@carecard/validate 3.10.0 → 3.11.0

package/.agents/skills/carecard-workspace-standards/SKILL.md

@@ -9,6 +9,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose
@@ -85,7 +87,7 @@ config.
 - Never suppress errors, TypeScript errors, linter warnings, authorization
   failures, RLS failures, build failures, hydration issues, or failing tests.
   Do not add `eslint-disable`, `@ts-ignore`, broad catches, empty catches, or
-  similar suppression unless explicitly requested.
+  similar suppression. Fix the root cause.
 - Do not add dependencies unless clearly necessary. If one might be needed, ask
   first with the reason, tradeoff, and why existing code cannot solve it.
 - Before finalizing repository work, run the affected repository's relevant
@@ -215,7 +217,7 @@ build artifacts, logs, or `.DS_Store`.
 Most JavaScript `ms-*` services use CommonJS, Mocha, Supertest, Docker Compose
 database tests, `@carecard/*` packages, and `sub-apps`
 controller/router/model patterns. TypeScript services such as `ms-messages`
-and `ms-template-ts` use Jest or TypeScript tooling and should keep their
+use Jest or TypeScript tooling and should keep their
 existing TypeScript style.
 
 - Keep environment-specific files explicit: `.env.development`, `.env.test`,
@@ -380,7 +382,7 @@ the authenticated dashboard.
 
 ## Auth Service RLS Contract
 
-- `ms-auth` follows the shared PostgreSQL/RLS pattern from `ms-template-js`: auth tables live in the `carecard` schema, RLS is enabled and forced on every auth table, and application runtime queries use the unprivileged database role.
+- `ms-auth` follows the shared PostgreSQL/RLS pattern: auth tables live in the `carecard` schema, RLS is enabled and forced on every auth table, and application runtime queries use the unprivileged database role.
 - Auth table policies allow normal JWT users to access only self-owned rows. Do not add redundant `user_id = <jwt sub>` SQL predicates to duplicate self-row checks when RLS owns the authorization decision.
 - A JWT payload containing `roles: ["ad"]` is the auth-service super-admin signal and can perform any action on auth tables. Dashboard code may map that role to `super_admin`, but backend auth RLS must not require a separate database role row for that bypass.
 - Public auth flows such as registration, login, confirmation, recovery, visitor creation, and service user lookup must use narrow system contexts (`system_create`, `system_login`, `system_confirm`, `system_recovery`, `system_visitor`, `system_service`) instead of privileged runtime queries.

package/.agents/skills/github-pr-create-update/SKILL.md

@@ -9,6 +9,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose
@@ -77,14 +79,20 @@ Do not continue automatically when:
    when `origin/development` is absent:
 
     ```sh
-    if git ls-remote --exit-code --heads origin development >/dev/null 2>&1; then
-      base="development"
-    elif git ls-remote --exit-code --heads origin main >/dev/null 2>&1; then
-      base="main"
-    else
-      echo "No origin/development or origin/main branch exists."
-      exit 1
+    remote_base_refs="$(git ls-remote --heads origin development main)"
+    remote_query_status=$?
+    if [ "$remote_query_status" -ne 0 ]; then
+      printf 'Unable to inspect origin base branches (exit %s).\n' "$remote_query_status" >&2
+      exit "$remote_query_status"
     fi
+    case "$remote_base_refs" in
+      *"refs/heads/development") base="development" ;;
+      *"refs/heads/main") base="main" ;;
+      *)
+        printf '%s\n' "No origin/development or origin/main branch exists." >&2
+        exit 1
+        ;;
+    esac
     git fetch origin "$base" --prune
     ```
 

package/.agents/skills/github-pr-merge-cleanup/SKILL.md

@@ -9,6 +9,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose
@@ -74,14 +76,20 @@ completion.
 
     ```sh
     gh auth status
-    if git ls-remote --exit-code --heads origin development >/dev/null 2>&1; then
-      base="development"
-    elif git ls-remote --exit-code --heads origin main >/dev/null 2>&1; then
-      base="main"
-    else
-      echo "No origin/development or origin/main branch exists."
-      exit 1
+    remote_base_refs="$(git ls-remote --heads origin development main)"
+    remote_query_status=$?
+    if [ "$remote_query_status" -ne 0 ]; then
+      printf 'Unable to inspect origin base branches (exit %s).\n' "$remote_query_status" >&2
+      exit "$remote_query_status"
     fi
+    case "$remote_base_refs" in
+      *"refs/heads/development") base="development" ;;
+      *"refs/heads/main") base="main" ;;
+      *)
+        printf '%s\n' "No origin/development or origin/main branch exists." >&2
+        exit 1
+        ;;
+    esac
     target_branch="$(git branch --show-current)"
     test -n "$target_branch"
     test "$target_branch" != "$base"
@@ -171,7 +179,19 @@ completion.
    not protected:
 
     ```sh
-    protected="$(gh api "repos/{owner}/{repo}/branches/$target_branch" --jq '.protected' 2>/dev/null || echo false)"
+    protected="$(gh api "repos/{owner}/{repo}/branches/$target_branch" --jq '.protected')"
+    protection_query_status=$?
+    if [ "$protection_query_status" -ne 0 ]; then
+      printf 'Unable to inspect branch protection (exit %s).\n' "$protection_query_status" >&2
+      exit "$protection_query_status"
+    fi
+    case "$protected" in
+      true|false) ;;
+      *)
+        printf 'Unexpected branch protection value: %s\n' "$protected" >&2
+        exit 1
+        ;;
+    esac
     if [ "$protected" = true ]; then
       gh pr merge "$pr_number" --squash --admin
     else
@@ -183,8 +203,16 @@ completion.
    delete it explicitly:
 
     ```sh
-    if [ "$protected" != true ] && git ls-remote --exit-code --heads origin "$target_branch" >/dev/null 2>&1; then
-      git push origin --delete "$target_branch"
+    if [ "$protected" != true ]; then
+      remote_target_ref="$(git ls-remote --heads origin "$target_branch")"
+      remote_query_status=$?
+      if [ "$remote_query_status" -ne 0 ]; then
+        printf 'Unable to inspect the remote target branch (exit %s).\n' "$remote_query_status" >&2
+        exit "$remote_query_status"
+      fi
+      if [ -n "$remote_target_ref" ]; then
+        git push origin --delete "$target_branch"
+      fi
     fi
     ```
 

package/.agents/skills/logged-in-user-profile-page/SKILL.md

@@ -9,6 +9,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Scope

package/.agents/skills/pkg-publish/SKILL.md

@@ -9,6 +9,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Trigger

package/.agents/skills/pkg-validate-validation-library/SKILL.md

@@ -9,6 +9,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose

package/.agents/skills/software-design-patterns-and-clean-code/SKILL.md

@@ -9,6 +9,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Purpose

package/.codex/AGENTS.md

@@ -4,6 +4,8 @@ Non-negotiable code organization rule: Functions with the same or equivalent beh
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 These instructions apply to the `pkg-validate` repository. This file is self-contained:
 it includes the workspace-level instructions that were previously read from
 `/Users/pankajpriscilla/SO_CareCardCa/.codex/AGENTS.md`, followed by
@@ -21,7 +23,7 @@ These instructions apply to the whole workspace. The workspace is a collection o
 - **Always follow the owner's naming conventions.** Use meaningful function, variable, file, test, and type names that match the surrounding code.
 - **Always follow the existing project structure.** Put code, tests, docs, services, validation, transforms, components, and helpers where the current repository already expects them.
 - **Always use Test-Driven Development.** Write or update focused tests first, verify they fail for the missing behavior when practical, then implement the code.
-- **Never suppress errors, TypeScript errors, linter warnings, or failing tests.** Do not add `eslint-disable`, `@ts-ignore`, broad catches, empty catches, or other suppression unless the user explicitly requests it. Handle the issue properly.
+- **Never suppress errors, TypeScript errors, linter warnings, or failing tests.** Do not add `eslint-disable`, `@ts-ignore`, broad catches, empty catches, or other suppression. Fix the root cause.
 - **Do not add new dependencies unless they are clearly necessary.** If a dependency might be needed, stop and ask for confirmation first, with a clear reason, tradeoff, and why existing code cannot reasonably solve it.
 - **Before finalizing any response for a repository, run every script in that repository's `.husky` directory.** Do not bypass hooks. If a `.husky` script fails, fix the underlying issue and rerun it. If it cannot run because of environment constraints, report the exact script and reason.
 

package/.github/workflows/auto-draft-pr.yml

@@ -102,7 +102,7 @@ jobs:
                     --head "$HEAD" \
                     --base "$BASE" \
                     --json number \
-                    --jq '.[0].number' || true)
+                    --jq '.[0].number')
 
                   if [[ -n "${EXISTING:-}" ]]; then
                     echo "An open PR already exists for $HEAD -> $BASE (#$EXISTING). Updating PR metadata."
@@ -165,7 +165,7 @@ jobs:
                     exit 0
                   fi
 
-                  if ! gh issue view "$TICKET_NUMBER" --repo "$REPO" --json number >/dev/null 2>&1; then
+                  if ! gh issue view "$TICKET_NUMBER" --repo "$REPO" --json number; then
                     echo "GitHub issue #$TICKET_NUMBER was not found. Skipping ticket assignment."
                     exit 0
                   fi

package/.github/workflows/publish.yml

@@ -45,7 +45,8 @@ jobs:
                   echo "package_name=${package_name}" >> "$GITHUB_OUTPUT"
                   echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
 
-                  if npm view "${package_name}@${package_version}" version >/dev/null 2>&1; then
+                  published_versions="$(npm view "${package_name}" versions --json)"
+                  if node -e 'const value=JSON.parse(process.argv[1]); const versions=Array.isArray(value) ? value : [value]; process.exit(versions.includes(process.argv[2]) ? 0 : 1);' "$published_versions" "$package_version"; then
                     echo "${package_name}@${package_version} is already published."
                     echo "should_publish=false" >> "$GITHUB_OUTPUT"
                   else

package/lib/validate.js

@@ -15,7 +15,8 @@ const isValidJsonString = str => {
     try {
         const json = JSON.parse(str);
         return typeof json === 'object' && json !== null;
-    } catch {
+    } catch (error) {
+        if (!(error instanceof SyntaxError)) throw error;
         return false;
     }
 };
@@ -229,12 +230,10 @@ const isValidDateString = str => {
 
 const isValidUrl = url => {
     if (typeof url !== 'string' || url.length === 0 || url.length > 2048) return false;
-    try {
-        const parsedUrl = new URL(url);
-        return parsedUrl.protocol === 'http:' || parsedUrl.protocol === 'https:';
-    } catch {
-        return false;
-    }
+    if (!URL.canParse(url)) return false;
+
+    const parsedUrl = new URL(url);
+    return parsedUrl.protocol === 'http:' || parsedUrl.protocol === 'https:';
 };
 const isValidArrayOfStrings = arr => {
     if (!Array.isArray(arr)) return false;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@carecard/validate",
-    "version": "3.10.0",
+    "version": "3.11.0",
     "repository": {
         "type": "git",
         "url": "git+https://github.com/CareCard-ca/pkg-validate.git"
@@ -38,7 +38,7 @@
         "typescript": "6.0.3"
     },
     "dependencies": {
-        "@carecard/common-util": "3.10.0"
+        "@carecard/common-util": "3.11.0"
     },
     "nyc": {
         "all": true,
@@ -54,6 +54,7 @@
     },
     "overrides": {
         "diff": "8.0.4",
+        "glob": "13.0.6",
         "serialize-javascript": "7.0.5",
         "js-yaml": "4.2.0"
     }

package/readme.md

@@ -15,6 +15,8 @@ Non-negotiable TDD rule: Always write the failing test first, run it to confirm
 
 Non-negotiable repository isolation rule: Every repository must run its Husky hooks and tests using only files, code, fixtures, dependencies, and services contained within that repository. Tests and Husky scripts must not import, require, read, execute, or otherwise depend on sibling repositories or paths outside the repository root. app-e2e-tests is the only exception because cross-repository end-to-end testing is its explicit responsibility.
 
+Non-negotiable error and warning rule: Never suppress, silence, hide, downgrade, filter, ignore, skip, or bypass errors or warnings from code, tests, tools, compilers, linters, or validation. Fix the root cause, then rerun the affected check and require a clean result. Expected error-path tests may assert errors, but must not conceal unexpected failures.
+
 Non-negotiable code organization rule: Functions with the same or equivalent behavior must use the same or clearly corresponding descriptive names across CareCard repositories, and equivalent functionality must live in files with the same names within each repository's established architecture. No backward compatibility names, aliases, or duplicate locations are allowed.
 
 ## Installation