create-nextblock 0.15.8 → 0.15.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nextblock",
-  "version": "0.15.8",
+  "version": "0.15.10",
   "description": "Scaffold a production-ready NextBlock CMS project — the open-source, full-stack AI-native CMS for Next.js 16, Supabase, and Tailwind CSS.",
   "main": "index.js",
   "bin": {

package/templates/nextblock-template/app/ToasterProvider.tsx

@@ -1,17 +1,26 @@
-"use client";
-
-import { Toaster } from "react-hot-toast";
-
-export function ToasterProvider() {
-  return (
-    <Toaster
-      position="top-right"
-      toastOptions={{
-        style: { fontSize: 14 },
-        success: { iconTheme: { primary: '#16a34a', secondary: 'white' } },
-        error: { iconTheme: { primary: '#dc2626', secondary: 'white' } },
-      }}
-    />
-  );
-}
-
+"use client";
+
+import { Toaster } from "react-hot-toast";
+import { Toaster as SonnerToaster } from "sonner";
+
+// Two toast libraries are in use across the app: react-hot-toast in most of the CMS,
+// and sonner in ~19 files (the commerce components, the settings pages, the new
+// inbox). Only react-hot-toast was ever mounted, so every sonner toast — including
+// "added to cart" — was silently discarded. Mount both rather than rewrite the call
+// sites, and keep the two visually aligned.
+export function ToasterProvider() {
+  return (
+    <>
+    <SonnerToaster position="top-right" richColors closeButton />
+    <Toaster
+      position="top-right"
+      toastOptions={{
+        style: { fontSize: 14 },
+        success: { iconTheme: { primary: '#16a34a', secondary: 'white' } },
+        error: { iconTheme: { primary: '#dc2626', secondary: 'white' } },
+      }}
+    />
+    </>
+  );
+}
+

package/templates/nextblock-template/app/actions/contactSellerActions.test.ts

@@ -0,0 +1,280 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+
+/**
+ * The enquiry action is the only unauthenticated, mail-sending endpoint the storefront
+ * exposes, so the tests here are about its guarantees rather than its happy path:
+ *
+ *  - the lead is persisted even when SMTP is dead (that is the entire reason the table
+ *    exists — a store with no payment keys usually has no mail server either);
+ *  - the recipient is never taken from the request;
+ *  - a tripped honeypot looks exactly like a success to the caller.
+ */
+
+const mocks = vi.hoisted(() => ({
+  verifyBotProtection: vi.fn(),
+  sendEmail: vi.fn(),
+  resolveSellerContactEmail: vi.fn(),
+  insert: vi.fn(),
+  productLookup: vi.fn(),
+  throttleCount: vi.fn(),
+  throttleKey: vi.fn(),
+  update: vi.fn(),
+  afterPromises: [] as Promise<unknown>[],
+  requestHeaders: {} as Record<string, string>,
+}));
+
+vi.mock('next/headers', () => ({
+  headers: async () => ({
+    get: (name: string) => mocks.requestHeaders[name.toLowerCase()] ?? null,
+  }),
+}));
+
+// `after` defers work until past the response, so the notification genuinely has not
+// run when the action returns. Capture each deferred promise so a test can await it
+// instead of racing it.
+vi.mock('next/server', () => ({
+  after: (callback: () => unknown) => {
+    const promise = Promise.resolve().then(callback);
+    mocks.afterPromises.push(promise);
+    return promise;
+  },
+}));
+
+/** Wait for everything `after()` deferred, mirroring what the platform does post-response. */
+async function flushAfter(): Promise<void> {
+  await Promise.all(mocks.afterPromises);
+}
+
+vi.mock('../../lib/botProtection/verify', () => ({
+  verifyBotProtection: mocks.verifyBotProtection,
+}));
+
+// Partial mock: the real describeSmtpError is what turns a transport failure into text
+// an admin can act on, so exercise it rather than stubbing it out. resolveFromDomain is
+// stubbed because it reaches for the live SMTP config, which this suite does not model.
+vi.mock('./email', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('./email')>()),
+  sendEmail: mocks.sendEmail,
+  resolveFromDomain: async () => 'example.com',
+}));
+
+vi.mock('../../lib/commerce/seller-contact', () => ({
+  resolveSellerContactEmail: mocks.resolveSellerContactEmail,
+}));
+
+vi.mock('@nextblock-cms/db/server', () => ({
+  getServiceRoleSupabaseClient: () => ({
+    from: (table: string) => {
+      if (table === 'products') {
+        return {
+          select: () => ({ eq: () => ({ maybeSingle: mocks.productLookup }) }),
+        };
+      }
+      return {
+        select: () => ({
+          eq: (_column: string, value: string) => {
+            mocks.throttleKey(value);
+            return { gte: mocks.throttleCount };
+          },
+        }),
+        insert: () => ({ select: () => ({ single: mocks.insert }) }),
+        update: (values: unknown) => {
+          mocks.update(values);
+          return { eq: async () => ({ error: null }) };
+        },
+      };
+    },
+  }),
+}));
+
+import { submitProductInquiry } from './contactSellerActions';
+
+function buildFormData(overrides: Record<string, string> = {}): FormData {
+  const formData = new FormData();
+  formData.set('product_id', 'prod-1');
+  formData.set('name', 'Ada Lovelace');
+  formData.set('email', 'ada@example.com');
+  formData.set('message', 'Can I buy ten of these?');
+  for (const [key, value] of Object.entries(overrides)) formData.set(key, value);
+  return formData;
+}
+
+describe('submitProductInquiry', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.afterPromises.length = 0;
+    mocks.requestHeaders = { 'x-forwarded-for': '203.0.113.7' };
+    mocks.verifyBotProtection.mockResolvedValue({ ok: true });
+    mocks.throttleCount.mockResolvedValue({ count: 0 });
+    mocks.productLookup.mockResolvedValue({
+      data: { id: 'prod-1', title: 'Brass Kettle', slug: 'brass-kettle' },
+    });
+    mocks.insert.mockResolvedValue({ data: { id: 'inq-1' }, error: null });
+    mocks.resolveSellerContactEmail.mockResolvedValue({
+      email: 'owner@example.com',
+      source: 'store_contact',
+    });
+    mocks.sendEmail.mockResolvedValue(undefined);
+  });
+
+  it('stores the enquiry and notifies the resolved seller address', async () => {
+    const result = await submitProductInquiry(null, buildFormData());
+    await flushAfter();
+
+    expect(result).toEqual({ success: true, messageKey: 'ecommerce.contact_seller_sent' });
+    expect(mocks.sendEmail).toHaveBeenCalledOnce();
+
+    const email = mocks.sendEmail.mock.calls[0][0];
+    expect(email.to).toBe('owner@example.com');
+    // The visitor's address goes in Reply-To so the owner can just hit reply.
+    expect(email.replyTo).toBe('ada@example.com');
+    expect(mocks.update).toHaveBeenCalledWith({ email_delivered: true, email_error: null });
+  });
+
+  it('still reports success when the mail server is unconfigured', async () => {
+    mocks.sendEmail.mockRejectedValue(new Error('Email server is not configured.'));
+
+    const result = await submitProductInquiry(null, buildFormData());
+    await flushAfter();
+
+    // The row is the deliverable; the visitor's message really did get through.
+    expect(result.success).toBe(true);
+    expect(mocks.insert).toHaveBeenCalled();
+    // The failure is recorded on the message rather than lost, so the CMS can show
+    // "not emailed" instead of implying the owner was told.
+    expect(mocks.update).toHaveBeenCalledWith(
+      expect.objectContaining({ email_delivered: false })
+    );
+    // And it is recorded as guidance, not as the raw transport text.
+    const recorded = mocks.update.mock.calls.at(-1)?.[0]?.email_error ?? '';
+    expect(recorded).toMatch(/CMS Settings/i);
+  });
+
+  it('ignores any recipient supplied by the client', async () => {
+    await submitProductInquiry(null, buildFormData({ recipient: 'attacker@evil.test' }));
+    await flushAfter();
+
+    expect(mocks.sendEmail.mock.calls[0][0].to).toBe('owner@example.com');
+  });
+
+  it('fakes a success when the honeypot is tripped, writing nothing', async () => {
+    mocks.verifyBotProtection.mockResolvedValue({ ok: false, reason: 'honeypot' });
+
+    const result = await submitProductInquiry(null, buildFormData());
+    await flushAfter();
+
+    expect(result).toEqual({ success: true, messageKey: 'ecommerce.contact_seller_sent' });
+    expect(mocks.insert).not.toHaveBeenCalled();
+    expect(mocks.sendEmail).not.toHaveBeenCalled();
+  });
+
+  it('rejects a malformed email address before touching the database', async () => {
+    const result = await submitProductInquiry(null, buildFormData({ email: 'not-an-email' }));
+
+    expect(result).toEqual({ success: false, messageKey: 'ecommerce.contact_seller_invalid' });
+    expect(mocks.insert).not.toHaveBeenCalled();
+  });
+
+  it('refuses a product id that does not exist', async () => {
+    mocks.productLookup.mockResolvedValue({ data: null });
+
+    const result = await submitProductInquiry(null, buildFormData());
+
+    expect(result).toEqual({ success: false, messageKey: 'ecommerce.contact_seller_invalid' });
+    expect(mocks.insert).not.toHaveBeenCalled();
+  });
+
+  it('throttles a flood from one masked IP', async () => {
+    mocks.throttleCount.mockResolvedValue({ count: 5 });
+
+    const result = await submitProductInquiry(null, buildFormData());
+
+    expect(result).toEqual({ success: false, messageKey: 'ecommerce.contact_seller_throttled' });
+    expect(mocks.insert).not.toHaveBeenCalled();
+  });
+
+  it('uses the stored product title rather than anything the client sent', async () => {
+    await submitProductInquiry(null, buildFormData({ product_title: 'FREE MONEY CLICK HERE' }));
+    await flushAfter();
+
+    const email = mocks.sendEmail.mock.calls[0][0];
+    expect(email.subject).toContain('Brass Kettle');
+    expect(email.subject).not.toContain('FREE MONEY');
+  });
+
+  it('escapes visitor text landing in the HTML body', async () => {
+    await submitProductInquiry(
+      null,
+      buildFormData({ name: '<script>alert(1)</script>', message: 'a < b & c' })
+    );
+    await flushAfter();
+
+    const email = mocks.sendEmail.mock.calls[0][0];
+    expect(email.html).not.toContain('<script>');
+    expect(email.html).toContain('&lt;script&gt;');
+    expect(email.html).toContain('a &lt; b &amp; c');
+  });
+
+  it('still throttles when no address header is present at all', async () => {
+    // Regression: the throttle used to sit inside `if (ipMasked)`, so a request with no
+    // usable address skipped the check entirely — a fail-open an attacker could trigger
+    // just by sending an unparseable header.
+    mocks.requestHeaders = {};
+    mocks.throttleCount.mockResolvedValue({ count: 5 });
+
+    const result = await submitProductInquiry(null, buildFormData());
+
+    expect(result).toEqual({ success: false, messageKey: 'ecommerce.contact_seller_throttled' });
+    expect(mocks.throttleKey).toHaveBeenCalledWith('unknown');
+  });
+
+  it('buckets an unparseable forwarded-for under the shared unknown key', async () => {
+    mocks.requestHeaders = { 'x-forwarded-for': 'nothanks' };
+    mocks.throttleCount.mockResolvedValue({ count: 0 });
+
+    await submitProductInquiry(null, buildFormData());
+
+    expect(mocks.throttleKey).toHaveBeenCalledWith('unknown');
+  });
+
+  it('prefers the platform header over the client-writable forwarded-for', async () => {
+    // x-forwarded-for is client-prependable on an appending proxy, so rotating it must
+    // not mint a fresh throttle bucket when a trusted header is available.
+    mocks.requestHeaders = {
+      'x-forwarded-for': '9.9.9.9',
+      'x-real-ip': '198.51.100.4',
+    };
+    mocks.throttleCount.mockResolvedValue({ count: 0 });
+
+    await submitProductInquiry(null, buildFormData());
+
+    expect(mocks.throttleKey).toHaveBeenCalledWith('198.51.100.x');
+  });
+
+  it('masks the stored address rather than keeping the full IP', async () => {
+    mocks.throttleCount.mockResolvedValue({ count: 0 });
+
+    await submitProductInquiry(null, buildFormData());
+
+    expect(mocks.throttleKey).toHaveBeenCalledWith('203.0.113.x');
+  });
+
+  it('translates a TLS/port mismatch into something the admin can act on', async () => {
+    // The verbatim OpenSSL error a real install hit: SMTP2GO on port 2525 with implicit
+    // TLS left switched on. It names neither TLS mode nor port, so it is stored as
+    // guidance instead.
+    mocks.sendEmail.mockRejectedValue(
+      new Error(
+        'B4730000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:ssl3_record.c:355:'
+      )
+    );
+
+    await submitProductInquiry(null, buildFormData());
+    await flushAfter();
+
+    const recorded = mocks.update.mock.calls.at(-1)?.[0]?.email_error ?? '';
+    expect(recorded).toContain('2525');
+    expect(recorded).toContain('465');
+    expect(recorded).not.toContain('ssl3_get_record');
+  });
+});

package/templates/nextblock-template/app/actions/contactSellerActions.ts

@@ -0,0 +1,222 @@
+'use server';
+
+import { headers } from 'next/headers';
+import { after } from 'next/server';
+import { getServiceRoleSupabaseClient } from '@nextblock-cms/db/server';
+
+import { resolveSellerContactEmail } from '../../lib/commerce/seller-contact';
+import { createThread, notifyAdminOfMessage } from '../../lib/messages/threads';
+import { verifyBotProtection } from '../../lib/botProtection/verify';
+
+/**
+ * Public "contact the seller" enquiry, shown in place of Add-to-Cart when the store
+ * cannot take payment for a product.
+ *
+ * Two rules shape this module:
+ *
+ * 1. The recipient is resolved ENTIRELY server-side. The existing form-block action
+ *    takes its recipient from a bound argument, which means the address travels in the
+ *    client payload; doing that here would publish the shop owner's inbox on every
+ *    product page and turn the store's SMTP credentials into an open relay.
+ *
+ * 2. The database row is the deliverable, not the email. A store with no payment keys
+ *    very often has no SMTP either, so the enquiry is persisted FIRST and the
+ *    notification attempted afterwards. A failed send downgrades to `email_delivered:
+ *    false` — the visitor is still told their message got through, because it did.
+ */
+
+const MAX_NAME_LENGTH = 120;
+const MAX_EMAIL_LENGTH = 254;
+const MAX_MESSAGE_LENGTH = 2000;
+const MAX_USER_AGENT_LENGTH = 500;
+
+/** Per-IP submission cap. Deliberately generous — this is anti-flood, not anti-user. */
+const THROTTLE_WINDOW_MINUTES = 10;
+const THROTTLE_MAX_SUBMISSIONS = 5;
+
+/**
+ * Throttle bucket for a request whose origin cannot be determined. Deliberately a single
+ * shared key: unattributable requests are throttled TOGETHER rather than exempted.
+ *
+ * This is the difference between this helper and the visually similar one in
+ * app/actions/consent.ts. There, a null mask just means one audit row is less precise.
+ * Here the value is load-bearing for a rate limit, so "I could not parse that" must
+ * never be allowed to mean "no limit applies".
+ */
+const UNKNOWN_IP_BUCKET = 'unknown';
+
+/**
+ * Best available client address, preferring headers the platform sets over ones the
+ * client can write.
+ *
+ * `x-forwarded-for` is a list the client can prepend to: on an appending proxy (nginx's
+ * proxy_add_x_forwarded_for, the shape this repo's Dockerfile deploys) its LEFTMOST
+ * entry is attacker-controlled, so keying a throttle on it lets one caller mint a fresh
+ * bucket per request. `x-vercel-forwarded-for` and `x-real-ip` are overwritten by the
+ * proxy on every request, so they are checked first.
+ */
+function firstHop(headerValue: string | null): string | null {
+  const [first] = (headerValue ?? '').split(',');
+  const trimmed = first?.trim() ?? '';
+  return trimmed || null;
+}
+
+function resolveClientIp(requestHeaders: Headers): string | null {
+  return (
+    firstHop(requestHeaders.get('x-vercel-forwarded-for')) ??
+    firstHop(requestHeaders.get('x-real-ip')) ??
+    firstHop(requestHeaders.get('x-forwarded-for'))
+  );
+}
+
+/** Reduce an address to a non-identifying prefix — never store a full IP. */
+function maskIp(ip: string | null): string {
+  if (!ip) return UNKNOWN_IP_BUCKET;
+  if (ip.includes(':')) {
+    const hextets = ip.split(':').filter(Boolean);
+    return `${hextets.slice(0, 3).join(':')}::x`;
+  }
+  const octets = ip.split('.');
+  if (octets.length === 4) {
+    octets[3] = 'x';
+    return octets.join('.');
+  }
+  return UNKNOWN_IP_BUCKET;
+}
+
+function readField(formData: FormData, name: string, maxLength: number): string {
+  const raw = formData.get(name);
+  return typeof raw === 'string' ? raw.trim().slice(0, maxLength) : '';
+}
+
+function isPlausibleEmail(value: string): boolean {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}
+
+export interface ContactSellerState {
+  success: boolean;
+  /** Translation key the client renders, with its own English fallback. */
+  messageKey:
+    | 'ecommerce.contact_seller_sent'
+    | 'ecommerce.contact_seller_error'
+    | 'ecommerce.contact_seller_throttled'
+    | 'ecommerce.contact_seller_invalid'
+    | '';
+  /** Set only for captcha failures, which carry their own provider-specific text. */
+  message?: string;
+}
+
+export async function submitProductInquiry(
+  _prevState: unknown,
+  formData: FormData
+): Promise<ContactSellerState> {
+  const verification = await verifyBotProtection(formData);
+  if (!verification.ok) {
+    // Fake a success for the honeypot so the bot learns nothing about the check.
+    if (verification.reason === 'honeypot') {
+      return { success: true, messageKey: 'ecommerce.contact_seller_sent' };
+    }
+    return { success: false, messageKey: '', message: verification.message };
+  }
+
+  const productId = readField(formData, 'product_id', 64);
+  const senderName = readField(formData, 'name', MAX_NAME_LENGTH);
+  const senderEmail = readField(formData, 'email', MAX_EMAIL_LENGTH);
+  const message = readField(formData, 'message', MAX_MESSAGE_LENGTH);
+  const locale = readField(formData, 'locale', 12) || null;
+
+  if (!productId || !senderName || !senderEmail || !message || !isPlausibleEmail(senderEmail)) {
+    return { success: false, messageKey: 'ecommerce.contact_seller_invalid' };
+  }
+
+  try {
+    const supabase = getServiceRoleSupabaseClient();
+
+    const requestHeaders = await headers();
+    // Always a string, so the throttle below always runs. See UNKNOWN_IP_BUCKET.
+    const ipMasked = maskIp(resolveClientIp(requestHeaders));
+    const userAgent = requestHeaders.get('user-agent');
+
+    const since = new Date(Date.now() - THROTTLE_WINDOW_MINUTES * 60_000).toISOString();
+    const { count } = await supabase
+      .from('product_inquiries')
+      .select('id', { count: 'exact', head: true })
+      .eq('ip_masked', ipMasked)
+      .gte('created_at', since);
+
+    if ((count ?? 0) >= THROTTLE_MAX_SUBMISSIONS) {
+      return { success: false, messageKey: 'ecommerce.contact_seller_throttled' };
+    }
+
+    // Look the product up server-side: a client-supplied title would let anyone send
+    // arbitrary text through the owner's own SMTP identity.
+    const { data: product } = await supabase
+      .from('products')
+      .select('id, title, slug')
+      .eq('id', productId)
+      .maybeSingle();
+
+    if (!product) {
+      return { success: false, messageKey: 'ecommerce.contact_seller_invalid' };
+    }
+
+    const { data: inserted, error: insertError } = await supabase
+      .from('product_inquiries')
+      .insert({
+        product_id: product.id,
+        product_slug: product.slug,
+        product_title: product.title,
+        sender_name: senderName,
+        sender_email: senderEmail,
+        message,
+        locale,
+        ip_masked: ipMasked,
+        user_agent: userAgent ? userAgent.slice(0, MAX_USER_AGENT_LENGTH) : null,
+      })
+      .select('id')
+      .single();
+
+    if (insertError) {
+      console.error('Failed to record product inquiry:', insertError.message);
+      return { success: false, messageKey: 'ecommerce.contact_seller_error' };
+    }
+
+    // Open the conversation this enquiry belongs to. The enquiry row above stays as
+    // the enquiry's own record (and owns the ip_masked the throttle counts); the thread
+    // is what the owner actually replies in.
+    const thread = await createThread({
+      source: 'product_inquiry',
+      subjectId: inserted.id,
+      subjectLabel: product.title,
+      senderName,
+      senderEmail,
+      message,
+      locale,
+      ipMasked,
+      userAgent: userAgent ? userAgent.slice(0, MAX_USER_AGENT_LENGTH) : null,
+    });
+
+    // Notification is best-effort and runs after the response. A bare floating promise
+    // would risk the serverless instance being frozen before the SMTP round trip ends.
+    if (thread) {
+      after(async () => {
+        const { email: recipient } = await resolveSellerContactEmail();
+        await notifyAdminOfMessage({
+          threadId: thread.threadId,
+          source: 'product_inquiry',
+          messageId: thread.messageId,
+          subjectLabel: product.title,
+          senderName,
+          senderEmail,
+          message,
+          recipient,
+        });
+      });
+    }
+
+    return { success: true, messageKey: 'ecommerce.contact_seller_sent' };
+  } catch (error) {
+    console.error('Product inquiry submission failed:', error);
+    return { success: false, messageKey: 'ecommerce.contact_seller_error' };
+  }
+}

package/templates/nextblock-template/app/actions/email-retry.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from 'vitest';
+
+import { describeSmtpError } from './email';
+
+/**
+ * A reply failed with "The mail server did not respond in time" on an install whose
+ * transport verifies in about a second and whose identical send succeeds moments later.
+ * That signature — everything healthy, one send hangs — is a pooled connection the relay
+ * reaped while it sat idle: nodemailer still believes it is open, so the send blocks
+ * until the socket timeout.
+ *
+ * sendEmail now drops the pool and retries once on a fresh connection for that class of
+ * fault only. These cover the classification, which is what decides retry vs report.
+ */
+
+describe('describeSmtpError', () => {
+  it('explains the TLS/port mismatch that produced an unreadable OpenSSL error', () => {
+    const message = describeSmtpError(
+      new Error('B4730000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:ssl3_record.c:355:')
+    );
+    expect(message).toContain('2525');
+    expect(message).toContain('465');
+    expect(message).not.toContain('ssl3_get_record');
+  });
+
+  it('names credentials as the cause of an auth rejection', () => {
+    const error = Object.assign(new Error('Invalid login: 535 authentication failed'), {
+      code: 'EAUTH',
+    });
+    expect(describeSmtpError(error)).toMatch(/username or password/i);
+  });
+
+  it('distinguishes a timeout from an unreachable host', () => {
+    const timeout = Object.assign(new Error('Connection timeout'), { code: 'ETIMEDOUT' });
+    expect(describeSmtpError(timeout)).toMatch(/did not respond in time/i);
+
+    const dns = Object.assign(new Error('getaddrinfo ENOTFOUND smtp.example.com'), {
+      code: 'ENOTFOUND',
+    });
+    expect(describeSmtpError(dns)).toMatch(/hostname could not be resolved/i);
+
+    const refused = Object.assign(new Error('connect ECONNREFUSED'), { code: 'ECONNREFUSED' });
+    expect(describeSmtpError(refused)).toMatch(/refused the connection/i);
+  });
+
+  it('tells an unconfigured install what to do rather than echoing the throw', () => {
+    expect(describeSmtpError(new Error('Email server is not configured.'))).toMatch(
+      /CMS Settings/i
+    );
+  });
+
+  it('passes an unrecognised failure through rather than inventing an explanation', () => {
+    expect(describeSmtpError(new Error('552 5.3.4 Message too big'))).toBe(
+      '552 5.3.4 Message too big'
+    );
+  });
+
+  it('handles a non-Error throw without crashing', () => {
+    expect(describeSmtpError('something odd')).toBe('something odd');
+    expect(describeSmtpError(null)).toBe('null');
+  });
+});