@jimhoyd/urlcode 0.5.5 → 0.5.6

package/.claude/skills/urlcode-authoring/SKILL.md

@@ -145,7 +145,7 @@ urlcode audit --project ./my-links --expect-routes <actual intended count>
 ```
 
 Use the real intended route count, including any `site`-generated routes. In a
-runtime checkout, substitute `node src/cli.ts` for `urlcode`; in a project made
+runtime checkout, substitute `node packages/core/src/cli.ts` for `urlcode`; in a project made
 from `urlcode-template`, the equivalent npm scripts work. External bindings
 require an already reviewed policy — add `--policy` where needed.
 

package/.claude/skills/urlcode-operations/SKILL.md

@@ -72,7 +72,7 @@ urlcode verify-deployment --project ./my-links --target https://links.example \
 
 Run the actual commands and report actual results, never "should work" or
 "should be reachable". `verify-deployment` needs a real target; do not
-simulate its output. In a runtime checkout, substitute `node src/cli.ts` for
+simulate its output. In a runtime checkout, substitute `node packages/core/src/cli.ts` for
 `urlcode`. Pass `--policy` where a snapshot needs bindings already reviewed
 by the operator.
 

package/README.md

@@ -107,7 +107,7 @@ it. Cross-repository acceptance is tracked in
 ## Status
 
 <!-- urlcode-current-version:start -->
-This checkout prepares the coordinated `0.5.5` core, UI, auth, admin and store
+This checkout prepares the coordinated `0.5.6` core, UI, auth, admin and store
 release. Package availability remains a live registry fact: use `npm run
 release:status` or the release's signed `train.json` before selecting an
 install combination. Independent package versioning remains enabled, and a

package/dist/BUILD-MANIFEST.json

@@ -4,7 +4,7 @@
     "dist/adapters.js": "a7153ec52f2ed7e0cdd8ed7d433504815f402ec53b2b1c3d38d0cf0e2fcf6509",
     "dist/agent-context.js": "1e4e9c7b85d155c06d99d8b70f625bd7ab31330a0207aef6ed1803243b759611",
     "dist/agent-lists.js": "35ab484198897501d011cb6cc00b5a6787192e19df29c97646e8c118fcc19eef",
-    "dist/agents-guide.js": "421df50bcf258f23aba742148e53074512584a10ba35a6264e70d3eacc016e3e",
+    "dist/agents-guide.js": "8f513332f6f54b3fe04c29512d7e51ac354456c8b096e213e34afce9fb4381ce",
     "dist/assets.js": "0833b093d2fe457ce68281110dc07d47914992753607741c13b339d92c76cf5c",
     "dist/authoring-files.js": "ad32814f9ae9c549c6247396f982aa700d13a293cc0a589609eccc68f8965550",
     "dist/authoring.js": "a52d289c67043cad170babb6adab7ca23be1d7c7e5a67e43eaadfa73d2fe7665",
@@ -13,10 +13,10 @@
     "dist/build-cloudflare.js": "ff92e72d0a63d70dd8c28b52978edd9fb23cb16601e4dfebd07c2cef7bd73661",
     "dist/build-static.js": "3920b54bad9a44c75de79f0bef2b2a919bfb3e20a8619eaf8d48cad2856978ac",
     "dist/bulk.js": "aac88d422bd9a7a341a421fb4e29ff5580b28d39250b7f1f5315ba20ae92da8a",
-    "dist/capabilities.js": "bb98f5bbf54cc4e82fa197f999a621ad815273176f02692c35566886e2bb8777",
+    "dist/capabilities.js": "f14c17de63764f6f4686fc1404bf21aa5cf56125ad81e6d6157a429438fc0cbf",
     "dist/capability-query.js": "9f68bc94901451d7b9ecdd3aee8c3376dca7f0b890e31d8205306cf8120dea86",
     "dist/catalog.js": "c378ef9bfd63b940790f6975f7db54557c2459722b65a7c170b97df24184bc52",
-    "dist/cli.js": "b8ff5c19dd2e1619ad4ba7de6eb811770f38e0b394f2bcded156d388d39c8f0b",
+    "dist/cli.js": "3343b0dc534b4518a6bff14786c480f50bb6941e188be61f962c43e0ccec84f5",
     "dist/client-address.js": "9d0d01466aab23124330605c5a0e0f981f87c897858acfad909f546a63df165b",
     "dist/cloudflare.js": "31da478a6b851b5923c14dbd11885684cecec51cc7e0a5d6031d8512f3ecc040",
     "dist/compliance-rules/baseline.js": "6296dea6bcb9f9bb80ed6ed5ab2f456e7f74e6de2be5d2d98ca8c983fb4df3ab",
@@ -54,17 +54,17 @@
     "dist/manifest.js": "83eed0d59621039ef364cf6e7b54c5bd47e0d8cf0a5abe7b07344bfc1db56ed8",
     "dist/match.js": "2299245c0ba85481afe470c95f0f79502b6310b6870f776d16d88525a5e5da63",
     "dist/mcp-authoring.js": "1183a56c5decb99ecb67a5da7bd91d1b494bc17a2965051aa63c4a7e291462b5",
-    "dist/mcp.js": "630936eaabd15cca18d0bf8249333f4f1b6eded29a1369512355e9200a705612",
+    "dist/mcp.js": "c835bbfda949a4e3ae0a3143a207a5bc3ebadc8e1ca5211668db1e8afc4ea1c1",
     "dist/observability.js": "f4b1ab496f051fe3ef2ed36b2b2e469c63a8940700e2df852e6ff2d9cccdd5ae",
     "dist/operator-host.js": "e3dac9d43a83beb775202b4ab9eeeba7ac63cebfc5dcc669be38d825be587bd0",
     "dist/pattern-guard.js": "6f157ced99666a89ca5af1418f5a14568d850985042dea309bf9ec0c19dbaca5",
     "dist/plugins.js": "a61aa933cd9e1b41020b86fae78aa3a7f45f5313124aa11b50cb57898722385e",
-    "dist/policies/agents.js": "c1dbc1e90339f472eeeb2372f7f4637f59a5d210797ea680ac8120a02aa20c10",
+    "dist/policies/agents.js": "b07f162fa8bfadf8866c09f9499a84c01740834703085e9ccf5a8cd1e02f6113",
     "dist/policies/cache.js": "d08184e50b0ecb7331b29e4145aaefacb23b64ddaf3555d579743762f90c1629",
     "dist/policies/compression.js": "800f3ae3b1a4c1fe58c3d9908364ea9d78f655ff50c7f7589f584378e7f194b0",
-    "dist/policies/security.js": "c68d39f5fa2d7d16f5bfb3dcff2ac71428cc41814970eecf8b931debd40c0f3e",
+    "dist/policies/security.js": "56dae854eb612cb83f3f81b144dd54034d45fefe7801afbfa4129b1e1609f1c0",
     "dist/policies/throttle.js": "bbb0cb1c24cf70d0a1ac32fc0618efb6c44e5b5d42564842f9c585ff7e501603",
-    "dist/policies.js": "3750a7032ec7326aa544f4808683ad9eb91d4f2c5afe79904420cd8a355710a9",
+    "dist/policies.js": "790694d06edb0a986a8a95e4eb6dcad0dc006cc53d84d4511b9e125a9b09a563",
     "dist/policy.js": "2da95b3f1f77249b1e9f399a06b88909b68594fdbc958176075e91ff23104a7c",
     "dist/prerender.js": "6210999e848ab86c87f265943960ef63716896da7a40e248221a6a30425c56b8",
     "dist/project-dependencies.js": "b43a8f3125f62d38f0e71237b7813a785ef0613a83fcdec3fa8314f33758a534",
@@ -85,10 +85,10 @@
     "dist/site.js": "9f8154d0a62ed1b650c064a24e609d50dd370f0ff2cee2567628029e30855616",
     "dist/tooling.js": "9fa72ac5fdcdb56c9e17ee5d8efae83e100d3ad862f90e855dd5766424830b57",
     "dist/trusted-functions.js": "f3800c75f45ce90faf85ba6664398ad9031c5a9ac51d5ce42bdcff08a497d48e",
-    "dist/types.js": "483bf520fb8088d9793c40b6a79cce068506a6137f8128fd3923e179ee3377b3",
+    "dist/types.js": "63c84f6eb1f7157858435739105249219dcbfb3d65189065aa7444370af51755",
     "dist/typescript-authoring.js": "df3d9c82e6b545cae5caae04c443ed4d2feae96def5e5cde250c0a90d83ae98c",
     "dist/vercel.js": "a0da20c095d0c7fa8f579ed4dd5951e7a34191f8a72a57c5e782c9eab39f6f08",
     "dist/verify-deployment.js": "2d3b6301b70684abfccea669f7901afda7fae9d9d66902809ecdef65f22aea16",
-    "dist/scripts/operational-drills.js": "c26c406d28013cc554b25a5b6bf8baf4e71d5e67e50d866fae546f538a192317"
+    "dist/scripts/operational-drills.js": "26f487454f7602b26d17c28eccd78aa59954cd7975791ac140092c614b36bc19"
   }
 }

package/dist/agents-guide.js

@@ -95,7 +95,7 @@ urlcode test
 urlcode audit --expect-routes ${routes}
 \`\`\`
 
-Run all three after every change, updating the route count deliberately and adding \`tests/requests.json\` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use \`node /path/to/urlcode/src/cli.ts\`.
+Run all three after every change, updating the route count deliberately and adding \`tests/requests.json\` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use \`node /path/to/urlcode/packages/core/src/cli.ts\`.
 
 ## Feedback
 

package/dist/capabilities.js

@@ -6,7 +6,7 @@ import { effectivePolicies, registry } from './policies.js';
 
 export const capabilityTargets = ['self-hosted', 'cloudflare', 'aws', 'vercel', 'static']         ;
                                                                 
-/** `static` never reaches the policy-module handshake (src/types.ts `TargetName`): it refuses every
+/** `static` never reaches the policy-module handshake (packages/core/src/types.ts `TargetName`): it refuses every
  * runtime policy outright, so it needs no entry in that exhaustive per-target record. */
                                                                
                                                                           

package/dist/cli.js

@@ -30,7 +30,7 @@ import { readFile } from 'node:fs/promises';
 import { installArtifact, inspectArtifacts } from './extension-artifacts.js';
 import { installBundle, readBundleLock } from './extension-bundles.js';
 
-const usage = `URLCode 0.5.5 — local/self-hosted runtime
+const usage = `URLCode 0.5.6 — local/self-hosted runtime
   urlcode init <directory> [--template page|redirects] [--with ui,auth,admin] [--bundle-release extension-bundles@vX.Y.Z] [--ack extension:id] [--manifest|--no-manifest] [--pin @scope/pkg=specifier]
     # --template redirects: the tested redirect starter from 'urlcode context --task redirects' (urlcode.yaml, 404.html, package.json with a PORT-aware start script, tests, AGENTS.md, .mcp.json); not combinable with --with
     # init works in place in a directory holding only package.json, package-lock.json, node_modules or .git: package.json is merged (scripts.start added, an existing pin kept), any other existing file is refused

package/dist/mcp.js

@@ -102,7 +102,7 @@ export async function serveMcp(options           )               {
   if(message.method==='initialize') {
    if(initialized){await error(id,-32600,'Already initialized');return;}
    if(typeof params.protocolVersion!=='string'||!object(params.capabilities)||!object(params.clientInfo)||typeof params.clientInfo.name!=='string'||typeof params.clientInfo.version!=='string'){await error(id,-32602,'Invalid initialize params');return;}
-   initialized=true;await send({jsonrpc:'2.0',id,result:{protocolVersion,capabilities:{tools:{}},serverInfo:{name:'urlcode',version:'0.5.5'}}});return;
+   initialized=true;await send({jsonrpc:'2.0',id,result:{protocolVersion,capabilities:{tools:{}},serverInfo:{name:'urlcode',version:'0.5.6'}}});return;
   }
   if(message.method==='ping'){await send({jsonrpc:'2.0',id,result:{}});return;}
   if(!ready){await error(id,-32002,'Initialize first');return;}

package/dist/policies/agents.js

@@ -2,7 +2,7 @@ import { assert, ConfigError } from '../errors.js';
 import { lists as bundled } from '../../data/agents/index.js';
                                                          
 
-// User-Agent policy. Contract in src/policies.ts. This module also runs inside
+// User-Agent policy. Contract in packages/core/src/policies.ts. This module also runs inside
 // the Cloudflare Worker, so it has no Node imports and never touches the
 // filesystem: bundled lists arrive through the generated data/agents/index.js
 // and project-relative list files arrive already loaded (src/agent-lists.ts

package/dist/policies/security.js

@@ -43,7 +43,7 @@ export const profiles
 });
 
 // Headers the runtime or a handler owns; `set` may not claim them. Mirrors
-// the set in src/http-policy.ts (that file uses the Node Buffer global, so the
+// the set in packages/core/src/http-policy.ts (that file uses the Node Buffer global, so the
 // list is reproduced rather than imported).
 export const reservedHeaders = Object.freeze(new Set(['connection','keep-alive','transfer-encoding','content-length','upgrade','trailer','proxy-authenticate','proxy-authorization','te','location','allow','content-range','accept-ranges','etag','last-modified','content-encoding','x-request-id','x-content-type-options','content-type','set-cookie','cache-control','vary','ratelimit','ratelimit-policy','retry-after','age']));
 

package/dist/policies.js

@@ -13,7 +13,7 @@ import { assert, ConfigError } from './errors.js';
 // function/middleware execution entirely -- trusted routes and sandbox: true
 // routes alike. Every
 // module here follows one contract so a first-party policy and an operator
-// plugin share a code path (PolicyModule in src/types.ts):
+// plugin share a code path (PolicyModule in packages/core/src/types.ts):
 //
 //   name          the YAML key under `policies`
 //   phases        'request' | 'response' | both; fixed order below

package/dist/scripts/operational-drills.js

@@ -4,7 +4,7 @@ import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
 import {tmpdir} from 'node:os';
 import {join} from 'node:path';
 import {startServer} from '../server.js';
-                                             
+                                                           
 
 const seconds=Number(process.env.URLCODE_SOAK_SECONDS||5);
 assert(Number.isInteger(seconds)&&seconds>=1&&seconds<=3600,'Soak must be 1–3600 seconds');

package/dist/types.js

@@ -154,7 +154,7 @@
  
 
 // ---------------------------------------------------------------------------
-// The host-side policy contract (src/policies.ts documents the phases).
+// The host-side policy contract (packages/core/src/policies.ts documents the phases).
 
                                                                   
                                                                             

package/docs/AI-AUTHORING.md

@@ -138,7 +138,7 @@ urlcode benchmark --project ./my-links --requests 100 --concurrency 2
 ```
 
 Use the intentional actual count, not always 2. Runtime checkout users can replace
-`urlcode` with `node src/cli.ts`. Template users can use the equivalent npm scripts.
+`urlcode` with `node packages/core/src/cli.ts`. Template users can use the equivalent npm scripts.
 External bindings require an already reviewed policy; add `--policy` where needed.
 The benchmark operates locally; it is not a load test of an external deployment.
 

package/examples/assets/example.yaml

@@ -9,9 +9,9 @@ files: [urlcode.yaml, functions/hello.mjs, public/about.html, public/guide.txt,
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/assets
-    - node src/cli.ts test --project examples/assets
-    - node src/cli.ts audit --project examples/assets --expect-routes 5
+    - node packages/core/src/cli.ts validate --local --project examples/assets
+    - node packages/core/src/cli.ts test --project examples/assets
+    - node packages/core/src/cli.ts audit --project examples/assets --expect-routes 5
 behavior:
   - native page, static and download routes serve snapshotted files with explicit caching
   - one trusted function shows the two kinds of route side by side

package/examples/aws/example.yaml

@@ -12,9 +12,9 @@ files: [urlcode.yaml, handler.mjs, template.yaml, public/index.html, public/note
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/aws
-    - node src/cli.ts test --project examples/aws
-    - node src/cli.ts audit --project examples/aws --expect-routes 5
+    - node packages/core/src/cli.ts validate --local --project examples/aws
+    - node packages/core/src/cli.ts test --project examples/aws
+    - node packages/core/src/cli.ts audit --project examples/aws --expect-routes 5
 behavior:
   - every route is native, so the project activates on Lambda without the sandbox
   - handler.mjs wraps the project with createLambdaHandler; deployment itself is unverified evidence

package/examples/cloudflare/example.yaml

@@ -12,8 +12,8 @@ files: [urlcode.yaml, wrangler.toml, tests/requests.json, README.md]
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/cloudflare
-    - node src/cli.ts test --project examples/cloudflare
-    - node src/cli.ts audit --project examples/cloudflare --expect-routes 4
+    - node packages/core/src/cli.ts validate --local --project examples/cloudflare
+    - node packages/core/src/cli.ts test --project examples/cloudflare
+    - node packages/core/src/cli.ts audit --project examples/cloudflare --expect-routes 4
 behavior:
   - only capabilities the Worker lowering supports appear, so the build succeeds on every target

package/examples/compliance/README.md

@@ -10,7 +10,7 @@ Run it against the cookbook from the runtime checkout. The module must be an
 absolute path outside the audited project:
 
 ```sh
-node src/cli.ts audit --project examples/cookbook \
+node packages/core/src/cli.ts audit --project examples/cookbook \
   --compliance baseline --compliance-rules "$PWD/examples/compliance/rules.mjs" --compliance-warn
 ```
 

package/examples/compliance/example.yaml

@@ -6,6 +6,6 @@ runnable: false
 files: [rules.mjs, README.md]
 tests:
   commands:
-    - node src/cli.ts audit --project examples/cookbook --compliance baseline --compliance-rules "$PWD/examples/compliance/rules.mjs" --compliance-warn
+    - node packages/core/src/cli.ts audit --project examples/cookbook --compliance baseline --compliance-rules "$PWD/examples/compliance/rules.mjs" --compliance-warn
 behavior:
   - three custom rules run alongside the built-in profile; one built-in notice is disabled and one severity raised

package/examples/conditions/example.yaml

@@ -12,8 +12,8 @@ files: [urlcode.yaml, tests/requests.json, README.md]
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/conditions --origin https://conditions.example.test
-    - node src/cli.ts test --project examples/conditions --origin https://conditions.example.test
-    - node src/cli.ts audit --project examples/conditions --expect-routes 4 --origin https://conditions.example.test
+    - node packages/core/src/cli.ts validate --local --project examples/conditions --origin https://conditions.example.test
+    - node packages/core/src/cli.ts test --project examples/conditions --origin https://conditions.example.test
+    - node packages/core/src/cli.ts audit --project examples/conditions --expect-routes 4 --origin https://conditions.example.test
 behavior:
   - cases are provably disjoint and every branch stays no-store; no branch is authentication

package/examples/cookbook/README.md

@@ -11,10 +11,10 @@ external services are required. Redirects target example.com; tests never follow
 From the runtime checkout:
 
 ```sh
-node src/cli.ts validate --project examples/cookbook
-node src/cli.ts test --project examples/cookbook
-node src/cli.ts audit --project examples/cookbook --expect-routes 40
-node src/cli.ts dev --project examples/cookbook
+node packages/core/src/cli.ts validate --project examples/cookbook
+node packages/core/src/cli.ts test --project examples/cookbook
+node packages/core/src/cli.ts audit --project examples/cookbook --expect-routes 40
+node packages/core/src/cli.ts dev --project examples/cookbook
 ```
 
 The [YAML guide](../../docs/YAML-GUIDE.md) explains the recipes and binding policy.

package/examples/cookbook/example.yaml

@@ -9,9 +9,9 @@ files: [urlcode.yaml, routes/code.yaml, routes/redirects.yaml, routes/responses.
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/cookbook
-    - node src/cli.ts test --project examples/cookbook
-    - node src/cli.ts audit --project examples/cookbook --expect-routes 40
+    - node packages/core/src/cli.ts validate --local --project examples/cookbook
+    - node packages/core/src/cli.ts test --project examples/cookbook
+    - node packages/core/src/cli.ts audit --project examples/cookbook --expect-routes 40
 behavior:
   - urlcode examples search finds single routes here through the generated route-index.json
   - fifteen routes exercise the fourteen middleware modules that the middleware recipe copies

package/examples/coverage-waiver/example.yaml

@@ -9,8 +9,8 @@ files: [urlcode.yaml, functions/notes.mjs, tests/requests.json, README.md]
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/coverage-waiver
-    - node src/cli.ts test --project examples/coverage-waiver
-    - node src/cli.ts audit --project examples/coverage-waiver --expect-routes 1
+    - node packages/core/src/cli.ts validate --local --project examples/coverage-waiver
+    - node packages/core/src/cli.ts test --project examples/coverage-waiver
+    - node packages/core/src/cli.ts audit --project examples/coverage-waiver --expect-routes 1
 behavior:
   - POST /notes is waived from coverage with a reason; GET is asserted by a fixture; the waiver is listed by audit, not hidden

package/examples/egress/example.yaml

@@ -13,7 +13,7 @@ grants:
 files: [urlcode.yaml, README.md]
 tests:
   commands:
-    - node src/cli.ts permissions --project examples/egress
-    - node src/cli.ts validate --local --project examples/egress --policy /operator/egress-policy.json
+    - node packages/core/src/cli.ts permissions --project examples/egress
+    - node packages/core/src/cli.ts validate --local --project examples/egress --policy /operator/egress-policy.json
 behavior:
   - without the policy the project refuses to activate; nothing here reaches the network during authoring inspection

package/examples/extensions/example.yaml

@@ -16,6 +16,6 @@ grants:
 files: [urlcode.yaml, README.md]
 tests:
   commands:
-    - node src/cli.ts validate --local --project examples/extensions --host-file /operator/host.mjs --origin https://extensions.example.test
+    - node packages/core/src/cli.ts validate --local --project examples/extensions --host-file /operator/host.mjs --origin https://extensions.example.test
 behavior:
   - "/account uses auth: {role: member}; routes and audit show the expanded policies.extensions.auth form"

package/examples/lifecycle/example.yaml

@@ -12,8 +12,8 @@ files: [urlcode.yaml, functions/notes.mjs, tests/requests.json, README.md]
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts test --project examples/lifecycle
-    - node src/cli.ts audit --project examples/lifecycle --expect-routes 2
+    - node packages/core/src/cli.ts test --project examples/lifecycle
+    - node packages/core/src/cli.ts audit --project examples/lifecycle --expect-routes 2
 behavior:
   - a note created by POST /notes is readable, replaceable and still present after the runtime restarts on the same data directory
   - the id and Location the create response returns are captured and substituted into later steps as {{id}} and {{where}}

package/examples/not-found/README.md

@@ -5,6 +5,6 @@ route, with status 404 and `text/html`. See
 [site conventions](../../docs/SITE.md#notfound--404html).
 
 ```sh
-node src/cli.ts test --project examples/not-found
-node src/cli.ts build --target static --project examples/not-found   # writes 404.html
+node packages/core/src/cli.ts test --project examples/not-found
+node packages/core/src/cli.ts build --target static --project examples/not-found   # writes 404.html
 ```

package/examples/not-found/example.yaml

@@ -9,9 +9,9 @@ files: [urlcode.yaml, public/index.html, public/404.html, tests/requests.json, R
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/not-found
-    - node src/cli.ts test --project examples/not-found
-    - node src/cli.ts audit --project examples/not-found --expect-routes 2
+    - node packages/core/src/cli.ts validate --local --project examples/not-found
+    - node packages/core/src/cli.ts test --project examples/not-found
+    - node packages/core/src/cli.ts audit --project examples/not-found --expect-routes 2
 behavior:
   - an unmatched GET or HEAD is answered with the page and status 404
   - other methods keep the plain-text 404

package/examples/prerender/README.md

@@ -14,11 +14,11 @@ runs no code at all.
 From the runtime checkout:
 
 ```sh
-node src/cli.ts dev --project examples/prerender        # the dynamic source, live
-node src/cli.ts test --project examples/prerender       # 7 fixtures
+node packages/core/src/cli.ts dev --project examples/prerender        # the dynamic source, live
+node packages/core/src/cli.ts test --project examples/prerender       # 7 fixtures
 node examples/prerender/prerender.mjs examples/prerender /absolute/out
-node src/cli.ts test --project /absolute/out            # fixtures the build wrote
-node src/cli.ts audit --project /absolute/out --expect-routes 3
+node packages/core/src/cli.ts test --project /absolute/out            # fixtures the build wrote
+node packages/core/src/cli.ts audit --project /absolute/out --expect-routes 3
 ```
 
 The same three URLs answer identically before and after. The difference is what

package/examples/prerender/example.yaml

@@ -9,8 +9,8 @@ files: [urlcode.yaml, functions/page.mjs, middleware/template.mjs, prerender.mjs
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts test --project examples/prerender
+    - node packages/core/src/cli.ts test --project examples/prerender
     - node examples/prerender/prerender.mjs examples/prerender /absolute/out
-    - node src/cli.ts audit --project /absolute/out --expect-routes 3
+    - node packages/core/src/cli.ts audit --project /absolute/out --expect-routes 3
 behavior:
   - the rendered project serves the same bytes from native page routes with no sandbox on the request path

package/examples/provider-conformance/example.yaml

@@ -8,7 +8,7 @@ routes: 5
 files: [urlcode.yaml, README.md]
 tests:
   commands:
-    - node src/cli.ts validate --local --project examples/provider-conformance
-    - node src/cli.ts verify-provider --target self-hosted --origin https://owned-fixture.example
+    - node packages/core/src/cli.ts validate --local --project examples/provider-conformance
+    - node packages/core/src/cli.ts verify-provider --target self-hosted --origin https://owned-fixture.example
 behavior:
   - no functions, bindings, assets or policies, so every target activates it; never mix it into a real project

package/examples/shared-blocks/example.yaml

@@ -10,8 +10,8 @@ files: [urlcode.yaml, tests/requests.json, README.md]
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/shared-blocks
-    - node src/cli.ts test --project examples/shared-blocks
-    - node src/cli.ts audit --project examples/shared-blocks --expect-routes 4
+    - node packages/core/src/cli.ts validate --local --project examples/shared-blocks
+    - node packages/core/src/cli.ts test --project examples/shared-blocks
+    - node packages/core/src/cli.ts audit --project examples/shared-blocks --expect-routes 4
 behavior:
   - a route's own request or response key replaces the shared block whole; nothing is deep merged

package/examples/vercel/example.yaml

@@ -12,8 +12,8 @@ files: [urlcode.yaml, api/index.js, vercel.json, public/index.html, public/notes
 tests:
   fixtures: tests/requests.json
   commands:
-    - node src/cli.ts validate --local --project examples/vercel
-    - node src/cli.ts test --project examples/vercel
-    - node src/cli.ts audit --project examples/vercel --expect-routes 5
+    - node packages/core/src/cli.ts validate --local --project examples/vercel
+    - node packages/core/src/cli.ts test --project examples/vercel
+    - node packages/core/src/cli.ts audit --project examples/vercel --expect-routes 5
 behavior:
   - every route is native, so the project activates on Vercel without the sandbox

package/llms-full.txt

@@ -1,5 +1,5 @@
 <!-- Generated by scripts/build-llms-full.ts (npm run docs:llms). Do not edit; edit the source documents. -->
-<!-- Consolidated URLCode authoring reference: 16 documents, about 61,239 tokens (estimate: characters / 4). -->
+<!-- Consolidated URLCode authoring reference: 16 documents, about 61,257 tokens (estimate: characters / 4). -->
 
 <!-- urlcode-current-version:start -->
 # URLCode
@@ -7,7 +7,7 @@
 > A portable runtime for programmable URL behavior, and the framework that grows
 > from it: routes in YAML, functions and middleware, then accounts, administration and
 > stored links as operator-installed extensions. Stable project format
-> `version: "1"`. Core is Apache-2.0; this revision is `0.5.5`. `function`/`middleware`
+> `version: "1"`. Core is Apache-2.0; this revision is `0.5.6`. `function`/`middleware`
 > routes are trusted by default with `sandbox: true` as the per-route opt-in. The
 > auth, admin, ui and store workspace packages are bundle sources. New sites install
 > core from npm and verified executable extensions from an immutable GitHub Release;
@@ -439,7 +439,7 @@ urlcode benchmark --project ./my-links --requests 100 --concurrency 2
 ```
 
 Use the intentional actual count, not always 2. Runtime checkout users can replace
-`urlcode` with `node src/cli.ts`. Template users can use the equivalent npm scripts.
+`urlcode` with `node packages/core/src/cli.ts`. Template users can use the equivalent npm scripts.
 External bindings require an already reviewed policy; add `--policy` where needed.
 The benchmark operates locally; it is not a load test of an external deployment.
 
@@ -773,7 +773,7 @@ programmatic compatibility analysis and provider verification limits.
 Source: https://github.com/jimhoyd-com/urlcode/blob/main/docs/YAML-GUIDE.md
 
 <!-- urlcode-current-version:start -->
-This guide targets URLCode 0.5.5. Start with the function example below,
+This guide targets URLCode 0.5.6. Start with the function example below,
 then add only the fields your route needs. The authoritative machine-readable
 shape is [JSON Schema](https://github.com/jimhoyd-com/urlcode/blob/main/schemas/urlcode.schema.json); semantic rules are in the
 [specification](https://github.com/jimhoyd-com/urlcode/blob/main/docs/SPECIFICATION.md). Unsupported fields fail validation.
@@ -788,10 +788,10 @@ From the runtime checkout:
 
 ```sh
 npm ci
-node src/cli.ts validate --project examples/cookbook
-node src/cli.ts test --project examples/cookbook
-node src/cli.ts audit --project examples/cookbook --expect-routes 40
-node src/cli.ts dev --project examples/cookbook
+node packages/core/src/cli.ts validate --project examples/cookbook
+node packages/core/src/cli.ts test --project examples/cookbook
+node packages/core/src/cli.ts audit --project examples/cookbook --expect-routes 40
+node packages/core/src/cli.ts dev --project examples/cookbook
 ```
 
 The cookbook is a larger learning project. The normal `urlcode init ../my-links`

package/llms.txt

@@ -4,7 +4,7 @@
 > A portable runtime for programmable URL behavior, and the framework that grows
 > from it: routes in YAML, functions and middleware, then accounts, administration and
 > stored links as operator-installed extensions. Stable project format
-> `version: "1"`. Core is Apache-2.0; this revision is `0.5.5`. `function`/`middleware`
+> `version: "1"`. Core is Apache-2.0; this revision is `0.5.6`. `function`/`middleware`
 > routes are trusted by default with `sandbox: true` as the per-route opt-in. The
 > auth, admin, ui and store workspace packages are bundle sources. New sites install
 > core from npm and verified executable extensions from an immutable GitHub Release;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jimhoyd/urlcode",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Portable runtime for programmable URL behavior",
   "type": "module",
   "workspaces": [
@@ -99,22 +99,22 @@
     "test:shard": "node --conditions=development --test",
     "lint": "eslint .",
     "check": "npm run check:code && npm run check:docs",
-    "check:code": "node scripts/check.ts && node scripts/check-release-tags.ts && node scripts/check-workspace-links.ts && node scripts/check-issue-labels.ts && npm run release:check",
+    "check:code": "node scripts/check.ts && node scripts/check-core-boundaries.ts && node scripts/check-release-tags.ts && node scripts/check-workspace-links.ts && node scripts/check-issue-labels.ts && npm run release:check",
     "test:workerd": "node scripts/workerd-parity.ts",
     "verify": "npm run lint && npm run typecheck && npm run check && npm run build && npm test && npm run verify:workspaces",
     "workspace:styles": "npm run styles --workspace @jimhoyd/urlcode-ui",
     "verify:workspaces": "npm run verify --workspace @jimhoyd/urlcode-ui && npm run verify --workspace @jimhoyd/urlcode-auth && npm run verify --workspace @jimhoyd/urlcode-admin && npm run verify --workspace @jimhoyd/urlcode-store && npm run verify --workspace @jimhoyd/urlcode-forms && npm run audit:packages && npm run test:workspace-integration",
     "audit:packages": "node scripts/package-audit.ts --all",
     "test:package": "npm run build && npm run test:package:built",
-    "dev": "node src/cli.ts dev --project starters/default",
-    "serve": "node src/cli.ts serve --project starters/default",
-    "validate": "node src/cli.ts validate --local --project starters/default",
-    "test:project": "node src/cli.ts test --project starters/default",
-    "init": "node src/cli.ts init",
-    "doctor": "node src/cli.ts doctor",
-    "routes": "node src/cli.ts routes --project starters/default",
-    "audit:routes": "node src/cli.ts audit --project starters/default",
-    "benchmark:project": "node src/cli.ts benchmark --project starters/default",
+    "dev": "node packages/core/src/cli.ts dev --project starters/default",
+    "serve": "node packages/core/src/cli.ts serve --project starters/default",
+    "validate": "node packages/core/src/cli.ts validate --local --project starters/default",
+    "test:project": "node packages/core/src/cli.ts test --project starters/default",
+    "init": "node packages/core/src/cli.ts init",
+    "doctor": "node packages/core/src/cli.ts doctor",
+    "routes": "node packages/core/src/cli.ts routes --project starters/default",
+    "audit:routes": "node packages/core/src/cli.ts audit --project starters/default",
+    "benchmark:project": "node packages/core/src/cli.ts benchmark --project starters/default",
     "docs:reference": "node scripts/generate-yaml-reference.ts",
     "docs:plugin": "node scripts/generate-claude-plugin.ts",
     "docs:llms": "node scripts/build-llms-full.ts",

package/skills/urlcode/SKILL.md

@@ -22,7 +22,7 @@ Check installed primitives, YAML configuration, policies, extensions and recipes
   policies and commands this runtime version supports.
 - Find the runtime: `urlcode` on the PATH, or
   `node node_modules/@jimhoyd/urlcode/dist/cli.js`, or
-  `node /path/to/urlcode/src/cli.ts` for a source checkout. Use one form for
+  `node /path/to/urlcode/packages/core/src/cli.ts` for a source checkout. Use one form for
   every command below.
 
 ## 2. Retrieve the minimum, do not read everything

package/starters/default/AGENTS.md

@@ -59,7 +59,7 @@ urlcode test
 urlcode audit --expect-routes 2
 ```
 
-Run all three after every change, updating the route count deliberately and adding `tests/requests.json` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use `node /path/to/urlcode/src/cli.ts`.
+Run all three after every change, updating the route count deliberately and adding `tests/requests.json` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use `node /path/to/urlcode/packages/core/src/cli.ts`.
 
 ## Feedback
 

package/starters/default/README.md

@@ -19,8 +19,8 @@ The function route uses `middleware/headers.mjs` to add a response header around
 GET/HEAD, redirect 302 and no-store defaults keep YAML short. Valid edits reload.
 
 This app uses the runtime you installed separately (compatible with 0.1.0).
-Without a global install, invoke `node /path/to/urlcode/src/cli.ts` instead of
-`urlcode`. Optional Make shortcuts accept `URLCODE='node /path/to/urlcode/src/cli.ts'`.
+Without a global install, invoke `node /path/to/urlcode/packages/core/src/cli.ts` instead of
+`urlcode`. Optional Make shortcuts accept `URLCODE='node /path/to/urlcode/packages/core/src/cli.ts'`.
 For a cloneable project with a pinned npm runtime dependency, use
 [urlcode-template](https://github.com/jimhoyd-com/urlcode-template). Both start
 with the same two route examples. No runtime fork or provider account is needed.