@spacefast/common 0.0.12 → 0.0.17

package/dist/utils/space-config.d.ts

@@ -1,5 +1,6 @@
+import { type Grant } from "../contracts/grants.js";
 import { type SpaceConfig, type SpaceConfigFile } from "../contracts/space-config.js";
-export type SpaceConfigBlockingIssueCode = "config_file_too_large" | "config_templates_over_limit" | "config_meta_too_long" | "config_invalid" | "inject_snippet_too_large" | "inject_invalid";
+export type SpaceConfigBlockingIssueCode = "config_file_too_large" | "config_templates_over_limit" | "config_meta_too_long" | "config_name_too_long" | "config_functions_key_removed" | "config_invalid" | "config_runtime_invalid_kind" | "config_runtime_entry_missing" | "inject_snippet_too_large" | "inject_invalid";
 export type SpaceConfigIssue = {
     severity: "info" | "warning" | "error";
     code: SpaceConfigBlockingIssueCode | "single_html_index" | "files_mode_inferred";
@@ -8,15 +9,27 @@ export type SpaceConfigIssue = {
     path?: string;
     details?: Record<string, unknown>;
 };
+export declare const CONFIG_PUBLIC_GRANT_COMPILED_ID = "config:access.public";
+/** Compiles the file-only access declaration; activation decides which Version is live. */
+export declare function compileSpaceConfigPublicGrant(fileConfig: Pick<SpaceConfigFile, "access"> | null | undefined): Grant | null;
 type SpaceConfigBlockingIssue = SpaceConfigIssue & {
     code: SpaceConfigBlockingIssueCode;
 };
+/**
+ * Keys a committed `sf.jsonc` owns outright: they are facts about the content
+ * of a version (who may read it, what it is called, what runs it), so they roll
+ * forward and back with the version instead of living in the space's mutable
+ * overlay. API intake refuses them rather than storing or dropping them.
+ */
+export declare const SPACE_CONFIG_FILE_ONLY_KEYS: readonly ["access", "name", "runtime"];
 /**
  * Validates a space `config` overlay at API intake (PATCH /spaces, publish
- * `config`): the 16 KB compiled-overlay cap plus the shared shape caps.
- * Returns the first blocking issue, or null when the overlay is acceptable.
+ * `config`): file-only keys, the 16 KB compiled-overlay cap, plus the shared
+ * shape caps. Returns the first blocking issue, or null when the overlay is
+ * acceptable. Takes the raw request value, because the overlay schema strips
+ * file-only keys and this is what has to see them.
  */
-export declare function spaceConfigOverlayIssue(config: SpaceConfig): SpaceConfigBlockingIssue | null;
+export declare function spaceConfigOverlayIssue(config: unknown): SpaceConfigBlockingIssue | null;
 export declare function stripJsonComments(raw: string): string;
 export type ParsedSpaceConfigFile = {
     /** Parsed config (cap- and shape-valid keys only); null when unusable. */

package/dist/utils/space-config.js

@@ -1,8 +1,35 @@
+import { CONFIG_PUBLIC_GRANT_SOURCE_REFERENCE, grantSchema, } from "../contracts/grants.js";
 import { SPACE_CONFIG_CAPS, SPACE_CONFIG_CANONICAL_FILE, SPACE_CONFIG_PRIVATE_FILES, spaceConfigFileSchema, spaceConfigSchema, } from "../contracts/space-config.js";
 const TEXT_BYTES = new TextEncoder();
+export const CONFIG_PUBLIC_GRANT_COMPILED_ID = "config:access.public";
 function byteLength(value) {
     return TEXT_BYTES.encode(value).length;
 }
+/** Compiles the file-only access declaration; activation decides which Version is live. */
+export function compileSpaceConfigPublicGrant(fileConfig) {
+    const patterns = fileConfig?.access?.public ?? [];
+    const include = patterns.filter((pattern) => !pattern.startsWith("!"));
+    if (include.length === 0)
+        return null;
+    return grantSchema.parse({
+        id: CONFIG_PUBLIC_GRANT_COMPILED_ID,
+        name: "Public paths from sf.jsonc",
+        audience: { kind: "public" },
+        resources: {
+            include,
+            exclude: patterns
+                .filter((pattern) => pattern.startsWith("!"))
+                .map((pattern) => pattern.slice(1)),
+        },
+        capabilities: ["page.view"],
+        constraints: {},
+        target: { kind: "live" },
+        source: {
+            kind: "config",
+            reference: CONFIG_PUBLIC_GRANT_SOURCE_REFERENCE,
+        },
+    });
+}
 function capIssues(candidate) {
     const issues = [];
     const templates = candidate.templates;
@@ -96,12 +123,104 @@ function capIssues(candidate) {
     }
     return issues;
 }
+// File-only keys (`name`, `runtime`) never reach the API overlay, so their
+// checks live beside the shared caps rather than inside them. Both run BEFORE
+// zod so a bad declaration reports its stable code instead of a shape error.
+const RUNTIME_KINDS = new Set(["zero", "functions"]);
+function fileOnlyIssues(candidate) {
+    const issues = [];
+    const name = candidate.name;
+    if (typeof name === "string" && name.trim().length > SPACE_CONFIG_CAPS.nameChars) {
+        issues.push({
+            severity: "error",
+            code: "config_name_too_long",
+            message: `name supports up to ${SPACE_CONFIG_CAPS.nameChars} characters.`,
+            path: "name",
+            details: { length: name.trim().length, limit: SPACE_CONFIG_CAPS.nameChars },
+        });
+    }
+    const runtime = candidate.runtime;
+    if (runtime === undefined) {
+        return issues;
+    }
+    if (typeof runtime !== "object" || runtime === null || Array.isArray(runtime)) {
+        issues.push({
+            severity: "error",
+            code: "config_runtime_invalid_kind",
+            message: 'runtime must be an object declaring a kind of "zero" or "functions".',
+            path: "runtime",
+        });
+        return issues;
+    }
+    const declaration = runtime;
+    const kind = declaration.kind;
+    if (typeof kind !== "string" || !RUNTIME_KINDS.has(kind)) {
+        issues.push({
+            severity: "error",
+            code: "config_runtime_invalid_kind",
+            message: 'runtime.kind must be "zero" or "functions".',
+            path: "runtime.kind",
+            ...(typeof kind === "string" ? { details: { kind } } : {}),
+        });
+        return issues;
+    }
+    if (kind === "zero") {
+        // Zero is never inferred, so a declaration that names neither entry has
+        // nothing to compile — failing here beats publishing static files under a
+        // config that promised a database app.
+        for (const key of ["server", "client"]) {
+            const value = declaration[key];
+            if (typeof value !== "string" || value.trim().length === 0) {
+                issues.push({
+                    severity: "error",
+                    code: "config_runtime_entry_missing",
+                    message: `runtime.${key} is required and must name a module when runtime.kind is "zero".`,
+                    path: `runtime.${key}`,
+                });
+            }
+        }
+        return issues;
+    }
+    const entry = declaration.entry;
+    if (entry !== undefined && (typeof entry !== "string" || entry.trim().length === 0)) {
+        issues.push({
+            severity: "error",
+            code: "config_runtime_entry_missing",
+            message: "runtime.entry must name a module when present; omit it to detect the worker instead.",
+            path: "runtime.entry",
+        });
+    }
+    return issues;
+}
+/**
+ * Keys a committed `sf.jsonc` owns outright: they are facts about the content
+ * of a version (who may read it, what it is called, what runs it), so they roll
+ * forward and back with the version instead of living in the space's mutable
+ * overlay. API intake refuses them rather than storing or dropping them.
+ */
+export const SPACE_CONFIG_FILE_ONLY_KEYS = ["access", "name", "runtime"];
 /**
  * Validates a space `config` overlay at API intake (PATCH /spaces, publish
- * `config`): the 16 KB compiled-overlay cap plus the shared shape caps.
- * Returns the first blocking issue, or null when the overlay is acceptable.
+ * `config`): file-only keys, the 16 KB compiled-overlay cap, plus the shared
+ * shape caps. Returns the first blocking issue, or null when the overlay is
+ * acceptable. Takes the raw request value, because the overlay schema strips
+ * file-only keys and this is what has to see them.
  */
 export function spaceConfigOverlayIssue(config) {
+    if (config === null || config === undefined || typeof config !== "object") {
+        return null;
+    }
+    for (const key of SPACE_CONFIG_FILE_ONLY_KEYS) {
+        if (Object.prototype.hasOwnProperty.call(config, key)) {
+            return {
+                severity: "error",
+                code: "config_invalid",
+                message: `${key} is only valid in the committed ${SPACE_CONFIG_CANONICAL_FILE} file.`,
+                path: key,
+                details: { file: SPACE_CONFIG_CANONICAL_FILE },
+            };
+        }
+    }
     const encoded = JSON.stringify(config);
     if (byteLength(encoded) > SPACE_CONFIG_CAPS.overlayBytes) {
         return {
@@ -114,9 +233,18 @@ export function spaceConfigOverlayIssue(config) {
     }
     return capIssues(config)[0] ?? null;
 }
-// Routing concerns never live in sf.jsonc (spec: redirects, rewrites,
-// proxies, and headers stay exclusively in `_redirects`/`_headers`).
-const ROUTING_KEYS = new Set(["redirects", "rewrites", "proxies", "proxy", "headers", "routes"]);
+// Other platforms' routing vocabulary. We have one matcher grammar; naming it
+// four more ways would be four more things to keep in sync.
+const ROUTING_KEYS = new Set(["proxies", "proxy", "routes"]);
+// OUR routing vocabulary. These keys are real sf.jsonc keys, owned end to end
+// by the routing compiler (crates/stattic-runtime-core): the strict v1 compiler
+// validates them and the merge folds them in behind `_redirects`/`_headers`.
+// This lane resolves the serving config, so it neither validates nor carries
+// them — it just leaves them alone.
+const ROUTING_RULE_KEYS = new Set(["redirects", "rewrites", "headers"]);
+// Replaced by the `runtime` declaration; never silently ignored like other
+// unknown keys, because it is the one key whose loss changes what gets served.
+const REMOVED_FUNCTIONS_KEY = "functions";
 const KNOWN_FILE_KEYS = new Set(Object.keys(spaceConfigFileSchema.shape));
 // Strips JSONC comments and trailing commas (string-aware single pass).
 export function stripJsonComments(raw) {
@@ -255,7 +383,23 @@ export function parseSpaceConfigFile(raw, options = {}) {
         if (KNOWN_FILE_KEYS.has(key)) {
             continue;
         }
-        if (ROUTING_KEYS.has(key)) {
+        if (ROUTING_RULE_KEYS.has(key)) {
+            delete record[key];
+            continue;
+        }
+        if (key === REMOVED_FUNCTIONS_KEY) {
+            // The runtime declaration replaced this key outright (spec "The old
+            // top-level functions.* key is removed in the same cutover"): warning-and-
+            // strip would publish static files under a config that asked for a
+            // worker, so it blocks with its own code instead.
+            issues.push({
+                severity: "error",
+                code: "config_functions_key_removed",
+                message: `The "${REMOVED_FUNCTIONS_KEY}" key was removed from ${configPath}; declare runtime.kind "functions" instead.`,
+                path: key,
+            });
+        }
+        else if (ROUTING_KEYS.has(key)) {
             issues.push({
                 severity: "error",
                 code: "config_invalid",
@@ -273,8 +417,7 @@ export function parseSpaceConfigFile(raw, options = {}) {
         }
         delete record[key];
     }
-    const caps = capIssues(record);
-    issues.push(...caps);
+    issues.push(...capIssues(record), ...fileOnlyIssues(record));
     if (issues.some((issue) => issue.severity === "error")) {
         return { config: null, issues };
     }

package/dist/utils/static-runtime-policy.d.ts

@@ -1,5 +1,10 @@
 export declare const PHP_LIKE_EXTENSIONS: string[];
+export declare const INTERNAL_REDIRECT_RESPONSE_HEADERS: string[];
 export declare const PLATFORM_MANAGED_RESPONSE_HEADERS: string[];
+/** Reserved response-header namespaces owned by the platform's own serving signature. */
+export declare const PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES: string[];
+/** True when user rules may neither set nor remove this response header. */
+export declare function isPlatformManagedResponseHeader(name: string): boolean;
 export declare const NON_IMMUTABLE_EXTENSIONS: string[];
 export declare const GUARANTEED_IMMUTABLE_PREFIXES: string[];
 /** Lowercased extension without the leading dot, posix semantics. Dotfiles have no extension. */

package/dist/utils/static-runtime-policy.js

@@ -7,13 +7,47 @@
 // (static-runtime-policy.fixtures.json). Do not add platform/filesystem
 // behavior here.
 export const PHP_LIKE_EXTENSIONS = ["php", "php3", "php4", "php5", "php7", "php8", "phtml", "phar"];
+// The internal-redirect/sendfile family: headers that do not describe a response, they
+// instruct the web server to produce a different one. Under nginx+php-fpm
+// X-Accel-Redirect (and every vendor spelling of it) turns a response into a server-side
+// read of an arbitrary internal path — a private-path disclosure primitive — while
+// X-Accel-Limit-Rate pins the serving worker for the length of the transfer.
+//
+// These are dangerous from ANY origin we do not control, so this family is factored out
+// of the platform-managed list below: a relay lane (runtime/engine/runtime/proxy.php)
+// must drop exactly this set from an untrusted upstream while still relaying the
+// ordinary response headers (location, content-encoding, content-range, allow) that the
+// rest of the managed list contains.
+export const INTERNAL_REDIRECT_RESPONSE_HEADERS = [
+    "x-accel-buffering",
+    "x-accel-charset",
+    "x-accel-expires",
+    "x-accel-limit-rate",
+    "x-accel-redirect",
+    "x-lighttpd-send-file",
+    "x-lighttpd-sendfile",
+    "x-lighttpd-sendfile2",
+    "x-reproxy-url",
+    "x-sendfile",
+];
 // Rejected/platform-managed response headers (internal-docs/platform.md "Routing And
-// Headers"): user `_headers` rules can never set or remove these. The list includes the
-// internal-redirect/sendfile family (X-Accel-Redirect, X-Sendfile, X-LIGHTTPD-send-file,
-// X-Accel-Buffering) because under nginx+php-fpm those headers turn a response into a
-// server-side file read — a private-path disclosure primitive. The native Rust compiler
-// rejects them at publish; the PHP runtime refuses them again at apply time so a compiler
-// gap can never emit one.
+// Headers"): user `_headers` rules can never set or remove these. The
+// internal-redirect/sendfile family above is spread in, so it stays a strict subset —
+// anything the proxy lane refuses to relay is also refused from `_headers`. The rest is
+// the connection and transport surface: hop-by-hop names (Connection, Keep-Alive, TE,
+// Trailer, Transfer-Encoding, Upgrade, Proxy-*), framing, and the edge-cache trio.
+//
+// `isPlatformManagedResponseHeader` — not this list alone — is the policy: the reserved
+// `x-spacefast-*` / `x-stattic-*` namespaces below carry the platform's own response
+// signature (X-Spacefast-Runtime, X-Spacefast-Version, X-Spacefast-Reason, …), so user
+// rules can never forge or clobber them.
+//
+// Every enforcement point derives from here: the `_headers` compiler in
+// @spacefast/routing imports it directly, the PHP runtime maps and prefixes are
+// generated from it into runtime/engine/shared/safety.php, and the Rust authorities
+// (crates/stattic-runtime-core policy.rs, crates/stattic-zero-runner
+// response_headers.rs) are drift-guarded against it by
+// apps/control-plane/src/runtime/php-policy-parity.test.ts.
 export const PLATFORM_MANAGED_RESPONSE_HEADERS = [
     "accept-ranges",
     "age",
@@ -28,21 +62,31 @@ export const PLATFORM_MANAGED_RESPONSE_HEADERS = [
     "cookie",
     "date",
     "host",
+    "keep-alive",
     "location",
     "netlify-cdn-cache-control",
+    "proxy-authenticate",
+    "proxy-authorization",
     "server",
     "set-cookie",
     "strict-transport-security",
     "surrogate-control",
+    "te",
     "trailer",
     "transfer-encoding",
     "upgrade",
     "vary",
-    "x-accel-buffering",
-    "x-accel-redirect",
-    "x-lighttpd-send-file",
-    "x-sendfile",
+    ...INTERNAL_REDIRECT_RESPONSE_HEADERS,
 ];
+/** Reserved response-header namespaces owned by the platform's own serving signature. */
+export const PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES = ["x-spacefast-", "x-stattic-"];
+const PLATFORM_MANAGED_RESPONSE_HEADER_SET = new Set(PLATFORM_MANAGED_RESPONSE_HEADERS);
+/** True when user rules may neither set nor remove this response header. */
+export function isPlatformManagedResponseHeader(name) {
+    const lower = name.trim().toLowerCase();
+    return (PLATFORM_MANAGED_RESPONSE_HEADER_SET.has(lower) ||
+        PLATFORM_MANAGED_RESPONSE_HEADER_PREFIXES.some((prefix) => lower.startsWith(prefix)));
+}
 export const NON_IMMUTABLE_EXTENSIONS = ["html", "htm", "php", "txt", "xml"];
 const PHP_LIKE_EXTENSION_SET = new Set(PHP_LIKE_EXTENSIONS);
 const NON_IMMUTABLE_EXTENSION_SET = new Set(NON_IMMUTABLE_EXTENSIONS);

package/dist/utils/storage-policy.d.ts

@@ -0,0 +1,20 @@
+export declare const STORAGE_OBJECT_MAX_FILE_BYTES: number;
+export declare const STORAGE_OBJECT_MAX_OWNER_BYTES: number;
+export declare const STORAGE_CONTENT_SNIFF_BYTES = 512;
+export declare const STORAGE_BLOCKED_CONTENT_TYPES: string[];
+export declare const STORAGE_BLOCKED_CONTENT_TYPE_FRAGMENTS: string[];
+export declare const STORAGE_BLOCKED_MAGIC_HEX: string[];
+export declare const STORAGE_BLOCKED_TEXT_PREFIXES: string[];
+export declare function storageDeclaredTypeBlocked(contentType: string): boolean;
+export declare function storageContentBlocked(contentType: string, input: Uint8Array): boolean;
+export type StorageByteRange = {
+    unsatisfiable: true;
+} | {
+    start: number;
+    end: number;
+    header: string;
+};
+export declare function storageParseSingleRange(rangeHeader: string | null | undefined, size: number): StorageByteRange | null;
+export declare function storageIfNoneMatchMatches(header: string | null | undefined, etag: string): boolean;
+export declare function storageParseHttpDate(value: string): number | null;
+export declare function storageIfRangeMatches(ifRange: string, etag: string, lastModified: string): boolean;

package/dist/utils/storage-policy.fixtures.json

@@ -0,0 +1,174 @@
+{
+    "content": [
+        {
+            "name": "declared html",
+            "contentType": "text/html; charset=utf-8",
+            "hex": "706c61696e",
+            "expected": true
+        },
+        {
+            "name": "declared javascript",
+            "contentType": "application/javascript",
+            "hex": "706c61696e",
+            "expected": true
+        },
+        {
+            "name": "windows executable magic",
+            "contentType": "application/octet-stream",
+            "hex": "4d5a0000",
+            "expected": true
+        },
+        {
+            "name": "mach executable magic",
+            "contentType": "application/octet-stream",
+            "hex": "feedfacf0000",
+            "expected": true
+        },
+        {
+            "name": "trimmed active html",
+            "contentType": "text/plain",
+            "hex": "20090a3c7363726970743e",
+            "expected": true
+        },
+        {
+            "name": "svg remains allowed",
+            "contentType": "image/svg+xml",
+            "hex": "3c73766720786d6c6e733d22687474703a2f2f7777772e77332e6f72672f323030302f737667223e",
+            "expected": false
+        },
+        {
+            "name": "plain bytes remain allowed",
+            "contentType": "application/octet-stream",
+            "hex": "68656c6c6f2073746f72616765",
+            "expected": false
+        }
+    ],
+    "ranges": [
+        { "name": "absent", "header": null, "size": 14, "expected": null },
+        {
+            "name": "full tail",
+            "header": "bytes=7-",
+            "size": 14,
+            "expected": { "start": 7, "end": 13, "header": "bytes=7-13" }
+        },
+        {
+            "name": "bounded",
+            "header": "bytes=0-6",
+            "size": 14,
+            "expected": { "start": 0, "end": 6, "header": "bytes=0-6" }
+        },
+        {
+            "name": "suffix",
+            "header": "bytes=-4",
+            "size": 14,
+            "expected": { "start": 10, "end": 13, "header": "bytes=10-13" }
+        },
+        {
+            "name": "clamped",
+            "header": "bytes=10-99",
+            "size": 14,
+            "expected": { "start": 10, "end": 13, "header": "bytes=10-13" }
+        },
+        {
+            "name": "unsatisfiable",
+            "header": "bytes=20-30",
+            "size": 14,
+            "expected": { "unsatisfiable": true }
+        },
+        { "name": "multiple ignored", "header": "bytes=0-1,4-5", "size": 14, "expected": null },
+        { "name": "malformed ignored", "header": "items=0-1", "size": 14, "expected": null }
+    ],
+    "ifNoneMatch": [
+        { "name": "exact", "header": "\"abc\"", "etag": "\"abc\"", "expected": true },
+        { "name": "weak", "header": "W/\"abc\"", "etag": "\"abc\"", "expected": true },
+        { "name": "list", "header": "\"no\", W/\"abc\"", "etag": "\"abc\"", "expected": true },
+        { "name": "wildcard", "header": "*", "etag": "\"abc\"", "expected": true },
+        { "name": "miss", "header": "\"no\"", "etag": "\"abc\"", "expected": false }
+    ],
+    "ifRange": [
+        {
+            "name": "exact etag",
+            "header": "\"abc\"",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": true
+        },
+        {
+            "name": "weak etag rejected",
+            "header": "W/\"abc\"",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": false
+        },
+        {
+            "name": "newer date",
+            "header": "Wed, 21 Oct 2015 07:29:00 GMT",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": true
+        },
+        {
+            "name": "older date",
+            "header": "Wed, 21 Oct 2015 07:27:00 GMT",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": false
+        },
+        {
+            "name": "leap second",
+            "header": "Wed, 21 Oct 2015 07:28:60 GMT",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:59 GMT",
+            "expected": true
+        },
+        {
+            "name": "obsolete RFC 850 date",
+            "header": "Sunday, 06-Nov-94 08:49:37 GMT",
+            "etag": "\"abc\"",
+            "lastModified": "Sun, 06 Nov 1994 08:49:37 GMT",
+            "expected": true
+        },
+        {
+            "name": "obsolete asctime date",
+            "header": "Sun Nov  6 08:49:37 1994",
+            "etag": "\"abc\"",
+            "lastModified": "Sun, 06 Nov 1994 08:49:37 GMT",
+            "expected": true
+        },
+        {
+            "name": "relative date rejected",
+            "header": "tomorrow",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": false
+        },
+        {
+            "name": "wrong weekday rejected",
+            "header": "Thu, 21 Oct 2015 07:29:00 GMT",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": false
+        },
+        {
+            "name": "invalid calendar date rejected",
+            "header": "Fri, 31 Feb 2023 07:29:00 GMT",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": false
+        },
+        {
+            "name": "out-of-range time rejected",
+            "header": "Wed, 21 Oct 2015 07:28:61 GMT",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": false
+        },
+        {
+            "name": "trailing garbage rejected",
+            "header": "Wed, 21 Oct 2015 07:29:00 GMT later",
+            "etag": "\"abc\"",
+            "lastModified": "Wed, 21 Oct 2015 07:28:00 GMT",
+            "expected": false
+        }
+    ]
+}