@sprqvntrs/bot-verify 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 SPRQVNTRS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,93 @@
+# @sprqvntrs/bot-verify
+
+Verify search-engine crawlers (Googlebot and the wider Google crawler family) against their **officially published IP ranges** and **reverse DNS**, and detect requests that *spoof* a crawler User-Agent from non-crawler IPs.
+
+Ships as raw TypeScript (bundled by the consuming app). Framework-agnostic core plus an optional React Router 7 middleware adapter.
+
+## Why
+
+Bots set `User-Agent: Googlebot` to bypass bot protection while originating from IPs that aren't Google's. This package answers, authoritatively, "is this request really from Google?" — and is built so it will **never** classify a *real* Google crawler as spoofed. When it can't be sure, it returns `uncertain` (callers treat that as pass-through).
+
+## Verdicts
+
+`verify({ userAgent, ip })` resolves to one of:
+
+| verdict | meaning | typical caller action |
+|---|---|---|
+| `not-a-claim` | UA doesn't claim a Google crawler | pass through |
+| `verified` | claims a crawler **and** IP is in Google's ranges (or rDNS-confirmed) | pass through |
+| `spoofed` | claims a crawler but IP is **not** Google's and rDNS does not confirm | block / log / ban |
+| `uncertain` | claims a crawler but client IP unknown, or rDNS inconclusive (DNS error) | **pass through** (never block) |
+
+Decision order: UA claim → valid client IP → IP in published ranges → reverse-DNS forward-confirm. Ranges are seeded from a bundled snapshot (so the store is never empty) and refreshed from Google daily; a failed refresh keeps the last-good list (fail-open).
+
+## Core usage
+
+```ts
+import { createBotVerifier } from '@sprqvntrs/bot-verify';
+
+const verifier = createBotVerifier({
+  rdns: true,            // reverse-DNS confirm on a range miss (default true)
+  rdnsTimeoutMs: 1500,
+  logger: (r) => myLogger.debug('bot-verify', r),
+});
+
+const result = await verifier.verify({ userAgent, ip });
+if (result.verdict === 'spoofed') { /* ... */ }
+```
+
+Other exports: `detectClaimedCrawler`, `getClientIp`, `ipInCidr` / `ipInAnyCidr` / `normalizeIp`, `RangeStore`, `GOOGLE_RANGE_URLS`, `reverseDnsVerify`.
+
+## React Router 7 middleware
+
+`react-router` is an optional peer dependency; only this subpath imports it.
+
+```ts
+// app/root.tsx
+import { createVerifiedBotMiddleware } from '@sprqvntrs/bot-verify/react-router';
+
+export const middleware = [
+  createVerifiedBotMiddleware({
+    mode: process.env.BOT_VERIFY_MODE === 'enforce' ? 'enforce' : 'monitor', // default monitor
+    clientIp: { trustedHeader: 'x-real-ip' },   // trust a header your edge proxy overwrites
+    onSpoof: (e) => {
+      // e.userAgent is ATTACKER-CONTROLLED — strip CR/LF before logging to any parser
+      const ua = e.userAgent.replace(/[\r\n]/g, ' ');
+      logger.warn(`SPOOFED_GOOGLEBOT ip=${e.ip} bot=${e.claimedBot} path=${e.path} ua="${ua}"`);
+    },
+  }),
+  // ...other middleware
+];
+```
+
+- `mode: 'monitor'` (default) logs via `onSpoof` and lets the request through — use this first to confirm zero false positives.
+- `mode: 'enforce'` returns `403 Forbidden` for spoofed requests.
+
+### Client IP — read this
+
+The leftmost `X-Forwarded-For` entry is attacker-controlled and is **never** trusted by default. Configure one of:
+
+- `clientIp: { trustedHeader: 'x-real-ip' }` — when a proxy you control (e.g. nginx with `real_ip_header`) **overwrites** that header with the true client IP. Preferred.
+- `clientIp: { xffTrustedProxyCount: N }` — trust `N` proxies counted from the **right** of `X-Forwarded-For`.
+
+If the client IP can't be resolved, `verify` returns `uncertain` (never blocks).
+
+### Banning via CrowdSec (note)
+
+This package detects and (optionally) returns 403 in-app. For durable firewall-level bans the recommended pattern is to keep enforcement in your IDS: emit a structured `onSpoof` log line and let CrowdSec own remediation — and remember `userAgent` is untrusted (strip CR/LF) and the **ban key must be `event.ip`** (the verifier-derived IP), never anything parsed out of the UA.
+
+## Tests
+
+```sh
+pnpm --filter @sprqvntrs/bot-verify test
+```
+
+## Raw TypeScript
+
+This package ships raw TypeScript (`main` and `types` point at `index.ts`), so a Vite
+consumer (Vite, React Router, Remix) must add the scope to `ssr.noExternal`:
+`ssr: { noExternal: [/^@sprqvntrs\//] }`.
+
+## License
+
+MIT

package/index.ts

@@ -0,0 +1,58 @@
+/**
+ * @sprqvntrs/bot-verify
+ *
+ * Detect spoofed search-engine crawlers by verifying the source IP against
+ * Google's published CIDR ranges and/or reverse-DNS.
+ *
+ * Framework-agnostic core. The React Router 7 middleware adapter is available
+ * at the `@sprqvntrs/bot-verify/react-router` subpath.
+ *
+ * @packageDocumentation
+ */
+
+// =============================================================================
+// Types
+// =============================================================================
+
+export type { BotVerdict, VerifyInput, VerifyResult } from './src/types.js';
+
+// =============================================================================
+// User-Agent detection
+// =============================================================================
+
+export { detectClaimedCrawler, GOOGLE_CRAWLER_TOKENS } from './src/ua.js';
+export type { GoogleCrawlerToken } from './src/ua.js';
+
+// =============================================================================
+// CIDR / IP utilities
+// =============================================================================
+
+export { ipInCidr, ipInAnyCidr, normalizeIp } from './src/cidr.js';
+
+// =============================================================================
+// IP range store
+// =============================================================================
+
+export { parsePrefixes, RangeStore, GOOGLE_RANGE_URLS } from './src/ranges.js';
+export type { RangeStoreOptions } from './src/ranges.js';
+
+// =============================================================================
+// Reverse-DNS verification
+// =============================================================================
+
+export { reverseDnsVerify } from './src/rdns.js';
+export type { ReverseDnsOptions } from './src/rdns.js';
+
+// =============================================================================
+// Core verifier
+// =============================================================================
+
+export { createBotVerifier } from './src/verify.js';
+export type { BotVerifier, BotVerifierOptions } from './src/verify.js';
+
+// =============================================================================
+// Client IP extraction
+// =============================================================================
+
+export { getClientIp } from './src/client-ip.js';
+export type { ClientIpOptions } from './src/client-ip.js';

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@sprqvntrs/bot-verify",
+  "version": "0.1.1",
+  "description": "Verify search-engine crawlers (Googlebot et al.) against their published IP ranges + reverse-DNS, and detect spoofed bots. Framework-agnostic core plus a React Router 7 middleware adapter.",
+  "type": "module",
+  "main": "./index.ts",
+  "types": "./index.ts",
+  "exports": {
+    ".": "./index.ts",
+    "./react-router": "./react-router/index.ts",
+    "./package.json": "./package.json"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SPRQVNTRS/platform.git",
+    "directory": "packages/bot-verify"
+  },
+  "files": [
+    "src/**/*",
+    "react-router/**/*",
+    "index.ts",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "ipaddr.js": "^2.2.0"
+  },
+  "peerDependencies": {
+    "react-router": ">=7.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react-router": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "react-router": "^7.9.5",
+    "typescript": "^5.6.0",
+    "vitest": "^3.2.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "homepage": "https://github.com/SPRQVNTRS/platform/tree/main/packages/bot-verify#readme",
+  "bugs": {
+    "url": "https://github.com/SPRQVNTRS/platform/issues"
+  }
+}

package/react-router/index.ts

@@ -0,0 +1,159 @@
+/**
+ * React Router 7 middleware adapter for `@sprqvntrs/bot-verify`.
+ *
+ * This is the ONLY file in this package that imports from `react-router`.
+ * All other modules are framework-agnostic.
+ *
+ * @packageDocumentation
+ */
+
+import type { MiddlewareFunction } from 'react-router';
+import { getClientIp } from '../src/client-ip.js';
+import { createBotVerifier } from '../src/verify.js';
+import type { BotVerifier, BotVerifierOptions } from '../src/verify.js';
+import type { ClientIpOptions } from '../src/client-ip.js';
+
+export type { BotVerifier, BotVerifierOptions } from '../src/verify.js';
+export type { ClientIpOptions } from '../src/client-ip.js';
+
+/** How the middleware should respond when it detects a spoofed bot. */
+export type EnforcementMode = 'monitor' | 'enforce';
+
+/**
+ * Structured event emitted when a spoofed bot is detected.
+ *
+ * SECURITY NOTE: `userAgent` is attacker-controlled. Before writing it to any
+ * log line that a downstream parser (e.g. CrowdSec, Fail2Ban, Splunk) consumes,
+ * you MUST sanitize it — strip CR (`\r`) and LF (`\n`) characters to prevent
+ * log-injection attacks. The `ip` field is derived from the verifier-resolved
+ * client IP and is safe to use directly as a ban key.
+ */
+export interface SpoofEvent {
+  /** Verifier-derived client IP (safe to use as a ban key). */
+  ip: string | null;
+  /**
+   * Raw User-Agent value — ATTACKER-CONTROLLED. Strip CR/LF before logging
+   * to any structured log parser.
+   */
+  userAgent: string;
+  /** The Google crawler token that was falsely claimed. */
+  claimedBot: string | null;
+  /** URL pathname of the spoofed request. */
+  path: string;
+  /** HTTP method of the spoofed request (GET, POST, …). */
+  httpMethod: string;
+  /** How the spoof verdict was reached. */
+  detectionMethod: 'ip-range' | 'rdns' | 'none';
+  /** Enforcement mode active when the spoof was detected. */
+  mode: EnforcementMode;
+}
+
+/** Options for {@link createVerifiedBotMiddleware}. */
+export interface VerifiedBotMiddlewareOptions {
+  /**
+   * Whether to block spoofed requests or merely observe them.
+   * - `'monitor'` (default): logs the event, lets the request through
+   * - `'enforce'`: returns a 403 Forbidden response
+   */
+  mode?: EnforcementMode;
+  /** Options passed to the client IP extractor. */
+  clientIp?: ClientIpOptions;
+  /**
+   * Pre-created verifier instance. Takes precedence over `verifierOptions`.
+   * Useful for sharing a single verifier across multiple middleware instances.
+   */
+  verifier?: BotVerifier;
+  /**
+   * Options passed to {@link createBotVerifier} when no `verifier` is supplied.
+   */
+  verifierOptions?: BotVerifierOptions;
+  /**
+   * Called when a spoofed bot is detected, in both `monitor` and `enforce` modes.
+   * Errors thrown by this callback are swallowed to prevent spoofed traffic from
+   * crashing legitimate request handling.
+   *
+   * The `event.userAgent` field is ATTACKER-CONTROLLED — sanitize it (strip
+   * CR/LF) before passing it to any structured log parser.
+   */
+  onSpoof?: (event: SpoofEvent) => void;
+  /**
+   * Factory for the 403 response returned in `enforce` mode.
+   * Defaults to `new Response('Forbidden', { status: 403 })`.
+   */
+  forbiddenResponse?: () => Response;
+  /**
+   * Optional pre-filter. When provided and returns `false`, the middleware
+   * skips bot verification entirely and calls `next()`. Useful for excluding
+   * static assets, health-check endpoints, etc.
+   */
+  shouldCheck?: (request: Request) => boolean;
+}
+
+/**
+ * Creates a React Router 7 middleware that detects and optionally blocks
+ * spoofed Google crawler requests.
+ *
+ * Usage in a route file:
+ * ```typescript
+ * import { createVerifiedBotMiddleware } from '@sprqvntrs/bot-verify/react-router';
+ *
+ * export const middleware = [
+ *   createVerifiedBotMiddleware({ mode: 'enforce', onSpoof: (e) => console.warn(e) }),
+ * ];
+ * ```
+ *
+ * @param opts - Middleware configuration
+ */
+export function createVerifiedBotMiddleware(
+  opts?: VerifiedBotMiddlewareOptions,
+): MiddlewareFunction {
+  const mode = opts?.mode ?? 'monitor';
+  const verifier = opts?.verifier ?? createBotVerifier(opts?.verifierOptions);
+  const forbiddenResponse = opts?.forbiddenResponse ?? (() => new Response('Forbidden', { status: 403 }));
+  const onSpoof = opts?.onSpoof;
+  const shouldCheck = opts?.shouldCheck;
+  const clientIpOpts = opts?.clientIp;
+
+  return async (args, next) => {
+    const { request } = args;
+
+    // Pre-filter: skip verification if caller says so
+    if (shouldCheck && !shouldCheck(request)) {
+      return next();
+    }
+
+    const userAgent = request.headers.get('user-agent') ?? '';
+    const ip = getClientIp(request.headers, clientIpOpts);
+
+    const result = await verifier.verify({ userAgent, ip });
+
+    if (result.verdict !== 'spoofed') {
+      return next();
+    }
+
+    const url = new URL(request.url);
+    const event: SpoofEvent = {
+      ip: result.ip,
+      userAgent,
+      claimedBot: result.claimedBot,
+      path: url.pathname,
+      httpMethod: request.method,
+      detectionMethod: result.method,
+      mode,
+    };
+
+    if (onSpoof) {
+      try {
+        onSpoof(event);
+      } catch {
+        // Swallow logger errors — do not let spoofed traffic crash request handling
+      }
+    }
+
+    if (mode === 'enforce') {
+      return forbiddenResponse();
+    }
+
+    return next();
+  };
+}

package/src/__tests__/cidr.test.ts

@@ -0,0 +1,115 @@
+import { describe, it, expect } from 'vitest';
+import { ipInCidr, ipInAnyCidr, normalizeIp } from '../cidr.js';
+
+describe('ipInCidr', () => {
+  describe('IPv4', () => {
+    it('matches an IP inside a /19 block', () => {
+      // 192.178.4.0/27 — IPs .0 through .31 are in range
+      expect(ipInCidr('192.178.4.1', '192.178.4.0/27')).toBe(true);
+    });
+
+    it('does not match an IP outside a /27 block', () => {
+      // .32 is the start of the next /27
+      expect(ipInCidr('192.178.4.32', '192.178.4.0/27')).toBe(false);
+    });
+
+    it('matches the network address itself', () => {
+      expect(ipInCidr('66.249.64.0', '66.249.64.0/19')).toBe(true);
+    });
+
+    it('does not match an IP from a different /19', () => {
+      expect(ipInCidr('66.249.96.1', '66.249.64.0/19')).toBe(false);
+    });
+  });
+
+  describe('IPv6', () => {
+    // From googlebot.json
+    const v6Cidr = '2001:4860:4801:10::/64';
+
+    it('matches a v6 address inside the prefix', () => {
+      expect(ipInCidr('2001:4860:4801:10::1', v6Cidr)).toBe(true);
+    });
+
+    it('does not match a v6 address outside the prefix', () => {
+      expect(ipInCidr('2001:4860:4801:11::1', v6Cidr)).toBe(false);
+    });
+  });
+
+  describe('v4-mapped in v6', () => {
+    it('matches an unwrapped v4-mapped address against an IPv4 CIDR', () => {
+      // ::ffff:66.249.64.1 should unwrap to 66.249.64.1
+      expect(ipInCidr('::ffff:66.249.64.1', '66.249.64.0/19')).toBe(true);
+    });
+
+    it('does not match a v6 CIDR when the IP unwraps to v4', () => {
+      // After unwrapping to v4, kinds differ → false
+      expect(ipInCidr('::ffff:66.249.64.1', '2001:4860:4801:10::/64')).toBe(false);
+    });
+  });
+
+  describe('malformed input', () => {
+    it('returns false for an invalid IP', () => {
+      expect(ipInCidr('not-an-ip', '66.249.64.0/19')).toBe(false);
+    });
+
+    it('returns false for an invalid CIDR', () => {
+      expect(ipInCidr('66.249.64.1', 'not-a-cidr')).toBe(false);
+    });
+
+    it('returns false for empty strings', () => {
+      expect(ipInCidr('', '')).toBe(false);
+    });
+  });
+});
+
+describe('ipInAnyCidr', () => {
+  it('returns true when IP matches at least one CIDR', () => {
+    const cidrs = ['10.0.0.0/8', '192.178.4.0/27'];
+    expect(ipInAnyCidr('192.178.4.5', cidrs)).toBe(true);
+  });
+
+  it('returns false when IP does not match any CIDR', () => {
+    const cidrs = ['10.0.0.0/8', '192.178.4.0/27'];
+    expect(ipInAnyCidr('1.2.3.4', cidrs)).toBe(false);
+  });
+
+  it('returns false for empty CIDR list', () => {
+    expect(ipInAnyCidr('66.249.64.1', [])).toBe(false);
+  });
+});
+
+describe('normalizeIp', () => {
+  it('normalizes a plain IPv4 address', () => {
+    expect(normalizeIp('66.249.64.1')).toBe('66.249.64.1');
+  });
+
+  it('normalizes an IPv6 address to lowercase', () => {
+    const result = normalizeIp('2001:4860:4801:0010::0001');
+    expect(result).toBe('2001:4860:4801:10::1');
+  });
+
+  it('unwraps v4-mapped IPv6 to plain IPv4', () => {
+    expect(normalizeIp('::ffff:66.249.64.1')).toBe('66.249.64.1');
+  });
+
+  it('unwraps v4-mapped IPv6 in hex form', () => {
+    // ::ffff:42f9:4001 = ::ffff:66.249.64.1
+    expect(normalizeIp('::ffff:42f9:4001')).toBe('66.249.64.1');
+  });
+
+  it('returns null for a hostname', () => {
+    expect(normalizeIp('googlebot.com')).toBeNull();
+  });
+
+  it('returns null for an empty string', () => {
+    expect(normalizeIp('')).toBeNull();
+  });
+
+  it('returns null for junk input', () => {
+    expect(normalizeIp('not.an.ip.address')).toBeNull();
+  });
+
+  it('handles bracketed IPv6 (strips brackets)', () => {
+    expect(normalizeIp('[::1]')).toBe('::1');
+  });
+});

package/src/__tests__/client-ip.test.ts

@@ -0,0 +1,104 @@
+import { describe, it, expect } from 'vitest';
+import { getClientIp } from '../client-ip.js';
+
+function makeHeaders(entries: Record<string, string>): Headers {
+  return new Headers(entries);
+}
+
+describe('getClientIp', () => {
+  describe('trustedHeader', () => {
+    it('returns the trusted header value when present and valid', () => {
+      const headers = makeHeaders({
+        'x-real-ip': '1.2.3.4',
+        'x-forwarded-for': '5.6.7.8',
+      });
+      expect(getClientIp(headers, { trustedHeader: 'x-real-ip' })).toBe('1.2.3.4');
+    });
+
+    it('falls back to XFF when trusted header is missing', () => {
+      const headers = makeHeaders({ 'x-forwarded-for': '5.6.7.8' });
+      expect(getClientIp(headers, { trustedHeader: 'x-real-ip' })).toBe('5.6.7.8');
+    });
+
+    it('falls back to XFF when trusted header contains invalid IP', () => {
+      const headers = makeHeaders({
+        'x-real-ip': 'not-an-ip',
+        'x-forwarded-for': '5.6.7.8',
+      });
+      expect(getClientIp(headers, { trustedHeader: 'x-real-ip' })).toBe('5.6.7.8');
+    });
+  });
+
+  describe('XFF with xffTrustedProxyCount', () => {
+    it('returns rightmost entry with count 0 (default)', () => {
+      const headers = makeHeaders({ 'x-forwarded-for': '1.2.3.4, 5.6.7.8' });
+      expect(getClientIp(headers, { xffTrustedProxyCount: 0 })).toBe('5.6.7.8');
+    });
+
+    it('returns second-from-right with count 1', () => {
+      const headers = makeHeaders({ 'x-forwarded-for': '1.2.3.4, 5.6.7.8' });
+      expect(getClientIp(headers, { xffTrustedProxyCount: 1 })).toBe('1.2.3.4');
+    });
+
+    it('handles three entries with count 1', () => {
+      const headers = makeHeaders({
+        'x-forwarded-for': '1.1.1.1, 2.2.2.2, 3.3.3.3',
+      });
+      expect(getClientIp(headers, { xffTrustedProxyCount: 1 })).toBe('2.2.2.2');
+    });
+  });
+
+  describe('SECURITY: forged leftmost entry', () => {
+    it('does NOT return a forged Google IP at position 0 when count is 0', () => {
+      // Attacker forges "66.249.79.2" as leftmost to impersonate Googlebot.
+      // Real edge proxy appended "9.9.9.9". Count=0 → rightmost → 9.9.9.9.
+      const headers = makeHeaders({
+        'x-forwarded-for': '66.249.79.2, 9.9.9.9',
+      });
+      const ip = getClientIp(headers, { xffTrustedProxyCount: 0 });
+      expect(ip).toBe('9.9.9.9');
+      expect(ip).not.toBe('66.249.79.2');
+    });
+
+    it('returns the forged IP only when count explicitly trusts it', () => {
+      // With count=1 we say proxy 9.9.9.9 is trusted and look one step left.
+      // In a real setup you'd only do this if you KNOW 9.9.9.9 is your proxy.
+      const headers = makeHeaders({
+        'x-forwarded-for': '66.249.79.2, 9.9.9.9',
+      });
+      const ip = getClientIp(headers, { xffTrustedProxyCount: 1 });
+      expect(ip).toBe('66.249.79.2');
+    });
+  });
+
+  describe('edge cases', () => {
+    it('returns null when no XFF header', () => {
+      const headers = makeHeaders({});
+      expect(getClientIp(headers)).toBeNull();
+    });
+
+    it('returns null for an invalid IP in XFF', () => {
+      const headers = makeHeaders({ 'x-forwarded-for': 'not-an-ip' });
+      expect(getClientIp(headers)).toBeNull();
+    });
+
+    it('returns null when count exceeds list length', () => {
+      const headers = makeHeaders({ 'x-forwarded-for': '1.2.3.4' });
+      expect(getClientIp(headers, { xffTrustedProxyCount: 5 })).toBeNull();
+    });
+
+    it('normalizes an IPv6 XFF entry', () => {
+      const headers = makeHeaders({
+        'x-forwarded-for': '2001:4860:4801:10::1',
+      });
+      expect(getClientIp(headers)).toBe('2001:4860:4801:10::1');
+    });
+
+    it('normalizes v4-mapped IPv6 in XFF to plain IPv4', () => {
+      const headers = makeHeaders({
+        'x-forwarded-for': '::ffff:1.2.3.4',
+      });
+      expect(getClientIp(headers)).toBe('1.2.3.4');
+    });
+  });
+});