zuplo 6.74.14 → 7.0.0

package/docs/policies/cdn-cache-control-outbound/schema.json

@@ -0,0 +1,275 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/cdn-cache-control-outbound.json",
+  "type": "object",
+  "title": "CDN Cache Control",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "requiresAI": false,
+  "products": ["api-gateway"],
+  "description": "Sets the response headers that tell a CDN how long it may cache a response and which purge tags it belongs to, separately from what the browser is told.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "CdnCacheControlOutboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "CdnCacheControlOutboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": ["cdn"],
+          "properties": {
+            "cdn": {
+              "type": "string",
+              "title": "CdnCacheControlVendor",
+              "enum": [
+                "akamai",
+                "fastly",
+                "cloudflare",
+                "cloudfront",
+                "generic"
+              ],
+              "examples": ["akamai"],
+              "description": "The CDN in front of this gateway. Required, with no default — each CDN reads a different header for shared-cache TTL and purge tags, and a wrong guess fails silently. Use `generic` for an RFC 9213 CDN that is not listed."
+            },
+            "strategy": {
+              "type": "string",
+              "title": "CdnCacheControlStrategy",
+              "default": "targeted",
+              "enum": ["targeted", "s-maxage"],
+              "x-advanced": true,
+              "description": "How the edge TTL is carried. `targeted` uses the CDN's own header (`Edge-Control`, `Surrogate-Control`, `CDN-Cache-Control`) and is the only way to cache at the edge without also caching in the browser. `s-maxage` folds the edge TTL into `Cache-Control` instead, for a property that honors origin `Cache-Control` but not the targeted header. Defaults to `targeted`, except on a CDN that reads no targeted header — CloudFront defaults to `s-maxage`, which is the only thing it supports."
+            },
+            "edge": {
+              "type": "object",
+              "title": "CdnCacheControlEdgeOptions",
+              "additionalProperties": false,
+              "required": ["maxAge"],
+              "description": "How long the CDN may serve this response. These directives are sent only to the CDN, never to the browser (unless `strategy` is `s-maxage`).",
+              "properties": {
+                "maxAge": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "examples": [1800],
+                  "description": "Seconds the CDN may serve this response without revalidating."
+                },
+                "staleWhileRevalidate": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "examples": [600],
+                  "description": "Seconds the CDN may keep serving a stale response while it revalidates in the background. Not expressible in Akamai's `Edge-Control` — configure it in Property Manager, or use `strategy: s-maxage`."
+                },
+                "staleIfError": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "examples": [86400],
+                  "description": "Seconds the CDN may serve a stale response when the gateway returns an error. Not expressible in Akamai's `Edge-Control` — configure it in Property Manager, or use `strategy: s-maxage`."
+                }
+              }
+            },
+            "client": {
+              "type": "object",
+              "title": "CdnCacheControlClientOptions",
+              "additionalProperties": false,
+              "required": [],
+              "description": "The `Cache-Control` sent to the browser or app. Separate from `edge` so the CDN can absorb load without clients holding stale data.",
+              "properties": {
+                "maxAge": {
+                  "type": "integer",
+                  "minimum": 0,
+                  "examples": [60],
+                  "description": "Seconds the client may reuse this response. Omit to send no `max-age`."
+                },
+                "visibility": {
+                  "type": "string",
+                  "title": "CdnCacheControlClientVisibility",
+                  "enum": ["public", "private", "no-store"],
+                  "examples": ["public"],
+                  "description": "`public` allows any cache to store the response, `private` restricts it to the client's own cache, `no-store` forbids client caching entirely. With `strategy: targeted` a `private`/`no-store` client policy still permits edge caching, because the CDN reads its own header."
+                },
+                "noCache": {
+                  "type": "boolean",
+                  "default": false,
+                  "x-advanced": true,
+                  "description": "Adds `no-cache`, so the client must revalidate before reusing the response. Distinct from `visibility: no-store`, which forbids storing it at all."
+                },
+                "mustRevalidate": {
+                  "type": "boolean",
+                  "default": false,
+                  "x-advanced": true,
+                  "description": "Adds `must-revalidate`, so the client may not serve the response once stale."
+                },
+                "mode": {
+                  "type": "string",
+                  "title": "CdnCacheControlClientMode",
+                  "default": "strictest",
+                  "enum": ["strictest", "replace", "preserve"],
+                  "description": "How to combine the configured client policy with a `Cache-Control` the upstream already sent. `strictest` (default) emits the more conservative of the two — the lower `max-age` and the union of restrictive directives. `replace` overwrites whatever upstream sent. `preserve` leaves the upstream header untouched and only adds the CDN headers."
+                }
+              }
+            },
+            "tags": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "default": [],
+              "examples": [["catalog", "cities"]],
+              "description": "Purge tags, rendered in the target CDN's format: comma-joined `Edge-Cache-Tag` (Akamai), space-joined `Surrogate-Key` (Fastly), comma-joined `Cache-Tag` (Cloudflare). CloudFront has no tag purge and rejects this option. Tags are validated against the CDN's length and character limits, because an over-long tag header is silently truncated rather than rejected."
+            },
+            "vary": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "default": [],
+              "examples": [["accept-language"]],
+              "x-advanced": true,
+              "description": "Request headers that vary this response, unioned with any `Vary` the upstream already sent and emitted as `Vary`. The union is deliberate: replacing an upstream `Vary: Authorization` would stop a shared cache keying on it and let it serve one user's response to another. Off by default: Akamai skips caching any response carrying `Vary` until Cache ID Modification is configured, so enabling this can silently disable edge caching entirely."
+            },
+            "respectUpstream": {
+              "type": "boolean",
+              "default": true,
+              "x-advanced": true,
+              "description": "When true (default), an upstream `Cache-Control` of `no-store`/`no-cache`/`private`, or a `Set-Cookie` on the response, suppresses all edge headers and purge tags. This keeps the application's ability to mark a response uncacheable. Set to false to override it — on Akamai this emits `Edge-Control: !no-store`."
+            },
+            "cacheConfig": {
+              "type": "object",
+              "title": "CdnCacheControlConfigFunction",
+              "additionalProperties": false,
+              "x-advanced": true,
+              "required": ["export", "module"],
+              "description": "A function that overrides the cache configuration per response, for rules that cannot be expressed statically (per-entity purge tags, a TTL that depends on a response header, or skipping an empty result set). Returning nothing (`undefined` or `null`) falls back to the `edge`, `client` and `tags` options, so those stay the enforced default and the function only handles exceptions. A returned config \\*\\*replaces\\*\\* those options wholesale rather than being merged directive by directive, so include every directive the response needs. Return `{ cache: false }` to skip caching a response entirely — note that also sends `Cache-Control: no-store` to the client unless `client.mode` is `preserve`. The function receives the live response: it must not consume the body, and should call `response.clone()` if it needs to read it.",
+              "properties": {
+                "export": {
+                  "type": "string",
+                  "default": "default",
+                  "description": "Specifies the export that holds your cache config function, e.g. `default`, `cdnCacheConfig`.",
+                  "examples": ["default", "cdnCacheConfig"]
+                },
+                "module": {
+                  "type": "string",
+                  "default": "",
+                  "description": "Specifies the module that holds your cache config function, in the format `$import(./modules/my-module)`.",
+                  "examples": ["$import(./modules/my-module)"]
+                }
+              }
+            }
+          },
+          "if": {
+            "required": ["cdn"],
+            "properties": {
+              "cdn": {
+                "const": "cloudfront"
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "strategy": {
+                "const": "s-maxage"
+              },
+              "tags": {
+                "maxItems": 0
+              }
+            }
+          },
+          "else": {
+            "allOf": [
+              {
+                "if": {
+                  "required": ["cdn"],
+                  "properties": {
+                    "cdn": {
+                      "const": "generic"
+                    }
+                  }
+                },
+                "then": {
+                  "properties": {
+                    "tags": {
+                      "maxItems": 0
+                    }
+                  }
+                }
+              },
+              {
+                "if": {
+                  "required": ["cdn"],
+                  "properties": {
+                    "cdn": {
+                      "const": "akamai"
+                    }
+                  },
+                  "not": {
+                    "required": ["strategy"],
+                    "properties": {
+                      "strategy": {
+                        "const": "s-maxage"
+                      }
+                    }
+                  }
+                },
+                "then": {
+                  "properties": {
+                    "edge": {
+                      "properties": {
+                        "staleWhileRevalidate": false,
+                        "staleIfError": false
+                      }
+                    }
+                  }
+                }
+              }
+            ]
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "CdnCacheControlOutboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "cacheConfig": {
+              "export": "default",
+              "module": "$import(./modules/my-module)"
+            },
+            "cdn": "akamai",
+            "client": {
+              "maxAge": 60,
+              "mode": "strictest",
+              "mustRevalidate": false,
+              "noCache": false,
+              "visibility": "public"
+            },
+            "edge": {
+              "maxAge": 1800,
+              "staleIfError": 86400,
+              "staleWhileRevalidate": 600
+            },
+            "respectUpstream": true,
+            "strategy": "targeted",
+            "tags": ["catalog", "cities"],
+            "vary": ["accept-language"]
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/ip-address-restriction-inbound/doc.md

@@ -0,0 +1,234 @@
+This policy compares the client's IP address against an allow list, a deny list,
+or both, and rejects non-matching requests with a `403 Forbidden`. Entries are
+individual IP addresses or CIDR ranges, in IPv4 or IPv6.
+
+### How It Works
+
+For each request the policy:
+
+1. Determines the client IP address — the same one reported to your code as
+   `context.incomingRequestProperties.ip` — or reads it from `clientIpHeader`
+   when that option is set
+2. Rejects the request if the address matches any `deny` entry
+3. Rejects the request if an `allow` list is set and the address matches none of
+   its entries
+4. Otherwise passes the request to the next policy or the handler
+
+`deny` is evaluated first, so an address covered by both lists is rejected.
+
+At least one of `allow` or `deny` must be set — a policy with neither would let
+every request through, which is never what was intended.
+
+### Policy Configuration
+
+Allow only two networks and a single address:
+
+```json
+{
+  "name": "ip-address-restriction",
+  "policyType": "ip-address-restriction-inbound",
+  "handler": {
+    "export": "IpAddressRestrictionInboundPolicy",
+    "module": "$import(@zuplo/runtime)",
+    "options": {
+      "allow": ["198.51.100.0/24", "2001:db8:1234::/48", "203.0.113.42"]
+    }
+  }
+}
+```
+
+Block a single abusive network while leaving the route otherwise public:
+
+```json
+{
+  "name": "ip-address-restriction",
+  "policyType": "ip-address-restriction-inbound",
+  "handler": {
+    "export": "IpAddressRestrictionInboundPolicy",
+    "module": "$import(@zuplo/runtime)",
+    "options": {
+      "deny": ["192.0.2.0/24"]
+    }
+  }
+}
+```
+
+### Writing Entries
+
+- An entry without a prefix is a single address: `203.0.113.42` is the same as
+  `203.0.113.42/32`, and `2001:db8::1` the same as `2001:db8::1/128`.
+- Host bits beyond the prefix are ignored, so `10.1.2.3/8` and `10.0.0.0/8` mean
+  the same range.
+- IPv4-mapped IPv6 addresses are matched as the IPv4 address they map to. A
+  client that a dual-stack proxy reports as `::ffff:198.51.100.7` matches an
+  `198.51.100.0/24` entry.
+- An IPv4 address never matches an IPv6 range, and vice versa. To cover a client
+  reachable over both, list a range for each family.
+- Addresses with leading zeros in an octet (`010.0.0.1`) are rejected, because
+  different tools read them as different addresses.
+
+Entries are validated when the policy is created, so a malformed address or
+prefix fails your deployment rather than rejecting live traffic. Each list can
+also be sourced from environment variables per entry:
+
+```json
+{
+  "options": {
+    "allow": ["$env(OFFICE_CIDR)", "$env(VPN_CIDR)"]
+  }
+}
+```
+
+### Usage Example
+
+Restrict an admin route while leaving the rest of the API public:
+
+```json
+{
+  "paths": {
+    "/v1/admin/users": {
+      "get": {
+        "x-zuplo-route": {
+          "policies": {
+            "inbound": ["ip-address-restriction", "api-key-auth"]
+          },
+          "handler": {
+            "export": "urlForwardHandler",
+            "module": "$import(@zuplo/runtime)",
+            "options": {
+              "baseUrl": "https://api.internal.example.com"
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+Put this policy first in the inbound list so restricted addresses are rejected
+before any work — authentication, rate limiting, upstream token fetches — is
+done on their behalf.
+
+### Where the Default Address Comes From
+
+By default the policy uses the address the gateway itself resolved — the same
+value your code sees as `context.incomingRequestProperties.ip`. That comes from
+exactly **one** header, chosen by the platform running the gateway
+(`true-client-ip` on Cloudflare, `x-real-ip` elsewhere), and it is resolved from
+the request as it originally arrived.
+
+Two consequences worth knowing:
+
+- **There is no fallback to a second header.** If the trusted header is absent,
+  the address is reported as unknown rather than being guessed from
+  `x-forwarded-for` or another header. Every available fallback is one a caller
+  can write, so a fallback would let anyone satisfy an allow list by sending a
+  header.
+- **Header stripping does not affect it.** The gateway removes `x-real-ip` and
+  the `cf-*` headers from the request before policies run (from compatibility
+  date **2024-01-15**), but the default path reads the original request, so this
+  makes no difference to it. It _does_ affect `clientIpHeader` — see below.
+
+During local development there is no edge to set the header and the caller
+really is the loopback interface, so the address is reported as `127.0.0.1`. An
+allow list that does not cover `127.0.0.1` will reject your local requests — add
+it to the list to test locally:
+
+```json
+{
+  "options": {
+    "allow": ["198.51.100.0/24", "127.0.0.1", "::1"]
+  }
+}
+```
+
+Note that `allowUnknownIpAddress` does **not** help here. Locally the address is
+known — it is `127.0.0.1` — and that option only applies when no address could
+be determined at all.
+
+### Requests With No Client IP Address
+
+When no client IP address can be determined, the request is rejected if an
+`allow` list is set, since an unknown address cannot be on it. With only a
+`deny` list the request continues, because there is nothing for it to match.
+
+Set `allowUnknownIpAddress` to `true` to let these requests through even with an
+`allow` list. This is most useful when you run your own proxy and cannot
+guarantee it sets the trusted header on every request.
+
+### Custom Client IP Header
+
+If a proxy in front of the gateway reports the client address in a header other
+than the standard ones, name it with `clientIpHeader`:
+
+```json
+{
+  "options": {
+    "allow": ["198.51.100.0/24"],
+    "clientIpHeader": "x-client-ip"
+  }
+}
+```
+
+Only the named header is read when this is set. Prefer a header your proxy sets
+to a single address.
+
+Unlike the default path, this option reads the request as policies see it, after
+the gateway has stripped `x-real-ip` and the `cf-*` headers (from compatibility
+date **2024-01-15**). Naming one of those here resolves nothing, and with an
+`allow` list that rejects every request. Use a dedicated header your proxy sets,
+such as `x-client-ip`.
+
+If the header holds a comma-separated list, the **last** entry is used, because
+proxies append and so the nearest proxy's entry is the rightmost one —
+everything to its left is whatever the caller sent. For a single-value header
+this makes no difference. This assumes one appending proxy in front of the
+gateway; if you have more than one, use a dedicated single-value header, since
+the trustworthy entry is then further left and its position depends on how many
+hops you control.
+
+### Security Considerations
+
+:::warning
+
+This policy is only as trustworthy as the header it reads the client address
+from. A header is a security control **only** if the proxy in front of your
+gateway replaces any client-supplied value rather than appending to it.
+
+The default path is not configurable for this reason: it reads a single header
+designated by the platform running the gateway, and never falls back to another
+one. On Zuplo's managed edge that header is set by the edge on every request and
+a caller cannot override it.
+
+Two specifics worth knowing if you self-host or run a CDN in front of Zuplo:
+
+- **`true-client-ip` is spoofable unless your own edge sets it.** Cloudflare
+  documents this directly: in a stacked-CDN setup, if you do not add the header
+  yourself, "its value can be spoofed to any value".
+- **`x-forwarded-for` is a list, and the untrustworthy end comes first.** When a
+  request already carries an `X-Forwarded-For` header,
+  [Cloudflare appends to it](https://developers.cloudflare.com/fundamentals/reference/http-headers/#x-forwarded-for)
+  rather than replacing it, and most proxies behave the same way. The entry your
+  own proxy added is therefore at the **end** of the list, while the entries at
+  the front are whatever the caller chose to send. The policy never reads this
+  header on the default path — but if you point `clientIpHeader` at it, this is
+  why only the last entry is used.
+
+If a proxy you control reports the client address in a dedicated header that it
+always overwrites, name that header with `clientIpHeader`. That is the
+configuration to prefer whenever you have it, because it removes the ambiguity
+entirely.
+
+:::
+
+- Rejected requests get a `403 Forbidden` with no detail about the address seen
+  or the rule matched. The address and the matching entry are written to the
+  request log at debug level instead, so an unauthorized caller is not told what
+  the gateway sees or that it is filtering by address at all.
+- An IP address identifies a network path, not a caller. Combine this policy
+  with an authentication policy rather than using it as your only control —
+  addresses within an allowed range can be shared, reassigned, or spoofed
+  upstream of your gateway.
+- Prefer the narrowest ranges that work. A `/8` allow entry covers 16 million
+  addresses.

package/docs/policies/ip-address-restriction-inbound/intro.md

@@ -0,0 +1,17 @@
+Restrict which clients can reach a route based on their IP address. Configure an
+allow list to expose an endpoint only to a set of known networks, a deny list to
+shut out abusive traffic, or both. Entries can be individual IP addresses or
+CIDR ranges, in IPv4 or IPv6.
+
+With this policy, you'll benefit from:
+
+- **Private APIs on a Public Gateway**: Limit admin, partner, or internal
+  endpoints to your office, VPN, or data center ranges
+- **Immediate Blocking**: Drop traffic from a bad actor's address or subnet
+  without a deploy of your backend
+- **Per-Route Control**: Apply different lists to different routes, so a public
+  endpoint and a restricted one can live in the same API
+- **IPv4 and IPv6**: Single addresses and CIDR ranges in both families, with
+  IPv4-mapped IPv6 addresses handled automatically
+- **Fail-Closed Defaults**: Requests whose address cannot be determined are
+  rejected when an allow list is set

package/docs/policies/ip-address-restriction-inbound/schema.json

@@ -0,0 +1,97 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/ip-address-restriction-inbound.json",
+  "type": "object",
+  "title": "IP Address Restriction",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": false,
+  "isHidden": false,
+  "requiresAI": false,
+  "products": ["api-gateway"],
+  "description": "Restricts which client IP addresses can call a route using an allow list, a deny list, or both. Entries are individual IP addresses or CIDR ranges, in IPv4 or IPv6.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "IpAddressRestrictionInboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "title": "IpAddressRestrictionInboundPolicyOptions",
+          "type": "object",
+          "description": "The options for this policy.",
+          "additionalProperties": false,
+          "required": [],
+          "if": {
+            "not": {
+              "required": ["allow"]
+            }
+          },
+          "then": {
+            "required": ["deny"]
+          },
+          "properties": {
+            "allow": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "string",
+                "pattern": "^\\s*([^,\\s]*\\$env\\([^)]+\\)[^,\\s]*|[0-9A-Fa-f.:]+(/[0-9]{1,3})?)\\s*$",
+                "description": "An IP address (`203.0.113.42`, `2001:db8::1`) or a CIDR range (`198.51.100.0/24`, `2001:db8::/32`)."
+              },
+              "examples": [["203.0.113.42", "198.51.100.0/24"]],
+              "description": "The IP addresses and CIDR ranges that are allowed to call the route. When set, requests from every other address are rejected with a `403 Forbidden`."
+            },
+            "deny": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "string",
+                "pattern": "^\\s*([^,\\s]*\\$env\\([^)]+\\)[^,\\s]*|[0-9A-Fa-f.:]+(/[0-9]{1,3})?)\\s*$",
+                "description": "An IP address (`203.0.113.42`, `2001:db8::1`) or a CIDR range (`198.51.100.0/24`, `2001:db8::/32`)."
+              },
+              "examples": [["203.0.113.99", "192.0.2.0/24"]],
+              "description": "The IP addresses and CIDR ranges that are rejected with a `403 Forbidden`. Evaluated before `allow`, so an address matching both lists is rejected."
+            },
+            "clientIpHeader": {
+              "type": "string",
+              "examples": ["x-client-ip"],
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Read the client IP address from this header instead of the standard forwarding headers (`x-real-ip`, `true-client-ip`, `cf-connecting-ip`, then the first entry of `x-forwarded-for`). Only set this when a proxy in front of the gateway reports the client address in a non-standard header."
+            },
+            "allowUnknownIpAddress": {
+              "type": "boolean",
+              "default": false,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Allow requests whose client IP address cannot be determined. By default these requests are rejected when an `allow` list is set, because an unknown address cannot be on it."
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "IpAddressRestrictionInboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "allow": ["203.0.113.42", "198.51.100.0/24"],
+            "deny": ["203.0.113.99", "192.0.2.0/24"]
+          }
+        }
+      ]
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "6.74.14",
+  "version": "7.0.0",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -12,16 +12,16 @@
     "docs"
   ],
   "engines": {
-    "node": ">=20.16.0",
+    "node": ">=24.0.0",
     "npm": ">=10"
   },
   "bin": {
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "6.74.14",
-    "@zuplo/core": "6.74.14",
-    "@zuplo/runtime": "6.74.14",
-    "@zuplo/test": "6.74.14"
+    "@zuplo/cli": "7.0.0",
+    "@zuplo/core": "7.0.0",
+    "@zuplo/runtime": "7.0.0",
+    "@zuplo/test": "7.0.0"
   }
 }