@raishin/vanguard-frontier-agentic 3.0.2 → 3.1.0

package/tests/fixtures/frontend-maestro-routing/taxonomy.json

@@ -0,0 +1,377 @@
+{
+  "provider": "frontend",
+  "domains": {
+    "accessibility-wcag": {
+      "keywords": [
+        "accessibility",
+        "wcag",
+        "a11y",
+        "aria",
+        "screen reader",
+        "success criteria",
+        "contrast ratio",
+        "keyboard trap"
+      ],
+      "agent": "accessibility-wcag-agent"
+    },
+    "ai-assisted-frontend-review": {
+      "keywords": [
+        "ai-generated",
+        "ai generated",
+        "llm-generated",
+        "copilot-generated",
+        "hallucinated api",
+        "vibe coded",
+        "generated by an ai"
+      ],
+      "agent": "ai-assisted-frontend-review-agent"
+    },
+    "angular": {
+      "keywords": [
+        "angular",
+        "signals",
+        "change detection",
+        "ngmodule",
+        "zone.js",
+        "angular ssr"
+      ],
+      "agent": "angular-specialist-agent"
+    },
+    "api-integration-bff": {
+      "keywords": [
+        "bff",
+        "backend for frontend",
+        "api contract",
+        "over-fetching",
+        "over fetching",
+        "edge authorization",
+        "graphql gateway"
+      ],
+      "agent": "api-integration-bff-agent"
+    },
+    "browser-compatibility": {
+      "keywords": [
+        "browser compatibility",
+        "caniuse",
+        "baseline",
+        "polyfill",
+        "browser matrix",
+        "graceful degradation"
+      ],
+      "agent": "browser-compatibility-agent"
+    },
+    "build-tooling-bundling": {
+      "keywords": [
+        "vite",
+        "webpack",
+        "rollup",
+        "bundle size",
+        "code splitting",
+        "build config",
+        "vendor chunk"
+      ],
+      "agent": "build-tooling-bundling-agent"
+    },
+    "css-architecture": {
+      "keywords": [
+        "css specificity",
+        "cascade layer",
+        "design token",
+        "custom property",
+        "container query",
+        "css architecture"
+      ],
+      "agent": "css-architecture-agent"
+    },
+    "design-systems-governance": {
+      "keywords": [
+        "design system",
+        "token pipeline",
+        "style dictionary",
+        "tokens studio",
+        "component library governance",
+        "theming"
+      ],
+      "agent": "design-systems-governance-agent"
+    },
+    "enterprise-red-team-review": {
+      "keywords": [
+        "red team",
+        "adversarial review",
+        "break the verdict",
+        "second pass review",
+        "challenge the specialist"
+      ],
+      "agent": "enterprise-red-team-review-agent"
+    },
+    "frontend-finops-cost-to-serve": {
+      "keywords": [
+        "cdn egress",
+        "cost to serve",
+        "edge compute cost",
+        "image transform cost",
+        "build minutes",
+        "ssr compute cost"
+      ],
+      "agent": "frontend-finops-cost-to-serve-agent"
+    },
+    "frontend-migration-modernization": {
+      "keywords": [
+        "migration",
+        "modernization",
+        "strangler fig",
+        "jquery to react",
+        "monolith to microfrontend",
+        "framework upgrade",
+        "cra to vite"
+      ],
+      "agent": "frontend-migration-modernization-agent"
+    },
+    "frontend-observability-rum": {
+      "keywords": [
+        "real user monitoring",
+        "rum",
+        "opentelemetry web",
+        "error tracking",
+        "field telemetry",
+        "telemetry sampling"
+      ],
+      "agent": "frontend-observability-rum-agent"
+    },
+    "frontend-platform-architect": {
+      "keywords": [
+        "module boundaries",
+        "platform architecture",
+        "technology adoption gate",
+        "cross-cutting architecture",
+        "shared platform contract"
+      ],
+      "agent": "frontend-platform-architect-agent"
+    },
+    "frontend-security": {
+      "keywords": [
+        "xss",
+        "dom xss",
+        "csp",
+        "trusted types",
+        "client-side supply chain",
+        "owasp",
+        "sanitize"
+      ],
+      "agent": "frontend-security-agent"
+    },
+    "html-semantics": {
+      "keywords": [
+        "markup structure",
+        "landmark",
+        "heading hierarchy",
+        "semantic html",
+        "whatwg",
+        "wai-aria",
+        "native element"
+      ],
+      "agent": "html-semantics-agent"
+    },
+    "internationalization-localization": {
+      "keywords": [
+        "i18n",
+        "l10n",
+        "icu messageformat",
+        "cldr",
+        "rtl layout",
+        "translation vendor",
+        "locale"
+      ],
+      "agent": "internationalization-localization-agent"
+    },
+    "javascript-runtime": {
+      "keywords": [
+        "event loop",
+        "microtask",
+        "promise composition",
+        "listener leak",
+        "unhandled rejection",
+        "dom event lifecycle"
+      ],
+      "agent": "javascript-runtime-agent"
+    },
+    "monorepo-dx": {
+      "keywords": [
+        "monorepo",
+        "turborepo",
+        "nx pipeline",
+        "pnpm workspace",
+        "remote caching",
+        "task graph"
+      ],
+      "agent": "monorepo-dx-agent"
+    },
+    "nextjs": {
+      "keywords": [
+        "next.js",
+        "nextjs",
+        "app router",
+        "server component",
+        "fetch cache",
+        "isr",
+        "next/image"
+      ],
+      "agent": "nextjs-specialist-agent"
+    },
+    "package-governance": {
+      "keywords": [
+        "package.json",
+        "lockfile",
+        "dependency confusion",
+        "renovate",
+        "dependabot",
+        "pnpm catalog",
+        "npm overrides"
+      ],
+      "agent": "package-governance-agent"
+    },
+    "product-analytics-experimentation": {
+      "keywords": [
+        "a/b test",
+        "experimentation",
+        "event schema",
+        "analytics instrumentation",
+        "statistical validity",
+        "conversion metric"
+      ],
+      "agent": "product-analytics-experimentation-agent"
+    },
+    "pwa-offline-capability": {
+      "keywords": [
+        "service worker",
+        "pwa",
+        "web app manifest",
+        "offline fallback",
+        "installability"
+      ],
+      "agent": "pwa-offline-capability-agent"
+    },
+    "react": {
+      "keywords": [
+        "react",
+        "hooks",
+        "useeffect",
+        "jsx",
+        "component architecture",
+        "rendering performance",
+        "react component"
+      ],
+      "agent": "react-specialist-agent"
+    },
+    "routing-navigation": {
+      "keywords": [
+        "route tree",
+        "loaders",
+        "route actions",
+        "deep link",
+        "navigation guard",
+        "route-level bundle"
+      ],
+      "agent": "routing-navigation-agent"
+    },
+    "ssr-hydration-streaming": {
+      "keywords": [
+        "hydration mismatch",
+        "streaming ssr",
+        "suspense boundary",
+        "server rendering",
+        "ttfb",
+        "error boundary placement"
+      ],
+      "agent": "ssr-hydration-streaming-agent"
+    },
+    "state-management-data-flow": {
+      "keywords": [
+        "state management",
+        "store shape",
+        "normalization",
+        "stale data",
+        "re-render cascade",
+        "client state boundary"
+      ],
+      "agent": "state-management-data-flow-agent"
+    },
+    "svelte-sveltekit": {
+      "keywords": [
+        "svelte",
+        "sveltekit",
+        "use:enhance",
+        "load function",
+        "progressive enhancement"
+      ],
+      "agent": "svelte-sveltekit-specialist-agent"
+    },
+    "testing-quality-engineering": {
+      "keywords": [
+        "test strategy",
+        "unit test",
+        "e2e test",
+        "test pyramid",
+        "flaky test",
+        "integration test suite"
+      ],
+      "agent": "testing-quality-engineering-agent"
+    },
+    "typescript-contracts": {
+      "keywords": [
+        "tsconfig",
+        "type contract",
+        "any-laundering",
+        "narrowing",
+        "ts-ignore",
+        "type signature"
+      ],
+      "agent": "typescript-contracts-agent"
+    },
+    "visual-regression": {
+      "keywords": [
+        "visual regression",
+        "pixel diff",
+        "chromatic",
+        "storybook test runner",
+        "screenshot assertion"
+      ],
+      "agent": "visual-regression-agent"
+    },
+    "vue": {
+      "keywords": [
+        "vue",
+        "composition api",
+        "vue 3",
+        "script setup",
+        "vue ssr"
+      ],
+      "agent": "vue-specialist-agent"
+    },
+    "web-performance-core-vitals": {
+      "keywords": [
+        "core web vitals",
+        "lcp",
+        "inp",
+        "cls",
+        "lab data",
+        "field data",
+        "performance budget"
+      ],
+      "agent": "web-performance-core-vitals-agent"
+    },
+    "web-platform-foundation": {
+      "keywords": [
+        "new project scaffolding",
+        "framework vs platform",
+        "browser support baseline",
+        "platform-layer decision"
+      ],
+      "agent": "web-platform-foundation-agent"
+    }
+  },
+  "live_guards": [],
+  "gate_mode": "live-guard-gate",
+  "live_guard_intent": "(deploy.*(?:prod|production)|\\b(?:prod|production)\\b.*\\b(?:deploy|deployment)\\b|rollout to prod|rollout to production|promote.*to (?:prod|production)|feature[- ]flag.*flip.*prod|cache purge.*prod|rollback.*prod|push.*live.*now|ship.*straight to production|skip the gate|force[- ]push.*main)",
+  "parallel_threshold": 0.6
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "angular-template-sanitizer-security-review",
+  "detectors": [
+    {
+      "id": "bypass-security-trust-html",
+      "regex": "bypassSecurityTrustHtml\\(",
+      "skill_keywords": ["bypassSecurityTrustHtml"],
+      "red": "red/comment.component.ts",
+      "green": "green/comment.component.ts",
+      "severity": "high",
+      "rationale": "Calling sanitizer.bypassSecurityTrustHtml() on a value that flows from user-submitted content marks it trusted and skips Angular's HTML sanitizer entirely before it reaches [innerHTML], enabling stored XSS; the safe idiom uses text interpolation ({{ userComment }}), which Angular's updateTextNode implements via renderer.setValue() on a text node — a code path that never parses HTML and has no bypass call for the regex to find."
+    },
+    {
+      "id": "unsanitized-innerHTML-binding",
+      "regex": "\\[innerHTML\\]\\s*=\\s*\"[a-zA-Z_$][\\w.]*\"",
+      "skill_keywords": ["[innerHTML]"],
+      "red": "red/profile.component.html",
+      "green": "green/profile.component.html",
+      "severity": "high",
+      "rationale": "Binding [innerHTML] to a bare identifier (userBio) sourced from a profile API that echoes user-submitted text relies on the compiler-added sanitizer function, which is skipped whenever the bound value isn't proven safe by the reviewer's trace; the safe idiom routes the same field through an explicit sanitizer.sanitize(userBio) call expression in the binding, which the bare-identifier regex (no parentheses allowed) correctly does not match."
+    },
+    {
+      "id": "bypass-security-trust-url-href",
+      "regex": "bypassSecurityTrustUrl\\(",
+      "skill_keywords": ["bypassSecurityTrustUrl"],
+      "red": "red/profile-link.component.ts",
+      "green": "green/profile-link.component.ts",
+      "severity": "high",
+      "rationale": "Calling sanitizer.bypassSecurityTrustUrl() on a raw user-controlled link with no scheme allowlist lets a crafted javascript: URL reach the anchor's [href] and execute on click; the safe idiom validates the scheme first (isValidHttpUrl(userLink) ? userLink : null) and never calls the bypass API, so the regex has no bypassSecurityTrustUrl( token to find."
+    },
+    {
+      "id": "bypass-security-trust-resource-url-src",
+      "regex": "bypassSecurityTrustResourceUrl\\(",
+      "skill_keywords": ["bypassSecurityTrustResourceUrl"],
+      "red": "red/avatar.component.ts",
+      "green": "green/avatar.component.ts",
+      "severity": "high",
+      "rationale": "Calling sanitizer.bypassSecurityTrustResourceUrl() on an unvalidated user-supplied image URL marks it trusted for [src] with no scheme or origin check, allowing an arbitrary or script-bearing resource load; the safe idiom validates the URL through sanitizer.sanitize(SecurityContext.URL, userImage) and binds ngSrc to the validated string, so no bypass call exists for the regex to find."
+    },
+    {
+      "id": "bound-iframe-sandbox-attribute",
+      "regex": "\\[(attr\\.)?sandbox\\]\\s*=\\s*\"",
+      "skill_keywords": ["[attr.sandbox]"],
+      "red": "red/embed.component.html",
+      "green": "green/embed.component.html",
+      "severity": "medium",
+      "rationale": "Binding the iframe's sandbox attribute dynamically ([attr.sandbox]=\"userSandbox\") lets a runtime value influence the iframe's security sandbox (the exact pattern Angular's NG0910 check exists to catch, since sandbox must be fixed at element-creation time); the safe idiom sets sandbox=\"allow-scripts\" as a static attribute with no binding syntax, which the bracket-anchored regex correctly does not match."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/green/avatar.component.ts

@@ -0,0 +1,19 @@
+import { Component, Input } from '@angular/core';
+import { DomSanitizer, SecurityContext } from '@angular/platform-browser';
+
+@Component({
+  selector: 'app-avatar',
+  // ngSrc requires a plain string, validated through DomSanitizer.sanitize()
+  // against SecurityContext.URL rather than an unchecked bypass call.
+  template: `<img [ngSrc]="safeImageUrl" width="64" height="64" />`,
+})
+export class AvatarComponent {
+  @Input() userImage = '';
+  safeImageUrl = '';
+
+  constructor(private sanitizer: DomSanitizer) {}
+
+  ngOnChanges() {
+    this.safeImageUrl = this.sanitizer.sanitize(SecurityContext.URL, this.userImage) ?? '';
+  }
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/green/comment.component.ts

@@ -0,0 +1,12 @@
+import { Component, Input } from '@angular/core';
+
+@Component({
+  selector: 'app-comment',
+  // Text interpolation: Angular's updateTextNode uses renderer.setValue()
+  // (the text content API), which never parses HTML, so no sanitizer
+  // bypass is needed or possible here.
+  template: `<div>{{ userComment }}</div>`,
+})
+export class CommentComponent {
+  @Input() userComment = '';
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/green/embed.component.html

@@ -0,0 +1,3 @@
+<!-- sandbox is a static attribute, fixed at element-creation time and never
+     bound to any expression, so its value cannot be influenced at runtime. -->
+<iframe sandbox="allow-scripts" [src]="trustedEmbedUrl"></iframe>

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/green/profile-link.component.ts

@@ -0,0 +1,20 @@
+import { Component, Input } from '@angular/core';
+
+@Component({
+  selector: 'app-profile-link',
+  // Scheme allowlist runs first; the template only ever binds to the
+  // validated result or null, never to a raw bypass call.
+  template: `<a [href]="isValidHttpUrl(userLink) ? userLink : null">Visit profile</a>`,
+})
+export class ProfileLinkComponent {
+  @Input() userLink = '';
+
+  isValidHttpUrl(value: string): boolean {
+    try {
+      const parsed = new URL(value);
+      return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    } catch {
+      return false;
+    }
+  }
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/green/profile.component.html

@@ -0,0 +1,4 @@
+<!-- A named sanitizer call sits directly on the path between the untrusted
+     field and the binding, so the bound expression is a call expression,
+     not a bare identifier. -->
+<div [innerHTML]="sanitizer.sanitize(userBio)"></div>

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/red/avatar.component.ts

@@ -0,0 +1,19 @@
+import { Component, Input } from '@angular/core';
+import { DomSanitizer, SafeResourceUrl } from '@angular/platform-browser';
+
+@Component({
+  selector: 'app-avatar',
+  template: `<img [src]="trustedImage" />`,
+})
+export class AvatarComponent {
+  @Input() userImage = '';
+  trustedImage: SafeResourceUrl;
+
+  constructor(private sanitizer: DomSanitizer) {}
+
+  ngOnChanges() {
+    // Marks an arbitrary user-supplied resource URL as trusted with no
+    // scheme or origin validation on the path.
+    this.trustedImage = this.sanitizer.bypassSecurityTrustResourceUrl(this.userImage);
+  }
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/red/comment.component.ts

@@ -0,0 +1,19 @@
+import { Component, Input } from '@angular/core';
+import { DomSanitizer, SafeHtml } from '@angular/platform-browser';
+
+@Component({
+  selector: 'app-comment',
+  template: `<div [innerHTML]="trustedComment"></div>`,
+})
+export class CommentComponent {
+  @Input() userComment = '';
+  trustedComment: SafeHtml;
+
+  constructor(private sanitizer: DomSanitizer) {}
+
+  ngOnChanges() {
+    // Bypasses Angular's XSS sanitizer entirely; userComment flows straight
+    // from a profile API that echoes attacker-submitted text.
+    this.trustedComment = this.sanitizer.bypassSecurityTrustHtml(this.userComment);
+  }
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/red/embed.component.html

@@ -0,0 +1,5 @@
+<!-- Binding a security-sensitive iframe attribute dynamically triggers
+     NG0910 in dev, but production builds have historically shipped this
+     pattern behind a config flag that suppresses the dev-mode check,
+     letting an attacker-influenced sandbox value reach the iframe. -->
+<iframe [attr.sandbox]="userSandbox" [src]="trustedEmbedUrl"></iframe>

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/red/profile-link.component.ts

@@ -0,0 +1,20 @@
+import { Component, Input } from '@angular/core';
+import { DomSanitizer, SafeUrl } from '@angular/platform-browser';
+
+@Component({
+  selector: 'app-profile-link',
+  template: `<a [href]="trustedLink">Visit profile</a>`,
+})
+export class ProfileLinkComponent {
+  @Input() userLink = '';
+
+  constructor(private sanitizer: DomSanitizer) {}
+
+  ngOnChanges() {
+    // No scheme allowlist anywhere on this path; a crafted javascript: URL
+    // reaches the anchor unmodified once the bypass call marks it trusted.
+    this.trustedLink = this.sanitizer.bypassSecurityTrustUrl(this.userLink);
+  }
+
+  trustedLink: SafeUrl;
+}

package/tests/fixtures/frontend-security-detection/angular-template-sanitizer-security-review/red/profile.component.html

@@ -0,0 +1,6 @@
+<!-- userBio comes from a profile API that echoes user-submitted text.
+     No sanitizer call anywhere between the API response and this binding;
+     the compiler-added sanitizer function is skipped when Angular sees the
+     value is a plain (non-Safe) string, and this bare-identifier form
+     confuses reviewers into assuming it is auto-safe like interpolation. -->
+<div [innerHTML]="userBio"></div>

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/detectors.json

@@ -0,0 +1,50 @@
+{
+  "skill_id": "edge-cache-data-bleed-review",
+  "detectors": [
+    {
+      "id": "revalidate-on-personalized-page",
+      "regex": "(?s)export const revalidate\\s*=\\s*\\d+.*cookies\\(\\)",
+      "skill_keywords": ["revalidate", "cookies()"],
+      "red": "red/dashboard-revalidate-cookies.tsx",
+      "green": "green/dashboard-revalidate-cookies.tsx",
+      "severity": "high",
+      "rationale": "A route-level `export const revalidate = N` combined with a `cookies()` read means the ISR cache entry for this path is shared across every visitor for the whole revalidate window, so the first visitor's session-derived HTML is replayed to the next visitor who hits the same URL; the safe idiom drops the route-level revalidate export entirely and isolates the cookies() read inside a 'use cache: private' function, which the regex (anchored on the literal `export const revalidate` export) never sees."
+    },
+    {
+      "id": "missing-use-cache-private-cookies-fn",
+      "regex": "\\bfunction\\s+\\w+\\([^)]*\\)\\s*\\{(?!\\s*['\\\"]use cache: private['\\\"])[^}]*cookies\\(\\)",
+      "skill_keywords": ["cookies()", "'use cache: private'"],
+      "red": "red/get-user-data.ts",
+      "green": "green/get-user-data.ts",
+      "severity": "high",
+      "rationale": "A server function that reads cookies() to look up per-user data with no cache-boundary directive at all can be silently pulled into a shared cache by a future refactor with no per-user cache key; the safe idiom declares 'use cache: private' as the function's first statement, which the regex's negative lookahead (checking immediately after the opening brace) correctly detects and therefore does not flag."
+    },
+    {
+      "id": "revalidate-generateStaticParams-user-ids",
+      "regex": "(?s)export const revalidate\\s*=\\s*\\d+.*generateStaticParams",
+      "skill_keywords": ["revalidate", "generateStaticParams", "force-dynamic"],
+      "red": "red/product-static-params.tsx",
+      "green": "green/product-static-params.tsx",
+      "severity": "high",
+      "rationale": "Pairing `revalidate` with `generateStaticParams` that enumerates per-user IDs means the authenticated page for one user gets cached and replayed to whoever polls the same URL before the next revalidation; the safe idiom removes `revalidate` and opts the route into `export const dynamic = 'force-dynamic'` instead, which the regex (requiring both `revalidate` and `generateStaticParams` in the same file) correctly does not match once `revalidate` is gone."
+    },
+    {
+      "id": "cache-control-public-user-data",
+      "regex": "['\\\"]Cache-Control['\\\"]:\\s*['\\\"]public",
+      "skill_keywords": ["Cache-Control", "public", "private"],
+      "red": "red/api-user-profile-route.ts",
+      "green": "green/api-user-profile-route.ts",
+      "severity": "high",
+      "rationale": "Setting `Cache-Control: public` on a Response built from cookies()-derived user data authorizes any shared CDN/proxy in front of the route to store and replay that body to a different client; the safe idiom sets `Cache-Control: private` instead, which the regex (matching only the literal `public` value) correctly does not flag."
+    },
+    {
+      "id": "vary-missing-cookie",
+      "regex": "Vary:\\s*['\\\"](?!.*Cookie)[^'\\\"]*['\\\"]",
+      "skill_keywords": ["Vary", "Cookie"],
+      "red": "red/api-user-profile-vary.ts",
+      "green": "green/api-user-profile-vary.ts",
+      "severity": "medium",
+      "rationale": "A `Vary` header that omits `Cookie` tells the CDN two requests with different session cookies are cache-equivalent, so one user's cached response can be served to another; the safe idiom includes `Cookie` in the Vary value (e.g. `Vary: Cookie, Accept-Encoding`), which the regex's negative lookahead for `Cookie` inside the quoted value correctly does not flag."
+    }
+  ]
+}

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/green/api-user-profile-route.ts

@@ -0,0 +1,15 @@
+import { cookies } from 'next/headers'
+
+// SAFE: the response carries `Cache-Control: private`, which tells shared
+// CDN/proxy caches they must not store the response at all -- only the
+// requesting user's own browser may cache it locally.
+export async function GET() {
+  const session = (await cookies()).get('session')?.value
+  const userData = await db.users.findBySession(session)
+  return new Response(JSON.stringify(userData), {
+    headers: {
+      'Cache-Control': 'private, max-age=300',
+      'Content-Type': 'application/json',
+    },
+  })
+}

package/tests/fixtures/frontend-security-detection/edge-cache-data-bleed-review/green/api-user-profile-vary.ts

@@ -0,0 +1,15 @@
+import { cookies } from 'next/headers'
+
+// SAFE: Cookie is included in Vary, so the CDN keys its cache on the
+// session cookie's value and never serves one user's cached response body to
+// a request carrying a different Cookie header.
+export async function GET() {
+  const session = (await cookies()).get('session')?.value
+  const userData = await db.users.findBySession(session)
+  return new Response(JSON.stringify(userData), {
+    headers: {
+      'Cache-Control': 'public, max-age=300',
+      Vary: 'Cookie, Accept-Encoding',
+    },
+  })
+}