@jimhoyd/urlcode 0.5.5 → 0.5.8

package/.claude/skills/urlcode-authoring/SKILL.md

@@ -11,6 +11,15 @@ validates. Features outside that contract do not silently degrade — they fail
 validation. So the cost of guessing is a broken project, and the whole job here
 is to author only what the pinned revision implements and then prove it.
 
+## No project yet? Install the scoped package
+
+The npm package is `@jimhoyd/urlcode` — always scoped. There is no unscoped
+`urlcode` package on the registry; `npm view urlcode` 404s. Install with
+`npm install @jimhoyd/urlcode`, then scaffold with
+`npx urlcode init .` (works in a directory holding only
+`package.json`, `package-lock.json`, `node_modules` or `.git`). Once installed,
+the rest of this skill and `urlcode context --project DIR` take over.
+
 ## Declarative-first default
 
 > Use URLCode's highest-level declarative features whenever possible. Generate custom code only when the framework cannot express the requirement.
@@ -38,6 +47,12 @@ supplies a host file, `get_extensions`. Bare `urlcode capabilities`, `recipes
 list`, the compact `llms.txt` index and `llms-full.txt` remain deliberate
 fallback/reference: in a source checkout read the matching task guide from
 `docs/`; in an npm installation search the heading in `llms-full.txt`.
+[URLCode AI](https://urlcode.ai/) is an optional, separate hosted service for
+shared skills and LLM tooling. Its remote MCP supplements the local
+project-aware `urlcode` server; never replace `.mcp.json` or put its bearer
+token in project files. Configure it only through the MCP client's secret
+facility; see the URLCode tooling guide for connection details. Its
+machine-readable entry point is `https://urlcode.ai/llms.txt`.
 When the project has an operator host file, inspect `urlcode extensions
 --project <dir> --host-file <absolute-file> --json` (MCP: `get_extensions`)
 before writing extension configuration or project hooks. The report is the
@@ -145,7 +160,7 @@ urlcode audit --project ./my-links --expect-routes <actual intended count>
 ```
 
 Use the real intended route count, including any `site`-generated routes. In a
-runtime checkout, substitute `node src/cli.ts` for `urlcode`; in a project made
+runtime checkout, substitute `node packages/core/src/cli.ts` for `urlcode`; in a project made
 from `urlcode-template`, the equivalent npm scripts work. External bindings
 require an already reviewed policy — add `--policy` where needed.
 

package/.claude/skills/urlcode-operations/SKILL.md

@@ -40,6 +40,10 @@ does not duplicate the repository's authored documentation tree.
 
 `llms.txt` at the repository root indexes all of the above alongside the
 authoring docs.
+[URLCode AI](https://urlcode.ai/) is the optional hosted companion for shared
+skills and LLM tooling. It does not replace local deployment checks or the
+project-aware `urlcode mcp` server. Its machine-readable entry point is
+`https://urlcode.ai/llms.txt`.
 
 ## Workflow
 
@@ -72,7 +76,7 @@ urlcode verify-deployment --project ./my-links --target https://links.example \
 
 Run the actual commands and report actual results, never "should work" or
 "should be reachable". `verify-deployment` needs a real target; do not
-simulate its output. In a runtime checkout, substitute `node src/cli.ts` for
+simulate its output. In a runtime checkout, substitute `node packages/core/src/cli.ts` for
 `urlcode`. Pass `--policy` where a snapshot needs bindings already reviewed
 by the operator.
 

package/README.md

@@ -10,7 +10,7 @@ console as operator-installed extensions instead of building them again.
 
 [![Verify](https://github.com/jimhoyd-com/urlcode/actions/workflows/ci.yml/badge.svg)](https://github.com/jimhoyd-com/urlcode/actions/workflows/ci.yml)
 
-[Documentation](docs/README.md) · [The framework](docs/FRAMEWORK.md) · [For AI agents](llms.txt) · [Starter](https://github.com/jimhoyd-com/urlcode-template) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md)
+[Documentation](docs/README.md) · [The framework](docs/FRAMEWORK.md) · [For AI agents](llms.txt) · [URLCode AI](https://urlcode.ai/) · [Starter](https://github.com/jimhoyd-com/urlcode-template) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md)
 
 **Your AI should build your application, not your framework.** Coding agents
 rebuild the same routing, validation, middleware, policies and authentication
@@ -37,8 +37,8 @@ come only from operator grants pinned to the project revision; grants govern
 that injected context, not the ambient Node environment a trusted, in-process
 module can reach on its own like any other code in the host.
 
-URLCode is not a URL shortener: stored short links are an operator-installed
-extension, not core's job. It is not a
+URLCode is not a URL shortener: stored short links are declared through the
+operator-installed `store` extension's collections, not core's job. It is not a
 general Node web framework: routing, validation, middleware wiring and
 policies are declared in YAML, not hand-wired; isolating a specific route's
 code from the host is an explicit `sandbox: true` opt-in, not something every
@@ -48,7 +48,7 @@ See [project direction](docs/PROJECT-DIRECTION.md).
 
 ## The framework
 
-Four packages, one project shape. A project climbs from redirects to a full
+Six packages, one project shape. A project climbs from redirects to a full
 application by adding YAML; the operator wires trusted packages in one host
 file outside the project. The full map, the composition contract and the rules
 an AI agent must follow are in [the framework](docs/FRAMEWORK.md).
@@ -59,6 +59,8 @@ an AI agent must follow are in [the framework](docs/FRAMEWORK.md).
 | [urlcode-ui](packages/ui) (workspace source) | Shared presentation: escaped templates, shadcn/ui partials, themes, translations | signed `extension-bundles@v…` GitHub Release |
 | [urlcode-auth](packages/auth) (workspace source) | Accounts: password, passkeys, OIDC, email codes, TOTP, sessions, roles, account page | signed `extension-bundles@v…` GitHub Release |
 | [urlcode-admin](packages/admin) (workspace source) | Administration: users, sessions, roles, audit, approvals, cases, impersonation | signed `extension-bundles@v…` GitHub Release |
+| [urlcode-store](packages/store) (workspace source) | Durable bounded JSON collections exposed as a typed CRUD API | signed `extension-bundles@v…` GitHub Release |
+| [urlcode-forms](packages/forms) (workspace source) | Bounded server-rendered form flows: escaped controls, admission, CSRF, validation | unreleased bundle source |
 
 Core stays available from npm, GitHub Releases and Homebrew. New sites install
 extensions from an immutable, attested `extension-bundles@v…` GitHub Release;
@@ -69,9 +71,10 @@ and channel alignment](docs/VERSION-ALIGNMENT.md).
 
 `urlcode-dynamic-link` and `urlcode-short` were published once as
 `0.1.0-alpha.1` and have since been retired: both were unpublished from npm and
-their repositories deleted, and neither has a successor. Nothing supported
-provides stored short links today — a project that needs them owns that storage
-itself. Anything still pinned to `@jimhoyd/urlcode-dynamic-link@0.1.0-alpha.1`
+their repositories deleted, and neither has a direct successor. A project that
+wants stored short links declares a collection through the `store` extension
+(see [docs/STORE.md](docs/STORE.md)) instead. Anything still pinned to
+`@jimhoyd/urlcode-dynamic-link@0.1.0-alpha.1`
 also has to deal with its exact declared peer `@jimhoyd/urlcode: 0.4.0-alpha.1`,
 which cannot be installed beside core `0.4.0-alpha.2` and never will be.
 
@@ -107,7 +110,7 @@ it. Cross-repository acceptance is tracked in
 ## Status
 
 <!-- urlcode-current-version:start -->
-This checkout prepares the coordinated `0.5.5` core, UI, auth, admin and store
+This checkout prepares the coordinated `0.5.8` core, UI, auth, admin and store
 release. Package availability remains a live registry fact: use `npm run
 release:status` or the release's signed `train.json` before selecting an
 install combination. Independent package versioning remains enabled, and a
@@ -130,7 +133,8 @@ remain open.
 
 Core has no native `link` handler. Stored short links moved out to a
 mount-based `urlcode-dynamic-link` extension, which has since been retired and
-unpublished; no supported package provides them.
+unpublished; a project that needs them declares a collection through the
+`store` extension instead (see [docs/STORE.md](docs/STORE.md)).
 
 URLCode is free and open-source software licensed under the
 [Apache License 2.0](LICENSE). Commercial use, modification, redistribution and
@@ -144,6 +148,8 @@ Start with the [YAML guide and recipe book](docs/YAML-GUIDE.md),
 authoring, use [the AI guide](docs/AI-AUTHORING.md), the bundled agent skills
 ([authoring](.claude/skills/urlcode-authoring/SKILL.md),
 [operations](.claude/skills/urlcode-operations/SKILL.md)) and [llms.txt](llms.txt).
+For optional shared skills and hosted LLM tooling, use [URLCode AI](https://urlcode.ai/);
+its remote MCP augments, rather than replaces, the local project server.
 Agents can also read project-pinned, signed declarative extension schemas through
 the read-only MCP tools described in [extensions](docs/EXTENSIONS.md#signed-declarative-artifacts);
 those artifacts are inert data, not an alternate executable package channel.
@@ -211,11 +217,12 @@ urlcode init my-urls && cd my-urls
 urlcode dev
 ```
 
-Open `http://127.0.0.1:3000/hello/Ada` for the function route and `/go` for
-the redirect. Edit the YAML; valid changes reload. `urlcode test` runs the
-project's HTTP fixtures. The [install guide](docs/INSTALL.md) covers the
-checksum-verified script, project-local installs, the container image and
-signed provenance. To work from a clone: `git clone … && make dev`.
+The starter deliberately has no routes. Ask the local MCP `get_context` tool
+(or run `urlcode context --project .`), then add the smallest declarative route
+or custom code the application needs. `urlcode test` runs the project's HTTP
+fixtures. The [install guide](docs/INSTALL.md) covers the checksum-verified
+script, project-local installs, the container image and signed provenance. To
+work from a clone: `git clone … && make dev`.
 
 ## A URL that runs your function
 
@@ -283,6 +290,9 @@ capability matrix and a copyable task prompt. `urlcode mcp` exposes read-only
 inspection, validation and conversion previews over stdio, and
 `--allow-authoring` adds project-confined authoring tools
 ([tooling](docs/TOOLING.md)).
+[URLCode AI](https://urlcode.ai/) is the optional hosted companion for shared
+skills and LLM tooling; its authenticated remote MCP setup is documented in
+[tooling](docs/TOOLING.md#optional-hosted-ai-mcp).
 
 ## Built with URLCode
 

package/dist/BUILD-MANIFEST.json

@@ -4,21 +4,21 @@
     "dist/adapters.js": "a7153ec52f2ed7e0cdd8ed7d433504815f402ec53b2b1c3d38d0cf0e2fcf6509",
     "dist/agent-context.js": "1e4e9c7b85d155c06d99d8b70f625bd7ab31330a0207aef6ed1803243b759611",
     "dist/agent-lists.js": "35ab484198897501d011cb6cc00b5a6787192e19df29c97646e8c118fcc19eef",
-    "dist/agents-guide.js": "421df50bcf258f23aba742148e53074512584a10ba35a6264e70d3eacc016e3e",
-    "dist/assets.js": "0833b093d2fe457ce68281110dc07d47914992753607741c13b339d92c76cf5c",
+    "dist/agents-guide.js": "307d92879034ef019213ab5c15ff5806de3333da4bb263d46fa87049d1a85d5c",
+    "dist/assets.js": "85d8e379dab466bc406b2ea1a9385f1fcecb35d05d825eb83089c55a62f6d1a4",
     "dist/authoring-files.js": "ad32814f9ae9c549c6247396f982aa700d13a293cc0a589609eccc68f8965550",
-    "dist/authoring.js": "a52d289c67043cad170babb6adab7ca23be1d7c7e5a67e43eaadfa73d2fe7665",
-    "dist/aws.js": "7d8e3a97b4f6dbefbd68da058f05192469d1efcaed5458b284863ebe462e060e",
-    "dist/body-schema.js": "0227ef8cf2b380e3ef65a358533aa0e0f4a119c94e63747b8eb03fe65a6b9193",
+    "dist/authoring.js": "a5620752a79d70525d36718411470fbc7ac9c7b4c8abb09a53355f92f9805393",
+    "dist/aws.js": "34bdbb85657426dc54a8301b5bcfa38c7559371215c430939438cc6b71dfa29e",
+    "dist/body-schema.js": "1c42bcd24187dfe0a7c5326f110081b714595fdfe577c2faea35cab3ca31d45a",
     "dist/build-cloudflare.js": "ff92e72d0a63d70dd8c28b52978edd9fb23cb16601e4dfebd07c2cef7bd73661",
     "dist/build-static.js": "3920b54bad9a44c75de79f0bef2b2a919bfb3e20a8619eaf8d48cad2856978ac",
     "dist/bulk.js": "aac88d422bd9a7a341a421fb4e29ff5580b28d39250b7f1f5315ba20ae92da8a",
-    "dist/capabilities.js": "bb98f5bbf54cc4e82fa197f999a621ad815273176f02692c35566886e2bb8777",
-    "dist/capability-query.js": "9f68bc94901451d7b9ecdd3aee8c3376dca7f0b890e31d8205306cf8120dea86",
-    "dist/catalog.js": "c378ef9bfd63b940790f6975f7db54557c2459722b65a7c170b97df24184bc52",
-    "dist/cli.js": "b8ff5c19dd2e1619ad4ba7de6eb811770f38e0b394f2bcded156d388d39c8f0b",
+    "dist/capabilities.js": "f14c17de63764f6f4686fc1404bf21aa5cf56125ad81e6d6157a429438fc0cbf",
+    "dist/capability-query.js": "00fbd8b592dea05de7487f3de21e6aa8808a6d2a90e8808811abeb843375dab3",
+    "dist/catalog.js": "629ed1d3580d5c5e238a4293e5b8491ba99d6948accda316bbd2ee3d7902cc0f",
+    "dist/cli.js": "5a99ca3f3d7c374f809a214e453b9b634c4057702b5ac92090b45e12c126fa34",
     "dist/client-address.js": "9d0d01466aab23124330605c5a0e0f981f87c897858acfad909f546a63df165b",
-    "dist/cloudflare.js": "31da478a6b851b5923c14dbd11885684cecec51cc7e0a5d6031d8512f3ecc040",
+    "dist/cloudflare.js": "b236918e499215ee42c2865181b3ed92decba0bf9d604f17f8b08736c86751d9",
     "dist/compliance-rules/baseline.js": "6296dea6bcb9f9bb80ed6ed5ab2f456e7f74e6de2be5d2d98ca8c983fb4df3ab",
     "dist/compliance-rules/privacy.js": "4cfb1c07d7df698c362dfc8761cd3bba893769e92d7fb0a3901e1c2d25e801f1",
     "dist/compliance-rules/shared.js": "86fd6db6a93375689acc64975cbc394ce9452dea21ae5941e743f99822515995",
@@ -26,69 +26,70 @@
     "dist/compliance.js": "29a18da3cefea94802ac7d817d1ab4e3674abd5c3ac4ef893cb8b01c6a23fb61",
     "dist/conditions.js": "ff25e97da550a3bdd80af55522045669438aa31a77d2bc83ad602bcefdee0475",
     "dist/config-worker.js": "bc2170d60c35f8d5de227cbfc4c5067dc61d7cbc5b98aed88e68a11797072da5",
-    "dist/config.js": "6fecd80a269c5c8097449205a09a7e3522336e1000dcb3a3c88adb1b349093db",
-    "dist/context.js": "225a25ad8dce00f52de2bb52a17aa85128cf34c4b82aa0cae846c8fc89b1cc52",
+    "dist/config.js": "b5e6d30dd5679da001203772a15e3ed5da735d9115082344e2cc397c020d2aa4",
+    "dist/context.js": "4061e18ecbcf1db69c6c76070349d0621774c419f2f775f06952470191e64e44",
     "dist/ecosystem-cli.js": "553911bf7e51c579ecd9d806f2ccfcba03ac601b87aa677c35147af36840e24d",
-    "dist/egress.js": "2ae29fe2cb4590fd2f715abe6817db47fed2f50dd31f37946ecf42eafbb0dd9e",
+    "dist/egress.js": "d7e3a2a92c9fcb5a1a1a038ff39df0b3a1d72978d84c36c7de295fa1e5af861b",
     "dist/errors.js": "fef26eb834dd61b8b5f587eb7ab265d216122d182545f0a1c5b19c20840dffb0",
-    "dist/examples.js": "8523799797d2530fe48ec5e96c34970bdba03c49afb31fdaab6a9c162a17dfa9",
+    "dist/examples.js": "22f36ceaa0ce4455b31d05d453d26a6c865009cfc3ad66c5519e82353b78e24a",
     "dist/explain-cli.js": "59050ad1139d419a23af4a844f2dc6b927c2bfd6599af7a2130b304733485f2d",
-    "dist/explain.js": "480f9590df4171ba0dc7187c878fc95623eefbc2fc47d38b974f36bc27ce6d00",
-    "dist/extension-artifacts.js": "01e1618799a0e920ef63b5cddf3680f245204895ad47bf956a4e4d8cbf706508",
+    "dist/explain.js": "29d0416dcbbc3ea349c9f927ea7f8d0f8f1cc0b6d25346a4deabc140aa517711",
+    "dist/extension-artifacts.js": "8c41bd33eea467869bf73b32dcce5ea7b533042058afd333102b53db6326b477",
     "dist/extension-bundles.js": "48d4cb64d2bbee8010447845eef491ee0be994e4867755f69ad8ee9105afbb29",
-    "dist/extension-transport.js": "5b312e754cac0c7623e35379d91478c2787134e8564caae2f87bb91c8ecc4fd4",
+    "dist/extension-transport.js": "8e56d20eb68dadf05026436af2eef19fed5296884c73834b1623333275c8900e",
     "dist/extensions.js": "ec4b1784fe278a5293ec12651765184bf57dac7146c0627dc9cb31deeb01a928",
     "dist/feature-plan.js": "214af2d3aac042386df2ca7ce06ee505a78d2e80a38bb4ef0e5b96a4a9866a97",
     "dist/function-sources.js": "16fad4abc81c7ee07b6cbcef2d23a9fc50e97a17cb4dde1db53469bbb555c96f",
-    "dist/function-worker.js": "35771790ada4e1b36d447d4967a5e6cf0b543f32944e4c904f5fbf8998e824a5",
-    "dist/functions.js": "d9f5a493ba389191707107972562edc5b5f435579622d5a0caa4d942d7b1326a",
-    "dist/guest-api.js": "49aec9ed72733ad119e63bcfcee18158dcc8ceb951e1823b8947f6407ff24afc",
+    "dist/function-worker.js": "17f8c81d3e1ad7e509266ba30b8975adc3e845e4d873f805e59369b8cf09f3ec",
+    "dist/functions.js": "9a12458423bbaad1b5073447e4305002d63348949c8bc07878dc9671a2c51a9f",
+    "dist/guest-api.js": "7668bb0e8bbbfc05c5e34bace436727735f5aa52f776fbc3e9edca3e7ff91fcb",
     "dist/header-validation.js": "465181dbb08ff05f52defdd29fda025c0c64589bf319fa87fa6d3ab4b68216d5",
-    "dist/http-policy.js": "393a6383bdf9e05597c98721b3a4c4207a9bbe359883babcbfa06b696c70f56c",
-    "dist/http-response.js": "565826d1ece4bd30dfc1150c75800acec1fef584f732e964409aa92958fc8550",
+    "dist/http-policy.js": "4fc00bc235ec70b0ed0a71e4af7501cc255a7e02268fd59387d7498075cfc284",
+    "dist/http-response.js": "c34d3e1436284f1339de411c6839419d1118f993ad67a8caa17da0268a779f66",
     "dist/index.js": "5e535104c672e70fa42f847ce6722c3b0bb2e3a9eac37f6a3c45d1a771f65f50",
-    "dist/init-with.js": "4b4bfca3081f57c525ec2b3617c4735d773c5317f285337948227ede4734f214",
+    "dist/init-with.js": "3e642ee85b0b51887b6fc877d6c8099500446376641d9f60bf31f64f407bbf8b",
     "dist/interchange-cli.js": "35bd70ba8077af5c3e39404ff0e5d28707632090a59a90645141252449fd3f04",
-    "dist/interchange.js": "3352228bc4ca652dd285fdaeddc8586f731fea5bd49521f408cce9a727f50ea8",
-    "dist/logging.js": "8ec57fea26983aa071b05fe15d680d6550b03488101163ed9666da674118cf31",
+    "dist/interchange.js": "3d9c79ca946b6cc3d14895c5bb3fdb3064ed0ca750cd326270fec2ba8c287403",
+    "dist/logging.js": "92f7a2cafc75be0cce560e0797bcaf8c98ab4d67338eda1dfc8c3a914f1b03a3",
     "dist/manifest.js": "83eed0d59621039ef364cf6e7b54c5bd47e0d8cf0a5abe7b07344bfc1db56ed8",
-    "dist/match.js": "2299245c0ba85481afe470c95f0f79502b6310b6870f776d16d88525a5e5da63",
-    "dist/mcp-authoring.js": "1183a56c5decb99ecb67a5da7bd91d1b494bc17a2965051aa63c4a7e291462b5",
-    "dist/mcp.js": "630936eaabd15cca18d0bf8249333f4f1b6eded29a1369512355e9200a705612",
+    "dist/match.js": "9069dfc59d485c7ed3b618d4ab4cfabcd67299ea4c45c646565e44a57b4bd51d",
+    "dist/mcp-authoring.js": "0753fb4f330ab710c7ee115315d7beb33b11faa80ca1b4fc114f5561c8abf7a7",
+    "dist/mcp.js": "f5cc0992b4e595fa36e33f84cb83e5917409ae7875c2f7a4686208cecaf5e671",
+    "dist/object-guards.js": "5af6012c803e9d587cb4270f52011bd2ba3e4655f73198dddc4ca327cdf89675",
     "dist/observability.js": "f4b1ab496f051fe3ef2ed36b2b2e469c63a8940700e2df852e6ff2d9cccdd5ae",
     "dist/operator-host.js": "e3dac9d43a83beb775202b4ab9eeeba7ac63cebfc5dcc669be38d825be587bd0",
-    "dist/pattern-guard.js": "6f157ced99666a89ca5af1418f5a14568d850985042dea309bf9ec0c19dbaca5",
+    "dist/pattern-guard.js": "cebd2af729d7999fffea489bb9bf9d5af945bd08b32b77f0463fb89af86fb167",
     "dist/plugins.js": "a61aa933cd9e1b41020b86fae78aa3a7f45f5313124aa11b50cb57898722385e",
-    "dist/policies/agents.js": "c1dbc1e90339f472eeeb2372f7f4637f59a5d210797ea680ac8120a02aa20c10",
-    "dist/policies/cache.js": "d08184e50b0ecb7331b29e4145aaefacb23b64ddaf3555d579743762f90c1629",
-    "dist/policies/compression.js": "800f3ae3b1a4c1fe58c3d9908364ea9d78f655ff50c7f7589f584378e7f194b0",
-    "dist/policies/security.js": "c68d39f5fa2d7d16f5bfb3dcff2ac71428cc41814970eecf8b931debd40c0f3e",
-    "dist/policies/throttle.js": "bbb0cb1c24cf70d0a1ac32fc0618efb6c44e5b5d42564842f9c585ff7e501603",
-    "dist/policies.js": "3750a7032ec7326aa544f4808683ad9eb91d4f2c5afe79904420cd8a355710a9",
-    "dist/policy.js": "2da95b3f1f77249b1e9f399a06b88909b68594fdbc958176075e91ff23104a7c",
-    "dist/prerender.js": "6210999e848ab86c87f265943960ef63716896da7a40e248221a6a30425c56b8",
-    "dist/project-dependencies.js": "b43a8f3125f62d38f0e71237b7813a785ef0613a83fcdec3fa8314f33758a534",
+    "dist/policies/agents.js": "b07f162fa8bfadf8866c09f9499a84c01740834703085e9ccf5a8cd1e02f6113",
+    "dist/policies/cache.js": "a52da3590b60048e4f5888591d26b16155c5250cacc212a9a2329d0f2a2149b2",
+    "dist/policies/compression.js": "afd6ee2b9c8122878b9f0e56b3d09613b44297b2297f6b76225979cbd4148ca5",
+    "dist/policies/security.js": "56dae854eb612cb83f3f81b144dd54034d45fefe7801afbfa4129b1e1609f1c0",
+    "dist/policies/throttle.js": "c3406b979d1144cfa96058b7874055de926bcea4fae240585b918092c987418a",
+    "dist/policies.js": "790694d06edb0a986a8a95e4eb6dcad0dc006cc53d84d4511b9e125a9b09a563",
+    "dist/policy.js": "2712abe24088ded09594dc8f048b47b94bd3dd85cc986c3a7a5b0c3ce7178796",
+    "dist/prerender.js": "363a369409323866d22aa3997ba57a27bae5b617d775fc3c74ba8944f02d4aa5",
+    "dist/project-dependencies.js": "d773224590221e9088444254d8e4e2aad63d968f39facac248f5084f29f92a03",
     "dist/project-tests.js": "63562978411ee94a69dcf45d4d47e84fba009d8654ac421c2a02a418cd80b4db",
     "dist/provider-verification.js": "ffcf9f05e8cb5f71ea46a97e279e8a613fdfdf9435ab02bd57af11e2680a9107",
-    "dist/proxy.js": "34107e59ac0dbbea090efa3cf5badf3226c5302ba25e8f8ff9b2b5596ed80e50",
-    "dist/readiness.js": "04143b22dbb8deec4b21b0f86c0c45c67f62a511efe1f99764b660791ef83343",
+    "dist/proxy.js": "b48f24fcee5fd425ae96b6617882be3861cb310988ac456df0f0fa7e53134ac9",
+    "dist/readiness.js": "862c6d5caf6a1e00217425348801616c8355ada7d3fa0e5f0caab8899346e672",
     "dist/recipes.js": "7af62ea9f612c82ea21e97e9d14451f05e0b509d6e420fb99fec96b22e3533f1",
-    "dist/review.js": "65c078fb027a4600dbbaa610d2f4cd639badffe7e508fe63e5ae90b17e86f17b",
-    "dist/route-diff.js": "8d71d50d332ffaaed588656bd32aa36763260d1ad87bb62d7ea1c8fb23383969",
-    "dist/router.js": "e5318f3a3b7aa9e0edfe2552f67555f1d7cc820ceec5c77d452c439b834f7434",
-    "dist/runtime.js": "6731200cdc1e8ac66b5d0ba7d0f42686ec31321b24e7d51130fe130e69478f37",
+    "dist/review.js": "102da9cea5a0edbd2ff2c8c26f5c25a9252832197c9fe19c54b754011a87d537",
+    "dist/route-diff.js": "f6e5b8965ededdcc76df431648751787af0b108141590744f248a69886c5f040",
+    "dist/router.js": "e8ffb65f6dc594439f032186b096788f5450ed5a2653f0a74eafbfc2505141e8",
+    "dist/runtime.js": "aa05e127b28e4f94b6802b01a2f74362d5a97b98cb9ed8b49dcfc0040159b812",
     "dist/sandbox.js": "c88c5aa5dd95b4f55f1ba62da7969ad66dbd97c30f72e5b5f2817a2098ac1c65",
-    "dist/scaffold.js": "0f936cabd20b609c7ebfebd7895710ce6c30882c3088a2356ac75bb4e0d10c55",
-    "dist/schema-query.js": "bfd1844acd8d54ac361115191fcfbaf828a67e223b9ec6e9c22f158761af149b",
-    "dist/server.js": "165b66fc4ed3b8e7c46ae4402ef66a5bc988c0910fb3e11556b040781e09d03c",
-    "dist/signals.js": "b55e54efc8fb6703e08f2a1e808ec8e011bda67738db8ceadf1b248f695795be",
-    "dist/site.js": "9f8154d0a62ed1b650c064a24e609d50dd370f0ff2cee2567628029e30855616",
+    "dist/scaffold.js": "378f0d21351c0e4c69c6bb31bd8b55735fa01d056f4a9b150462fea74f5e8867",
+    "dist/schema-query.js": "becded534b3a85a60f5b2ee819252a973bc8ff3890bdfece0428877453fbcb12",
+    "dist/server.js": "b3b66948fc8cd6be791529994fc765d77a20990f181bf19517d51e03726cab59",
+    "dist/signals.js": "81476f857b053696cddc5ed0d3f219ae48ba9523681bf13bc93830d03896d6eb",
+    "dist/site.js": "0b8d5e25bb0e2357e4f8b6995f45f7898087c7f37cdc5302e4c83ec5a4caa43d",
     "dist/tooling.js": "9fa72ac5fdcdb56c9e17ee5d8efae83e100d3ad862f90e855dd5766424830b57",
-    "dist/trusted-functions.js": "f3800c75f45ce90faf85ba6664398ad9031c5a9ac51d5ce42bdcff08a497d48e",
-    "dist/types.js": "483bf520fb8088d9793c40b6a79cce068506a6137f8128fd3923e179ee3377b3",
+    "dist/trusted-functions.js": "0f5f6038c8ae96ccca3a4ec6da17910c8872dc6e9a2da8753e1b6e2a1fcef0a9",
+    "dist/types.js": "a378e6bb6ffbcbe6d703a36949f7bf6c00973ade4808575828be4f90841e1120",
     "dist/typescript-authoring.js": "df3d9c82e6b545cae5caae04c443ed4d2feae96def5e5cde250c0a90d83ae98c",
-    "dist/vercel.js": "a0da20c095d0c7fa8f579ed4dd5951e7a34191f8a72a57c5e782c9eab39f6f08",
-    "dist/verify-deployment.js": "2d3b6301b70684abfccea669f7901afda7fae9d9d66902809ecdef65f22aea16",
-    "dist/scripts/operational-drills.js": "c26c406d28013cc554b25a5b6bf8baf4e71d5e67e50d866fae546f538a192317"
+    "dist/vercel.js": "fa4034aa1582f41c8b9d380ad4e068dded6adb002155b5079e2c858b0e34f90f",
+    "dist/verify-deployment.js": "85b4318efaf65608d193010c8904bc337f472bd5eac97ff3a7d52bbf017f81cd",
+    "dist/scripts/operational-drills.js": "26f487454f7602b26d17c28eccd78aa59954cd7975791ac140092c614b36bc19"
   }
 }

package/dist/agents-guide.js

@@ -34,6 +34,9 @@ export function renderAgentsGuide({ routes }                    )         {
   const handlers = handlerNames.filter(name => native.has(name));
   const policies = Object.keys(registry).filter(name => native.has(`policies.${name}`                  ));
   const site = Object.entries(generatedPaths).map(([key, path]) => `\`${key}\` (${path})`);
+  const auditGuidance = routes === 0
+    ? 'With no active routes, this initial audit intentionally exits nonzero with `no-active-routes`. Add the first route and its fixture, then make the audit pass; remove `allow-empty-project: true` from the generated GitHub workflow at that point.'
+    : 'Run all three after every change.';
   return `# Working on this project
 
 This project uses URLCode: URL behavior is declared in \`urlcode.yaml\`, and the
@@ -58,7 +61,7 @@ static serving and authentication. Read this file before changing anything.
 
 When present, \`${mcpConfigFile}\` registers the read-only \`urlcode mcp\` server; prefer its
 tools (also \`get_manifest\`) to reading documents. Inspect \`get_extensions\` before
-replacing extension behavior. \`--allow-authoring\` is an operator opt-in; never add it. For a committed artifact lock, use \`get_extension_artifacts\`/\`get_extension_artifact\`; they expose verified inert data and never activate an extension.
+replacing extension behavior. \`--allow-authoring\` is an operator opt-in; never add it. For a committed artifact lock, use \`get_extension_artifacts\`/\`get_extension_artifact\`; they expose verified inert data and never activate an extension. [URLCode AI](https://urlcode.ai/) is a separate optional hosted service for shared skills and LLM tooling; its remote MCP never replaces this local project server, and its credential belongs only in a client secret facility, never project files. Its machine-readable entry point is \`https://urlcode.ai/llms.txt\`.
 
 ## What the runtime provides (this version)
 
@@ -95,7 +98,7 @@ urlcode test
 urlcode audit --expect-routes ${routes}
 \`\`\`
 
-Run all three after every change, updating the route count deliberately and adding \`tests/requests.json\` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use \`node /path/to/urlcode/src/cli.ts\`.
+${auditGuidance} \`N\` counts declared routes plus one route for each active \`site.*\` convention; an audit mismatch reports the declared/generated split. Update it deliberately and add \`tests/requests.json\` fixtures for every new route (positive/negative, every active method, HEAD). No global install: use \`node /path/to/urlcode/packages/core/src/cli.ts\`.
 
 ## Feedback
 

package/dist/assets.js

@@ -9,8 +9,8 @@ import { assert, HttpError } from './errors.js';
                                                                                                               
 
 /** The header surface assetResponse reads for conditional and range requests. */
-                                                                                                                 
-                                                                  
+                                                                                                          
+                                                           
 
 // Asset bytes are immutable between successful reloads. No request opens a file.
 const denied = /^(?:node_modules|urlcode\.ya?ml|package(?:-lock)?\.json|.*\.(?:pem|key|p12|pfx|env))$/i;

package/dist/authoring.js

@@ -10,17 +10,14 @@ import { prepareFunctionSnapshot, requestedPermissions } from './policy.js';
 import { assert } from './errors.js';
 import { renderPackageManifest } from './project-dependencies.js';
                                                                
-import { redirectStarter } from './context.js';
                                                  
 
-                              
+                       
      
                                                                                                              
                                                                                                             
      
                                        
-                                                                                                                           
-                                                          
  
 // Agents install the runtime before they can read its docs, so `init .` has to work after `npm init` and `npm install`.
 // A directory is accepted in place only when it holds nothing but what npm and git create; anything else is user work
@@ -41,18 +38,7 @@ async function inspectExisting(target        )
   }
   return { entries: new Set(names), packageJson, pinned };
 }
-/** Adds what the starter needs to an existing package.json and changes nothing else; a conflicting script is refused, never overwritten. */
-export function mergePackageJson(text        , scripts                        , dependency        , version        )         {
-  const manifest = JSON.parse(text)                                                                                                                         ;
-  for (const [name, command] of Object.entries(scripts)) {
-    const current = manifest.scripts?.[name];
-    assert(current === undefined || current === command, `package.json already defines scripts.${name}; remove it or set it to: ${command}`);
-    manifest.scripts = { ...manifest.scripts, [name]: command };
-  }
-  if (manifest.dependencies?.[dependency] === undefined && manifest.devDependencies?.[dependency] === undefined) manifest.dependencies = { ...manifest.dependencies, [dependency]: version };
-  return JSON.stringify(manifest, null, 2) + '\n';
-}
-export async function initProject(destination        , { manifest, template = 'default' }              = {})                  {
+export async function initProject(destination        , { manifest }              = {})                  {
   const target = resolve(destination);
   await mkdir(dirname(target), { recursive: true });
   const existing = await inspectExisting(target);
@@ -60,23 +46,11 @@ export async function initProject(destination        , { manifest, template = 'd
   // A new directory is reserved exclusively before copying; an existing one is only ever added to.
   if (!existing) await mkdir(target);
   try {
-    if (template === 'redirects') { await writeRedirectsStarter(target, existing); return target; }
-    const source = fileURLToPath(new URL(`../starters/${template === 'page' ? 'page' : 'default'}/`, import.meta.url));
+    const source = fileURLToPath(new URL('../starters/default/', import.meta.url));
     for (const file of await readdir(source)) {
       if (file === '.gitignore' || file === 'AGENTS.md' || file === mcpConfigFile) continue;
       await cp(join(source,file), join(target,file === 'gitignore.template' ? '.gitignore' : file), { recursive: true, force: false, errorOnExist: true });
     }
-    if (template === 'page') {
-      const routes = Object.keys((await loadDocument(target)).routes).length;
-      // The page starter is the smallest project, but an agent opened in it still needs the same first-step guidance and MCP registration.
-      await writeExclusive(join(target, 'AGENTS.md'), renderAgentsGuide({ routes }));
-      await writeExclusive(join(target, mcpConfigFile), renderMcpConfig('.', { local: manifest !== undefined || existing?.pinned === true }));
-      if (manifest) {
-        const pkg = await open(join(target,'package.json'), 'wx', 0o644);
-        try { await pkg.writeFile(renderPackageManifest(target, manifest)); } finally { await pkg.close(); }
-      }
-      return target;
-    }
     // AGENTS.md is generated from the installed runtime's capability catalog so
     // it names only what this version implements; the starter carries a
     // committed copy for clones, kept identical by test.
@@ -102,35 +76,6 @@ export async function initProject(destination        , { manifest, template = 'd
   }
   return target;
 }
-const redirectFixtures = [
-  { path: '/old', status: 301, expectHeaders: { location: 'https://example.com/new' } },
-  { path: '/users/42', status: 308, expectHeaders: { location: 'https://example.com/profiles/42' } },
-  { path: '/people/7', status: 302, expectHeaders: { location: '/profiles/7' } },
-  { path: '/legacy/a/b/c/d/e/f/g/h/i', status: 302, expectHeaders: { location: 'https://example.com/modern/a/b/c/d/e/f/g/h/i' } },
-  { path: '/search?q=tea', status: 302, expectHeaders: { location: 'https://example.com/find?q=tea' } },
-  { path: '/missing', status: 404 },
-];
-/** The redirect starter is the `--task redirects` starter, so init and `urlcode context` cannot disagree. */
-async function writeRedirectsStarter(target        , existing                  )                {
-  const starter = redirectStarter();
-  const version = (JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'))                       ).version;
-  const files                         = {
-    [starter.file]: starter.yaml,
-    ...starter.companions,
-    'tests/requests.json': JSON.stringify(redirectFixtures, null, 2) + '\n',
-  };
-  await mkdir(join(target, 'tests'));
-  for (const [name, body] of Object.entries(files)) await writeExclusive(join(target, name), body);
-  if (existing?.packageJson !== undefined) await writeFile(join(target, 'package.json'), mergePackageJson(existing.packageJson, starter.packageScripts, '@jimhoyd/urlcode', version));
-  else await writeExclusive(join(target, 'package.json'), JSON.stringify({ name: 'redirects', version: '1.0.0', private: true, scripts: starter.packageScripts, dependencies: { '@jimhoyd/urlcode': version } }, null, 2) + '\n');
-  const routes = Object.keys((await loadDocument(target)).routes).length;
-  await writeExclusive(join(target, 'AGENTS.md'), renderAgentsGuide({ routes }));
-  await writeExclusive(join(target, mcpConfigFile), renderMcpConfig('.', { local: true }));
-}
-async function writeExclusive(file        , body        )                {
-  const handle = await open(file, 'wx', 0o644);
-  try { await handle.writeFile(body); } finally { await handle.close(); }
-}
 export async function addRedirect(project        , destination        , alias                     )                  {
   const loaded = await loadDocument(project);
   const slug = alias || randomBytes(6).toString('base64url');

package/dist/aws.js

@@ -6,6 +6,7 @@ import { activateNativeOnly, lazyRuntime, resolveOrigin } from './adapters.js';
 import { prepareResponse, errorResponse } from './http-response.js';
                                                      
 import { assert, ConfigError, HttpError } from './errors.js';
+import { isRecord } from './object-guards.js';
 
                                                                                                                                                                                                                                                            
 /** A Lambda payload format 2.0 event, as far as this adapter reads it. */
@@ -18,7 +19,20 @@ import { assert, ConfigError, HttpError } from './errors.js';
                                                                         
 
 const platformOrigins = ['URLCODE_PUBLIC_HOST'];
-const isRecord = (value         )                                   => value !== null && typeof value === 'object';
+// Payload format 2.0 joins every repeated header with a comma before this
+// adapter ever sees it (there is no `multiValueHeaders` on this format), so a
+// client that sent one occurrence with a comma in its value is
+// indistinguishable, at this layer, from two occurrences API Gateway joined.
+// Splitting unconditionally corrupts the former and inflates its count. Only
+// the headers RFC 7230/9110 define as a comma-separated list are safe to
+// split; every other header (including any project-declared one) is kept as
+// the single value the platform handed over, whatever characters it holds.
+const listValuedHeaders = new Set([
+  'accept','accept-charset','accept-encoding','accept-language','access-control-allow-headers','access-control-allow-methods',
+  'access-control-expose-headers','access-control-request-headers','allow','cache-control','connection','content-encoding',
+  'content-language','expect','forwarded','if-match','if-none-match','pragma','te','trailer','transfer-encoding','upgrade',
+  'vary','via','warning','www-authenticate','x-forwarded-for',
+]);
 
 // Payload format 2.0 only, as used by Lambda Function URLs and API Gateway
 // HTTP APIs. Format 1.0 supplies the path and query already decoded, so the
@@ -44,9 +58,12 @@ function requestHeaders(event             )
   for (const [name,value] of Object.entries(event.headers || {})) {
     if (value === undefined) continue;
     const key = name.toLowerCase();
-    // API Gateway joins repeats with a comma; the count reflects that a client
-    // sent more than one, which route policy uses to reject ambiguous inputs.
-    const parts = key === 'cookie' ? [value] : String(value).split(',');
+    // API Gateway joins repeats of a *list-valued* header with a comma; the
+    // count then reflects that a client sent more than one, which route
+    // policy uses to reject ambiguous inputs. Any other header is scalar as
+    // far as this adapter is concerned: splitting it on comma would mangle a
+    // legitimate value and miscount a single occurrence as several.
+    const parts = listValuedHeaders.has(key) ? String(value).split(',') : [String(value)];
     for (const part of parts) headers.append(key, part.trim());
     counts[key] = parts.length;
   }

package/dist/body-schema.js

@@ -1,5 +1,6 @@
 import { assert } from './errors.js';
 import { assertSafePattern, maxPatternInputLength } from './pattern-guard.js';
+import { isRecord, own } from './object-guards.js';
 
 /**
  * The JSON Schema subset a route may declare for `request.body.schema`.
@@ -18,8 +19,6 @@ export const uuidFormat = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a
 const types = ['object', 'array', 'string', 'integer', 'number', 'boolean', 'null'];
 const keywords = new Set(['type','properties','required','additionalProperties','items','enum','minLength','maxLength','pattern','format','minimum','maximum','minItems','maxItems']);
 const limits = { depth: 6, nodes: 128, properties: 64, enums: 64, length: 8192, items: 10000 };
-const isRecord = (value         )                                   => typeof value === 'object' && value !== null && !Array.isArray(value);
-const own = (object        , key        )          => Object.hasOwn(object, key);
 const patterns = new WeakMap                    ();
 
 /** Rejects, at load time, any schema outside the supported subset or its limits. */
@@ -75,7 +74,7 @@ const describe = (value         )         => value === null ? 'null' : Array.isA
  * is the schema keyword that failed, and `expected` is the schema's own
  * constraint. Nothing the client sent is ever placed in an issue.
  */
-                                                                                                                                                                            
+                                                                                                                                                                     
 const escapePointer = (name        )         => name.replace(/~/g, '~0').replace(/\//g, '~1');
 /** Structured failures for `value`; `checkBodySchema` renders the same list as text. */
 export function bodySchemaIssues(schema            , value         , path = '', issues                    = [], max = 8)                    {

package/dist/capabilities.js

@@ -6,7 +6,7 @@ import { effectivePolicies, registry } from './policies.js';
 
 export const capabilityTargets = ['self-hosted', 'cloudflare', 'aws', 'vercel', 'static']         ;
                                                                 
-/** `static` never reaches the policy-module handshake (src/types.ts `TargetName`): it refuses every
+/** `static` never reaches the policy-module handshake (packages/core/src/types.ts `TargetName`): it refuses every
  * runtime policy outright, so it needs no entry in that exhaustive per-target record. */
                                                                
                                                                           

package/dist/capability-query.js

@@ -1,11 +1,12 @@
 import {readdirSync,readFileSync,statSync} from 'node:fs';
 import {fileURLToPath} from 'node:url';
-import {parse} from 'yaml';
 import {capabilityDetails,capabilityNames,capabilityTargets,formatCapabilities,getCapabilities,routeCapabilities} from './capabilities.js';
                                                                                                            
 import {ConfigError} from './errors.js';
+import {parseYaml} from './config.js';
 import {getSchemaFragment} from './schema-query.js';
                                                       
+import {isRecord as object} from './object-guards.js';
                                                             
 
                                                               
@@ -18,7 +19,6 @@ import {getSchemaFragment} from './schema-query.js';
                              
  
 const root=(...parts         )=>fileURLToPath(new URL('../'+parts.join('/'),import.meta.url));
-const object=(value        )                                =>value!==null&&typeof value==='object'&&!Array.isArray(value);
 function yamlFiles(directory       )          {
   const out         =[];
   for(const entry of readdirSync(directory,{withFileTypes:true}).sort((a,b)=>a.name.localeCompare(b.name))) {
@@ -32,7 +32,7 @@ function yamlFiles(directory       )          {
 function usage(base       ,files         ,name               )                   {
   const result                  =[];
   for(const file of files) {
-    let document        ;try{document=parse(readFileSync(file,'utf8'));}catch{continue;}
+    let document        ;try{document=parseYaml(readFileSync(file,'utf8'));}catch{continue;}
     if(!object(document))continue;
     const routes         =[];
     if(name==='extension'&&object(document.extensions)&&Object.keys(document.extensions).length)routes.push('(project)');

package/dist/catalog.js

@@ -23,7 +23,7 @@ import {assert} from './errors.js';
                                                                        
  
 /** The fields the capability preflight determines; `npm run check` refuses hand-written values that differ. */
-                                                                                                                                    
+                                                                                                                             
                                                                                                     
 
 const schemaFile=fileURLToPath(new URL('../schemas/recipe.schema.json',import.meta.url));