@vibe-agent-toolkit/resources 0.1.39-rc.8 → 0.1.39

package/dist/external-link-validator.js

@@ -1,5 +1,81 @@
+import { userInfo } from 'node:os';
+import { resolveAuthenticatedUrl, safePath, } from '@vibe-agent-toolkit/utils';
 import markdownLinkCheck from 'markdown-link-check';
 import { ExternalLinkCache } from './external-link-cache.js';
+import { classifyAuthenticatedResponse } from './link-auth-classify.js';
+import { wrapLinkAuthDepsWithMemo } from './link-auth-deps-memo.js';
+import { authTransport } from './link-auth-transport.js';
+/**
+ * Resolve the OS user for cache scoping. Falls back through several layers
+ * because `os.userInfo()` throws when the running user has no /etc/passwd
+ * entry (common in container environments) — that's recoverable, not fatal.
+ */
+function resolveOsUser() {
+    try {
+        const u = userInfo().username;
+        if (u !== '')
+            return u;
+    }
+    catch {
+        // userInfo() throws when the running user has no /etc/passwd entry —
+        // recover via env vars below.
+    }
+    // Use `||` (not `??`) so an empty-string USER/USERNAME also falls through.
+    // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
+    const fromEnv = process.env['USER'] || process.env['USERNAME'];
+    if (fromEnv)
+        return fromEnv;
+    // Last resort: two distinct OS users on the same host both end up here
+    // would share the auth cache (cross-user leak). Warn once so the
+    // collision is at least observable. Adopters whose container clears
+    // these env vars deliberately can set `USER=container-name` to scope.
+    warnDefaultUserFallbackOnce();
+    return 'default';
+}
+let defaultUserWarned = false;
+function warnDefaultUserFallbackOnce() {
+    if (defaultUserWarned)
+        return;
+    defaultUserWarned = true;
+    console.warn("[vat] linkAuth: could not determine an OS user via os.userInfo() or USER/USERNAME env; " +
+        "scoping auth cache to 'default'. Two users on this host would share auth-cached results — " +
+        'set the USER env var explicitly to scope per-user.');
+}
+/**
+ * Make an OS username safe for use as a directory component. Replaces path
+ * separators (`/`, `\`), the parent-directory shorthand (`..`), and other
+ * characters that could escape the cacheDir. Windows can produce
+ * `DOMAIN\user` forms; tests inject pathological values like `../escaped`.
+ */
+function sanitizeOsUser(user) {
+    // Replace any character outside `[A-Za-z0-9._-]` with `_`. Then collapse any
+    // remaining `..` so a name like `..foo` cannot recombine into a traversal.
+    const replaced = user.replaceAll(/[^A-Za-z0-9._-]/g, '_').replaceAll('..', '__');
+    return replaced.length > 0 ? replaced : 'default';
+}
+/**
+ * Build a LinkValidationResult from a status code by re-classifying it under
+ * the current run's provider `check` block. Used by both the cache-hit and
+ * cache-miss paths so the two produce identical results for the same
+ * `(url, provider)` pair — the cache only persists `statusCode`, not the
+ * derived `code`, so the code must be re-derived on every read.
+ */
+function buildAuthResult(originalUrl, statusCode, plan, cached, cachedStatusMessage) {
+    const classified = classifyAuthenticatedResponse(statusCode, plan.check);
+    const result = {
+        url: originalUrl,
+        status: classified?.outcome === 'alive' ? 'ok' : 'error',
+        statusCode,
+        cached,
+    };
+    if (classified?.code != null) {
+        result.code = classified.code;
+    }
+    if (result.status === 'error') {
+        result.error = cachedStatusMessage ?? `HTTP ${statusCode}`;
+    }
+    return result;
+}
 /**
  * Safely serialize an error to a string, preventing [object Object] issues.
  * Handles Error objects, strings, objects, and edge cases.
@@ -55,7 +131,18 @@ function safeSerializeError(err) {
  */
 export class ExternalLinkValidator {
     cache;
+    /**
+     * Auth-branch cache — scoped to a per-OS-user subdirectory of `cacheDir`
+     * (#113 §6.3) so two users on a shared machine never read each other's
+     * authenticated results. Distinct from `cache` (the anonymous cache, which
+     * stays shared across users for the markdown-link-check path).
+     */
+    authCache;
     options;
+    linkAuthConfig;
+    fetchImpl;
+    linkAuthDeps;
+    sleep;
     /**
      * Create a new external link validator
      *
@@ -70,7 +157,20 @@ export class ExternalLinkValidator {
             userAgent: options.userAgent ??
                 'Mozilla/5.0 (compatible; VAT-LinkChecker/1.0; +https://github.com/jdutton/vibe-agent-toolkit)',
         };
+        this.linkAuthConfig = options.linkAuthConfig;
+        this.fetchImpl = options.fetchImpl ?? globalThis.fetch;
+        // Wrap the configured runCommand (or the engine's default) with a memo
+        // keyed by stringified argv so each unique token-resolution command runs
+        // at most once per validator instance. Validating N links to the same
+        // host previously re-resolved the token N times — including subprocess
+        // spawns for `command` sources. Per #125 review: treat all token
+        // resolvers as expensive; the memo's lifetime equals one validate() run.
+        this.linkAuthDeps = wrapLinkAuthDepsWithMemo(options.linkAuthDeps);
+        this.sleep = options.sleep;
         this.cache = new ExternalLinkCache(cacheDir, this.options.cacheTtlHours);
+        const osUser = sanitizeOsUser(options.osUser ?? resolveOsUser());
+        const authCacheDir = safePath.join(cacheDir, `auth-${osUser}`);
+        this.authCache = new ExternalLinkCache(authCacheDir, this.options.cacheTtlHours);
     }
     /**
      * Validate a single external link
@@ -79,6 +179,28 @@ export class ExternalLinkValidator {
      * @returns Validation result
      */
     async validateLink(url) {
+        // Authenticated branch (issue #113): if a provider in linkAuthConfig
+        // claims this URL's host, bypass markdown-link-check and do a direct
+        // authenticated fetch + per-§7 classify.
+        if (this.linkAuthConfig) {
+            const plan = resolveAuthenticatedUrl(url, this.linkAuthConfig, this.linkAuthDeps);
+            if ('fetchUrl' in plan) {
+                return this.validateAuthenticatedLink(url, plan);
+            }
+            if (plan.outcome === 'unverified') {
+                // Per §6.3: never cache unverified outcomes — the result flips the
+                // moment a token appears, so caching a "no token" result is wrong.
+                return {
+                    url,
+                    status: 'error',
+                    statusCode: 0,
+                    error: plan.reason,
+                    cached: false,
+                    code: 'LINK_AUTH_UNVERIFIED',
+                };
+            }
+            // 'unsupported' → fall through to anonymous markdown-link-check path
+        }
         // Check cache first
         const cached = await this.cache.get(url);
         if (cached) {
@@ -119,6 +241,59 @@ export class ExternalLinkValidator {
     async validateLinks(urls) {
         return Promise.all(urls.map((url) => this.validateLink(url)));
     }
+    /**
+     * Issue an authenticated fetch for `originalUrl` using the engine's plan
+     * (rewritten URL + auth headers + provider's check config), classify the
+     * response per #113 §7, and write a status-cache entry. Cache is keyed by
+     * the *rewritten* URL (§6.3) — the original `blob/` URL 404s, so caching
+     * by original would poison results.
+     */
+    async validateAuthenticatedLink(originalUrl, plan) {
+        // Cache check, keyed by rewritten URL. IMPORTANT: re-classify the cached
+        // statusCode under the *current* run's provider `check` block, rather
+        // than treating cache-hit as a status-only short-circuit. The cache
+        // only persists `statusCode` — without re-classifying we'd drop the
+        // LINK_AUTH_* `code`, and the consumer would fall back to
+        // `EXTERNAL_URL_DEAD` (error) instead of `LINK_AUTH_DEAD_OR_UNAUTHORIZED`
+        // (warning). Cache-hit semantics must match cache-miss semantics for
+        // the same (url, provider) pair.
+        const cached = await this.authCache.get(plan.fetchUrl);
+        if (cached) {
+            return buildAuthResult(originalUrl, cached.statusCode, plan, true, cached.statusMessage);
+        }
+        // Fresh fetch via the auth-aware transport (handles cross-origin redirect
+        // Authorization stripping + 429/Retry-After per §5.2 §8). The conditional
+        // spread builds the object in one pass — AuthTransportOptions.sleep is
+        // readonly so post-construction assignment would be a TS error.
+        const transportOptions = {
+            signal: AbortSignal.timeout(this.options.timeout),
+            ...(this.sleep === undefined ? {} : { sleep: this.sleep }),
+        };
+        let response;
+        try {
+            response = await authTransport(plan.fetchUrl, plan.headers, this.fetchImpl, transportOptions);
+        }
+        catch (err) {
+            // Network-level failure (DNS/connect/TLS/timeout) — return error with
+            // no code so the consumer's existing statusCode→IssueCode mapping
+            // (EXTERNAL_URL_ERROR / EXTERNAL_URL_TIMEOUT) applies.
+            const message = safeSerializeError(err) ?? 'Authenticated fetch failed';
+            return {
+                url: originalUrl,
+                status: 'error',
+                statusCode: 0,
+                error: message,
+                cached: false,
+            };
+        }
+        const result = buildAuthResult(originalUrl, response.status, plan, false);
+        // Persist by rewritten URL so subsequent runs hit the cache. The cache
+        // only stores statusCode + statusMessage; the `code` is re-derived on
+        // read by re-running classifyAuthenticatedResponse against the current
+        // provider (see the authCache.get branch above).
+        await this.authCache.set(plan.fetchUrl, result.statusCode, result.error ?? 'OK');
+        return result;
+    }
     /**
      * Check a link using markdown-link-check
      */
@@ -179,16 +354,21 @@ export class ExternalLinkValidator {
         });
     }
     /**
-     * Clear the validation cache
+     * Clear both validation caches (anonymous + authenticated).
+     *
+     * Adopters call this after rotating a token or invalidating link data —
+     * the operation must wipe both surfaces or stale auth results survive
+     * (a real bug: a 401 cached under the old token would haunt the new one).
      */
     async clearCache() {
-        await this.cache.clear();
+        await Promise.all([this.cache.clear(), this.authCache.clear()]);
     }
     /**
-     * Get cache statistics
+     * Get combined cache statistics across both caches.
      */
     async getCacheStats() {
-        return this.cache.getStats();
+        const [anon, auth] = await Promise.all([this.cache.getStats(), this.authCache.getStats()]);
+        return { total: anon.total + auth.total, expired: anon.expired + auth.expired };
     }
 }
 //# sourceMappingURL=external-link-validator.js.map

package/dist/external-link-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-link-validator.js","sourceRoot":"","sources":["../src/external-link-validator.ts"],"names":[],"mappings":"AAAA,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,iEAAiE;QACjE,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAChC,CAAC;IAED,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QAC1B,0DAA0D;QAC1D,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACxC,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvC,mDAAmD;QACnD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACzB,kDAAkD;YAClD,MAAM,GAAG,GAAI,GAA6B,CAAC,OAAO,CAAC;YACnD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;QACtE,CAAC;QACD,OAAO,UAAU,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,iDAAiD;QACjD,+CAA+C;QAC/C,MAAM,GAAG,GAAI,GAA6B,CAAC,OAAO,CAAC;QACnD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC;IAC/E,CAAC;AACF,CAAC;AAgCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAoB;IACzB,OAAO,CAAyC;IAEjE;;;;;OAKG;IACH,YAAY,QAAgB,EAAE,UAAwC,EAAE;QACvE,IAAI,CAAC,OAAO,GAAG;YACd,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC;YAC7B,SAAS,EACR,OAAO,CAAC,SAAS;gBACjB,+FAA+F;SAChG,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC7B,oBAAoB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;YAEjE,4EAA4E;YAC5E,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO;oBACN,GAAG;oBACH,MAAM,EAAE,IAAa;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,IAAI;iBACZ,CAAC;YACH,CAAC;YAED,0CAA0C;YAC1C,OAAO;gBACN,GAAG;gBACH,MAAM,EAAE,OAAgB;gBACxB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,MAAM,CAAC,aAAa;aAC3B,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEzC,iBAAiB;QACjB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QAEnE,OAAO;YACN,GAAG,MAAM;YACT,MAAM,EAAE,KAAK;SACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,IAAc;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CACtB,GAAW;QAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,UAAU,GAAG,GAAG,CAAC;YAElC,iBAAiB,CAChB,QAAQ,EACR;gBACC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI;gBACpC,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;gBAChC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBAChD,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE;oBACZ;wBACC,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE;4BACR,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;yBACpC;qBACD;iBACD;aACD,EACD,CAAC,KAAmB,EAAE,OAAmG,EAAE,EAAE;gBAC5H,IAAI,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,CAAC;wBACb,KAAK,EAAE,KAAK,CAAC,OAAO;qBACpB,CAAC,CAAC;oBACH,OAAO;gBACR,CAAC;gBAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,CAAC;wBACb,KAAK,EAAE,oCAAoC;qBAC3C,CAAC,CAAC;oBACH,OAAO;gBACR,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC7B,CAAC,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACP,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,gBAAgB,MAAM,CAAC,MAAM,EAAE,CAAC;oBAEvF,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,KAAK,EAAE,YAAY;qBACnB,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC,CACD,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACf,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC9B,CAAC;CACD"}
+{"version":3,"file":"external-link-validator.js","sourceRoot":"","sources":["../src/external-link-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,EACL,uBAAuB,EACvB,QAAQ,GAGT,MAAM,2BAA2B,CAAC;AACnC,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAqB,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD;;;;GAIG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,8BAA8B;IAChC,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,uEAAuE;IACvE,iEAAiE;IACjE,oEAAoE;IACpE,sEAAsE;IACtE,2BAA2B,EAAE,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,SAAS,2BAA2B;IAClC,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,IAAI,CACV,yFAAyF;QACvF,4FAA4F;QAC5F,oDAAoD,CACvD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAID;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,WAAmB,EACnB,UAAkB,EAClB,IAAkB,EAClB,MAAe,EACf,mBAA4B;IAE5B,MAAM,UAAU,GAAG,6BAA6B,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,MAAM,MAAM,GAAyB;QACpC,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;QACxD,UAAU;QACV,MAAM;KACN,CAAC;IACF,IAAI,UAAU,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,GAAG,mBAAmB,IAAI,QAAQ,UAAU,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,iEAAiE;QACjE,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IAChC,CAAC;IAED,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QAC1B,0DAA0D;QAC1D,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACxC,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvC,mDAAmD;QACnD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACzB,kDAAkD;YAClD,MAAM,GAAG,GAAI,GAA6B,CAAC,OAAO,CAAC;YACnD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;QACtE,CAAC;QACD,OAAO,UAAU,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,iDAAiD;QACjD,+CAA+C;QAC/C,MAAM,GAAG,GAAI,GAA6B,CAAC,OAAO,CAAC;QACnD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC;IAC/E,CAAC;AACF,CAAC;AA+ED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,qBAAqB;IAChB,KAAK,CAAoB;IAC1C;;;;;OAKG;IACc,SAAS,CAAoB;IAC7B,OAAO,CAKtB;IACe,cAAc,CAA6B;IAC3C,SAAS,CAAe;IACxB,YAAY,CAAe;IAC3B,KAAK,CAA8C;IAEpE;;;;;OAKG;IACH,YAAY,QAAgB,EAAE,UAAwC,EAAE;QACvE,IAAI,CAAC,OAAO,GAAG;YACd,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC;YAC7B,SAAS,EACR,OAAO,CAAC,SAAS;gBACjB,+FAA+F;SAChG,CAAC;QAEF,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACvD,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,yEAAyE;QACzE,IAAI,CAAC,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE3B,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEzE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,MAAM,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC7B,qEAAqE;QACrE,qEAAqE;QACrE,yCAAyC;QACzC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACnC,mEAAmE;gBACnE,mEAAmE;gBACnE,OAAO;oBACN,GAAG;oBACH,MAAM,EAAE,OAAO;oBACf,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,IAAI,CAAC,MAAM;oBAClB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB;iBAC5B,CAAC;YACH,CAAC;YACD,qEAAqE;QACtE,CAAC;QAED,oBAAoB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;YAEjE,4EAA4E;YAC5E,IAAI,IAAI,EAAE,CAAC;gBACV,OAAO;oBACN,GAAG;oBACH,MAAM,EAAE,IAAa;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,IAAI;iBACZ,CAAC;YACH,CAAC;YAED,0CAA0C;YAC1C,OAAO;gBACN,GAAG;gBACH,MAAM,EAAE,OAAgB;gBACxB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,MAAM,CAAC,aAAa;aAC3B,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEzC,iBAAiB;QACjB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QAEnE,OAAO;YACN,GAAG,MAAM;YACT,MAAM,EAAE,KAAK;SACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,IAAc;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,yBAAyB,CACtC,WAAmB,EACnB,IAAkB;QAElB,yEAAyE;QACzE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,0DAA0D;QAC1D,0EAA0E;QAC1E,qEAAqE;QACrE,iCAAiC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1F,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,gBAAgB,GAAwC;YAC7D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAC1D,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,aAAa,CAC7B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,gBAAgB,CAChB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,kEAAkE;YAClE,uDAAuD;YACvD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,4BAA4B,CAAC;YACxE,OAAO;gBACN,GAAG,EAAE,WAAW;gBAChB,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,KAAK;aACb,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1E,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,iDAAiD;QACjD,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CACtB,GAAW;QAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9B,MAAM,QAAQ,GAAG,UAAU,GAAG,GAAG,CAAC;YAElC,iBAAiB,CAChB,QAAQ,EACR;gBACC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI;gBACpC,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;gBAChC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBAChD,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE;oBACZ;wBACC,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE;4BACR,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;yBACpC;qBACD;iBACD;aACD,EACD,CAAC,KAAmB,EAAE,OAAmG,EAAE,EAAE;gBAC5H,IAAI,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,CAAC;wBACb,KAAK,EAAE,KAAK,CAAC,OAAO;qBACpB,CAAC,CAAC;oBACH,OAAO;gBACR,CAAC;gBAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,CAAC;wBACb,KAAK,EAAE,oCAAoC;qBAC3C,CAAC,CAAC;oBACH,OAAO;gBACR,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBAC/B,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC7B,CAAC,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACP,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,gBAAgB,MAAM,CAAC,MAAM,EAAE,CAAC;oBAEvF,OAAO,CAAC;wBACP,GAAG;wBACH,MAAM,EAAE,OAAO;wBACf,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,KAAK,EAAE,YAAY;qBACnB,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC,CACD,CAAC;QACH,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU;QACf,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QAClB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IACjF,CAAC;CACD"}

package/dist/index.d.ts

@@ -44,4 +44,8 @@ export { openFrontmatter, FrontmatterParseError, type FrontmatterEditor, } from
 export { rewriteFrontmatterUriReferencesFromSchema, rewriteFrontmatterFieldsAtPaths, rewriteBodyLinks, type RewriteHref, } from './rewriter-helpers.js';
 export { parseConfigFile, loadConfig, } from './config-parser.js';
 export { ProjectConfigSchema, SkillFileEntrySchema, SkillsConfigSchema, SkillPackagingConfigSchema, SkillSourceDescriptorSchema, TestConfigSchema, type SkillSourceDescriptor, type TestConfig, } from './schemas/project-config.js';
+export { fetchAuthenticated, type ContentFetchResult, type FetchAuthenticatedOptions, } from './link-auth-content-fetch.js';
+export { ContentCache, type ContentMetadata } from './content-cache.js';
+export { wrapLinkAuthDepsWithMemo, type LinkAuthDeps, } from './link-auth-deps-memo.js';
+export { buildLinkAuthEngineConfig } from './link-auth-config-build.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,YAAY,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAGtF,YAAY,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAKjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAG3E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,yCAAyC,EACzC,+BAA+B,EAC/B,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,eAAe,EACf,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,GAChB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,YAAY,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAGtF,YAAY,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,YAAY,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAKjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAG3E,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,yCAAyC,EACzC,+BAA+B,EAC/B,gBAAgB,EAChB,KAAK,WAAW,GACjB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,eAAe,EACf,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,GAChB,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EACL,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,GAC/B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAKxE,OAAO,EACL,wBAAwB,EACxB,KAAK,YAAY,GAClB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -57,4 +57,16 @@ export { rewriteFrontmatterUriReferencesFromSchema, rewriteFrontmatterFieldsAtPa
 // Export project config parsing
 export { parseConfigFile, loadConfig, } from './config-parser.js';
 export { ProjectConfigSchema, SkillFileEntrySchema, SkillsConfigSchema, SkillPackagingConfigSchema, SkillSourceDescriptorSchema, TestConfigSchema, } from './schemas/project-config.js';
+// linkAuth content-fetch primitive (issue #113 slice 3). Ships standalone;
+// callers wire it into asset-reference / bundling consumers as they need.
+export { fetchAuthenticated, } from './link-auth-content-fetch.js';
+export { ContentCache } from './content-cache.js';
+// Token-resolution memo wrapper. High-volume callers iterating many URLs
+// from the same provider wrap their deps once and reuse the result, so
+// expensive token sources (`gh auth token` etc.) run at most once.
+export { wrapLinkAuthDepsWithMemo, } from './link-auth-deps-memo.js';
+// Bridge from adopter `resources.linkAuth` (Zod-validated) to the engine's
+// `LinkAuthConfig` (fully-expanded providers). Adopters carrying a parsed
+// config can hand it directly to `fetchAuthenticated` via this bridge.
+export { buildLinkAuthEngineConfig } from './link-auth-config-build.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,+DAA+D;AAC/D,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,wBAAwB,CAAC;AAEhC,yDAAyD;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,oFAAoF;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA2B9D,qFAAqF;AACrF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,iDAAiD;AACjD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,gCAAgC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,qDAAqD;AACrD,OAAO,EACL,gBAAgB,GAKjB,MAAM,wBAAwB,CAAC;AAEhC,kEAAkE;AAClE,0EAA0E;AAE1E,2EAA2E;AAC3E,OAAO,EAAE,gBAAgB,EAA+B,MAAM,YAAY,CAAC;AAE3E,sEAAsE;AACtE,OAAO,EACL,eAAe,EACf,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EACL,yCAAyC,EACzC,+BAA+B,EAC/B,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,gCAAgC;AAChC,OAAO,EACL,eAAe,EACf,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAGjB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,+DAA+D;AAC/D,OAAO,EACL,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,wBAAwB,CAAC;AAEhC,yDAAyD;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,oFAAoF;AACpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA2B9D,qFAAqF;AACrF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,iDAAiD;AACjD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AAElG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAE9E,gCAAgC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,qDAAqD;AACrD,OAAO,EACL,gBAAgB,GAKjB,MAAM,wBAAwB,CAAC;AAEhC,kEAAkE;AAClE,0EAA0E;AAE1E,2EAA2E;AAC3E,OAAO,EAAE,gBAAgB,EAA+B,MAAM,YAAY,CAAC;AAE3E,sEAAsE;AACtE,OAAO,EACL,eAAe,EACf,qBAAqB,GAEtB,MAAM,yBAAyB,CAAC;AAEjC,+EAA+E;AAC/E,OAAO,EACL,yCAAyC,EACzC,+BAA+B,EAC/B,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAE/B,gCAAgC;AAChC,OAAO,EACL,eAAe,EACf,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAGjB,MAAM,6BAA6B,CAAC;AAErC,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EACL,kBAAkB,GAGnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,YAAY,EAAwB,MAAM,oBAAoB,CAAC;AAExE,yEAAyE;AACzE,uEAAuE;AACvE,mEAAmE;AACnE,OAAO,EACL,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAElC,2EAA2E;AAC3E,0EAA0E;AAC1E,uEAAuE;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/link-auth-classify.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Classify a response from an authenticated external-link fetch into one of
+ * the outcomes defined in design issue #113 §7.
+ *
+ * Pure function: takes the HTTP status from a completed fetch plus the
+ * matched provider's `check` block, returns the outcome name and the matching
+ * `LINK_AUTH_*` code from `CODE_REGISTRY`. Pre-fetch outcomes (`unsupported`,
+ * `unverified`) are produced upstream by `resolveAuthenticatedUrl` and never
+ * reach this classifier.
+ *
+ * Status codes that don't match any classified outcome return `null` — the
+ * caller falls through to the existing anonymous `EXTERNAL_URL_DEAD` path
+ * (per §7 "unsupported"), since the authenticated fetch produced no signal
+ * the per-provider table can speak to.
+ */
+import type { ProviderCheck } from '@vibe-agent-toolkit/utils';
+export type LinkAuthOutcome = {
+    readonly outcome: 'alive';
+    readonly code: null;
+} | {
+    readonly outcome: 'dead';
+    readonly code: 'LINK_AUTH_DEAD';
+} | {
+    readonly outcome: 'dead_or_unauthorized';
+    readonly code: 'LINK_AUTH_DEAD_OR_UNAUTHORIZED';
+} | {
+    readonly outcome: 'forbidden';
+    readonly code: 'LINK_AUTH_FORBIDDEN';
+} | {
+    readonly outcome: 'unauthorized';
+    readonly code: 'LINK_AUTH_UNAUTHORIZED';
+};
+export declare function classifyAuthenticatedResponse(status: number, check: ProviderCheck): LinkAuthOutcome | null;
+//# sourceMappingURL=link-auth-classify.d.ts.map

package/dist/link-auth-classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-auth-classify.d.ts","sourceRoot":"","sources":["../src/link-auth-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC7D;IACE,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC;CACjD,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAElF,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,aAAa,GACnB,eAAe,GAAG,IAAI,CA6BxB"}

package/dist/link-auth-classify.js

@@ -0,0 +1,42 @@
+/**
+ * Classify a response from an authenticated external-link fetch into one of
+ * the outcomes defined in design issue #113 §7.
+ *
+ * Pure function: takes the HTTP status from a completed fetch plus the
+ * matched provider's `check` block, returns the outcome name and the matching
+ * `LINK_AUTH_*` code from `CODE_REGISTRY`. Pre-fetch outcomes (`unsupported`,
+ * `unverified`) are produced upstream by `resolveAuthenticatedUrl` and never
+ * reach this classifier.
+ *
+ * Status codes that don't match any classified outcome return `null` — the
+ * caller falls through to the existing anonymous `EXTERNAL_URL_DEAD` path
+ * (per §7 "unsupported"), since the authenticated fetch produced no signal
+ * the per-provider table can speak to.
+ */
+export function classifyAuthenticatedResponse(status, check) {
+    // aliveStatus wins first: a provider can in principle declare any code as
+    // alive (e.g. a future host where 204 means alive), so the membership test
+    // runs before the well-known-status branches.
+    if (check.aliveStatus.includes(status)) {
+        return { outcome: 'alive', code: null };
+    }
+    if (status === 401) {
+        return { outcome: 'unauthorized', code: 'LINK_AUTH_UNAUTHORIZED' };
+    }
+    if (status === 403) {
+        return { outcome: 'forbidden', code: 'LINK_AUTH_FORBIDDEN' };
+    }
+    if (status === 404 || status === 410) {
+        if (check.notFoundMeaning === 'dead') {
+            return { outcome: 'dead', code: 'LINK_AUTH_DEAD' };
+        }
+        return {
+            outcome: 'dead_or_unauthorized',
+            code: 'LINK_AUTH_DEAD_OR_UNAUTHORIZED',
+        };
+    }
+    // 2xx not in aliveStatus, 3xx redirects, 429 rate-limit, 5xx server errors
+    // — none of these are classified per §7. Caller decides what to do.
+    return null;
+}
+//# sourceMappingURL=link-auth-classify.js.map

package/dist/link-auth-classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-auth-classify.js","sourceRoot":"","sources":["../src/link-auth-classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH,MAAM,UAAU,6BAA6B,CAC3C,MAAc,EACd,KAAoB;IAEpB,0EAA0E;IAC1E,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACrD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE,gCAAgC;SACvC,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,oEAAoE;IACpE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/link-auth-config-build.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bridge between the adopter-facing linkAuth config (Zod-validated, with
+ * macro references) and the engine-facing config (fully-expanded providers).
+ *
+ * Adopter config providers can be either:
+ *   - `{ use: <macro>, ...overrides }` — reference a shipped macro; deep-merge
+ *     `overrides` on top of the macro's defaults
+ *   - A full inline `{ match, rewrite, auth, token, check }` — used as-is
+ *
+ * This function walks each provider entry, runs macro expansion when needed,
+ * and re-validates each fully-expanded provider against `InlineProviderSchema`.
+ * Since the schemas are passthrough (per the repo Postel's Law rule for
+ * adopter input), unknown extra keys survive expansion silently — the engine
+ * ignores them at runtime, and a separate lint/warn pass is the right home
+ * for typo-catching DX. Post-expansion validation still catches the cases
+ * passthrough doesn't relax: missing required fields, and wrong types on
+ * declared fields (e.g. `notFoundMeaning: 'totally-invalid'`).
+ *
+ * Per design issue #113 §5 (macros are config, not a privileged code path)
+ * and §4 (engine vocabulary).
+ */
+import { type LinkAuthConfig, type Provider } from '@vibe-agent-toolkit/utils';
+import { InlineProviderSchema, type LinkAuthProjectConfig } from './schemas/link-auth.js';
+/**
+ * Compile-time drift defense: top-level field sets must match between the
+ * Zod schema and the engine's `Provider` interface. A strict structural
+ * check would also catch sub-type drift, but TS variance (readonly arrays in
+ * engine vs mutable in Zod inference) makes that noisy — the realistic
+ * drift mode is adding/renaming a top-level field on one side and forgetting
+ * the other, which this top-level key comparison catches at `tsc` time.
+ *
+ * The schema and engine type are kept in sync by review (per slice 1 design
+ * decision); this guard makes that review easier.
+ */
+type _SchemaKeys = keyof typeof InlineProviderSchema.shape;
+type _EngineKeys = keyof Provider;
+type _KeysAgree = [_SchemaKeys] extends [_EngineKeys] ? [_EngineKeys] extends [_SchemaKeys] ? true : {
+    error: 'engine Provider has a field that InlineProviderSchema lacks';
+    missing: Exclude<_EngineKeys, _SchemaKeys>;
+} : {
+    error: 'InlineProviderSchema has a field that engine Provider lacks';
+    missing: Exclude<_SchemaKeys, _EngineKeys>;
+};
+export declare const _assertSchemaKeysAgreeWithEngine: _KeysAgree;
+export declare function buildLinkAuthEngineConfig(adopter: LinkAuthProjectConfig): LinkAuthConfig;
+export {};
+//# sourceMappingURL=link-auth-config-build.d.ts.map

package/dist/link-auth-config-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-auth-config-build.d.ts","sourceRoot":"","sources":["../src/link-auth-config-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACd,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,oBAAoB,EAAE,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE1F;;;;;;;;;;GAUG;AAKH,KAAK,WAAW,GAAG,MAAM,OAAO,oBAAoB,CAAC,KAAK,CAAC;AAC3D,KAAK,WAAW,GAAG,MAAM,QAAQ,CAAC;AAClC,KAAK,UAAU,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,GACjD,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,GACjC,IAAI,GACJ;IAAE,KAAK,EAAE,6DAA6D,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;CAAE,GACtH;IAAE,KAAK,EAAE,6DAA6D,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;CAAE,CAAC;AAIzH,eAAO,MAAM,gCAAgC,EAAE,UAAiB,CAAC;AAEjE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAaxF"}

package/dist/link-auth-config-build.js

@@ -0,0 +1,86 @@
+/**
+ * Bridge between the adopter-facing linkAuth config (Zod-validated, with
+ * macro references) and the engine-facing config (fully-expanded providers).
+ *
+ * Adopter config providers can be either:
+ *   - `{ use: <macro>, ...overrides }` — reference a shipped macro; deep-merge
+ *     `overrides` on top of the macro's defaults
+ *   - A full inline `{ match, rewrite, auth, token, check }` — used as-is
+ *
+ * This function walks each provider entry, runs macro expansion when needed,
+ * and re-validates each fully-expanded provider against `InlineProviderSchema`.
+ * Since the schemas are passthrough (per the repo Postel's Law rule for
+ * adopter input), unknown extra keys survive expansion silently — the engine
+ * ignores them at runtime, and a separate lint/warn pass is the right home
+ * for typo-catching DX. Post-expansion validation still catches the cases
+ * passthrough doesn't relax: missing required fields, and wrong types on
+ * declared fields (e.g. `notFoundMeaning: 'totally-invalid'`).
+ *
+ * Per design issue #113 §5 (macros are config, not a privileged code path)
+ * and §4 (engine vocabulary).
+ */
+import { expandMacro, } from '@vibe-agent-toolkit/utils';
+import { InlineProviderSchema } from './schemas/link-auth.js';
+// Type-level assert: the declaration must compile to `true` (i.e. both
+// directions of the key-set check pass). The exported function holds a
+// reference to the type so noUnusedLocals doesn't fire.
+export const _assertSchemaKeysAgreeWithEngine = true;
+export function buildLinkAuthEngineConfig(adopter) {
+    const providers = adopter.providers.map((entry, index) => expandProviderEntry(entry, index));
+    // Pass the cache block through to the engine config so the slice-3
+    // content-fetch primitive can read `ttlMinutes` from the same source of
+    // truth as the rest of the engine config. The engine itself doesn't consume
+    // this field — it stays stateless — but riding along on the config keeps
+    // callers from having to pass two objects to the primitive.
+    if (adopter.cache !== undefined) {
+        return { providers, cache: buildEngineCache(adopter.cache) };
+    }
+    return { providers };
+}
+function buildEngineCache(adopterCache) {
+    // Schema is passthrough so adopterCache may carry forward-compatible extras
+    // we don't know about — copy only the fields the engine type declares.
+    return adopterCache.ttlMinutes === undefined ? {} : { ttlMinutes: adopterCache.ttlMinutes };
+}
+function expandProviderEntry(entry, index) {
+    // Discriminate via Object.hasOwn (not `'use' in entry`) so a prototype-
+    // injected `use` cannot reroute an inline entry into macro expansion. The
+    // Zod parser already produces plain JSON-shaped objects, but defending in
+    // depth costs nothing.
+    const isMacroRef = typeof entry === 'object' &&
+        entry !== null &&
+        Object.hasOwn(entry, 'use');
+    if (!isMacroRef) {
+        return entry;
+    }
+    const { use, overrides } = splitMacroEntry(entry);
+    const expanded = expandMacro(use, overrides);
+    // Re-validate the fully-expanded shape. Unknown extra keys pass through
+    // (the engine ignores them); what we still catch are missing required
+    // fields and wrong types on declared fields — e.g. a macro override that
+    // sets `check.notFoundMeaning: 'bogus'` is rejected here even though the
+    // upstream macro schema's passthrough accepted it.
+    const parsed = InlineProviderSchema.safeParse(expanded);
+    if (!parsed.success) {
+        throw new Error(`linkAuth providers[${index}] (use: ${JSON.stringify(use)}) ` +
+            `produced an invalid provider after macro expansion: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
+function splitMacroEntry(entry) {
+    // `use` value comes from a Zod-validated source so the type is string at
+    // this point — but defensively-check it anyway: `Object.hasOwn` upstream
+    // tells us the key exists, not what its value's type is.
+    const useValue = entry['use'];
+    if (typeof useValue !== 'string') {
+        throw new TypeError(`linkAuth provider \`use\` must be a string, got ${typeof useValue}`);
+    }
+    const overrides = {};
+    for (const [key, value] of Object.entries(entry)) {
+        if (key === 'use')
+            continue;
+        overrides[key] = value;
+    }
+    return { use: useValue, overrides };
+}
+//# sourceMappingURL=link-auth-config-build.js.map

package/dist/link-auth-config-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-auth-config-build.js","sourceRoot":"","sources":["../src/link-auth-config-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,WAAW,GAGZ,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,oBAAoB,EAA8B,MAAM,wBAAwB,CAAC;AAwB1F,uEAAuE;AACvE,uEAAuE;AACvE,wDAAwD;AACxD,MAAM,CAAC,MAAM,gCAAgC,GAAe,IAAI,CAAC;AAEjE,MAAM,UAAU,yBAAyB,CAAC,OAA8B;IACtE,MAAM,SAAS,GAAe,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACnE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAClC,CAAC;IACF,mEAAmE;IACnE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,4DAA4D;IAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,gBAAgB,CACvB,YAAyD;IAEzD,4EAA4E;IAC5E,uEAAuE;IACvE,OAAO,YAAY,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,UAAU,GACd,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAE9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,KAAgC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE7C,wEAAwE;IACxE,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI;YAC3D,uDAAuD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAgB,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IAIrD,yEAAyE;IACzE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,mDAAmD,OAAO,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,KAAK;YAAE,SAAS;QAC5B,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC"}

package/dist/link-auth-content-fetch.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Public content-fetch primitive for the linkAuth feature (design issue #113 §6.2).
+ *
+ * Ships as a standalone primitive — no consumer wiring (asset-references,
+ * bundling) lands in this slice. The shape and security disciplines are
+ * designed so future callers can adopt it without reworking the contract.
+ *
+ * Responsibility split:
+ *   - `resolveAuthenticatedUrl` (engine): pick provider, rewrite URL, resolve
+ *     token, expand auth.headers AND fetch.headers against the same context.
+ *   - `ContentCache`: persist `(bytes, metadata)` keyed by rewritten URL with
+ *     30-min default TTL; whitelists fields so tokens cannot be persisted.
+ *   - `authTransport`: cross-origin auth strip, 429/Retry-After handling.
+ *   - **This primitive**: wire them together, decide cache vs fetch, build
+ *     metadata, return a typed result.
+ *
+ * Behavior matrix:
+ *   - Engine returns `unsupported` → return as-is, no fetch, no cache touch.
+ *   - Engine returns `unverified` → return as-is, no fetch, **no cache touch**
+ *     even if a cache was supplied (§6.3: result flips when a token appears,
+ *     so caching the no-token answer would poison future runs).
+ *   - Engine returns success + cache present + not forceRefresh + cache hit →
+ *     return `{ bytes, metadata, cached: true }`, no fetch.
+ *   - Engine returns success otherwise → fetch via `authTransport` (using
+ *     `fetch.headers` merged over `auth.headers` when present), write to
+ *     cache if supplied, return `{ bytes, metadata, cached: false }`.
+ *
+ * **Throws** on network-level failures from the transport: DNS resolution
+ * failure, TLS handshake failure, connection refused, `AbortError` from the
+ * caller's `signal`, or any underlying `fetchImpl` rejection. The cache is
+ * only touched after the response body is fully read, so a transport failure
+ * cannot land a partial entry on disk. Consumers that need degradation
+ * semantics (validators, batch tools) should wrap calls in a try/catch.
+ *
+ * **Token never persisted.** Tokens are interpolated into headers in-memory;
+ * the metadata interface excludes header fields. The cache additionally
+ * whitelists the metadata fields it accepts. See cycle-6 token-persistence
+ * test for the on-disk assertion.
+ *
+ * **High-volume callers**: token resolution can be expensive (`gh auth token`
+ * spawns a subprocess). Callers iterating many URLs should wrap their `deps`
+ * once with `wrapLinkAuthDepsWithMemo` from `./link-auth-deps-memo.js` and
+ * pass the wrapped object to every invocation, so the same argv resolves at
+ * most once across the iteration.
+ */
+import { type LinkAuthConfig } from '@vibe-agent-toolkit/utils';
+import { type ContentCache, type ContentMetadata } from './content-cache.js';
+import { type LinkAuthDeps } from './link-auth-deps-memo.js';
+import { type AuthTransportOptions } from './link-auth-transport.js';
+export interface FetchAuthenticatedOptions {
+    /** Content cache to read from and write to. Omit to skip caching entirely. */
+    readonly cache?: ContentCache;
+    /** Bypass cache reads (still writes through on success). Default: false. */
+    readonly forceRefresh?: boolean;
+    /** Test/DI hook. Default: `globalThis.fetch`. */
+    readonly fetchImpl?: typeof fetch;
+    /** Token-resolution dependencies (env map, runCommand). Default: engine defaults. */
+    readonly deps?: LinkAuthDeps;
+    /** Propagated to the transport — caller's per-request timeout budget. */
+    readonly signal?: AbortSignal;
+    /** Per-call overrides for the transport's redirect / retry caps. */
+    readonly transportOptions?: AuthTransportOptions;
+}
+export type ContentFetchResult = {
+    readonly bytes: Uint8Array;
+    readonly metadata: ContentMetadata;
+    readonly cached: boolean;
+} | {
+    readonly outcome: 'unsupported';
+} | {
+    readonly outcome: 'unverified';
+    readonly reason: string;
+};
+export declare function fetchAuthenticated(url: string, config: LinkAuthConfig, options?: FetchAuthenticatedOptions): Promise<ContentFetchResult>;
+//# sourceMappingURL=link-auth-content-fetch.d.ts.map

package/dist/link-auth-content-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-auth-content-fetch.d.ts","sourceRoot":"","sources":["../src/link-auth-content-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEzF,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEpF,MAAM,WAAW,yBAAyB;IACxC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;CAClD;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,kBAAkB,CAAC,CAiE7B"}