@jimhoyd/urlcode 0.5.0 → 0.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jimhoyd/urlcode",
-  "version": "0.5.0",
+  "version": "0.5.6",
   "description": "Portable runtime for programmable URL behavior",
   "type": "module",
   "workspaces": [
@@ -85,30 +85,36 @@
     "llms-full.txt",
     "NOTICE",
     "recipes",
-    "skills"
+    "skills",
+    "docs/AI-AUTHORING.md",
+    "docs/YAML-REFERENCE.md",
+    "docs/TOOLING.md",
+    "docs/FUNCTION-SECURITY.md"
   ],
   "scripts": {
     "build": "node --disable-warning=ExperimentalWarning scripts/build.ts",
+    "prepare": "node --disable-warning=ExperimentalWarning scripts/build.ts --quiet",
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --conditions=development --test test/*.test.ts",
+    "test:shard": "node --conditions=development --test",
     "lint": "eslint .",
     "check": "npm run check:code && npm run check:docs",
-    "check:code": "node scripts/check.ts && node scripts/check-release-tags.ts && node scripts/check-workspace-links.ts && node scripts/check-issue-labels.ts && npm run release:check",
+    "check:code": "node scripts/check.ts && node scripts/check-core-boundaries.ts && node scripts/check-release-tags.ts && node scripts/check-workspace-links.ts && node scripts/check-issue-labels.ts && npm run release:check",
     "test:workerd": "node scripts/workerd-parity.ts",
     "verify": "npm run lint && npm run typecheck && npm run check && npm run build && npm test && npm run verify:workspaces",
     "workspace:styles": "npm run styles --workspace @jimhoyd/urlcode-ui",
-    "verify:workspaces": "npm run verify --workspace @jimhoyd/urlcode-ui && npm run verify --workspace @jimhoyd/urlcode-auth && npm run verify --workspace @jimhoyd/urlcode-admin && npm run verify --workspace @jimhoyd/urlcode-store && npm run audit:packages && npm run test:workspace-integration",
+    "verify:workspaces": "npm run verify --workspace @jimhoyd/urlcode-ui && npm run verify --workspace @jimhoyd/urlcode-auth && npm run verify --workspace @jimhoyd/urlcode-admin && npm run verify --workspace @jimhoyd/urlcode-store && npm run verify --workspace @jimhoyd/urlcode-forms && npm run audit:packages && npm run test:workspace-integration",
     "audit:packages": "node scripts/package-audit.ts --all",
     "test:package": "npm run build && npm run test:package:built",
-    "dev": "node src/cli.ts dev --project starters/default",
-    "serve": "node src/cli.ts serve --project starters/default",
-    "validate": "node src/cli.ts validate --local --project starters/default",
-    "test:project": "node src/cli.ts test --project starters/default",
-    "init": "node src/cli.ts init",
-    "doctor": "node src/cli.ts doctor",
-    "routes": "node src/cli.ts routes --project starters/default",
-    "audit:routes": "node src/cli.ts audit --project starters/default",
-    "benchmark:project": "node src/cli.ts benchmark --project starters/default",
+    "dev": "node packages/core/src/cli.ts dev --project starters/default",
+    "serve": "node packages/core/src/cli.ts serve --project starters/default",
+    "validate": "node packages/core/src/cli.ts validate --local --project starters/default",
+    "test:project": "node packages/core/src/cli.ts test --project starters/default",
+    "init": "node packages/core/src/cli.ts init",
+    "doctor": "node packages/core/src/cli.ts doctor",
+    "routes": "node packages/core/src/cli.ts routes --project starters/default",
+    "audit:routes": "node packages/core/src/cli.ts audit --project starters/default",
+    "benchmark:project": "node packages/core/src/cli.ts benchmark --project starters/default",
     "docs:reference": "node scripts/generate-yaml-reference.ts",
     "docs:plugin": "node scripts/generate-claude-plugin.ts",
     "docs:llms": "node scripts/build-llms-full.ts",

package/recipes/store-crud/README.md

@@ -1,8 +1,8 @@
 # Store CRUD
 
 `/api/todos/*` is a persistent JSON CRUD API. The project declares one
-collection and its mount; the operator-installed `store` extension
-(`@jimhoyd/urlcode-store`) serves it and keeps the data in the operator's
+collection and its mount; the operator-installed `store` extension serves it
+from a verified bundle and keeps the data in the operator's
 directory. There is no handler code. Full contract, limits and guarantees:
 [docs/STORE.md](../../docs/STORE.md).
 
@@ -10,20 +10,19 @@ directory. There is no handler code. Full contract, limits and guarantees:
 
 The store is not core and does not activate on its own.
 
-- The operator installs `@jimhoyd/urlcode-store` next to `@jimhoyd/urlcode`
-  and registers it in a host file kept outside the project.
-- The package is on npm (`@jimhoyd/urlcode-store`).
-  `urlcode init --with ui,auth,store` scaffolds a protected site from the
-  published packages. A no-auth `init --with store` needs `--ack store:public-write`,
-  which the core published at the store's first release does not have, so write the host file below by hand until a
-  newer core is released.
+- The operator selects the signed `store` bundle release and registers it in a
+  host file kept outside the project.
+- `urlcode init --with ui,auth,store --bundle-release extension-bundles@v…`
+  scaffolds a protected site from verified bundles. A no-auth `init --with
+  store` needs `--ack store:public-write`.
 - The data directory must be outside the project. It is single-writer: one
   server process per directory.
 
 ```js
 // /operator/host.mjs -- trusted operator code, never part of the project
 import {inspectExtensionRevision} from '@jimhoyd/urlcode/extensions';
-import {storeExtension} from '@jimhoyd/urlcode-store';
+import {loadExtensionBundle} from '@jimhoyd/urlcode/extension-bundles';
+const {storeExtension} = await loadExtensionBundle(process.env.URLCODE_PROJECT, 'store');
 const projectSha256 = await inspectExtensionRevision(process.env.URLCODE_PROJECT);
 export default {extensions: [storeExtension({directory: '/operator/data/store', projectSha256})]};
 ```

package/recipes/store-crud/recipe.yaml

@@ -7,7 +7,7 @@ targets: {self-hosted: conditional, cloudflare: refused, aws: conditional, verce
 routes: 1
 services:
   - name: store extension
-    description: An operator host file registering storeExtension from @jimhoyd/urlcode-store, with a data directory outside the project. The operator installs the package; `urlcode init --with ui,auth,store` scaffolds a protected host, and the README shows a hand-written one.
+    description: An operator host file registering the verified store bundle, with a data directory outside the project. `urlcode init --with ui,auth,store --bundle-release extension-bundles@v…` scaffolds a protected host, and the README shows a hand-written one.
 grants:
   - kind: extension
     description: The registration pins projectSha256 to this exact revision; editing a collection or the mount needs operator review and a new pin.

package/schemas/urlcode.schema.json

@@ -703,6 +703,9 @@
                   "env": {
                     "type": "string",
                     "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+                  },
+                  "default": {
+                    "type": "string"
                   }
                 },
                 "required": [

package/skills/urlcode/SKILL.md

@@ -22,7 +22,7 @@ Check installed primitives, YAML configuration, policies, extensions and recipes
   policies and commands this runtime version supports.
 - Find the runtime: `urlcode` on the PATH, or
   `node node_modules/@jimhoyd/urlcode/dist/cli.js`, or
-  `node /path/to/urlcode/src/cli.ts` for a source checkout. Use one form for
+  `node /path/to/urlcode/packages/core/src/cli.ts` for a source checkout. Use one form for
   every command below.
 
 ## 2. Retrieve the minimum, do not read everything

package/starters/default/AGENTS.md

@@ -59,7 +59,7 @@ urlcode test
 urlcode audit --expect-routes 2
 ```
 
-Run all three after every change, updating the route count deliberately and adding `tests/requests.json` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use `node /path/to/urlcode/src/cli.ts`.
+Run all three after every change, updating the route count deliberately and adding `tests/requests.json` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use `node /path/to/urlcode/packages/core/src/cli.ts`.
 
 ## Feedback
 

package/starters/default/README.md

@@ -19,8 +19,8 @@ The function route uses `middleware/headers.mjs` to add a response header around
 GET/HEAD, redirect 302 and no-store defaults keep YAML short. Valid edits reload.
 
 This app uses the runtime you installed separately (compatible with 0.1.0).
-Without a global install, invoke `node /path/to/urlcode/src/cli.ts` instead of
-`urlcode`. Optional Make shortcuts accept `URLCODE='node /path/to/urlcode/src/cli.ts'`.
+Without a global install, invoke `node /path/to/urlcode/packages/core/src/cli.ts` instead of
+`urlcode`. Optional Make shortcuts accept `URLCODE='node /path/to/urlcode/packages/core/src/cli.ts'`.
 For a cloneable project with a pinned npm runtime dependency, use
 [urlcode-template](https://github.com/jimhoyd-com/urlcode-template). Both start
 with the same two route examples. No runtime fork or provider account is needed.