@plurnk/plurnk-execs 0.4.32 → 0.4.33

package/SPEC.md

@@ -203,7 +203,7 @@ A **registration** bound — a sibling of the §3 trust gate, **not** the §3.2
 | `PLURNK_EXECS_<TAG>=0` (or `false`) | surgical kill-switch for one tag |
 | `PLURNK_EXECS_ONLY=a,b,c` | allowlist — a tag not listed is disabled |
 
-The two compose within a layer (an allowlisted tag can still be individually killed). `ONLY` is reserved: a runtime tag may not be named `only`. Purely **subtractive** — there is no force-enable verb, by design.
+The two compose within a layer (an allowlisted tag can still be individually killed). `ONLY` is reserved: a runtime tag may not be named `only`. **Keys are matched case-insensitively** — `PLURNK_EXECS_sh=0` ≡ `PLURNK_EXECS_SH=0`, the way the mcp config folds server names, so the natural lowercase-tag spelling doesn't silently no-op. Purely **subtractive** — there is no force-enable verb, by design.
 
 **The cascade is an intersection.** A tag is live iff enabled in *every* layer: `enabled(tag) = service ∧ client ∧ …`. Because each layer only subtracts, order is irrelevant and no downstream layer can undo an upstream disable — **the client can never re-enable what the service disabled**, structurally, not by a policed rule.
 

package/dist/policy.d.ts

@@ -1,4 +1,5 @@
 export default class Policy {
+    #private;
     static isEnabled(tag: string, env?: Record<string, string | undefined>): boolean;
     static enabledAcross(tag: string, layers: Array<Record<string, string | undefined>>): boolean;
 }

package/dist/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAqBA,MAAM,CAAC,OAAO,OAAO,MAAM;IACvB,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO;IAc7F,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,OAAO;CAGhG"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAqBA,MAAM,CAAC,OAAO,OAAO,MAAM;;IAcvB,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO;IAc7F,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,OAAO;CAGhG"}

package/dist/policy.js

@@ -20,11 +20,24 @@
 // `PLURNK_EXECS_*` format for the per-session client layer. One parser, both
 // tiers — the consumer feeds the client's map straight to these methods.
 export default class Policy {
+    // Read a PLURNK_EXECS_<suffix> key case-INSENSITIVELY. The env-var
+    // convention is uppercase, but an operator/agent naturally writes the tag as
+    // it appears (PLURNK_EXECS_sh=0) — matching the tag they see, not shouting
+    // it — and a case-sensitive miss would silently no-op (service#328). Fold
+    // the key the way the mcp config already folds server names. Direct hit
+    // first (the common uppercase form), then a folded scan.
+    static #read(env, suffix) {
+        const key = `PLURNK_EXECS_${suffix.toUpperCase()}`;
+        if (key in env)
+            return env[key];
+        const hit = Object.keys(env).find((k) => k.toUpperCase() === key);
+        return hit === undefined ? undefined : env[hit];
+    }
     static isEnabled(tag, env = process.env) {
-        const off = env[`PLURNK_EXECS_${tag.toUpperCase()}`];
+        const off = Policy.#read(env, tag);
         if (off === "0" || off?.toLowerCase() === "false")
             return false;
-        const only = env.PLURNK_EXECS_ONLY;
+        const only = Policy.#read(env, "ONLY");
         if (only) {
             const allow = new Set(only.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean));
             if (!allow.has(tag.toLowerCase()))

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,2EAA2E;AAC3E,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,uCAAuC;AACvC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,OAAO,OAAO,MAAM;IACvB,MAAM,CAAC,SAAS,CAAC,GAAW,EAAE,MAA0C,OAAO,CAAC,GAAG;QAC/E,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,WAAW,EAAE,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,CAAC,aAAa,CAAC,GAAW,EAAE,MAAiD;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;CACJ"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,2EAA2E;AAC3E,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,uCAAuC;AACvC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,CAAC,OAAO,OAAO,MAAM;IACvB,mEAAmE;IACnE,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,CAAC,KAAK,CAAC,GAAuC,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,gBAAgB,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACnD,IAAI,GAAG,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAClE,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,GAAW,EAAE,MAA0C,OAAO,CAAC,GAAG;QAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,EAAE,WAAW,EAAE,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,CAAC,aAAa,CAAC,GAAW,EAAE,MAAiD;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;CACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@plurnk/plurnk-execs",
-    "version": "0.4.32",
+    "version": "0.4.33",
     "description": "Framework + contract for the @plurnk/plurnk-execs-* runtime executor family.",
     "keywords": [
         "plurnk",