workproof 0.3.0 → 0.4.0

package/README.md

@@ -144,6 +144,37 @@ only comparable when that line matches:
 How: `git blame --line-porcelain -w -M --ignore-revs-file .git-blame-ignore-revs HEAD -- <file> over a deterministic 1-in-1 file sample (surviving-lines 0.1.1: FNV-1a on path); generated, vendored and lock files excluded`
 ```
 
+## When you are two people
+
+Git has no idea that the address on your laptop and the address on your work machine belong to
+one person. It counts them as two authors, so a report about one of them describes half your
+work and says nothing about the rest, and every figure in it is quietly too small. This is the
+most common way these numbers go wrong and nothing normally tells you.
+
+The report tells you:
+
+```
+**1 other identity in this repository looks like the same person and was not counted here**:
+Efe Genc. The same name, "Efe Genc", on another address. Every figure below therefore describes
+only the work under the identities named above. If they are the same person, re-run with each
+address passed to `--author`, or merge them in a `.mailmap`.
+```
+
+The same line appears as a warning on stderr while the run is happening, and as
+`identity.possiblySplit` in the JSON. Three signals raise it: the same name on another address,
+a GitHub noreply login that matches your address or your name, and the same address name on
+another domain. Role addresses like `dev@` and bot addresses are ignored, because sharing one
+proves nothing.
+
+It is a disclosure, not a correction. The tool cannot know whether two addresses are one person,
+so it never merges them for you: pass each address to `--author`, or write a `.mailmap`, which
+`git log`, `git blame` and `git shortlog` all read as well.
+[`surviving-lines --identities`](https://github.com/Bubblegunn/surviving-lines) prints the
+`.mailmap` lines for a whole repository if you want to fix it once for everyone.
+
+The addresses themselves stay out of the document unless you pass `--emails`, the same rule the
+rest of the report follows.
+
 ## In plain language
 
 Each repository section of the Markdown report opens with a paragraph a non-engineer can
@@ -198,6 +229,16 @@ Three commands, in increasing order of what the reader needs to have.
   compares HEAD, then recomputes every figure and prints what differs. A report from another
   repository stops at the fingerprint. If HEAD moved since the report, it says so and shows
   which figures changed.
+The hash is reproducible **across operating systems, git versions, locales and directory
+names**, for the same repository at the same commit with the same command and the same
+`--fingerprint-key`. It is not reproducible across a rewritten history, a different sample
+or a different seed, and it is not meant to be: those change the measurement. Two fields
+in the report are deliberately outside the hash, because a verifier on another machine
+cannot reproduce them: the local directory name, and the git version. They stay in the
+document, where they explain why two runs might legitimately differ. Before 0.4.0 both
+were inside it, so the same repository in a folder with a different name hashed
+differently; a test now pins all of this, and CI checks it on Linux, macOS and Windows.
+
 - `workproof attest report.json` writes `report.intoto.json`, an
   [in-toto](https://in-toto.io) v1 Statement whose subject is the report hash and whose
   predicate carries the tool version, parameters, HEAD, keyed fingerprint, git version and
@@ -452,6 +493,28 @@ with an attestation if the reader cannot reach the repository.
 It measures survivorship and activity, not quality, review, design or mentoring. It does
 not rank people. It does not replace references. It is not a legal document.
 
+## What the research says about numbers like these
+
+Repository-derived figures have a literature, and most of it is a warning. Kalliamvakou,
+Gousios and Blincoe catalogued the traps in mining a forge, including that most repositories
+are personal and inactive and that a large share of merged pull requests are not recorded as
+merged ([MSR 2014](https://doi.org/10.1145/2597073.2597074), extended in [EMSE
+2015](https://doi.org/10.1007/s10664-015-9393-5)). Bird and colleagues related ownership
+concentration to defects rather than to credit, which is a different question from this one
+and is not evidence that a high share means good work. On survival, Spinellis, Louridas and
+Kechagia put the median line lifespan at about 2.4 years across 89 repositories ([PeerJ CS
+7:e372, 2021](https://doi.org/10.7717/peerj-cs.372)), and Gurov found over half of all lines
+are never deleted in 120 TypeScript repositories ([arXiv
+2606.04993](https://arxiv.org/abs/2606.04993)).
+
+None of that work measures a person's share of the surviving code, which is what the
+surviving-lines figure here reports. A first measurement of how far that share diverges from
+commit share, over twelve repositories, is in
+[surviving-lines/research](https://github.com/Bubblegunn/surviving-lines/tree/main/research):
+the same person tops both in 25 of 36 runs, and among substantial contributors the two
+differ by a median of 7.5 percentage points. That is the honest size of the effect this
+report exists to expose, measured rather than asserted.
+
 ## Where it comes from
 
 The method is written up in
@@ -461,6 +524,16 @@ workproof's only dependency. Degree of authorship follows Avelino, Hora and Vale
 (2016), major contributors follow Bird et al. (2011), and the absence factor is the CHAOSS
 Contributor Absence Factor.
 
+## Thanks
+
+[@edwardsong08](https://github.com/edwardsong08) sent two pull requests on the day this was
+published, without knowing me: `--format markdown|json|both`, so a pipeline can ask for one file
+instead of two ([#9](https://github.com/Bubblegunn/workproof/pull/9)), and a language map that
+covers Elixir, Scala, Haskell, Lua, R, Objective-C and Zig
+([#3](https://github.com/Bubblegunn/workproof/pull/3)). Both shipped in 0.1.3 and are in every
+release since. The second one is why the footprint figure names the right language for anyone
+outside the handful I had thought to list.
+
 ## Development
 
 ```

package/dist/src/analyse.d.ts

@@ -38,6 +38,12 @@ export interface RepoReport {
         emails: string[];
         names: string[];
         count: number;
+        /** Addresses here that look like the subject and were not counted as them. */
+        possiblySplit?: {
+            names: string[];
+            emails?: string[];
+            reasons: string[];
+        };
     };
     /** What the figures were computed with, so a verifier can tell a drift from an edit. */
     environment: {

package/dist/src/analyse.js

@@ -8,7 +8,7 @@ import { isBot, excludedSet } from "./exclusions.js";
 // surviving-lines ships plain ESM JavaScript without type declarations.
 // @ts-ignore
 import { globToRegExp } from "surviving-lines/bin/surviving-lines.js";
-import { resolveIdentity } from "./figures/identity.js";
+import { resolveIdentity, possibleSplits } from "./figures/identity.js";
 import { tenure, commitShare } from "./figures/commits.js";
 import { cadence } from "./figures/cadence.js";
 import { footprint, testsAndDocs } from "./figures/footprint.js";
@@ -83,6 +83,9 @@ export async function analyseRepo(cwd, params, hooks = {}) {
     const ex = await applyExclusions(cwd, everything, params);
     const all = ex.commits;
     const id = await resolveIdentity(all, params.author, cwd);
+    // Before any figure is computed: does someone else here look like the same person? A split
+    // identity makes every figure below describe half the work, silently.
+    const splits = possibleSplits(all, id);
     const t = tenure(all, id, { ...(params.since ? { since: params.since } : {}), ...(params.until ? { until: params.until } : {}) });
     const start = new Date(t.value.first + "T00:00:00Z");
     const end = new Date(t.value.last + "T23:59:59Z");
@@ -138,7 +141,20 @@ export async function analyseRepo(cwd, params, hooks = {}) {
         head: await headSha(cwd),
         fingerprint: fingerprint(await rootCommit(cwd), await remoteUrl(cwd), key),
         fingerprintKeyed: true,
-        identity: { emails: params.emails ? [...new Set(id.emails.map(publicEmail))] : [], names: id.names, count: id.emails.length },
+        identity: {
+            emails: params.emails ? [...new Set(id.emails.map(publicEmail))] : [],
+            names: id.names,
+            count: id.emails.length,
+            ...(splits.length
+                ? {
+                    possiblySplit: {
+                        names: [...new Set(splits.map((sp) => sp.name))],
+                        ...(params.emails ? { emails: [...new Set(splits.map((sp) => publicEmail(sp.email)))] } : {}),
+                        reasons: [...new Set(splits.map((sp) => sp.reason))],
+                    },
+                }
+                : {}),
+        },
         environment: { git: await gitVersion(cwd), blame, ignoreRevs, seed: params.seed ?? "" },
         excluded: { botCommits: ex.botCommits, files: ex.excluded.size, linesAddedShare: addedAll ? addedExcluded / addedAll : 0, enabled: ex.enabled },
         figures,

package/dist/src/cli.js

@@ -245,6 +245,12 @@ async function main() {
         await writeFile(`${out}.badge.json`, JSON.stringify(badgeFor(report), null, 2));
         written.push(`${out}.badge.json`);
     }
+    for (const repo of report.repositories) {
+        const split = repo.identity.possiblySplit;
+        if (!split)
+            continue;
+        progress(`${repo.name}: warning, ${split.names.length} other identity in this repository looks like the same person and is not in these figures (${split.names.join(", ")}). Pass every address to --author, or merge them in a .mailmap.`);
+    }
     console.log(`wrote ${written.join(" and ")} in ${((Date.now() - started) / 1000).toFixed(1)}s`);
 }
 const entry = process.argv[1] ? pathToFileURL(process.argv[1]).href : "";

package/dist/src/figures/identity.d.ts

@@ -22,3 +22,23 @@ export declare function foldIdentity(s: string): string;
  */
 export declare function resolveIdentity(commits: Commit[], author: string[] | undefined, cwd: string): Promise<Identity>;
 export declare const isMine: (c: Commit, id: Identity) => boolean;
+/**
+ * Addresses in this repository that look like the subject but were not counted as them.
+ *
+ * A person who commits from a laptop and a work machine is two authors to git, so a report
+ * describes half of their work and says nothing about the other half. That is a silent wrong
+ * number in a tool whose whole claim is that its numbers can be checked, so the report
+ * discloses the suspicion rather than quietly resolving it: only the author knows whether two
+ * addresses are one person, and `--author` takes both when they are.
+ */
+export declare function possibleSplits(commits: {
+    name: string;
+    email: string;
+}[], identity: {
+    emails: string[];
+    names: string[];
+}): {
+    name: string;
+    email: string;
+    reason: string;
+}[];

package/dist/src/figures/identity.js

@@ -54,3 +54,57 @@ function authorsHint(commits) {
     return top.length ? `Authors here: ${top.join(", ")}. Pass one with --author.` : "The repository has no commits.";
 }
 export const isMine = (c, id) => id.emails.includes(c.email);
+/** Local parts that belong to a role rather than a person, so sharing one proves nothing. */
+const GENERIC_LOCAL = new Set(["dev", "admin", "info", "me", "git", "hello", "mail", "noreply", "no-reply", "contact", "support", "team", "root", "user", "build", "ci", "bot", "test", "email", "work", "home"]);
+const isBotAddress = (mail) => /\[bot\]@|^(?:dependabot|renovate|github-actions|greenkeeper)\b/i.test(mail);
+/** The GitHub login inside `12345+login@users.noreply.github.com`, or the older form. */
+const githubLogin = (mail) => {
+    const m = /^(?:\d+\+)?([^@+]+)@users\.noreply\.github\.com$/i.exec(mail);
+    return m ? m[1].toLowerCase() : null;
+};
+const localPart = (mail) => mail.split("@")[0].replace(/^\d+\+/, "");
+const loose = (s) => foldIdentity(s).replace(/[\s._-]/g, "");
+/**
+ * Addresses in this repository that look like the subject but were not counted as them.
+ *
+ * A person who commits from a laptop and a work machine is two authors to git, so a report
+ * describes half of their work and says nothing about the other half. That is a silent wrong
+ * number in a tool whose whole claim is that its numbers can be checked, so the report
+ * discloses the suspicion rather than quietly resolving it: only the author knows whether two
+ * addresses are one person, and `--author` takes both when they are.
+ */
+export function possibleSplits(commits, identity) {
+    const mine = new Set(identity.emails.map(foldIdentity));
+    const myNames = identity.names.map(foldIdentity);
+    const myLogins = identity.emails.map(githubLogin).filter((l) => l !== null);
+    const myLocals = identity.emails.map(localPart);
+    const seen = new Set();
+    const out = [];
+    for (const c of commits) {
+        const email = c.email;
+        if (mine.has(foldIdentity(email)) || seen.has(foldIdentity(email)) || isBotAddress(email))
+            continue;
+        let reason = "";
+        if (myNames.includes(foldIdentity(c.name))) {
+            reason = `the same name, "${c.name}", on another address`;
+        }
+        else {
+            const theirLogin = githubLogin(email);
+            const theirLocal = localPart(email);
+            if (theirLogin && (myLocals.some((l) => loose(l) === loose(theirLogin)) || myNames.some((n) => loose(n) === loose(theirLogin)))) {
+                reason = `the GitHub login "${theirLogin}" matches yours`;
+            }
+            else if (myLogins.some((l) => loose(l) === loose(theirLocal) || myNames.some((n) => loose(n) === loose(theirLocal)))) {
+                reason = `the address name "${theirLocal}" matches your GitHub login`;
+            }
+            else if (!theirLogin && myLocals.some((l) => l === theirLocal && l.length >= 3 && !GENERIC_LOCAL.has(l))) {
+                reason = `the same address name, "${theirLocal}", on another domain`;
+            }
+        }
+        if (reason) {
+            seen.add(foldIdentity(email));
+            out.push({ name: c.name, email, reason });
+        }
+    }
+    return out;
+}

package/dist/src/report.d.ts

@@ -10,7 +10,6 @@ export interface Report {
     /** sha256 of the RFC 8785 canonical JSON of { params, repositories }. */
     hash: string;
 }
-/** The hash a report with these parameters and repositories must carry. */
 export declare const hashOf: (params: unknown, repositories: unknown) => string;
 export declare function buildReport(repositories: RepoReport[], params: Params, meta: {
     version: string;

package/dist/src/report.js

@@ -3,7 +3,34 @@ import { canonicalize } from "./canonical.js";
 import { publicEmail } from "./analyse.js";
 import { plainSummary } from "./summary.js";
 /** The hash a report with these parameters and repositories must carry. */
-export const hashOf = (params, repositories) => createHash("sha256").update(canonicalize({ params, repositories })).digest("hex");
+/**
+ * What of a repository the hash covers: everything a stranger with the same repository at
+ * the same commit can reproduce, and nothing else.
+ *
+ * Two fields are recorded in the report and deliberately left out. `name` is the local
+ * directory's basename, so the same repository cloned to a different folder hashed
+ * differently. `environment.git` is the local git version string, so two people with the
+ * same repository and different git hashed differently. Both were reproduced with real
+ * runs before 0.4.0. They stay in the document because they explain why two runs might
+ * legitimately differ; they are not something a verifier can be asked to reproduce.
+ *
+ * The blame flags, the ignore-revs file and the seed stay in, because those are the
+ * question the caller asked, not the machine they asked it on.
+ */
+function forHash(repositories) {
+    if (!Array.isArray(repositories))
+        return repositories;
+    return repositories.map((repo) => {
+        if (repo === null || typeof repo !== "object")
+            return repo;
+        const { name: _name, environment, ...rest } = repo;
+        if (environment === null || typeof environment !== "object")
+            return rest;
+        const { git: _git, ...restEnvironment } = environment;
+        return { ...rest, environment: restEnvironment };
+    });
+}
+export const hashOf = (params, repositories) => createHash("sha256").update(canonicalize({ params, repositories: forHash(repositories) })).digest("hex");
 /**
  * What of the parameters the report may carry: never the fingerprint key, never a GitHub
  * noreply login, and without --emails no author given as an email address.
@@ -72,7 +99,12 @@ export function renderMarkdown(report, narrative) {
         ``,
     ];
     for (const repo of report.repositories) {
-        out.push(`## ${repo.name}`, ``, `HEAD \`${repo.head.slice(0, 12)}\` · fingerprint \`${repo.fingerprint.slice(0, 16)}\` · identities: ${repo.identity.names.join(", ")}${repo.identity.emails.length ? ` (${repo.identity.emails.join(", ")})` : ""}`, ``, repo.excluded.enabled
+        out.push(`## ${repo.name}`, ``, `HEAD \`${repo.head.slice(0, 12)}\` · fingerprint \`${repo.fingerprint.slice(0, 16)}\` · identities: ${repo.identity.names.join(", ")}${repo.identity.emails.length ? ` (${repo.identity.emails.join(", ")})` : ""}`, ``, ...(repo.identity.possiblySplit
+            ? [
+                `**${plural(repo.identity.possiblySplit.names.length, "other identity", "other identities")} in this repository look${repo.identity.possiblySplit.names.length === 1 ? "s" : ""} like the same person and ${repo.identity.possiblySplit.names.length === 1 ? "was" : "were"} not counted here**: ${repo.identity.possiblySplit.names.join(", ")}${repo.identity.possiblySplit.emails?.length ? ` (${repo.identity.possiblySplit.emails.join(", ")})` : ""}. ${repo.identity.possiblySplit.reasons.map((r, i) => (i === 0 ? r.charAt(0).toUpperCase() + r.slice(1) : r)).join("; ")}. Every figure below therefore describes only the work under the identities named above. If they are the same person, re-run with each address passed to \`--author\`, or merge them in a \`.mailmap\`.`,
+                ``,
+            ]
+            : []), repo.excluded.enabled
             ? `excluded ${plural(repo.excluded.botCommits, "bot commit", "bot commits")} and ${plural(repo.excluded.files, "generated, vendored or lock file", "generated, vendored or lock files")} (${pct(repo.excluded.linesAddedShare)} of lines added)`
             : `exclusions off (--no-exclusions): bot commits and generated files are counted`, ``, `### In plain language`, ``, plainSummary(repo), ``, `That paragraph is assembled from the figures below by a fixed rule, with no model involved, so it says nothing the numbers do not.`, ``);
         for (const f of repo.figures) {

package/dist/src/schema.js

@@ -31,6 +31,13 @@ function checkRepository(problems, path, r) {
         expect(problems, `${path}.identity.emails`, Array.isArray(id.emails), "array");
         expect(problems, `${path}.identity.names`, Array.isArray(id.names), "array");
         expect(problems, `${path}.identity.count`, typeof id.count === "number", "number");
+        if (id.possiblySplit !== undefined && expect(problems, `${path}.identity.possiblySplit`, isObject(id.possiblySplit), "object")) {
+            const ps = id.possiblySplit;
+            expect(problems, `${path}.identity.possiblySplit.names`, Array.isArray(ps.names), "array");
+            expect(problems, `${path}.identity.possiblySplit.reasons`, Array.isArray(ps.reasons), "array");
+            if (ps.emails !== undefined)
+                expect(problems, `${path}.identity.possiblySplit.emails`, Array.isArray(ps.emails), "array");
+        }
     }
     if (expect(problems, `${path}.environment`, isObject(repo.environment), "object")) {
         const env = repo.environment;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workproof",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Turn a private git repository into a verifiable engineering report for one author, without showing any code: thirteen figures from git, a hash anyone can recompute offline, verify, and an in-toto attestation.",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -24,7 +24,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "npm run build && node --test dist/test/figures.test.js dist/test/exclusions.test.js dist/test/adversarial.test.js dist/test/integrity.test.js dist/test/attest.test.js dist/test/report.test.js dist/test/summary.test.js dist/test/cli.test.js dist/test/action.test.js test/release.test.mjs",
+    "test": "npm run build && node --test dist/test/figures.test.js dist/test/exclusions.test.js dist/test/adversarial.test.js dist/test/integrity.test.js dist/test/attest.test.js dist/test/report.test.js dist/test/summary.test.js dist/test/cli.test.js dist/test/action.test.js test/release.test.mjs test/suite.test.mjs",
     "prepublishOnly": "npm test",
     "examples": "npm run build && node examples/basic.mjs",
     "release": "node scripts/release.mjs",

package/schema/report.schema.json

@@ -4,52 +4,169 @@
   "title": "workproof report",
   "description": "A verifiable engineering report for one author. hash is sha256 over the RFC 8785 canonical JSON of { params, repositories }.",
   "type": "object",
-  "required": ["tool", "schemaVersion", "version", "generatedAt", "params", "repositories", "hash"],
+  "required": [
+    "tool",
+    "schemaVersion",
+    "version",
+    "generatedAt",
+    "params",
+    "repositories",
+    "hash"
+  ],
   "properties": {
-    "tool": { "const": "workproof" },
-    "schemaVersion": { "const": 2 },
-    "version": { "type": "string" },
-    "generatedAt": { "type": "string", "format": "date-time" },
-    "params": { "type": "object" },
-    "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "tool": {
+      "const": "workproof"
+    },
+    "schemaVersion": {
+      "const": 2
+    },
+    "version": {
+      "type": "string"
+    },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "params": {
+      "type": "object"
+    },
+    "hash": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$"
+    },
     "repositories": {
       "type": "array",
       "minItems": 1,
       "items": {
         "type": "object",
-        "required": ["name", "head", "fingerprint", "identity", "environment", "excluded", "figures"],
+        "required": [
+          "name",
+          "head",
+          "fingerprint",
+          "identity",
+          "environment",
+          "excluded",
+          "figures"
+        ],
         "properties": {
-          "name": { "type": "string" },
-          "head": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
-          "fingerprint": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
-          "fingerprintKeyed": { "type": "boolean" },
+          "name": {
+            "type": "string"
+          },
+          "head": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{40}$"
+          },
+          "fingerprint": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "fingerprintKeyed": {
+            "type": "boolean"
+          },
           "identity": {
             "type": "object",
-            "required": ["emails", "names", "count"],
+            "required": [
+              "emails",
+              "names",
+              "count"
+            ],
             "properties": {
-              "emails": { "type": "array", "items": { "type": "string" } },
-              "names": { "type": "array", "items": { "type": "string" } },
-              "count": { "type": "integer", "minimum": 0 }
+              "emails": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "names": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "count": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "possiblySplit": {
+                "type": "object",
+                "properties": {
+                  "names": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "emails": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "reasons": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "required": [
+                  "names",
+                  "reasons"
+                ]
+              }
             }
           },
           "environment": {
             "type": "object",
-            "required": ["git", "blame"],
+            "required": [
+              "git",
+              "blame"
+            ],
             "properties": {
-              "git": { "type": "string" },
-              "blame": { "type": "array", "items": { "type": "string" } },
-              "ignoreRevs": { "type": ["string", "null"] },
-              "seed": { "type": "string" }
+              "git": {
+                "type": "string"
+              },
+              "blame": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "ignoreRevs": {
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
+              "seed": {
+                "type": "string"
+              }
             }
           },
           "excluded": {
             "type": "object",
-            "required": ["botCommits", "files", "linesAddedShare"],
+            "required": [
+              "botCommits",
+              "files",
+              "linesAddedShare"
+            ],
             "properties": {
-              "botCommits": { "type": "integer", "minimum": 0 },
-              "files": { "type": "integer", "minimum": 0 },
-              "linesAddedShare": { "type": "number", "minimum": 0, "maximum": 1 },
-              "enabled": { "type": "boolean" }
+              "botCommits": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "files": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "linesAddedShare": {
+                "type": "number",
+                "minimum": 0,
+                "maximum": 1
+              },
+              "enabled": {
+                "type": "boolean"
+              }
             }
           },
           "figures": {
@@ -57,13 +174,31 @@
             "minItems": 1,
             "items": {
               "type": "object",
-              "required": ["id", "title", "value", "command", "limits"],
+              "required": [
+                "id",
+                "title",
+                "value",
+                "command",
+                "limits"
+              ],
               "properties": {
-                "id": { "type": "string", "minLength": 1 },
-                "title": { "type": "string" },
+                "id": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "title": {
+                  "type": "string"
+                },
                 "value": {},
-                "command": { "type": "string" },
-                "limits": { "type": "array", "items": { "type": "string" } }
+                "command": {
+                  "type": "string"
+                },
+                "limits": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
               }
             }
           }