laneyard 0.1.0 → 0.2.0

package/dist/src/runner/pty.js

@@ -28,30 +28,42 @@ export function startPty(opts) {
     let timedOut = false;
     let timer;
     proc.onData(opts.onData);
+    /**
+     * SIGINT first so fastlane can clean up after itself; SIGKILL five seconds
+     * later if it will not. One path, so cancelling and timing out cannot drift
+     * apart — and so neither can leave the single worker blocked.
+     */
+    const stop = () => {
+        try {
+            proc.kill("SIGINT");
+        }
+        catch {
+            /* already gone */
+        }
+        setTimeout(() => {
+            try {
+                proc.kill("SIGKILL");
+            }
+            catch {
+                /* already gone */
+            }
+        }, 5000);
+    };
+    opts.signal?.addEventListener("abort", stop, { once: true });
     const done = new Promise((resolve) => {
         if (opts.timeoutMs !== undefined) {
             timer = setTimeout(() => {
                 timedOut = true;
-                // SIGINT first: fastlane cleans up after itself. SIGKILL if it keeps stalling.
-                try {
-                    proc.kill("SIGINT");
-                }
-                catch {
-                    /* the process may have died in the meantime */
-                }
-                setTimeout(() => {
-                    try {
-                        proc.kill("SIGKILL");
-                    }
-                    catch {
-                        /* same */
-                    }
-                }, 5000);
+                stop();
             }, opts.timeoutMs);
         }
         proc.onExit(({ exitCode, signal }) => {
             if (timer)
                 clearTimeout(timer);
+            // The listener would otherwise accumulate on every run sharing a
+            // long-lived signal (the queue's per-run AbortController is not one,
+            // but nothing here should depend on that).
+            opts.signal?.removeEventListener("abort", stop);
             // `waitpid` only reports an exit code for a normal end: a process
             // killed by a signal leaves 0, which would pass a cancellation off
             // as a success. We apply the shell convention, 128 + signal, so an

package/dist/src/runner/queue.js

@@ -0,0 +1,114 @@
+/** Statuses from which a run never moves again. */
+const TERMINAL = ["success", "failed", "cancelled", "interrupted"];
+/**
+ * Drains queued runs, one at a time.
+ *
+ * The queue is not held in memory: a run's `queued` status in the database *is*
+ * its place in line. That is what lets the server restart mid-queue and carry
+ * on, and what makes the position shown in the interface the truth rather than
+ * a second copy of it.
+ *
+ * One at a time, globally. A mobile build saturates the machine it runs on, and
+ * two at once are frequently slower than two in sequence.
+ */
+export class RunQueue {
+    runs;
+    job;
+    draining = false;
+    pending = false;
+    closed = false;
+    idlePromise = Promise.resolve();
+    running = new Map();
+    constructor(runs, job) {
+        this.runs = runs;
+        this.job = job;
+    }
+    /** Tells the queue there may be work. Safe to call at any time, from anywhere. */
+    wake() {
+        if (this.closed)
+            return;
+        if (this.draining) {
+            // A call arriving mid-drain is remembered rather than dropped: the drain
+            // may already have read an empty queue and be on its way out.
+            this.pending = true;
+            return;
+        }
+        this.draining = true;
+        this.idlePromise = this.drainUntilQuiet().finally(() => {
+            this.draining = false;
+        });
+    }
+    async drainUntilQuiet() {
+        do {
+            this.pending = false;
+            await this.drain();
+        } while (this.pending && !this.closed);
+    }
+    /** Resolves when the queue has nothing left to do. For tests and shutdown. */
+    async idle() {
+        await this.idlePromise;
+    }
+    async drain() {
+        for (;;) {
+            if (this.closed)
+                return;
+            // One at a time: if something is already in flight — including a run this
+            // process did not start — the queue waits rather than doubling up.
+            if (this.runs.activeCount() > 0)
+                return;
+            const next = this.runs.queued()[0];
+            if (!next)
+                return;
+            const controller = new AbortController();
+            this.running.set(next.id, controller);
+            try {
+                await this.job(next.id, controller.signal);
+            }
+            catch {
+                // A job that throws must not stall every run behind it. `executeRun`
+                // promises not to, but the queue cannot afford to depend on that.
+            }
+            finally {
+                this.running.delete(next.id);
+                // Whatever happened, the run must not still be waiting or in flight.
+                //
+                // Two failures hide here, and both are worse than a wrong status. If the
+                // job returns without moving the run out of `queued` — a project deleted
+                // from config.yml while its run waited, say — the next iteration reads
+                // the same row and calls the job again, forever. And a job that throws
+                // after `executeRun` reached `preparing` leaves a run with no end, which
+                // the interface polls until someone gives up.
+                const after = this.runs.get(next.id);
+                if (after && !TERMINAL.includes(after.status)) {
+                    this.runs.finish(next.id, {
+                        status: "failed",
+                        exitCode: null,
+                        errorSummary: "The run ended unexpectedly",
+                    });
+                }
+            }
+        }
+    }
+    /**
+     * Cancels a run whether it has started or not.
+     *
+     * A run still waiting is finished on the spot: there is nothing to signal, and
+     * making someone wait for a build they have cancelled would be absurd.
+     */
+    cancel(runId) {
+        const active = this.running.get(runId);
+        if (active) {
+            active.abort();
+            return true;
+        }
+        const run = this.runs.get(runId);
+        if (run?.status !== "queued")
+            return false;
+        this.runs.finish(runId, { status: "cancelled", exitCode: null, errorSummary: "Cancelled before it started" });
+        return true;
+    }
+    /** Stops taking new work; the run in flight is left to finish. */
+    close() {
+        this.closed = true;
+    }
+}

package/dist/src/secrets/cipher.js

@@ -0,0 +1,28 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+/**
+ * AES-256-GCM, from Node's standard library — no dependency to audit.
+ *
+ * GCM is authenticated: a modified ciphertext fails to decrypt rather than
+ * producing plausible rubbish, which is what you want for a value that will be
+ * handed to a build as a password.
+ *
+ * Payload format: `v1.<iv>.<tag>.<ciphertext>`, each part base64. The version
+ * prefix exists so the format can be changed without guessing what old rows are.
+ */
+const VERSION = "v1";
+const IV_BYTES = 12; // 96 bits, the size GCM is specified for.
+export function encrypt(plaintext, key) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const body = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return [VERSION, iv.toString("base64"), cipher.getAuthTag().toString("base64"), body.toString("base64")].join(".");
+}
+export function decrypt(payload, key) {
+    const [version, ivB64, tagB64, bodyB64] = payload.split(".");
+    if (version !== VERSION || !ivB64 || !tagB64 || bodyB64 === undefined) {
+        throw new Error("Unrecognised secret format");
+    }
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivB64, "base64"));
+    decipher.setAuthTag(Buffer.from(tagB64, "base64"));
+    return Buffer.concat([decipher.update(Buffer.from(bodyB64, "base64")), decipher.final()]).toString("utf8");
+}

package/dist/src/secrets/key.js

@@ -0,0 +1,40 @@
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+const KEY_BYTES = 32;
+/**
+ * Reads the vault key, creating it on first use.
+ *
+ * The key lives beside the database but never inside it: someone who walks off
+ * with `laneyard.db` gets ciphertext and nothing else.
+ *
+ * A key another user can read is treated as an error rather than a warning —
+ * the same stance `ssh` takes on private keys, and for the same reason: silently
+ * carrying on would make the encryption decorative.
+ */
+export async function loadOrCreateKey(home) {
+    const path = join(home, "key");
+    try {
+        const info = await stat(path);
+        if ((info.mode & 0o077) !== 0) {
+            throw new Error(`Vault key ${path} is readable by other users. Run \`chmod 600 ${path}\` and start again.`);
+        }
+        const key = await readFile(path);
+        if (key.byteLength !== KEY_BYTES) {
+            throw new Error(`Vault key ${path} is ${key.byteLength} bytes, expected ${KEY_BYTES}. ` +
+                "Refusing to guess: move it aside and Laneyard will create a new one, " +
+                "but every stored secret will have to be entered again.");
+        }
+        return key;
+    }
+    catch (cause) {
+        if (cause.code !== "ENOENT")
+            throw cause;
+    }
+    await mkdir(home, { recursive: true });
+    const key = randomBytes(KEY_BYTES);
+    // The mode is set at creation, not after: a `chmod` afterwards leaves a window
+    // during which the key exists and is world-readable.
+    await writeFile(path, key, { mode: 0o600 });
+    return key;
+}

package/dist/src/secrets/vault.js

@@ -0,0 +1,68 @@
+import { scrub } from "../logs/redact.js";
+import { decrypt, encrypt } from "./cipher.js";
+import { loadOrCreateKey } from "./key.js";
+/**
+ * The only component that ever holds a decrypted secret.
+ *
+ * Everything else — the store, the API, the interface — deals in names and
+ * ciphertext. Keeping plaintext to one small file is what makes "a secret never
+ * reaches a log" a claim you can check by reading, rather than a hope.
+ */
+export class Vault {
+    key;
+    store;
+    constructor(key, store) {
+        this.key = key;
+        this.store = store;
+    }
+    static async open(home, store) {
+        return new Vault(await loadOrCreateKey(home), store);
+    }
+    async set(projectSlug, key, value, masked) {
+        this.store.set(projectSlug, key, encrypt(value, this.key), masked);
+    }
+    remove(projectSlug, key) {
+        return this.store.remove(projectSlug, key);
+    }
+    list(projectSlug) {
+        return this.store.list(projectSlug);
+    }
+    listGlobal() {
+        return this.store.listGlobal();
+    }
+    /**
+     * Removes this project's secret values from a piece of text, in one shot.
+     *
+     * Separate from `Redactor`, which is stateful and belongs to a live stream:
+     * reusing that instance here would corrupt its buffer mid-run.
+     */
+    scrub(projectSlug, text) {
+        return scrub(text, this.maskedValues(projectSlug));
+    }
+    /**
+     * Every secret that applies to a project, ready to become environment variables.
+     *
+     * A row that will not decrypt is skipped rather than thrown: a key that was
+     * rotated or a corrupted row should cost one variable, not the whole build.
+     * The run then fails on its own terms, with fastlane saying what was missing.
+     */
+    resolve(projectSlug) {
+        const out = {};
+        for (const [key, payload] of Object.entries(this.store.encrypted(projectSlug))) {
+            try {
+                out[key] = decrypt(payload, this.key);
+            }
+            catch {
+                // Deliberately silent here; the interface reports unreadable secrets.
+            }
+        }
+        return out;
+    }
+    /** The values a run's output must not contain. */
+    maskedValues(projectSlug) {
+        const masked = this.store.maskedKeys(projectSlug);
+        return Object.entries(this.resolve(projectSlug))
+            .filter(([key]) => masked.has(key))
+            .map(([, value]) => value);
+    }
+}

package/dist/src/server/app.js

@@ -7,9 +7,14 @@ import { fileURLToPath } from "node:url";
 import { RunStore } from "../db/runs.js";
 import { Workspace } from "../git/workspace.js";
 import { LogStore } from "../logs/store.js";
+import { executeRun } from "../runner/orchestrate.js";
+import { RunQueue } from "../runner/queue.js";
 import { LoginThrottle, SESSION_COOKIE, SessionStore, verifyPassword } from "./auth.js";
+import { registerFastfileRoutes } from "./routes/fastfile.js";
 import { registerProjectRoutes } from "./routes/projects.js";
+import { registerReadinessRoutes } from "./routes/readiness.js";
 import { registerRunRoutes } from "./routes/runs.js";
+import { registerSecretRoutes } from "./routes/secrets.js";
 import { registerWebSocket } from "./ws.js";
 export async function buildApp(deps) {
     const app = Fastify({ logger: false });
@@ -29,6 +34,68 @@ export async function buildApp(deps) {
             await new Workspace(workspacePath(slug), entry.git_url, entry.git_auth).ensureCloned();
         },
     };
+    // The queue is assembled here rather than in `createServerFromConfig`: its job
+    // needs `runs`, `logs`, the workspace and artifact paths and the sockets, none
+    // of which exist before `ctx` does. It is assigned after the context literal
+    // because the job it drives closes over that very context — hence the field
+    // being optional in the type rather than a cast pretending it is already set.
+    ctx.queue = new RunQueue(ctx.runs, async (runId, signal) => {
+        const run = ctx.runs.get(runId);
+        if (!run)
+            return;
+        const slug = run.projectSlug;
+        const entry = deps.config.project(slug);
+        if (!entry) {
+            // The project was removed from config.yml while this run waited. Ending it
+            // here is what keeps the queue from re-reading the same row for ever.
+            ctx.runs.finish(runId, {
+                status: "failed",
+                exitCode: null,
+                errorSummary: `Project "${slug}" is no longer in the configuration`,
+            });
+            return;
+        }
+        await executeRun({
+            runId,
+            runs: ctx.runs,
+            logs: ctx.logs,
+            workspacePath: ctx.workspacePath(slug),
+            artifactsDir: ctx.artifactsDir(runId),
+            gitUrl: entry.git_url,
+            gitAuth: entry.git_auth,
+            branch: entry.default_branch,
+            // Resolved after the clone, once the repository's laneyard.yml is finally readable.
+            resolveSettings: async () => {
+                const r = await ctx.config.resolve(slug, ctx.workspacePath(slug));
+                return r.settings;
+            },
+            env: process.env,
+            secrets: ctx.vault.resolve(slug),
+            maskedValues: ctx.vault.maskedValues(slug),
+            signal,
+            onChunk: (chunk, offset) => app.broadcastRunChunk?.(runId, chunk, offset),
+        })
+            .then((r) => ctx.sockets?.finish(runId, r.status))
+            .catch((cause) => {
+            // Last safety net. `executeRun` commits to never throwing, but the queue
+            // cannot afford to depend on that: a run left neither finished nor
+            // failed is a row the interface polls until someone gives up.
+            ctx.runs.finish(runId, {
+                status: "failed",
+                exitCode: null,
+                errorSummary: ctx.vault.scrub(slug, `Unexpected failure: ${cause.message}`),
+            });
+            ctx.sockets?.finish(runId, "failed");
+        });
+    });
+    // `ctx.queue` is assigned immediately above; naming it here rather than
+    // reaching through the optional field is what lets every route treat the
+    // queue as simply present.
+    const queue = ctx.queue;
+    app.decorate("queue", queue);
+    // A closed server must stop taking new work: the run in flight is left to
+    // finish, but nothing behind it starts on a server nobody is listening to.
+    app.addHook("onClose", async () => queue.close());
     const throttle = new LoginThrottle();
     app.post("/api/login", async (req, reply) => {
         const { password } = req.body;
@@ -61,6 +128,9 @@ export async function buildApp(deps) {
     ctx.sockets = await registerWebSocket(app, ctx);
     await registerProjectRoutes(app, ctx);
     await registerRunRoutes(app, ctx);
+    await registerSecretRoutes(app, ctx);
+    await registerReadinessRoutes(app, ctx);
+    await registerFastfileRoutes(app, ctx);
     // Resolved from the module's location, not from the data folder:
     // `deps.root` is ~/.laneyard, the built SPA lives in the repository. Two
     // relative positions, depending on whether we're running on the sources

package/dist/src/server/routes/fastfile.js

@@ -0,0 +1,131 @@
+import { join } from "node:path";
+import { FastfileStore } from "../../fastfile/store.js";
+import { Workspace } from "../../git/workspace.js";
+export async function registerFastfileRoutes(app, ctx) {
+    // Stateless: the previous content it keeps in memory during a write lives
+    // on the call stack, not on the instance, so sharing one across requests
+    // costs nothing and mirrors how the other routes reuse a single `Workspace`.
+    const store = new FastfileStore();
+    /**
+     * Common preamble: the project must exist and its clone must be present —
+     * the Fastfile, like the lane list, lives in the repository. Sends the
+     * response itself and returns null on failure so callers can bail out with
+     * a single early return.
+     */
+    const ready = async (slug, reply) => {
+        const entry = ctx.config.project(slug);
+        if (!entry) {
+            reply.code(404).send({ error: "Unknown project" });
+            return null;
+        }
+        try {
+            await ctx.ensureWorkspace(slug);
+        }
+        catch (cause) {
+            reply.code(503).send({ error: cause.message });
+            return null;
+        }
+        const workspacePath = ctx.workspacePath(slug);
+        const resolved = await ctx.config.resolve(slug, workspacePath);
+        return {
+            workspacePath,
+            fastlaneDir: resolved.settings.fastlane_dir,
+            workspace: new Workspace(workspacePath, entry.git_url, entry.git_auth),
+            defaultBranch: entry.default_branch,
+        };
+    };
+    app.get("/api/projects/:slug/fastfile", async (req, reply) => {
+        const { slug } = req.params;
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        try {
+            const [content, dirty, diff] = await Promise.all([
+                store.read(r.workspacePath, r.fastlaneDir),
+                r.workspace.isDirty(),
+                r.workspace.diff(join(r.fastlaneDir, "Fastfile")),
+            ]);
+            return { content, dirty, diff };
+        }
+        catch (cause) {
+            // Unreadable Fastfile — deleted by hand, say — is the same kind of
+            // "could not tell" as an unreadable lane list elsewhere in the API.
+            return reply.code(503).send({ error: cause.message });
+        }
+    });
+    app.put("/api/projects/:slug/fastfile", async (req, reply) => {
+        const { slug } = req.params;
+        const { content } = (req.body ?? {});
+        if (typeof content !== "string") {
+            return reply.code(400).send({ error: "content is required" });
+        }
+        // The one refusal in this file, and not a heuristic: a run in flight is
+        // reading the very file this write would replace, the same reason
+        // `Workspace.prepare` refuses to touch a dirty workspace.
+        if (ctx.runs.hasActiveRun(slug)) {
+            return reply.code(409).send({
+                error: "A run is in progress for this project. Wait for it to finish before editing the Fastfile.",
+            });
+        }
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        // Asks the sidecar for the lanes: that parses the file and lists what it
+        // found, which is exactly the two things that matter here — it still
+        // parses, and the lanes are still there. The introspection cache is keyed
+        // on a hash of the whole fastlane folder, so the changed content here is
+        // what makes the next read of the lane list fresh — no separate
+        // invalidation step needed.
+        const verify = async () => {
+            try {
+                await ctx.lanes(slug, r.workspacePath, r.fastlaneDir);
+                return { ok: true };
+            }
+            catch (cause) {
+                return { ok: false, reason: cause.message };
+            }
+        };
+        const result = await store.write(r.workspacePath, content, verify, r.fastlaneDir);
+        if (!result.ok)
+            return reply.code(400).send({ error: result.reason });
+        return reply.code(204).send();
+    });
+    app.get("/api/projects/:slug/changes", async (req, reply) => {
+        const { slug } = req.params;
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        const [files, diff] = await Promise.all([r.workspace.status(), r.workspace.diff()]);
+        return { files, diff };
+    });
+    app.post("/api/projects/:slug/commit", async (req, reply) => {
+        const { slug } = req.params;
+        const { message } = (req.body ?? {});
+        if (!message)
+            return reply.code(400).send({ error: "A commit message is required" });
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        // Exactly what changed, never `git add -A`: a build leaves files
+        // scattered in the workspace, and this is the one place that must not
+        // scoop them up because they happened to be there.
+        const files = await r.workspace.status();
+        if (files.length === 0)
+            return reply.code(400).send({ error: "Nothing to commit" });
+        await r.workspace.commit(message, files);
+        return reply.code(204).send();
+    });
+    app.post("/api/projects/:slug/push", async (req, reply) => {
+        const { slug } = req.params;
+        const r = await ready(slug, reply);
+        if (!r)
+            return;
+        try {
+            await r.workspace.push(r.defaultBranch);
+            return reply.code(204).send();
+        }
+        catch (cause) {
+            return reply.code(400).send({ error: cause.message });
+        }
+    });
+}

package/dist/src/server/routes/projects.js

@@ -30,6 +30,13 @@ export async function registerProjectRoutes(app, ctx) {
         const { slug } = req.params;
         if (!ctx.config.project(slug))
             return reply.code(404).send({ error: "Unknown project" });
-        return ctx.runs.listByProject(slug);
+        // The whole line is read once and the positions are looked up in it, rather
+        // than asking the database where each of fifty runs stands. The position is
+        // the global one: the queue is shared by every project.
+        const line = ctx.runs.queued().map((r) => r.id);
+        return ctx.runs.listByProject(slug).map((run) => {
+            const at = line.indexOf(run.id);
+            return { ...run, queuePosition: at === -1 ? null : at + 1 };
+        });
     });
 }

package/dist/src/server/routes/readiness.js

@@ -0,0 +1,89 @@
+import { execFile } from "node:child_process";
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { Workspace } from "../../git/workspace.js";
+import { runChecks } from "../../heuristics/readiness.js";
+const exec = promisify(execFile);
+/**
+ * `bundle check` in the workspace, rejecting with what bundler said.
+ *
+ * Installs nothing: the checklist reports, it does not act. The timeout is
+ * generous because bundler resolves the whole Gemfile.lock, and short enough
+ * that a wedged bundler does not hold the request open.
+ */
+async function bundleCheck(cwd) {
+    try {
+        const { stdout } = await exec("bundle", ["check"], { cwd, timeout: 60_000 });
+        return stdout.trim();
+    }
+    catch (cause) {
+        const err = cause;
+        throw new Error((err.stdout || err.stderr || err.message).trim());
+    }
+}
+/** The path of a `fastlane` a run would find, or null. */
+async function findFastlane() {
+    try {
+        const { stdout } = await exec("which", ["fastlane"], { timeout: 5_000 });
+        return stdout.trim() || null;
+    }
+    catch {
+        // A non-zero exit from `which` is the answer "no", not a failure.
+        return null;
+    }
+}
+const exists = async (path) => access(path).then(() => true, () => false);
+export async function registerReadinessRoutes(app, ctx) {
+    /**
+     * Computed only when asked for.
+     *
+     * These checks shell out to git and to bundler, so nothing else in the
+     * interface may trigger them: the tab asks when it is opened, and when the
+     * user presses refresh. Nothing here is cached either — a stale green tick is
+     * worse than a red cross, which is why the answer carries the time it was
+     * produced.
+     */
+    app.get("/api/projects/:slug/readiness", async (req, reply) => {
+        const { slug } = req.params;
+        const entry = ctx.config.project(slug);
+        if (!entry)
+            return reply.code(404).send({ error: "Unknown project" });
+        const workspacePath = ctx.workspacePath(slug);
+        const workspace = new Workspace(workspacePath, entry.git_url, entry.git_auth);
+        // What each lane calls lives in the repository, so the clone has to exist.
+        // A clone that fails is not an error page: it is the reason two of the five
+        // checks cannot answer, and the other three still can.
+        let unreachable = null;
+        try {
+            await ctx.ensureWorkspace(slug);
+        }
+        catch (cause) {
+            unreachable = cause.message;
+        }
+        const resolved = await ctx.config.resolve(slug, workspacePath);
+        const fastlaneDir = resolved?.settings.fastlane_dir ?? "fastlane";
+        const uses = unreachable !== null
+            ? { ok: false, reason: unreachable }
+            : await ctx
+                .uses(slug, workspacePath, fastlaneDir)
+                .then((lanes) => ({ ok: true, value: lanes }))
+                // Broken Fastfile, no Ruby, no fastlane: all of them are "could not
+                // tell", none of them is a 500.
+                .catch((cause) => ({ ok: false, reason: cause.message }));
+        const checks = await runChecks({
+            probeRepository: () => workspace.probeRemote(),
+            dependencies: {
+                workspace: unreachable !== null
+                    ? { ok: false, reason: unreachable }
+                    : { ok: true, value: { hasGemfile: await exists(join(workspacePath, "Gemfile")) } },
+                bundleCheck: () => bundleCheck(workspacePath),
+                findFastlane,
+            },
+            // Names only: the vault never hands a value to anything but a run.
+            secretKeys: ctx.vault.list(slug).map((s) => s.key),
+            uses,
+        });
+        return { checkedAt: new Date().toISOString(), checks };
+    });
+}