    expect(src).not.toMatch(/console\.log\(/);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 4. CES RPC server handshake and dispatch
+// ---------------------------------------------------------------------------
+
+describe("CesRpcServer", () => {
+  test("completes handshake with correct protocol version", async () => {
+    const { server, handshake, input } = createTestServer();
+    const _servePromise = server.serve();
+
+    const ack = await handshake();
+    expect(ack.type).toBe("handshake_ack");
+    expect(ack.accepted).toBe(true);
+    expect(ack.protocolVersion).toBe(CES_PROTOCOL_VERSION);
+    expect(ack.sessionId).toBe("test-session");
+    expect(server.isHandshakeComplete).toBe(true);
+    expect(server.currentSessionId).toBe("test-session");
+
+    server.close();
+    input.end();
+  });
+
+  test("rejects handshake with wrong protocol version", async () => {
+    const { server, send, collectOutputLines, input } = createTestServer();
+    const _servePromise = server.serve();
+
+    send({
+      type: "handshake_request",
+      protocolVersion: "99.99.99",
+      sessionId: "bad-session",
+    });
+
+    await new Promise((r) => setTimeout(r, 10));
+    const lines = collectOutputLines();
+    expect(lines.length).toBeGreaterThanOrEqual(1);
+    const ack = JSON.parse(lines[0]) as HandshakeAck;
+    expect(ack.accepted).toBe(false);
+    expect(ack.reason).toMatch(/Unsupported protocol version/);
+    expect(server.isHandshakeComplete).toBe(false);
+
+    server.close();
+    input.end();
+  });
+
+  test("rejects RPC before handshake", async () => {
+    const { server, send, collectOutputLines, input } = createTestServer();
+    const _servePromise = server.serve();
+
+    send({
+      type: "rpc",
+      id: "1",
+      kind: "request",
+      method: "list_grants",
+      payload: {},
+      timestamp: new Date().toISOString(),
+    });
+
+    await new Promise((r) => setTimeout(r, 10));
+    const lines = collectOutputLines();
+    expect(lines.length).toBeGreaterThanOrEqual(1);
+    const resp = JSON.parse(lines[0]);
+    expect(resp.payload.success).toBe(false);
+    expect(resp.payload.error.code).toBe("HANDSHAKE_REQUIRED");
+
+    server.close();
+    input.end();
+  });
+
+  test("dispatches RPC to registered handler", async () => {
+    const handlers: RpcHandlerRegistry = {
+      list_grants: async (_req: unknown) => {
+        return { grants: [] };
+      },
+    };
+
+    const { server, handshake, rpc, input } = createTestServer(handlers);
+    const _servePromise = server.serve();
+
+    await handshake();
+
+    const resp = await rpc("list_grants", {});
+    expect(resp.kind).toBe("response");
+    expect(resp.method).toBe("list_grants");
+    expect((resp.payload as { grants: unknown[] }).grants).toEqual([]);
+
+    server.close();
+    input.end();
+  });
+
+  test("returns METHOD_NOT_FOUND for unknown methods", async () => {
+    const { server, handshake, rpc, input } = createTestServer();
+    const _servePromise = server.serve();
+
+    await handshake();
+
+    const resp = await rpc("nonexistent_method", {});
+    expect(resp.kind).toBe("response");
+    expect(
+      (resp.payload as { success: boolean; error: { code: string } }).error
+        .code,
+    ).toBe("METHOD_NOT_FOUND");
+
+    server.close();
+    input.end();
+  });
+
+  test("returns HANDLER_ERROR when handler throws", async () => {
+    const handlers: RpcHandlerRegistry = {
+      fail_method: async () => {
+        throw new Error("Intentional test failure");
+      },
+    };
+
+    const { server, handshake, rpc, input } = createTestServer(handlers);
+    const _servePromise = server.serve();
+
+    await handshake();
+
+    const resp = await rpc("fail_method", {});
+    expect(resp.kind).toBe("response");
+    const payload = resp.payload as {
+      success: boolean;
+      error: { code: string; message: string };
+    };
+    expect(payload.error.code).toBe("HANDLER_ERROR");
+    expect(payload.error.message).toMatch(/Intentional test failure/);
+
+    server.close();
+    input.end();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 5. CES private data paths
+// ---------------------------------------------------------------------------
+
+describe("CES data paths", () => {
+  test("local mode data root includes 'protected/credential-executor'", () => {
+    const root = getCesDataRoot("local");
+    expect(root).toMatch(/protected[/\\]credential-executor$/);
+  });
+
+  test("managed mode data root defaults to /ces-data", () => {
+    const savedDir = process.env["CES_DATA_DIR"];
+    delete process.env["CES_DATA_DIR"];
+    try {
+      expect(getCesDataRoot("managed")).toBe("/ces-data");
+    } finally {
+      if (savedDir !== undefined) process.env["CES_DATA_DIR"] = savedDir;
+    }
+  });
+
+  test("managed mode data root respects CES_DATA_DIR env var", () => {
+    const savedDir = process.env["CES_DATA_DIR"];
+    process.env["CES_DATA_DIR"] = "/custom/ces-data";
+    try {
+      expect(getCesDataRoot("managed")).toBe("/custom/ces-data");
+    } finally {
+      if (savedDir !== undefined) {
+        process.env["CES_DATA_DIR"] = savedDir;
+      } else {
+        delete process.env["CES_DATA_DIR"];
+      }
+    }
+  });
+
+  test("local data root is under the Cadet root, not the workspace", () => {
+    const root = getCesDataRoot("local");
+    // Must be under .cadet/protected/, NOT .cadet/workspace/
+    expect(root).toMatch(/\.cadet[/\\]protected[/\\]/);
+    expect(root).not.toMatch(/workspace/);
+  });
+
+  test("getBootstrapSocketPath defaults to /run/ces-bootstrap", () => {
+    const savedDir = process.env["CES_BOOTSTRAP_SOCKET_DIR"];
+    delete process.env["CES_BOOTSTRAP_SOCKET_DIR"];
+    try {
+      expect(getBootstrapSocketPath()).toBe(
+        resolveIpcEndpoint("ces", {
+          workspaceDir: "/run/ces-bootstrap",
+        }).path,
+      );
+    } finally {
+      if (savedDir !== undefined) {
+        process.env["CES_BOOTSTRAP_SOCKET_DIR"] = savedDir;
+      } else {
+        delete process.env["CES_BOOTSTRAP_SOCKET_DIR"];
+      }
+    }
+  });
+
+  test("getBootstrapSocketPath uses CES_BOOTSTRAP_SOCKET_DIR via resolveIpcEndpoint", () => {
+    const savedDir = process.env["CES_BOOTSTRAP_SOCKET_DIR"];
+    const savedWorkspace = process.env["CADET_WORKSPACE_DIR"];
+    process.env["CES_BOOTSTRAP_SOCKET_DIR"] = "/tmp/ces-bootstrap";
+    process.env["CADET_WORKSPACE_DIR"] = "/tmp/ces-ws";
+    try {
+      expect(getBootstrapSocketPath()).toBe(
+        resolveIpcEndpoint("ces", {
+          workspaceDir: "/tmp/ces-bootstrap",
+        }).path,
+      );
+      expect(getBootstrapSocketPath()).not.toBe(
+        resolveIpcEndpoint("ces", { workspaceDir: "/tmp/ces-ws" }).path,
+      );
+    } finally {
+      if (savedDir !== undefined) {
+        process.env["CES_BOOTSTRAP_SOCKET_DIR"] = savedDir;
+      } else {
+        delete process.env["CES_BOOTSTRAP_SOCKET_DIR"];
+      }
+      if (savedWorkspace !== undefined) {
+        process.env["CADET_WORKSPACE_DIR"] = savedWorkspace;
+      } else {
+        delete process.env["CADET_WORKSPACE_DIR"];
+      }
+    }
+  });
+});