@jimhoyd/urlcode 0.4.1 → 0.4.6

package/docs/policies/throttle.md

@@ -1,103 +0,0 @@
-# Throttle policy
-
-`policies.throttle` gives each client, route or client-route pair a request
-budget: `quota` requests per `window` seconds. The runtime counts requests in
-a sliding window (two fixed windows blended by elapsed time, the usual middle
-ground between a fixed window that bursts at its edges and a token bucket
-that is hard to explain in a header) and refuses the request that would
-exceed the budget before it reads a body or reaches the sandbox. Refused
-requests are not counted, so a retrying client cannot keep its own window
-from clearing.
-
-```yaml
-version: "1"
-policies:
-  throttle:
-    quota: 120          # requests
-    window: 60          # seconds
-    partition: client   # client | route | client-route  (default client)
-    status: 429         # 4xx or 5xx answered on refusal (default 429)
-    mode: enforce       # enforce | report               (default enforce)
-    maxKeys: 100000     # bounded counter table, LRU eviction
-
-routes:
-  /api/lookup/{id}:
-    function: { source: functions/lookup.mjs }
-    policies:
-      throttle: { quota: 10, window: 60 }   # tighter budget with its own counter
-```
-
-A route override that restates `quota` and `window` gets its own counters; a
-route that inherits the project budget shares the client's counter with every
-other route on the same budget. `throttle: false` on a route turns it off there.
-
-## Standards
-
-- [RFC 6585](https://www.rfc-editor.org/rfc/rfc6585) status 429 by default;
-  any 4xx or 5xx `status` is accepted and the body is a short plain-text line.
-- [RFC 9110 `Retry-After`](https://www.rfc-editor.org/rfc/rfc9110#field.retry-after),
-  integer seconds, on every refusal.
-- [IETF httpapi RateLimit header fields](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/)
-  on every response, allowed or refused, in structured-field syntax:
-  `RateLimit-Policy: "default";q=<quota>;w=<window>` and
-  `RateLimit: "default";r=<remaining>;t=<seconds until reset>`.
-
-A refusal also carries `content-type: text/plain; charset=utf-8` and
-`cache-control: no-store` so no intermediary keeps it.
-
-## Targets
-
-| Target | `partition: route` | `client` / `client-route` |
-|---|---|---|
-| node (`urlcode serve`) | native | native |
-| vercel | native, per instance | refused at activation |
-| aws | native, per instance | refused at activation |
-| cloudflare | refused | refused |
-
-Counters live in the process. On serverless targets a route counter is at
-least an honest per-instance ceiling, while a client counter would silently
-become `quota × instances`, so those partitions are refused with the route
-named. The Cloudflare build refuses the policy; map the same `quota` and
-`window` to a provider rate rule instead.
-
-## Client identity
-
-`client` is the socket peer address. Behind a load balancer every request
-would share one address, so name the proxies allowed to speak for a client:
-`urlcode serve --trusted-proxies 10.0.0.0/8,::1`. Only then is
-`X-Forwarded-For` consulted, walking from the right past trusted hops. When no
-client can be resolved (a caller that passed none, an adapter without a peer)
-requests share a single bucket rather than escaping the budget; the policy
-inventory (`urlcode audit`, `testPlan().policies`) reports this as
-`unresolvedClient: "shared key"`.
-
-## Report before enforce
-
-Run a release with `mode: report`: headers are emitted and every request logs
-`{ event: "throttle", route, outcome: "allowed" | "exceeded", remaining }`
-(never the client address), but nothing is refused. Read the `exceeded` lines
-against real traffic, set `quota` from what you saw, then switch to `enforce`.
-In enforce mode only `exceeded` is logged.
-
-## What it does not do
-
-- No shared state across processes or instances. Two `urlcode serve`
-  processes behind one balancer each enforce the full budget. A host plugin
-  (`onRequest` returning a refusal, backed by whatever store you run) is the
-  place for a cluster-wide budget; see the plugin contract in
-  `docs/SPIKE-EXTENSIONS.md`.
-- No per-user or per-token keys. The partition is address or route; a token
-  bucket per API key is again a plugin.
-- Counters do not survive a reload: a new snapshot starts empty.
-- `maxKeys` bounds memory with least-recently-used eviction; an evicted key
-  starts fresh, so a table sized below the number of concurrent clients
-  under-counts rather than blocks.
-
-## Interaction with other policies
-
-Request order is agents, throttle, cache. A denied agent never touches a
-counter; a throttled request never reaches the cache lookup or the handler.
-Security headers and compression still apply to a refusal. A cache hit skips
-only the cache's own response hook, so a cached response still carries the
-client's `RateLimit` headers; the request was counted. A 405 is counted too
-and carries them.

package/docs/yaml/assets.md

@@ -1,36 +0,0 @@
-# YAML guide: Pages, static folders and downloads
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 10. Pages, static folders, downloads and MIME
-
-```yaml
-  /about:
-    page:
-      file: public/about.html
-      cacheControl: no-cache
-  /assets/*:
-    static:
-      directory: public/assets
-      index: index.html
-      cacheControl: public, max-age=3600
-  /download:
-    download:
-      file: public/guide.txt
-      filename: urlcode-guide.txt
-      contentType: text/plain
-      cacheControl: no-store
-```
-
-All files must exist. MIME is detected by extension, not content sniffing; unknown
-extensions become application/octet-stream. `contentType` overrides detection
-without MIME parameters. An override on a static mount affects all its files.
-The download name defaults to the source basename. `index` is opt-in and only
-applies to slash-terminated requests. No automatic slash redirect or SPA fallback.
-
-Cache choices: `no-cache` (asset default), `no-store`, `public, max-age=3600`,
-`public, max-age=31536000, immutable`. Reserve immutable caching for versioned
-URLs. GET/HEAD, ETag/date validation and single byte ranges are supported.
-Files stay snapshotted until reload/restart. See [assets](../ASSETS.md) for complete
-conditional/range semantics and publication safety. Files are limited to 16 MiB
-each and 64 MiB total unique bytes per snapshot.

package/docs/yaml/conditions.md

@@ -1,20 +0,0 @@
-# YAML guide: Enable, disable and expire
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 11. Enable, disable and expire
-
-```yaml
-  /paused:
-    enabled: false
-    redirect: {url: 'https://example.com/'}
-  /campaign:
-    description: A scheduled end, no scheduled start
-    expires: "2030-01-01T00:00:00Z"
-    redirect: {url: 'https://example.com/'}
-```
-
-Quote timestamps so they remain strings. Disabled routes return 404; expired
-routes return 410. Expiry is an absolute UTC timestamp, not a TTL. There is no
-start-time scheduler. `description` is authoring metadata. Changing YAML activates
-through dev reload or production restart/deployment; it is not an HTTP mutation.

package/docs/yaml/functions.md

@@ -1,168 +0,0 @@
-# YAML guide: Functions, inputs and methods
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 1. A URL that runs code
-
-A complete `urlcode.yaml`:
-
-```yaml
-version: "1"
-routes:
-  /hello/{name}:
-    function: functions/hello.mjs
-    env:
-      GREETING: {value: Hello}
-```
-
-Create `functions/hello.mjs`:
-
-```js
-export default function hello(request, {args, env}) {
-  return Response.json({message: `${env.GREETING}, ${args.name}!`});
-}
-```
-
-GET `/hello/Ada` returns JSON. HEAD invokes the function and suppresses the body.
-
-`function: functions/hello.mjs` is the short form. The loader expands it to the
-long form before anything else reads the route: every `{param}` in the path
-becomes a required string input (`minLength: 1`, `maxLength: 128`) and a
-matching `args` entry, so the route above is the same route as
-
-```yaml
-  /hello/{name}:
-    parameters:
-      - name: name
-        in: path
-        required: true
-        schema: {type: string, minLength: 1, maxLength: 128}
-    function:
-      source: functions/hello.mjs
-      args:
-        name: {from: path, name: name}
-    env:
-      GREETING: {value: Hello}
-```
-
-A path parameter the route declares itself keeps its own schema; only the
-undeclared ones get the default. Use the long form when you need a named
-`export`, query, header, `env` or `secret` arguments, or a tighter path schema.
-`routes`, `audit` and `explain` show the expansion. Middleware has the same
-short form: `middleware: [middleware/headers.mjs]` means
-`middleware: [{source: middleware/headers.mjs}]`. The path must be
-project-relative, end in `.mjs` or `.js` and contain no `..` segment.
-Methods default to GET and HEAD. Function paths resolve from the project root,
-not the YAML file's directory. Modules are ES modules either way: `.mjs` always
-works, while a trusted `.js` module is loaded by Node and therefore needs the
-nearest `package.json` to say `"type": "module"` (a `sandbox: true` route reads
-`.js` as ESM regardless). Serving never transpiles TypeScript; build it first
-with [TypeScript authoring](../TYPESCRIPT-AUTHORING.md). The route above
-declares no `sandbox`, so it runs trusted and in-process: Node APIs, npm
-imports, network and filesystem access are all available to it, exactly as they
-are to any other Node code in the host. Add `sandbox: true` to trade them away
-for isolation -- inside the guest none of them exist. See
-[trust model and sandbox opt-in](../FUNCTION-SECURITY.md).
-
-## 4. Input types and constraints
-
-Use this list under a route's `parameters` when those inputs are needed:
-
-```yaml
-    parameters:
-      - name: search
-        in: query
-        required: true
-        schema: {type: string, minLength: 1, maxLength: 200}
-      - name: page
-        in: query
-        schema: {type: integer, minimum: 1, default: 1}
-      - name: weight
-        in: query
-        schema: {type: number, minimum: 0, maximum: 1}
-      - name: preview
-        in: query
-        schema: {type: boolean, default: false}
-      - name: category
-        in: query
-        schema: {type: string, enum: [docs, news], default: docs}
-      - name: ids
-        in: query
-        schema: {type: array, items: {type: integer}, maxItems: 10}
-```
-
-Path inputs must be required strings with no default. Query/header scalar types
-are string, integer, number and boolean; arrays are query-only. Booleans are
-exactly `true`/`false`; numbers do not accept exponent notation or whitespace.
-Defaults apply to absence, not empty strings. Duplicate scalar values fail.
-Required, missing and invalid inputs return 400. This is a documented subset,
-not full OpenAPI/JSON Schema: no `pattern`, `format`, nested input objects,
-`oneOf`, `style` or `explode` in parameter schemas.
-
-## 5. Methods and body validation
-
-```yaml
-  /echo:
-    methods: [POST]
-    request:
-      body:
-        required: true
-        maxBytes: 4096
-        contentTypes: [application/json]
-        format: json
-    function:
-      source: functions/echo.mjs
-```
-
-```js
-export default async function echo(request) {
-  return Response.json(await request.json());
-}
-```
-
-This validates JSON syntax/media type/UTF-8 and body size, not an application
-object schema. Validate business fields in code. Empty required body: 400;
-oversized body: 413; wrong media type: 415. For text, use `contentTypes:
-[text/plain]`, `format: text`, and `request.text()`; see the runnable `/text`
-recipe. `maxBytes: 0` can reject nonempty bodies. Bodies are buffered, not streamed.
-
-Allowed methods: GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS. An explicit list
-replaces the defaults: `[GET]` does not add HEAD. Wrong method returns 405 with
-Allow. Asset handlers accept only GET/HEAD. Body bytes are not automatically
-mapped to function arguments.
-
-## 6. All function argument sources
-
-Within `function.args`, supported values are:
-
-```yaml
-      args:
-        label: campaign
-        attempts: 3
-        preview: false
-        code: {from: path, name: code}
-        page: {from: query, name: page}
-        channel: {from: header, name: x-channel}
-        greeting: {env: GREETING}
-        token: {secret: TOKEN}
-```
-
-This is a field-shape illustration: declare the referenced path/query/header
-inputs and route binding aliases before using it. Null, array and arbitrary
-object arguments are not supported. Read `context.args` or directly access
-`context.inputs.path/query/header`, `context.env` and `context.secrets`.
-`function.export` selects a named export; omit it for `default`.
-
-For a dynamic redirect, use validated choices instead of accepting any URL:
-
-```js
-export default function choice(request, {args}) {
-  const destinations = {docs: 'https://example.com/docs', home: 'https://example.com/'};
-  return Response.redirect(destinations[args.destination], 302);
-}
-```
-
-The runnable `/choice` recipe declares an enum query input and binds it to args.
-Functions can return `Response.json(...)`, `new Response('text', {status, headers})`,
-or `Response.redirect(...)`. HTML is a string response with Content-Type text/html;
-escape untrusted values yourself. See the exact [guest API](../SPECIFICATION.md#functions).

package/docs/yaml/middleware.md

@@ -1,31 +0,0 @@
-# YAML guide: Middleware
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 7. Middleware before and after a handler
-
-```yaml
-  /go-with-header:
-    middleware:
-      - source: middleware/headers.mjs
-        export: decorate
-    redirect: {url: 'https://example.com/'}
-```
-
-```js
-export async function decorate(request, context, next) {
-  context.state.example = 'cookbook';
-  const response = await next();
-  response.headers.set('x-middleware', context.state.example);
-  return response;
-}
-```
-
-Entries run in declared order before the handler and reverse order afterward.
-Return a Response early to skip downstream code; call `next()` at most once.
-Up to 16 middleware entries share the route's execution mode, one deadline and
-one set of approved route bindings; the mode is the route's `sandbox` field, not
-a per-entry choice. On a `sandbox: true` route native bodies are opaque;
-preserving them requires retaining original status/headers. Return a new
-Response to replace native content or destination.
-YAML response headers apply last. See [middleware](../MIDDLEWARE.md) for details.

package/docs/yaml/organization.md

@@ -1,74 +0,0 @@
-# YAML guide: Bindings, split files and tests
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 12. Environment and secret references
-
-Route-level shape (references only, never secret values):
-
-```yaml
-    env:
-      GREETING: {value: Hello}
-      REGION: {env: APP_REGION}
-    secrets:
-      TOKEN: {secret: APP_TOKEN}
-```
-
-Literal non-secret env needs no grant. External env and secrets require an
-operator-owned policy outside the checkout, granting exact names to the route
-and pinning the reviewed config/code digest. `urlcode permissions --project
-./my-links` prints a proposed policy; review it and store it outside the app.
-Then pass `--policy /operator/path/policy.json` to validate/dev/test/serve.
-This inspection does not authorize the project or execute its code.
-
-Use ignored `.env.local` for local values; process environment wins. Production
-`serve` reads process environment, never `.env.local`. Let your supervisor resolve
-provider secrets and inject them; direct provider secret-store adapters do not
-exist yet. Every config/code change invalidates the grant; rotate values by
-restarting/redeploying. Never return a secret in an example response. Middleware
-and functions on an approved route can read its bindings. See [policy setup](../FUNCTION-SECURITY.md).
-
-## 13. Split files and folders
-
-Complete entry point:
-
-```yaml
-version: "1"
-includes:
-  - routes/code.yaml
-  - routes/marketing/links.yaml
-routes: {}
-```
-
-Each included file contains `version: "1"` and `routes`. No nested includes,
-globs, anchors, merge keys or remote includes. References always use project-root
-paths. Duplicate routes fail; include order is not priority. See [organization](../ORGANIZATION.md)
-and [matching/regex/wildcard rules](../ROUTING.md).
-
-## 14. Assert inputs and outputs
-
-Save a JSON array as `tests/requests.json`:
-
-```json
-[
-  {"path":"/hello/Ada","status":200,"expectBody":"{\"message\":\"Hello, Ada!\"}"},
-  {"path":"/hello/Ada","method":"HEAD","status":200,"expectBody":""},
-  {"path":"/go","status":302,"expectHeaders":{"location":"https://example.com/"}},
-  {"path":"/go","method":"POST","status":405,"expectHeaders":{"allow":"GET, HEAD"}}
-]
-```
-
-This fixture targets recipes 1 and 2 together; the runnable cookbook has its own
-matching expectations. Supported test fields: `path`, optional `method`, request
-`headers` and string `body`, required `status`, optional exact string `expectBody`
-and string-map `expectHeaders`. Tests do not follow external redirects. There
-are no route-local YAML test fields or JSON-path assertions yet.
-
-Run validate, test, routes, and audit with an intentional expected count. Test
-both positive and negative inputs, every allowed method, HEAD, middleware short
-circuits and relevant asset conditions. Audit needs meaningful body/header
-assertions; a status-only success is insufficient. Benchmarks and recovery drills
-are separate from functional correctness. See [readiness](../READINESS.md).
-
-See [organization and readability practices](../BEST-PRACTICES.md) for conventions
-that keep larger projects easy to maintain.

package/docs/yaml/policies.md

@@ -1,37 +0,0 @@
-# YAML guide: Policies and profiles
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 16. Hardened profile and per-route overrides
-
-```yaml
-version: "1"
-policies:
-  profile: hardened               # security, agents, throttle, compression, cache
-  throttle: { quota: 60, window: 60 }   # tighten one number; the rest stays
-profiles:
-  public-api:
-    security: { headers: oshp-no-csp, set: { x-robots-tag: noindex } }
-    cache: { strategy: swr, maxAge: 30, staleWhileRevalidate: 300 }
-routes:
-  /:
-    page: {source: pages/index.html}
-  /api/lookup/{id}:
-    parameters:
-      - {name: id, in: path, required: true, schema: {type: string, maxLength: 64}}
-    function: {source: functions/lookup.mjs}
-    policies:
-      profile: public-api          # merges over the project layer
-      throttle: {quota: 10, window: 60, partition: client-route}
-  /healthz:
-    respond: {text: ok}
-    policies: {throttle: false, agents: false}
-```
-
-Everything under `policies` is optional and off unless declared. The project
-block sets defaults, a route block adjusts them, `false` removes one policy for
-that route and an object merges shallowly over what is below it. `hardened`
-is the only built-in profile; `profiles` defines your own. Serve with
-`--trusted-proxies` when a proxy sits in front so `client` partitioning sees
-the real peer. Not every target accepts every policy: see the per-target
-table in [policies](../POLICIES.md) before deploying the same YAML to an adapter.

package/docs/yaml/redirects.md

@@ -1,64 +0,0 @@
-# YAML guide: Redirects
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 2. Ordinary and permanent redirects
-
-The following snippets are **entries under `routes:`** unless stated otherwise:
-
-```yaml
-  /go:
-    redirect:
-      url: https://example.com/
-  /moved:
-    redirect:
-      url: https://example.com/new
-      status: 308
-    response:
-      headers:
-        Cache-Control: public, max-age=60
-```
-
-302 is the default. Allowed codes are 301, 302, 303, 307 and 308. Choose status
-and cache policy deliberately: a cached permanent redirect can outlive a server
-rollback. Requests' query strings are not forwarded by default. No function or
-middleware means no sandbox execution for these routes.
-
-## 3. Parameterized redirects and explicit query forwarding
-
-```yaml
-  /product/{id}:
-    parameters:
-      - name: id
-        in: path
-        required: true
-        schema: {type: string, minLength: 1, maxLength: 64}
-      - name: page
-        in: query
-        schema: {type: integer, minimum: 1, maximum: 100, default: 1}
-      - name: tag
-        in: query
-        schema: {type: array, items: {type: string}, maxItems: 3}
-      - name: x-channel
-        in: header
-        schema: {type: string, enum: [web, email], default: web}
-    redirect:
-      url: https://example.com/products/{id}
-      query:
-        map:
-          page: {from: query, name: page}
-          label: {from: query, name: tag}
-          channel: {from: header, name: x-channel}
-        pass: [utm_source]
-```
-
-`/product/abc?page=2&tag=red&tag=blue&utm_source=news&ignored=no` redirects to
-`https://example.com/products/abc?page=2&label=red&label=blue&channel=web&utm_source=news`.
-The unknown `ignored` key is dropped. Missing `page` becomes 1. Arrays produce
-repeated destination keys. Invalid page values return 400 before redirecting.
-
-Destination hosts/schemes are literal HTTP(S); path placeholders are safely
-encoded. No arbitrary input-controlled host, credentials, secret interpolation,
-or unrestricted `pass: true`. Mapping/passthrough keys must not collide with
-existing destination keys. Header inputs are client-supplied values, not proof
-of identity. See [input and redirect semantics](../SPECIFICATION.md).

package/docs/yaml/responses.md

@@ -1,57 +0,0 @@
-# YAML guide: Declared responses, headers and cookies
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 8. Native responses, headers and cookies
-
-```yaml
-  /status:
-    respond:
-      json: {ok: true, service: my-links}
-  /notice:
-    respond:
-      status: 503
-      text: Temporarily unavailable
-    response:
-      headers:
-        Retry-After: "60"
-  /empty:
-    respond: {status: 204}
-  /cookie-demo:
-    respond: {text: Non-secret preferences only}
-    response:
-      headers:
-        Set-Cookie:
-          - "theme=light; Path=/; Secure; SameSite=Lax"
-          - "notice=seen; Path=/; HttpOnly; Secure; SameSite=Lax"
-```
-
-`respond` defaults to 200. Use text or JSON, never both. Omit both for an empty
-body; 204/205 must have no body. 206/304 belong to native asset handling.
-Header values are literal strings; quote numeric-looking values. Only Set-Cookie
-accepts arrays. Do not put live session tokens in YAML. Secure cookies require
-HTTPS at the browser. Functions can create dynamic cookies, but no cookie
-parsing/signing/authentication framework is built in.
-
-Do not set Content-Length, Location, Allow, ETag, Content-Range or other
-runtime-owned headers in YAML. Use the corresponding handler. The full reserved
-list and precedence rules are in [HTTP](../HTTP.md).
-
-## 9. Explicit OPTIONS response (not automatic CORS)
-
-```yaml
-  /preflight:
-    methods: [OPTIONS]
-    respond: {status: 204}
-    response:
-      headers:
-        Access-Control-Allow-Origin: https://app.example.com
-        Access-Control-Allow-Methods: GET, HEAD
-        Access-Control-Allow-Headers: Content-Type
-```
-
-This teaches declared headers only; it is not a working cross-origin GET API.
-For a real API, OPTIONS and the actual methods must be handled on the same URL,
-and actual responses also need the appropriate CORS headers. Because one path
-has one handler, use a function with `[GET, HEAD, OPTIONS]` to branch on method.
-Never reflect arbitrary Origin with credentials. Automatic CORS is unsupported.

package/docs/yaml/site.md

@@ -1,24 +0,0 @@
-# YAML guide: Site conventions
-
-Snippets are entries under `routes:` unless stated otherwise; the [guide index](../YAML-GUIDE.md) lists every page.
-
-## 17. Site conventions
-
-Generate the well-known files from a top-level `site` block instead of writing
-them by hand. Each declared key becomes one native route counted by
-`routes`/`audit`; a declared route at the same path wins.
-
-```yaml
-site:
-  robots:
-    disallow: [ai-crawlers, /admin]
-    sitemap: true                 # Sitemap line needs --origin
-  favicon: public/favicon.svg     # served at /favicon.ico
-  securityTxt:
-    contact: [mailto:security@example.com]
-    expires: "2099-01-01T00:00:00Z"
-  llms: public/llms.txt           # served at /llms.txt
-  # sitemap: true                 # /sitemap.xml; refuses to start without --origin
-```
-
-See [site conventions](../SITE.md) for every field, exclusions and target support.

package/packaging/claude-plugin/.claude-plugin/plugin.json

@@ -1,19 +0,0 @@
-{
-  "name": "urlcode",
-  "description": "Authoring and operating URLCode projects: the implemented YAML contract, capability limits, deployment and verification commands for the pinned runtime revision.",
-  "version": "0.4.1",
-  "author": {
-    "name": "jimhoyd-com",
-    "url": "https://github.com/jimhoyd-com"
-  },
-  "homepage": "https://github.com/jimhoyd-com/urlcode",
-  "repository": "https://github.com/jimhoyd-com/urlcode.git",
-  "license": "Apache-2.0",
-  "keywords": [
-    "urlcode",
-    "routing",
-    "yaml",
-    "redirects",
-    "middleware"
-  ]
-}