@rimelight/security 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rimelight Entertainment
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@rimelight/security",
+  "version": "0.0.2",
+  "private": false,
+  "description": "Rimelight Entertainment Security Middleware and Utilities.",
+  "type": "module",
+  "exports": {
+    ".": "./src/integrations/index.ts",
+    "./middleware": "./src/middleware/index.ts",
+    "./config": "./src/config/index.ts",
+    "./*": "./src/*"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "astro": "7.1.0",
+    "typescript": "6.0.3"
+  },
+  "peerDependencies": {
+    "astro": ">=7.0.1"
+  },
+  "packageManager": "pnpm@11.9.0"
+}

package/src/config/index.ts

@@ -0,0 +1 @@
+export * from "./security"

package/src/config/security.ts

@@ -0,0 +1,263 @@
+import type { AstroUserConfig } from "astro"
+
+export type AstroSecurityConfig = NonNullable<AstroUserConfig["security"]>
+export type AstroCspConfig = Exclude<NonNullable<AstroSecurityConfig["csp"]>, boolean>
+
+export interface SecurityConfigOptions {
+  /**
+   * The base domain name for this project (e.g., "starter.rimelight.com") used to autoconfigure
+   * standard allowedDomains and img-src CDN targets.
+   */
+  domain: string
+  /**
+   * Additional Allowed Domains (appended to the default wildcard subdomains of `domain`)
+   */
+  allowedDomains?: AstroSecurityConfig["allowedDomains"]
+  /**
+   * Additional sources to allow for img-src directive
+   */
+  imgSrc?: string[]
+  /**
+   * Additional sources to allow for connect-src directive
+   */
+  connectSrc?: string[]
+  /**
+   * Additional sources to allow for frame-src directive
+   */
+  frameSrc?: string[]
+  /**
+   * Additional script resources
+   */
+  scriptResources?: string[]
+  /**
+   * Additional style resources
+   */
+  styleResources?: string[]
+  /**
+   * Enables the 'require-trusted-types-for' directive
+   */
+  trustedTypes?: boolean
+  /**
+   * Direct overrides for any security config fields
+   */
+  overrides?: Partial<Omit<AstroSecurityConfig, "csp">> & {
+    csp?: Partial<AstroCspConfig>
+  }
+}
+
+/**
+ * Generates a standard, strictly configured Security/CSP object for Astro configurations with
+ * support for easy customization and additions per project.
+ *
+ * @example
+ *   ;```ts
+ *   // Default returned shape:
+ *   {
+ *   checkOrigin: true,
+ *   allowedDomains: [
+ *   {
+ *   hostname: "**.domain.com",
+ *   protocol: "https"
+ *   }
+ *   ],
+ *   csp: {
+ *   algorithm: "SHA-384",
+ *   directives: [
+ *   "default-src 'none'",
+ *   "img-src 'self' data: https://cdn.domain.com https://i3.ytimg.com https://www.youtube.com https://www.youtube-nocookie.com",
+ *   "font-src 'self'",
+ *   "connect-src 'self' https://cloudflareinsights.com",
+ *   "frame-ancestors 'none'",
+ *   "frame-src https://www.youtube.com https://www.youtube-nocookie.com",
+ *   "upgrade-insecure-requests",
+ *   "base-uri 'self'",
+ *   "form-action 'self'"
+ *   ],
+ *   scriptDirective: {
+ *   resources: [
+ *   "'self'",
+ *   "https://static.cloudflareinsights.com",
+ *   "https://betterlytics.io/analytics.js",
+ *   "'inline-speculation-rules'"
+ *   ]
+ *   },
+ *   styleDirective: {
+ *   resources: [
+ *   "'self'",
+ *   "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='"
+ *   ]
+ *   }
+ *   }
+ *   }
+ *   ```
+ */
+type DirectiveItem = { resource: string; kind?: "element" | "attribute" }
+type DirectiveInput = string[] | DirectiveItem[] | { resources?: string[] } | null | undefined
+
+const normalizeDirective = (input: DirectiveInput): DirectiveItem[] => {
+  if (!input) return []
+  if (Array.isArray(input)) {
+    return input.map((item) => {
+      if (typeof item === "string") {
+        return { resource: item, kind: "element" }
+      }
+      return item
+    })
+  }
+  if (typeof input === "object" && "resources" in input && Array.isArray(input.resources)) {
+    return input.resources.map((res) => ({ resource: res, kind: "element" }))
+  }
+  return []
+}
+
+function mergeDirective(current: any, incoming: any): any {
+  if (!current && !incoming) return undefined
+
+  const currentNormalized = normalizeDirective(current)
+  const incomingNormalized = normalizeDirective(incoming)
+
+  const mergedMap = new Map<string, DirectiveItem>()
+  for (const item of [...currentNormalized, ...incomingNormalized]) {
+    const key = `${item.resource}::${item.kind || "element"}`
+    mergedMap.set(key, item)
+  }
+
+  const mergedList = Array.from(mergedMap.values())
+
+  const currentWasArray = Array.isArray(current)
+  const incomingWasArray = Array.isArray(incoming)
+
+  if (
+    !currentWasArray &&
+    !incomingWasArray &&
+    current &&
+    typeof current === "object" &&
+    incoming &&
+    typeof incoming === "object" &&
+    !("length" in current) &&
+    !("length" in incoming)
+  ) {
+    return {
+      resources: mergedList.map((item) => item.resource)
+    }
+  }
+
+  return mergedList
+}
+
+export function defineSecurity(options: SecurityConfigOptions): AstroSecurityConfig {
+  const { domain, overrides } = options
+  const domainWithWildcard = `**.${domain}`
+
+  // 1. Build default allowed domains
+  const allowedDomains = [
+    {
+      hostname: domainWithWildcard,
+      protocol: "https" as const
+    },
+    ...(options.allowedDomains || [])
+  ]
+
+  // 2. Build CSP directives
+  const imgSources = Array.from(
+    new Set([
+      "'self'",
+      "data:",
+      `https://cdn.${domain}`,
+      "https://i3.ytimg.com",
+      "https://www.youtube.com",
+      "https://www.youtube-nocookie.com",
+      ...(options.imgSrc || [])
+    ])
+  )
+
+  const connectSources = Array.from(
+    new Set(["'self'", "https://cloudflareinsights.com", ...(options.connectSrc || [])])
+  )
+
+  const frameSources = Array.from(
+    new Set([
+      "https://www.youtube.com",
+      "https://www.youtube-nocookie.com",
+      ...(options.frameSrc || [])
+    ])
+  )
+
+  const baseDirectives: AstroCspConfig["directives"] = [
+    "default-src 'none'",
+    `img-src ${imgSources.join(" ")}`,
+    "font-src 'self'",
+    `connect-src ${connectSources.join(" ")}`,
+    "frame-ancestors 'none'",
+    `frame-src ${frameSources.join(" ")}`,
+    "upgrade-insecure-requests",
+    "base-uri 'self'",
+    "form-action 'self'",
+    "object-src 'none'",
+    "manifest-src 'self'",
+    ...(options.trustedTypes ? ["require-trusted-types-for 'script'" as const] : [])
+  ]
+
+  // 3. Build script & style directives
+  const scriptResources = Array.from(
+    new Set([
+      "'self'",
+      "https://static.cloudflareinsights.com",
+      "https://betterlytics.io/analytics.js",
+      "'inline-speculation-rules'",
+      // Astro ClientRouter (View Transitions)
+      "'sha256-ZuMSxilKU+4KIM8LWna4lqBEKzd6WaiAjz6gamhm7zM='",
+      ...(options.scriptResources || [])
+    ])
+  )
+
+  const styleResources = Array.from(
+    new Set([
+      "'self'",
+      // Astro ClientRouter (View Transitions)
+      "'sha256-SKuaOGnks7NAUq37nvw1PfGEE0lOAs5ERbiYRbGFIbw='",
+      ...(options.styleResources || [])
+    ])
+  )
+
+  // 4. Build base SecurityConfig
+  const securityConfig: AstroSecurityConfig = {
+    checkOrigin: true,
+    allowedDomains,
+    csp: {
+      algorithm: "SHA-384",
+      directives: baseDirectives,
+      scriptDirective: {
+        resources: scriptResources
+      },
+      styleDirective: {
+        resources: styleResources
+      }
+    }
+  }
+
+  // 5. Merge overrides
+  if (overrides) {
+    const { csp, ...restOverrides } = overrides
+    Object.assign(securityConfig, restOverrides)
+    if (csp && typeof securityConfig.csp === "object" && securityConfig.csp !== null) {
+      const currentCsp = securityConfig.csp
+      const mergedCsp: AstroCspConfig = {
+        ...currentCsp,
+        ...csp
+      }
+
+      if (csp.scriptDirective || currentCsp.scriptDirective) {
+        mergedCsp.scriptDirective = mergeDirective(currentCsp.scriptDirective, csp.scriptDirective)
+      }
+
+      if (csp.styleDirective || currentCsp.styleDirective) {
+        mergedCsp.styleDirective = mergeDirective(currentCsp.styleDirective, csp.styleDirective)
+      }
+
+      securityConfig.csp = mergedCsp
+    }
+  }
+
+  return securityConfig
+}

package/src/env.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="astro/client" />
+
+declare module "virtual:sri-manifest" {
+  export const manifest: Record<string, string>
+}

package/src/integrations/index.ts

@@ -0,0 +1 @@
+export * from "./sri"

package/src/integrations/sri.ts

@@ -0,0 +1,137 @@
+import type { AstroIntegration } from "astro"
+import { createHash } from "node:crypto"
+
+interface SRIConfig {
+  security?: {
+    csp?: {
+      scriptDirective?: {
+        resources?: string[]
+      }
+    }
+  }
+}
+
+function assertSRIConfig(obj: unknown): asserts obj is SRIConfig {
+  if (!obj || typeof obj !== "object") throw new Error("Expected config")
+}
+
+/**
+ * Astro SRI Integration Fetches external scripts at build-time and generates hashes for the SSR
+ * middleware.
+ */
+export function sri(): AstroIntegration {
+  const sriManifest: Record<string, string> = {}
+
+  return {
+    name: "@rimelight/security",
+    hooks: {
+      "astro:config:setup": async ({ updateConfig, config, command, logger }) => {
+        const isDev = command === "dev"
+
+        if (isDev) {
+          logger.info("Skipping SRI discovery in development mode.")
+        } else {
+          // 1. Identify External Scripts from CSP config
+          // We look into the custom 'security' block in astro.config.mjs
+          assertSRIConfig(config)
+
+          const security = config.security
+          const externalUrls: string[] = []
+
+          if (security?.csp?.scriptDirective?.resources) {
+            for (const resource of security.csp.scriptDirective.resources) {
+              if (resource.startsWith("https://")) {
+                try {
+                  const parsed = new URL(resource)
+                  // Skip wildcard domains
+                  if (parsed.hostname.includes("*")) continue
+
+                  // Skip root domains or directories (no actual script/style file)
+                  const path = parsed.pathname
+                  if (path === "/" || path === "" || path.endsWith("/")) continue
+
+                  externalUrls.push(resource)
+                } catch {
+                  // Skip invalid URLs
+                }
+              }
+            }
+          }
+
+          if (externalUrls.length > 0) {
+            // 2. Fetch and Hash External Scripts
+            const results = await Promise.all(
+              externalUrls.map(async (url) => {
+                try {
+                  const response = await fetch(url)
+                  if (!response.ok) throw new Error(`HTTP ${response.status}`)
+
+                  const buffer = await response.arrayBuffer()
+                  const hash = createHash("sha384").update(Buffer.from(buffer)).digest("base64")
+
+                  sriManifest[url] = `sha384-${hash}`
+                  return { url, success: true }
+                } catch (err: unknown) {
+                  const message = err instanceof Error ? err.message : String(err)
+                  return { url, success: false, error: message }
+                }
+              })
+            )
+
+            const succeeded = results.filter((r) => r.success).map((r) => r.url)
+            const failed = results.filter((r) => !r.success)
+
+            if (failed.length === 0) {
+              logger.info(
+                `SRI Discovery: successfully hashed ${succeeded.length} external resource(s).\n` +
+                  `      Succeeded:\n` +
+                  succeeded.map((url) => `      - ${url}`).join("\n")
+              )
+            } else {
+              const succeededBlock =
+                succeeded.length > 0
+                  ? `      Succeeded:\n` + succeeded.map((url) => `      - ${url}`).join("\n")
+                  : ""
+              const failedBlock =
+                `      Failed:\n` + failed.map((f) => `      - ${f.url} (${f.error})`).join("\n")
+
+              const parts = [
+                `SRI Discovery: hashed ${succeeded.length}/${results.length} external resource(s).`,
+                succeededBlock,
+                failedBlock
+              ].filter(Boolean)
+
+              logger.warn(parts.join("\n\n"))
+            }
+          } else {
+            logger.info("SRI Discovery: no external resources found to hash.")
+          }
+        }
+
+        // 3. Provide hashes to the runtime via Vite's virtual module
+        const virtualModuleId = "virtual:sri-manifest"
+        const resolvedVirtualModuleId = "\0" + virtualModuleId
+
+        updateConfig({
+          vite: {
+            plugins: [
+              {
+                name: "vite-plugin-sri-manifest",
+                resolveId(id: string) {
+                  if (id === virtualModuleId) return resolvedVirtualModuleId
+                  return null
+                },
+                load(id: string) {
+                  if (id === resolvedVirtualModuleId) {
+                    return `export const manifest = ${JSON.stringify(sriManifest)};`
+                  }
+                  return null
+                }
+              }
+            ]
+          }
+        })
+      }
+    }
+  }
+}

package/src/middleware/index.ts

@@ -0,0 +1 @@
+export * from "./security"

package/src/middleware/security.ts

@@ -0,0 +1,255 @@
+import { defineMiddleware } from "astro:middleware"
+// @ts-ignore - virtual module generated by the SRI integration
+import { manifest } from "virtual:sri-manifest"
+
+declare const HTMLRewriter: any
+
+function assertManifest(obj: unknown): asserts obj is Record<string, string> {
+  if (!obj || typeof obj !== "object") throw new Error("Expected manifest")
+}
+
+// Assert and pre-compile regular expressions once at startup
+assertManifest(manifest)
+
+const manifestRegexes = Object.entries(manifest).map(([url, hash]) => ({
+  hash,
+  scriptRegex: new RegExp(`(<script[^>]+src=["']${url}["'][^>]*)(/?>)`, "g"),
+  linkRegex: new RegExp(`(<link[^>]+href=["']${url}["'][^>]*)(/?>)`, "g")
+}))
+
+function addSecurityHeaders(response: Response, origin?: string): Response {
+  try {
+    response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
+    response.headers.set("X-Content-Type-Options", "nosniff")
+    response.headers.set("X-Frame-Options", "DENY")
+    response.headers.set("Cross-Origin-Resource-Policy", "same-origin")
+    response.headers.set(
+      "Strict-Transport-Security",
+      "max-age=31536000; includeSubDomains; preload"
+    )
+    response.headers.set(
+      "Permissions-Policy",
+      "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
+    )
+    response.headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
+    if (origin) {
+      response.headers.set(
+        "Link",
+        [
+          `<${origin}/sitemap-index.xml>; rel="sitemap"`,
+          `<${origin}/llms.txt>; rel="llms"`,
+          `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+          `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+        ].join(", ")
+      )
+    }
+    return response
+  } catch {
+    const headers = new Headers(response.headers)
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin")
+    headers.set("X-Content-Type-Options", "nosniff")
+    headers.set("X-Frame-Options", "DENY")
+    headers.set("Cross-Origin-Resource-Policy", "same-origin")
+    headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
+    headers.set(
+      "Permissions-Policy",
+      "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
+    )
+    headers.set("No-Vary-Search", 'except=("q" "search" "locale"), params=?1')
+    if (origin) {
+      headers.set(
+        "Link",
+        [
+          `<${origin}/sitemap-index.xml>; rel="sitemap"`,
+          `<${origin}/llms.txt>; rel="llms"`,
+          `<${origin}/.well-known/api-catalog>; rel="api-catalog"`,
+          `<${origin}/rss.xml>; rel="alternate"; type="application/rss+xml"`
+        ].join(", ")
+      )
+    }
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    })
+  }
+}
+
+/**
+ * Security Middleware: Injects SRI integrity attributes and security headers.
+ */
+export const security = defineMiddleware(async (context, next) => {
+  // HTTP to HTTPS redirect only in production
+  if (import.meta.env.PROD && context.request.url.startsWith("http://")) {
+    const httpsUrl = context.request.url.replace(/^http:/, "https:")
+    return Response.redirect(httpsUrl, 301)
+  }
+
+  const response = await next()
+  const contentType = response.headers.get("content-type") || ""
+
+  // Early return for non-HTML responses (avoid body parsing/corruption/overhead)
+  if (!contentType.includes("text/html")) {
+    return addSecurityHeaders(response, context.url.origin)
+  }
+
+  if (import.meta.env.DEV) {
+    const cleanHeaders = new Headers(response.headers)
+    cleanHeaders.delete("content-security-policy")
+    let modifiedHtml = await response.text()
+    modifiedHtml = modifiedHtml.replace(
+      /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
+      ""
+    )
+    return addSecurityHeaders(
+      new Response(modifiedHtml, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: cleanHeaders
+      }),
+      context.url.origin
+    )
+  }
+
+  let cspHeader = response.headers.get("content-security-policy")
+  const newHeaders = new Headers(response.headers)
+
+  if (cspHeader) {
+    // Unescape HTML entities (like &#39; or &#x27; to ') that Astro's native CSP generation mistakenly puts in the header
+    cspHeader = cspHeader
+      .replace(/&#0*39;/g, "'")
+      .replace(/&#x0*27;/gi, "'")
+      .replace(/&quot;/g, '"')
+      .replace(/&amp;/g, "&")
+    newHeaders.set("content-security-policy", cspHeader)
+  }
+
+  const nonceValue = cspHeader ? crypto.randomUUID().replace(/-/g, "") : null
+
+  if (cspHeader && nonceValue) {
+    let newCsp = cspHeader
+    if (newCsp.includes("script-src ")) {
+      newCsp = newCsp.replace("script-src ", `script-src 'nonce-${nonceValue}' `)
+    } else {
+      newCsp = newCsp + `; script-src 'nonce-${nonceValue}'`
+    }
+    if (newCsp.includes("style-src ")) {
+      newCsp = newCsp.replace("style-src ", `style-src 'nonce-${nonceValue}' `)
+    } else {
+      newCsp = newCsp + `; style-src 'nonce-${nonceValue}'`
+    }
+    newHeaders.set("content-security-policy", newCsp)
+  }
+
+  if (typeof HTMLRewriter !== "undefined") {
+    let rewriter = new HTMLRewriter()
+
+    // Only register handlers if there are items to hash
+    if (manifestRegexes.length > 0) {
+      rewriter = rewriter
+        .on("script[src]", {
+          element(el: any) {
+            const src = el.getAttribute("src")
+            if (src && manifest[src]) {
+              el.setAttribute("integrity", manifest[src])
+              el.setAttribute("crossorigin", "anonymous")
+            }
+          }
+        })
+        .on('link[rel="stylesheet"][href]', {
+          element(el: any) {
+            const href = el.getAttribute("href")
+            if (href && manifest[href]) {
+              el.setAttribute("integrity", manifest[href])
+              el.setAttribute("crossorigin", "anonymous")
+            }
+          }
+        })
+    }
+
+    rewriter = rewriter.on('meta[http-equiv="content-security-policy" i]', {
+      element(el: any) {
+        el.remove()
+      }
+    })
+
+    if (nonceValue) {
+      rewriter = rewriter
+        .on("head", {
+          element(el: any) {
+            el.append(`<meta name="csp-nonce" content="${nonceValue}">`, { html: true })
+          }
+        })
+        .on("script", {
+          element(el: any) {
+            if (!el.getAttribute("nonce")) {
+              el.setAttribute("nonce", nonceValue)
+            }
+          }
+        })
+        .on("style", {
+          element(el: any) {
+            el.setAttribute("nonce", nonceValue)
+          }
+        })
+    }
+
+    return addSecurityHeaders(
+      rewriter.transform(
+        new Response(response.body, {
+          status: response.status,
+          statusText: response.statusText,
+          headers: newHeaders
+        })
+      ),
+      context.url.origin
+    )
+  }
+
+  let modifiedHtml = await response.text()
+
+  // Remove Astro-injected CSP meta tag to prevent duplicate CSP headers and HTML escaping errors
+  modifiedHtml = modifiedHtml.replace(
+    /<meta\s[^>]*http-equiv\s*=\s*["']?content-security-policy[^>]*>/gi,
+    ""
+  )
+
+  // Use pre-compiled regexes
+  for (const { hash, scriptRegex, linkRegex } of manifestRegexes) {
+    if (!hash) continue
+
+    modifiedHtml = modifiedHtml.replace(
+      scriptRegex,
+      `$1 integrity="${hash}" crossorigin="anonymous"$2`
+    )
+
+    modifiedHtml = modifiedHtml.replace(
+      linkRegex,
+      `$1 integrity="${hash}" crossorigin="anonymous"$2`
+    )
+  }
+
+  if (nonceValue) {
+    modifiedHtml = modifiedHtml.replace(
+      /<head([^>]*)>/i,
+      `<head$1>\n<meta name="csp-nonce" content="${nonceValue}">`
+    )
+    modifiedHtml = modifiedHtml.replace(
+      /<script(?![^>]*nonce=)([^>]*)>/gi,
+      `<script$1 nonce="${nonceValue}">`
+    )
+    modifiedHtml = modifiedHtml.replace(
+      /<style(?![^>]*nonce=)([^>]*)>/gi,
+      `<style$1 nonce="${nonceValue}">`
+    )
+  }
+
+  return addSecurityHeaders(
+    new Response(modifiedHtml, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: newHeaders
+    }),
+    context.url.origin
+  )
+})

package/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "extends": "astro/tsconfigs/strictest",
+  "include": [".astro/types.d.ts", "**/*"],
+  "exclude": ["dist"],
+  "compilerOptions": {
+    "plugins": [
+      {
+        "name": "@astrojs/ts-plugin"
+      }
+    ],
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "allowArbitraryExtensions": true,
+    "jsx": "preserve"
+  }
+}