@cldmv/slothlet 3.15.0 โ†’ 3.15.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +58 -57
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -37,26 +37,25 @@ v3 rebuilds Slothlet from the inside out with a **Unified Wrapper architecture**
37
37
 
38
38
  Every feature has been hardened with a comprehensive test suite - over **5,300 tests** across eager, lazy, CJS, ESM, TypeScript, and mixed module scenarios.
39
39
 
40
- ๐Ÿ“‹ **[See the full v3.0 changelog](./docs/changelog/v3.0.md)** for the architecture rewrite, hook system redesign, i18n layer, background materialization, lifecycle events, collision modes, mutation controls, sanitization improvements, and context isolation upgrades.
40
+ ๐Ÿ“‹ **[See the full v3.0 changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3.0.md)** for the architecture rewrite, hook system redesign, i18n layer, background materialization, lifecycle events, collision modes, mutation controls, sanitization improvements, and context isolation upgrades.
41
41
 
42
42
  ---
43
43
 
44
44
  ## โœจ What's New
45
45
 
46
- ### Latest: v3.15.0 (August 2026)
46
+ ### Latest: v3.15.1 (August 2026)
47
47
 
48
- - **Character-safe `moduleID`s and scoped `remove(moduleID, apiPath)` (#303)** โ€” A `moduleID` may now contain any character โ€” `:`, `/`, `.`, `-` โ€” and round-trips through `add`/`leaves`/`remove`/`reload`, closing a silent bug where a namespaced id like `vine:abc` mounted fine but could never be enumerated or removed (the internal composite key now joins with a reserved multi-character token instead of `:`). `remove()` also gains a surgical scoped form โ€” `remove(moduleID, apiPath)` โ€” that detaches only the nodes one module owns under a path, leaving other modules untouched, and both scoped removals and synthetic (in-memory) adds now survive a base `reload()`.
49
- - **Runtime-mutation hardening** โ€” `api.add()` refuses prototype-polluting mount-path segments (`__proto__`/`constructor`/`prototype`) (#302), and reading a built-in member (`.apply`/`.call`/`.bind`) off a callable leaf no longer materializes it as a child endpoint or corrupts the leaf's record (#304).
50
- - [View full v3.15.0 Changelog](./docs/changelog/v3/v3.15.0.md)
48
+ - **Maintenance & supply-chain hardening โ€” no runtime changes** โ€” The public API and loader behavior are identical to 3.15.0. This release scopes every GitHub Actions workflow token to least privilege (#319), clears two high-severity advisories in the dev-only test/lint toolchain (`brace-expansion`, `nanoid` โ€” transitive, never shipped to consumers; #322), adds an OpenSSF Scorecard badge (#320), and fixes documentation links and CI plumbing (#316, #321, #314).
49
+ - [View full v3.15.1 Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.15.1.md)
51
50
 
52
51
  ### Recent Releases
53
52
 
54
- - **v3.14.0** (August 2026) โ€” Browser importmap resolves consumer-graph package `exports` subpaths (not just slothlet's own surface), so a redirected dependency subpath no longer 404s in the browser and consumers can drop hand-maintained allowlists (#297) ([Changelog](./docs/changelog/v3/v3.14.0.md))
55
- - **v3.13.3** (August 2026) โ€” Completes the version-dispatcher permissions fix (a second framework read path probed the marker with a gated `__`-private read) by detecting a dispatcher by object identity, and fixes nested-instance permission isolation so a second `slothlet()` booted inside a permissioned leaf no longer throws during its own construction ([Changelog](./docs/changelog/v3/v3.13.3.md))
56
- - **v3.13.2** (August 2026) โ€” Restores composition of version-dispatched fields under a `permissions` configuration: slothlet's own version-dispatcher marker keys are exempted from the 3.13.0 module-private (`_`/`__`) rule by object identity, so a colliding version-dispatched field no longer fails at composition with `PERMISSION_DENIED` while a consumer's identically-named private member stays denied ([Changelog](./docs/changelog/v3/v3.13.2.md))
57
- - **v3.13.1** (August 2026) โ€” `devcheck` dev-environment detection fix: reads the `--conditions=slothlet-dev` CLI form from `process.execArgv` and recognizes a scoped `node_modules` install at any depth, so a correct dev run or a git/tarball install no longer self-terminates ([Changelog](./docs/changelog/v3/v3.13.1.md))
53
+ - **v3.15.0** (August 2026) โ€” Character-safe `moduleID`s and scoped `remove(moduleID, apiPath)`: a `moduleID` may contain any character and round-trips through `add`/`leaves`/`remove`/`reload`; scoped removals and synthetic adds now survive `reload()`; plus a prototype-pollution guard on mount paths (#303, #302, #304) ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.15.0.md))
54
+ - **v3.14.0** (August 2026) โ€” Browser importmap resolves consumer-graph package `exports` subpaths (not just slothlet's own surface), so a redirected dependency subpath no longer 404s in the browser and consumers can drop hand-maintained allowlists (#297) ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.14.0.md))
55
+ - **v3.13.3** (August 2026) โ€” Completes the version-dispatcher permissions fix (a second framework read path probed the marker with a gated `__`-private read) by detecting a dispatcher by object identity, and fixes nested-instance permission isolation so a second `slothlet()` booted inside a permissioned leaf no longer throws during its own construction ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.13.3.md))
56
+ - **v3.13.2** (August 2026) โ€” Restores composition of version-dispatched fields under a `permissions` configuration: slothlet's own version-dispatcher marker keys are exempted from the 3.13.0 module-private (`_`/`__`) rule by object identity, so a colliding version-dispatched field no longer fails at composition with `PERMISSION_DENIED` while a consumer's identically-named private member stays denied ([Changelog](https://github.com/CLDMV/slothlet/blob/master/docs/changelog/v3/v3.13.2.md))
58
57
 
59
- ๐Ÿ“š **For complete version history and detailed release notes, see [docs/changelog/](./docs/changelog/) folder.**
58
+ ๐Ÿ“š **For complete version history and detailed release notes, see [docs/changelog/](https://github.com/CLDMV/slothlet/tree/master/docs/changelog/) folder.**
60
59
 
61
60
  ---
62
61
 
@@ -81,7 +80,7 @@ Every feature has been hardened with a comprehensive test suite - over **5,300 t
81
80
  - **Zero dependencies**: Pure Node.js implementation
82
81
  - **Memory efficiency**: Lazy mode loads modules on-demand, eager mode optimizes for predictable behavior
83
82
 
84
- ๐Ÿ“Š **For comprehensive performance benchmarks and analysis, see [docs/PERFORMANCE.md](./docs/PERFORMANCE.md)**
83
+ ๐Ÿ“Š **For comprehensive performance benchmarks and analysis, see [docs/PERFORMANCE.md](https://github.com/CLDMV/slothlet/blob/master/docs/PERFORMANCE.md)**
85
84
 
86
85
  ### ๐ŸŽฃ **Hook System** _(redesigned in v3)_
87
86
 
@@ -94,7 +93,7 @@ Powerful function interceptor system with 4 hook types and three-phase subset or
94
93
 
95
94
  Each hook type supports three ordered execution **subsets**: `"before"` โ†’ `"primary"` (default) โ†’ `"after"`. Pattern matching, priority control, runtime enable/disable, and short-circuit support included.
96
95
 
97
- ๐ŸŽฃ **For complete hook system documentation, see [docs/HOOKS.md](./docs/HOOKS.md)**
96
+ ๐ŸŽฃ **For complete hook system documentation, see [docs/HOOKS.md](https://github.com/CLDMV/slothlet/blob/master/docs/HOOKS.md)**
98
97
 
99
98
  ### ๐Ÿ” **Permission System** _(new in v3.3, read-gated in v3.7)_
100
99
 
@@ -108,13 +107,13 @@ Path-based access control for inter-module API calls **and** data-value reads (v
108
107
  - **Runtime management** โ€” `api.slothlet.permissions.addRule()`, `.removeRule()`, `.self.*`, `.global.*`, `.control.*`
109
108
  - **Context conditions** _(v3.4)_ โ€” optional `condition` field; accepts a plain object (deep leaf matching), function, or array (OR); evaluated against per-request ALS context
110
109
 
111
- ๐Ÿ” **For complete permission system documentation, see [docs/PERMISSIONS.md](./docs/PERMISSIONS.md)** ยท ๐Ÿ“ **For condition syntax, see [docs/PERMISSIONS-CONDITIONS.md](./docs/PERMISSIONS-CONDITIONS.md)**
110
+ ๐Ÿ” **For complete permission system documentation, see [docs/PERMISSIONS.md](https://github.com/CLDMV/slothlet/blob/master/docs/PERMISSIONS.md)** ยท ๐Ÿ“ **For condition syntax, see [docs/PERMISSIONS-CONDITIONS.md](https://github.com/CLDMV/slothlet/blob/master/docs/PERMISSIONS-CONDITIONS.md)**
112
111
 
113
112
  ### ๐ŸŒ **Full Internationalization** _(new in v3)_
114
113
 
115
114
  All error messages and debug output are translated. Supported languages: English (US/UK) ยท Spanish (Spain/Mexico) ยท French ยท German ยท Portuguese ยท Hindi ยท Japanese ยท Korean ยท Russian ยท Chinese (Simplified)
116
115
 
117
- Only US English (`en-us`) ships built in; every other locale โ€” including UK English (`en-gb`) โ€” comes from the optional **`@cldmv/slothlet-i18n`** package installed alongside slothlet (auto-detected, nothing to import or configure). Configure the language via `i18n: { language: "es-mx" }` in your slothlet config. See **[docs/I18N.md](./docs/I18N.md)**.
116
+ Only US English (`en-us`) ships built in; every other locale โ€” including UK English (`en-gb`) โ€” comes from the optional **`@cldmv/slothlet-i18n`** package installed alongside slothlet (auto-detected, nothing to import or configure). Configure the language via `i18n: { language: "es-mx" }` in your slothlet config. See **[docs/I18N.md](https://github.com/CLDMV/slothlet/blob/master/docs/I18N.md)**.
118
117
 
119
118
  ### ๐Ÿ”„ **Context Propagation**
120
119
 
@@ -125,7 +124,7 @@ Automatic context preservation across all asynchronous boundaries:
125
124
  - **Class instance propagation**: Context preserved in class method calls
126
125
  - **Zero configuration**: Works automatically with TCP servers, HTTP servers, and custom EventEmitters
127
126
 
128
- ๐Ÿ”„ **For context propagation details, see [docs/CONTEXT-PROPAGATION.md](./docs/CONTEXT-PROPAGATION.md)**
127
+ ๐Ÿ”„ **For context propagation details, see [docs/CONTEXT-PROPAGATION.md](https://github.com/CLDMV/slothlet/blob/master/docs/CONTEXT-PROPAGATION.md)**
129
128
 
130
129
  ### ๐Ÿ”ง **Smart API Management**
131
130
 
@@ -134,7 +133,7 @@ Automatic context preservation across all asynchronous boundaries:
134
133
  - **Advanced Sanitization**: Custom naming rules with glob and boundary patterns; `api.slothlet.sanitize()` at runtime
135
134
  - **Hybrid Exports**: Support for callable APIs with methods, default + named exports
136
135
 
137
- ๐Ÿ—๏ธ **[Module structure](./docs/MODULE-STRUCTURE.md)** ยท ๐Ÿ“ **[API flattening](./docs/API-RULES/API-FLATTENING.md)** ยท ๐Ÿ”ก **[Sanitization](./docs/SANITIZATION.md)**
136
+ ๐Ÿ—๏ธ **[Module structure](https://github.com/CLDMV/slothlet/blob/master/docs/MODULE-STRUCTURE.md)** ยท ๐Ÿ“ **[API flattening](https://github.com/CLDMV/slothlet/blob/master/docs/API-RULES/API-FLATTENING.md)** ยท ๐Ÿ”ก **[Sanitization](https://github.com/CLDMV/slothlet/blob/master/docs/SANITIZATION.md)**
138
137
 
139
138
  ### ๐Ÿ”— **Runtime & Context System**
140
139
 
@@ -152,11 +151,11 @@ Run slothlet in the browser, web workers, and Electron renderers โ€” anywhere th
152
151
  - **Bundler-friendly**: bundled apps need only the manifest; raw-ESM pages and Electron renderers get the importmap too
153
152
  - **Full parity**: `self`, hooks, permissions, metadata, i18n, lifecycle events, and api mutation all work in-browser (live-binding context manager)
154
153
 
155
- ๐ŸŒ **For complete browser-mode documentation, see [docs/BROWSER.md](./docs/BROWSER.md)**
154
+ ๐ŸŒ **For complete browser-mode documentation, see [docs/BROWSER.md](https://github.com/CLDMV/slothlet/blob/master/docs/BROWSER.md)**
156
155
 
157
156
  ### ๐Ÿ›  **Developer Experience**
158
157
 
159
- - **TypeScript-Friendly**: Comprehensive JSDoc annotations with auto-generated declarations โ€” see **[docs/TYPESCRIPT.md](./docs/TYPESCRIPT.md)**
158
+ - **TypeScript-Friendly**: Comprehensive JSDoc annotations with auto-generated declarations โ€” see **[docs/TYPESCRIPT.md](https://github.com/CLDMV/slothlet/blob/master/docs/TYPESCRIPT.md)**
160
159
  - **Configurable Debug**: Detailed logging via CLI flags or environment variables
161
160
  - **Multiple Instances**: Parameter-based isolation for complex applications
162
161
  - **Inspectable APIs**: `console.log(api.math)` and logical versioned paths like `console.log(api.auth)` show real module contents instead of proxy internals (v3+)
@@ -208,19 +207,19 @@ const result = await api.math.add(2, 3); // ALL calls awaited in lazy mode
208
207
 
209
208
  ## ๐Ÿ“š Configuration
210
209
 
211
- The most-used options are summarized below. The complete reference โ€” every option, every diagnostic, every deprecated alias โ€” lives in **[docs/CONFIGURATION.md](./docs/CONFIGURATION.md)**.
210
+ The most-used options are summarized below. The complete reference โ€” every option, every diagnostic, every deprecated alias โ€” lives in **[docs/CONFIGURATION.md](https://github.com/CLDMV/slothlet/blob/master/docs/CONFIGURATION.md)**.
212
211
 
213
- | Option | Type | Default | Description |
214
- | ------------- | -------- | ----------- | ---------------------------------------------------------------------------------- |
215
- | `dir` | `string` | `"api"` | Directory to load API modules from |
216
- | `mode` | `string` | `"eager"` | `"eager"` (load upfront) or `"lazy"` (on-demand with copy-left materialization) |
217
- | `runtime` | `string` | `"async"` | `"async"` (AsyncLocalStorage) or `"live"` (live-bindings) |
218
- | `context` | `object` | `{}` | Per-request context โ€” read via `import { context } from "@cldmv/slothlet/runtime"` |
219
- | `hook` | `mixed` | `false` | Enable hooks; see **[HOOKS.md](./docs/HOOKS.md)** |
220
- | `permissions` | `object` | `undefined` | Path-based access control; see **[PERMISSIONS.md](./docs/PERMISSIONS.md)** |
221
- | `i18n` | `object` | `{}` | Language for translated error/debug messages โ€” see **[I18N.md](./docs/I18N.md)** |
212
+ | Option | Type | Default | Description |
213
+ | ------------- | -------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------- |
214
+ | `dir` | `string` | `"api"` | Directory to load API modules from |
215
+ | `mode` | `string` | `"eager"` | `"eager"` (load upfront) or `"lazy"` (on-demand with copy-left materialization) |
216
+ | `runtime` | `string` | `"async"` | `"async"` (AsyncLocalStorage) or `"live"` (live-bindings) |
217
+ | `context` | `object` | `{}` | Per-request context โ€” read via `import { context } from "@cldmv/slothlet/runtime"` |
218
+ | `hook` | `mixed` | `false` | Enable hooks; see **[HOOKS.md](https://github.com/CLDMV/slothlet/blob/master/docs/HOOKS.md)** |
219
+ | `permissions` | `object` | `undefined` | Path-based access control; see **[PERMISSIONS.md](https://github.com/CLDMV/slothlet/blob/master/docs/PERMISSIONS.md)** |
220
+ | `i18n` | `object` | `{}` | Language for translated error/debug messages โ€” see **[I18N.md](https://github.com/CLDMV/slothlet/blob/master/docs/I18N.md)** |
222
221
 
223
- Also configurable: `apiDepth`, `hidden` (globs hiding files/folders from the API), `debug`, `reference`, `sanitize`, `backgroundMaterialize`, `api.collision`, `api.mutations`, `versionDispatcher`, `typescript`, plus diagnostics and lifecycle internals. All documented in **[CONFIGURATION.md](./docs/CONFIGURATION.md)**.
222
+ Also configurable: `apiDepth`, `hidden` (globs hiding files/folders from the API), `debug`, `reference`, `sanitize`, `backgroundMaterialize`, `api.collision`, `api.mutations`, `versionDispatcher`, `typescript`, plus diagnostics and lifecycle internals. All documented in **[CONFIGURATION.md](https://github.com/CLDMV/slothlet/blob/master/docs/CONFIGURATION.md)**.
224
223
 
225
224
  ---
226
225
 
@@ -239,7 +238,7 @@ api.slothlet.lifecycle.on("materialized:complete", ({ total }) => console.log(`$
239
238
  await api.slothlet.materialize.wait(); // optional: gate traffic on ready
240
239
  ```
241
240
 
242
- ๐Ÿ“Š **Benchmarks & analysis: [docs/PERFORMANCE.md](./docs/PERFORMANCE.md)** ยท ๐Ÿ”€ **Visual pipeline diagram: [docs/MODULE-STRUCTURE.md#loading-pipeline-overview](./docs/MODULE-STRUCTURE.md#loading-pipeline-overview)** ยท โšก **Lifecycle events: [docs/LIFECYCLE.md](./docs/LIFECYCLE.md)**
241
+ ๐Ÿ“Š **Benchmarks & analysis: [docs/PERFORMANCE.md](https://github.com/CLDMV/slothlet/blob/master/docs/PERFORMANCE.md)** ยท ๐Ÿ”€ **Visual pipeline diagram: [docs/MODULE-STRUCTURE.md#loading-pipeline-overview](https://github.com/CLDMV/slothlet/blob/master/docs/MODULE-STRUCTURE.md#loading-pipeline-overview)** ยท โšก **Lifecycle events: [docs/LIFECYCLE.md](https://github.com/CLDMV/slothlet/blob/master/docs/LIFECYCLE.md)**
243
242
 
244
243
  ---
245
244
 
@@ -258,7 +257,7 @@ api.slothlet.hook.on("**:error", ({ path, error, source }) => console.error(path
258
257
  const out = await api.math.add(2, 3); // hooks fire automatically
259
258
  ```
260
259
 
261
- ๐ŸŽฃ **Configuration, all four types, subsets, pattern syntax, management API: [docs/HOOKS.md](./docs/HOOKS.md)**
260
+ ๐ŸŽฃ **Configuration, all four types, subsets, pattern syntax, management API: [docs/HOOKS.md](https://github.com/CLDMV/slothlet/blob/master/docs/HOOKS.md)**
262
261
 
263
262
  ---
264
263
 
@@ -278,7 +277,7 @@ await scoped.database.query();
278
277
 
279
278
  Context propagates automatically through `EventEmitter` callbacks (TCP/HTTP servers, custom emitters), class methods, and every async boundary. Inside modules: `import { context, instanceID } from "@cldmv/slothlet/runtime"`.
280
279
 
281
- ๐Ÿ”„ **Full reference, isolation guarantees, merge strategies, TCP/HTTP examples: [docs/CONTEXT-PROPAGATION.md](./docs/CONTEXT-PROPAGATION.md)**
280
+ ๐Ÿ”„ **Full reference, isolation guarantees, merge strategies, TCP/HTTP examples: [docs/CONTEXT-PROPAGATION.md](https://github.com/CLDMV/slothlet/blob/master/docs/CONTEXT-PROPAGATION.md)**
282
281
 
283
282
  ---
284
283
 
@@ -293,7 +292,7 @@ await api.slothlet.api.reload("database.*"); // hot-reload
293
292
 
294
293
  Collision modes (`merge` / `merge-replace` / `replace` / `skip` / `warn` / `error`) โ€” independently configurable for initial load vs runtime `add()`. Mutation controls let you disable `add` / `remove` / `reload` in production. Eager vs lazy reload semantics differ (eager merges into the live wrapper; lazy resets to an unmaterialized proxy).
295
294
 
296
- ๐Ÿ” **Full reference: [docs/RELOAD.md](./docs/RELOAD.md)** ยท ๐Ÿท๏ธ **Metadata system: [docs/METADATA.md](./docs/METADATA.md)**
295
+ ๐Ÿ” **Full reference: [docs/RELOAD.md](https://github.com/CLDMV/slothlet/blob/master/docs/RELOAD.md)** ยท ๐Ÿท๏ธ **Metadata system: [docs/METADATA.md](https://github.com/CLDMV/slothlet/blob/master/docs/METADATA.md)**
297
296
 
298
297
  ---
299
298
 
@@ -314,7 +313,7 @@ api.slothlet.lifecycle.on("impl:removed", ({ apiPath }) => {
314
313
 
315
314
  Events: `materialized:complete`, `impl:created`, `impl:changed`, `impl:removed`. Public surface is `on` / `off` only.
316
315
 
317
- โšก **Full reference: [docs/LIFECYCLE.md](./docs/LIFECYCLE.md)**
316
+ โšก **Full reference: [docs/LIFECYCLE.md](https://github.com/CLDMV/slothlet/blob/master/docs/LIFECYCLE.md)**
318
317
 
319
318
  ---
320
319
 
@@ -352,7 +351,7 @@ export const myModule = {
352
351
 
353
352
  The same import works from `.mjs`, `.cjs` (via `require`), `.ts`, and `.mts` (TypeScript path fixed in v3.5.0).
354
353
 
355
- ๐Ÿ—๏ธ **[Module structure patterns](./docs/MODULE-STRUCTURE.md)** ยท ๐Ÿ“ **[All 13 API transformation rules](./docs/API-RULES.md)**
354
+ ๐Ÿ—๏ธ **[Module structure patterns](https://github.com/CLDMV/slothlet/blob/master/docs/MODULE-STRUCTURE.md)** ยท ๐Ÿ“ **[All 13 API transformation rules](https://github.com/CLDMV/slothlet/blob/master/docs/API-RULES.md)**
356
355
 
357
356
  ---
358
357
 
@@ -388,33 +387,33 @@ try {
388
387
 
389
388
  ### Reference
390
389
 
391
- - **[Configuration Reference](./docs/CONFIGURATION.md)** โ€” every option with defaults, validation rules, and the `api.slothlet.diag.*` namespace
392
- - **[Generated API Reference](./docs/generated/API.md)** โ€” auto-generated from JSDoc; the complete public surface
393
- - **[Changelog](./docs/changelog/)** โ€” all release notes (v2 + v3)
394
- - **[Migration Guide](./docs/MIGRATION.md)** โ€” upgrading from v2.x
390
+ - **[Configuration Reference](https://github.com/CLDMV/slothlet/blob/master/docs/CONFIGURATION.md)** โ€” every option with defaults, validation rules, and the `api.slothlet.diag.*` namespace
391
+ - **[Generated API Reference](https://github.com/CLDMV/slothlet/blob/master/docs/generated/API.md)** โ€” auto-generated from JSDoc; the complete public surface
392
+ - **[Changelog](https://github.com/CLDMV/slothlet/tree/master/docs/changelog/)** โ€” all release notes (v2 + v3)
393
+ - **[Migration Guide](https://github.com/CLDMV/slothlet/blob/master/docs/MIGRATION.md)** โ€” upgrading from v2.x
395
394
 
396
395
  ### Technical Guides
397
396
 
398
- - **[Performance Analysis](./docs/PERFORMANCE.md)** โ€” startup vs runtime benchmarks, memory analysis, materialization cost breakdown
399
- - **[Hook System](./docs/HOOKS.md)** โ€” 4 types, three-phase subsets, pattern matching, management API
400
- - **[Permission System](./docs/PERMISSIONS.md)** โ€” rules, glob patterns, self-call bypass, read gating, runtime management
401
- - **[Permission Conditions](./docs/PERMISSIONS-CONDITIONS.md)** โ€” `condition` field syntax: deep object matching, functions, OR arrays
402
- - **[Context Propagation](./docs/CONTEXT-PROPAGATION.md)** โ€” per-request isolation, EventEmitter / class propagation, merge strategies
403
- - **[Lifecycle Events](./docs/LIFECYCLE.md)** โ€” `materialized:complete`, `impl:*` events, subscription API
404
- - **[Hot Reload & Dynamic API](./docs/RELOAD.md)** โ€” `add`, `remove`, `reload`, collision modes, mutation controls, eager vs lazy semantics
405
- - **[Versioning](./docs/VERSIONING.md)** โ€” multi-version module dispatch, `versionDispatcher`, version metadata
406
- - **[Metadata System](./docs/METADATA.md)** โ€” function metadata tagging for security, authorization, auditing
407
- - **[Module Structure](./docs/MODULE-STRUCTURE.md)** โ€” organization patterns, examples, and the loading-pipeline diagram
408
- - **[Sanitization](./docs/SANITIZATION.md)** โ€” filename โ†’ property-name transformation rules
409
- - **[TypeScript Support](./docs/TYPESCRIPT.md)** โ€” fast mode (esbuild), strict mode (tsc), `.d.ts` generation
410
- - **[Internationalization](./docs/I18N.md)** โ€” supported languages and configuration
411
- - **[Testing & Coverage](./docs/TESTING.md)** โ€” measuring coverage of composition-loaded leaves in a consumer project (the `server.deps.inline` requirement)
397
+ - **[Performance Analysis](https://github.com/CLDMV/slothlet/blob/master/docs/PERFORMANCE.md)** โ€” startup vs runtime benchmarks, memory analysis, materialization cost breakdown
398
+ - **[Hook System](https://github.com/CLDMV/slothlet/blob/master/docs/HOOKS.md)** โ€” 4 types, three-phase subsets, pattern matching, management API
399
+ - **[Permission System](https://github.com/CLDMV/slothlet/blob/master/docs/PERMISSIONS.md)** โ€” rules, glob patterns, self-call bypass, read gating, runtime management
400
+ - **[Permission Conditions](https://github.com/CLDMV/slothlet/blob/master/docs/PERMISSIONS-CONDITIONS.md)** โ€” `condition` field syntax: deep object matching, functions, OR arrays
401
+ - **[Context Propagation](https://github.com/CLDMV/slothlet/blob/master/docs/CONTEXT-PROPAGATION.md)** โ€” per-request isolation, EventEmitter / class propagation, merge strategies
402
+ - **[Lifecycle Events](https://github.com/CLDMV/slothlet/blob/master/docs/LIFECYCLE.md)** โ€” `materialized:complete`, `impl:*` events, subscription API
403
+ - **[Hot Reload & Dynamic API](https://github.com/CLDMV/slothlet/blob/master/docs/RELOAD.md)** โ€” `add`, `remove`, `reload`, collision modes, mutation controls, eager vs lazy semantics
404
+ - **[Versioning](https://github.com/CLDMV/slothlet/blob/master/docs/VERSIONING.md)** โ€” multi-version module dispatch, `versionDispatcher`, version metadata
405
+ - **[Metadata System](https://github.com/CLDMV/slothlet/blob/master/docs/METADATA.md)** โ€” function metadata tagging for security, authorization, auditing
406
+ - **[Module Structure](https://github.com/CLDMV/slothlet/blob/master/docs/MODULE-STRUCTURE.md)** โ€” organization patterns, examples, and the loading-pipeline diagram
407
+ - **[Sanitization](https://github.com/CLDMV/slothlet/blob/master/docs/SANITIZATION.md)** โ€” filename โ†’ property-name transformation rules
408
+ - **[TypeScript Support](https://github.com/CLDMV/slothlet/blob/master/docs/TYPESCRIPT.md)** โ€” fast mode (esbuild), strict mode (tsc), `.d.ts` generation
409
+ - **[Internationalization](https://github.com/CLDMV/slothlet/blob/master/docs/I18N.md)** โ€” supported languages and configuration
410
+ - **[Testing & Coverage](https://github.com/CLDMV/slothlet/blob/master/docs/TESTING.md)** โ€” measuring coverage of composition-loaded leaves in a consumer project (the `server.deps.inline` requirement)
412
411
 
413
412
  ### API Rules & Transformation
414
413
 
415
- - **[API Rules](./docs/API-RULES.md)** โ€” all 13 transformation rules with verified test examples
416
- - **[API Rules Conditions](./docs/API-RULES/API-RULES-CONDITIONS.md)** โ€” every conditional that controls API generation
417
- - **[API Flattening](./docs/API-RULES/API-FLATTENING.md)** โ€” flattening rules with decision tree
414
+ - **[API Rules](https://github.com/CLDMV/slothlet/blob/master/docs/API-RULES.md)** โ€” all 13 transformation rules with verified test examples
415
+ - **[API Rules Conditions](https://github.com/CLDMV/slothlet/blob/master/docs/API-RULES/API-RULES-CONDITIONS.md)** โ€” every conditional that controls API generation
416
+ - **[API Flattening](https://github.com/CLDMV/slothlet/blob/master/docs/API-RULES/API-FLATTENING.md)** โ€” flattening rules with decision tree
418
417
 
419
418
  ### Repo
420
419
 
@@ -423,7 +422,7 @@ try {
423
422
  - **[Security Policy](./SECURITY.md)** โ€” security guidelines and reporting
424
423
  - **[Test Documentation](./api_tests/)** โ€” comprehensive test module examples
425
424
 
426
- [![CodeFactor]][codefactor_url] [![npms.io score]][npms_url] [![npm unpacked size]][npm_size_url] [![Repo size]][repo_size_url]
425
+ [![CodeFactor]][codefactor_url] [![OpenSSF Scorecard]][ossf_scorecard_url] [![npms.io score]][npms_url] [![npm unpacked size]][npm_size_url] [![Repo size]][repo_size_url]
427
426
 
428
427
  ---
429
428
 
@@ -467,6 +466,8 @@ To my wife and children - thank you for your patience, your encouragement, and t
467
466
  [npm_last_update_url]: https://www.npmjs.com/package/@cldmv/slothlet
468
467
  [codefactor]: https://img.shields.io/codefactor/grade/github/CLDMV/slothlet?style=for-the-badge&logo=codefactor&logoColor=white&labelColor=F44A6A
469
468
  [codefactor_url]: https://www.codefactor.io/repository/github/cldmv/slothlet
469
+ [openssf scorecard]: https://img.shields.io/ossf-scorecard/github.com/CLDMV/slothlet?style=for-the-badge&label=OpenSSF%20Scorecard
470
+ [ossf_scorecard_url]: https://scorecard.dev/viewer/?uri=github.com/CLDMV/slothlet
470
471
  [npms.io score]: https://img.shields.io/npms-io/final-score/%40cldmv%2Fslothlet?style=for-the-badge&logo=npms&logoColor=white&labelColor=0B5D57
471
472
  [npms_url]: https://npms.io/search?q=%40cldmv%2Fslothlet
472
473
  [npm downloads]: https://img.shields.io/npm/dm/%40cldmv%2Fslothlet.svg?style=for-the-badge&logo=npm&logoColor=white&labelColor=CB3837
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@cldmv/slothlet",
3
- "version": "3.15.0",
3
+ "version": "3.15.1",
4
4
  "moduleVersions": {
5
5
  "lazy": "3.0.0",
6
6
  "eager": "3.0.0",