@vibe-agent-toolkit/utils 0.1.39-rc.1 → 0.1.39-rc.10

package/dist/git-url.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Parsed representation of a git URL accepted by `vat audit`.
+ *
+ * - `cloneUrl` is the URL passed to `git clone` (after stripping ref/subpath
+ *   fragments and after expanding GitHub shorthand to a full HTTPS URL).
+ * - `ref` is an optional branch or tag name (deep commit SHAs are not
+ *   guaranteed to work with shallow clone — see design spec for details).
+ * - `subpath` is an optional subdirectory within the cloned repo to audit.
+ */
+export interface ParsedGitUrl {
+    cloneUrl: string;
+    ref?: string;
+    subpath?: string;
+}
+/**
+ * Parse a string into a {@link ParsedGitUrl}.
+ *
+ * Accepted forms:
+ *  - `https://host/owner/repo.git`
+ *  - `https://host/owner/repo.git#ref`
+ *  - `https://host/owner/repo.git#ref:subpath`
+ *  - `https://github.com/owner/repo/tree/<ref>/<subpath>` (GitHub web URL)
+ *  - `owner/repo` (GitHub shorthand → expanded to HTTPS)
+ *  - `git@host:owner/repo.git`
+ *  - `ssh://git@host/owner/repo.git`
+ *
+ * Throws on malformed input.
+ */
+export declare function parseGitUrl(input: string): ParsedGitUrl;
+/**
+ * Detect whether a string should be treated as a git URL (for the polymorphic
+ * `[git-url-or-path]` audit argument). True for:
+ *  - http(s):// URLs
+ *  - ssh:// URLs
+ *  - file:// URLs (used by integration tests against local bare repos)
+ *  - git@host:path scp-style URLs
+ *  - GitHub shorthand `owner/repo` (strict — no extensions, no extra slashes)
+ *
+ * Everything else (including relative paths like `./foo/bar`, absolute paths,
+ * and multi-segment paths like `foo/bar/baz`) is treated as a filesystem path.
+ */
+export declare function isGitUrl(input: string): boolean;
+//# sourceMappingURL=git-url.d.ts.map

package/dist/git-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-url.d.ts","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAgEvD;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAmB/C"}

package/dist/git-url.js

@@ -0,0 +1,135 @@
+/**
+ * Split a URL with an optional `#ref[:subpath]` fragment into the base URL
+ * and fragment components. Keeps the fragment-handling logic local so the
+ * per-form regexes can stay simple and anchored.
+ */
+function splitFragment(input) {
+    const hashIndex = input.indexOf('#');
+    if (hashIndex === -1) {
+        return { base: input };
+    }
+    const base = input.slice(0, hashIndex);
+    const fragment = input.slice(hashIndex + 1);
+    const colonIndex = fragment.indexOf(':');
+    if (colonIndex === -1) {
+        return { base, ref: fragment };
+    }
+    return {
+        base,
+        ref: fragment.slice(0, colonIndex),
+        subpath: fragment.slice(colonIndex + 1),
+    };
+}
+/**
+ * Parse a string into a {@link ParsedGitUrl}.
+ *
+ * Accepted forms:
+ *  - `https://host/owner/repo.git`
+ *  - `https://host/owner/repo.git#ref`
+ *  - `https://host/owner/repo.git#ref:subpath`
+ *  - `https://github.com/owner/repo/tree/<ref>/<subpath>` (GitHub web URL)
+ *  - `owner/repo` (GitHub shorthand → expanded to HTTPS)
+ *  - `git@host:owner/repo.git`
+ *  - `ssh://git@host/owner/repo.git`
+ *
+ * Throws on malformed input.
+ */
+export function parseGitUrl(input) {
+    const trimmed = input.trim();
+    if (trimmed === '') {
+        throw new Error(`Invalid git URL or path: <empty>.`);
+    }
+    // file:// form: file:///path/to/repo[#ref[:subpath]] — used primarily by
+    // integration tests that clone a local bare repo. `git clone` accepts
+    // file:// natively.
+    if (trimmed.startsWith('file://')) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        return buildParsed(base, ref, subpath);
+    }
+    // HTTPS .git form: https://host/path.git[#ref[:subpath]]
+    if (/^https?:\/\//.test(trimmed)) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        if (base.endsWith('.git')) {
+            return buildParsed(base, ref, subpath);
+        }
+        // GitHub web URL: https://github.com/owner/repo/tree/<ref>[/<subpath>]
+        const ghWeb = 
+        // eslint-disable-next-line security/detect-unsafe-regex -- Anchored ^...$ with bounded character classes; the only variable-length group is the trailing subpath. Safe from ReDoS.
+        /^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/tree\/([^/]+)(?:\/(.+))?$/.exec(trimmed);
+        if (ghWeb) {
+            const owner = ghWeb[1] ?? '';
+            const repo = ghWeb[2] ?? '';
+            const webRef = ghWeb[3];
+            const webSubpath = ghWeb[4];
+            return buildParsed(`https://github.com/${owner}/${repo}.git`, webRef, webSubpath);
+        }
+    }
+    // SSH ssh:// form: ssh://git@host/path[#ref[:subpath]]
+    if (trimmed.startsWith('ssh://')) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        return buildParsed(base, ref, subpath);
+    }
+    // SSH scp-like form: git@host:owner/repo.git[#ref[:subpath]]
+    // Anchored, no alternation with nested quantifiers — safe from ReDoS.
+    if (/^[^@\s]+@[^:\s]+:[^#\s]+/.test(trimmed)) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        return buildParsed(base, ref, subpath);
+    }
+    // GitHub shorthand: owner/repo[#ref[:subpath]] (single slash in base)
+    const { base, ref, subpath } = splitFragment(trimmed);
+    const shorthand = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(base);
+    if (shorthand) {
+        const owner = shorthand[1] ?? '';
+        const repo = shorthand[2] ?? '';
+        return buildParsed(`https://github.com/${owner}/${repo}.git`, ref, subpath);
+    }
+    throw new Error(`Invalid git URL or path: ${input}. Accepted forms: ` +
+        `https://<host>/<owner>/<repo>.git, ` +
+        `git@<host>:<owner>/<repo>.git, ` +
+        `<owner>/<repo>, or a local filesystem path.`);
+}
+function buildParsed(cloneUrl, ref, subpath) {
+    const result = { cloneUrl };
+    if (ref !== undefined && ref !== '')
+        result.ref = ref;
+    if (subpath !== undefined && subpath !== '')
+        result.subpath = subpath;
+    return result;
+}
+/**
+ * Detect whether a string should be treated as a git URL (for the polymorphic
+ * `[git-url-or-path]` audit argument). True for:
+ *  - http(s):// URLs
+ *  - ssh:// URLs
+ *  - file:// URLs (used by integration tests against local bare repos)
+ *  - git@host:path scp-style URLs
+ *  - GitHub shorthand `owner/repo` (strict — no extensions, no extra slashes)
+ *
+ * Everything else (including relative paths like `./foo/bar`, absolute paths,
+ * and multi-segment paths like `foo/bar/baz`) is treated as a filesystem path.
+ */
+export function isGitUrl(input) {
+    const trimmed = input.trim();
+    if (trimmed === '')
+        return false;
+    if (/^https?:\/\//.test(trimmed))
+        return true;
+    if (trimmed.startsWith('ssh://'))
+        return true;
+    if (trimmed.startsWith('file://'))
+        return true;
+    // Match the same scp-style pattern parseGitUrl uses, including the
+    // requirement of a non-empty path segment after the colon. Without the
+    // trailing `[^#\s]+`, `isGitUrl` would accept inputs like `foo@host:`
+    // that parseGitUrl then rejects with a less-helpful error.
+    if (/^[^@\s]+@[^:\s]+:[^#\s]+/.test(trimmed))
+        return true;
+    // Strict GitHub shorthand: exactly two segments, no extension on second,
+    // no path separators beyond the single /. Strip any `#ref[:subpath]`
+    // fragment first so `owner/repo#main` and `owner/repo#main:sub` are
+    // recognized — `parseGitUrl` handles fragments uniformly across forms.
+    const hashIndex = trimmed.indexOf('#');
+    const base = hashIndex === -1 ? trimmed : trimmed.slice(0, hashIndex);
+    return /^[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+$/.test(base);
+}
+//# sourceMappingURL=git-url.js.map

package/dist/git-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-url.js","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,yDAAyD;IACzD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,uEAAuE;QACvE,MAAM,KAAK;QACT,mLAAmL;QACnL,yFAAyF,CAAC,IAAI,CAC5F,OAAO,CACR,CAAC;QACJ,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,6DAA6D;IAC7D,sEAAsE;IACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,sEAAsE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,KAAK,oBAAoB;QACnD,qCAAqC;QACrC,iCAAiC;QACjC,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,GAAY,EAAE,OAAgB;IACnE,MAAM,MAAM,GAAiB,EAAE,QAAQ,EAAE,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export * from './asset-reference.js';
 export * from './fs-utils.js';
 export * from './file-crawler.js';
 export * from './gitignore-checker.js';
+export * from './git-url.js';
 export * from './git-utils.js';
 export * from './project-utils.js';
 export * from './git-tracker.js';
@@ -17,4 +18,10 @@ export * from './test-helpers.js';
 export * from './zod-introspection.js';
 export * from './template.js';
 export * from './skill-targets.js';
+export { type LinkAuthConfig, type Provider, type ProviderAuth, type ProviderCheck, resolveAuthenticatedUrl, type ResolveOutcome, } from './link-auth/resolve.js';
+export type { ProviderMatch } from './link-auth/select-provider.js';
+export type { RewriteRule } from './link-auth/rewrite.js';
+export type { TokenSource } from './link-auth/resolve-token.js';
+export { expandMacro, UnknownMacroError } from './link-auth/expand-macro.js';
+export * from './skill-test/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAG/B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,gBAAgB,CAAC;AAI/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,eAAe,CAAC;AAG9B,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAG/B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAI/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,eAAe,CAAC;AAG9B,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAG7E,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -16,6 +16,8 @@ export * from './fs-utils.js';
 export * from './file-crawler.js';
 // Git ignore checking
 export * from './gitignore-checker.js';
+// Git URL parsing (parse/detect git URLs, GitHub shorthand, SSH forms)
+export * from './git-url.js';
 // Git utilities (using git commands directly)
 export * from './git-utils.js';
 // Project root discovery (canonical: config → git → null).
@@ -31,4 +33,10 @@ export * from './zod-introspection.js';
 export * from './template.js';
 // Skill target resolution (cross-platform flat skill install paths)
 export * from './skill-targets.js';
+// linkAuth pure engine — public API only (issue #113).
+// Internal helpers (rewrite, build-headers, etc.) stay module-private.
+export { resolveAuthenticatedUrl, } from './link-auth/resolve.js';
+export { expandMacro, UnknownMacroError } from './link-auth/expand-macro.js';
+// Skill testing utilities (environment management for headless agent runs)
+export * from './skill-test/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,uBAAuB;AACvB,cAAc,eAAe,CAAC;AAE9B,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,uBAAuB;AACvB,cAAc,eAAe,CAAC;AAE9B,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,uEAAuE;AACvE,cAAc,cAAc,CAAC;AAE7B,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,uDAAuD;AACvD,uEAAuE;AACvE,OAAO,EAKL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,2EAA2E;AAC3E,cAAc,uBAAuB,CAAC"}

package/dist/link-auth/build-headers.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Render auth-header templates with rendered values, and a structural
+ * redaction helper for serialization.
+ *
+ * `buildHeaders` renders each header value template against a context that
+ * carries `${token}` plus any named captures / vars from the rewrite step.
+ * `redactHeaders` masks `Authorization` values for any caller that needs to
+ * serialize headers into logs, errors, or cache entries — the design's §8
+ * "tokens never leak" claim depends on every such site routing through this.
+ *
+ * Per design issue #113 §4 (auth.headers vocabulary) and §8 (redaction is
+ * structural; Authorization values never appear in serialized output).
+ */
+export declare const REDACTED_VALUE = "<redacted>";
+/**
+ * Render a map of header templates into a map of concrete header values.
+ *
+ * @throws {TemplateMissingVarError} if a header template references an
+ *   unknown context key
+ * @throws {TemplateSyntaxError} from a malformed template expression
+ * @throws {UnknownTransformError} from a template calling an unknown transform
+ */
+export declare function buildHeaders(templates: Record<string, string>, context: Record<string, string>): Record<string, string>;
+/**
+ * Return a copy of `headers` with sensitive values replaced by `REDACTED_VALUE`.
+ * Header-name matching is case-insensitive but exact (no prefix matching) — a
+ * header like `X-Authorization-Foo` is NOT considered sensitive.
+ *
+ * **Input must be a plain key-value object.** A `Headers` instance (Web Fetch
+ * API) or a `Map` yields `[]` from `Object.entries` and would silently no-op
+ * redaction — converting to a plain object is the caller's responsibility.
+ */
+export declare function redactHeaders(headers: Record<string, string>): Record<string, string>;
+//# sourceMappingURL=build-headers.d.ts.map

package/dist/link-auth/build-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-headers.d.ts","sourceRoot":"","sources":["../../src/link-auth/build-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,cAAc,eAAe,CAAC;AAc3C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMrF"}

package/dist/link-auth/build-headers.js

@@ -0,0 +1,58 @@
+/**
+ * Render auth-header templates with rendered values, and a structural
+ * redaction helper for serialization.
+ *
+ * `buildHeaders` renders each header value template against a context that
+ * carries `${token}` plus any named captures / vars from the rewrite step.
+ * `redactHeaders` masks `Authorization` values for any caller that needs to
+ * serialize headers into logs, errors, or cache entries — the design's §8
+ * "tokens never leak" claim depends on every such site routing through this.
+ *
+ * Per design issue #113 §4 (auth.headers vocabulary) and §8 (redaction is
+ * structural; Authorization values never appear in serialized output).
+ */
+import { renderTemplate } from './template.js';
+export const REDACTED_VALUE = '<redacted>';
+/**
+ * Header names whose values must be masked when serialized.
+ *
+ * v1 ships only `authorization` because that is the only secret-bearing
+ * header the current macros emit. **Omission is the security risk** — any
+ * future macro that emits a header carrying a secret (`Cookie`,
+ * `Proxy-Authorization`, `X-API-Key`, custom bearer-style headers) must add
+ * that name here, or the token will silently leak through serialization.
+ * Extending the set is not the dangerous edit; forgetting to extend it is.
+ */
+const SENSITIVE_HEADER_NAMES = new Set(['authorization']);
+/**
+ * Render a map of header templates into a map of concrete header values.
+ *
+ * @throws {TemplateMissingVarError} if a header template references an
+ *   unknown context key
+ * @throws {TemplateSyntaxError} from a malformed template expression
+ * @throws {UnknownTransformError} from a template calling an unknown transform
+ */
+export function buildHeaders(templates, context) {
+    const headers = Object.create(null);
+    for (const [name, template] of Object.entries(templates)) {
+        headers[name] = renderTemplate(template, context);
+    }
+    return headers;
+}
+/**
+ * Return a copy of `headers` with sensitive values replaced by `REDACTED_VALUE`.
+ * Header-name matching is case-insensitive but exact (no prefix matching) — a
+ * header like `X-Authorization-Foo` is NOT considered sensitive.
+ *
+ * **Input must be a plain key-value object.** A `Headers` instance (Web Fetch
+ * API) or a `Map` yields `[]` from `Object.entries` and would silently no-op
+ * redaction — converting to a plain object is the caller's responsibility.
+ */
+export function redactHeaders(headers) {
+    const redacted = Object.create(null);
+    for (const [name, value] of Object.entries(headers)) {
+        redacted[name] = SENSITIVE_HEADER_NAMES.has(name.toLowerCase()) ? REDACTED_VALUE : value;
+    }
+    return redacted;
+}
+//# sourceMappingURL=build-headers.js.map

package/dist/link-auth/build-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-headers.js","sourceRoot":"","sources":["../../src/link-auth/build-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiC,EACjC,OAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA+B;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/link-auth/expand-macro.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Macro loader + expander.
+ *
+ * Loads the bundled `macros.yaml` once at module init and exposes
+ * `expandMacro(name, overrides?)` which deep-merges the named macro with any
+ * adopter overrides. The merge is "adopter wins": objects merge recursively,
+ * arrays and primitives are replaced wholesale (no element-wise array merge).
+ *
+ * The shipped macro file is at `link-auth/macros.yaml`, copied into the dist
+ * tree by `packages/dev-tools/src/copy-yaml-assets.ts` during build so the
+ * runtime `fs.readFileSync(new URL('./macros.yaml', import.meta.url))`
+ * resolves in both source-mode (vitest) and built-mode (dist).
+ *
+ * Per design issue #113 §5 (macros are config, not a privileged code path).
+ */
+/**
+ * Thrown when a `use: <name>` references a macro not in the shipped set.
+ * Message lists the available macros so a typo surfaces clearly.
+ */
+export declare class UnknownMacroError extends Error {
+    constructor(name: string, available: readonly string[]);
+}
+/**
+ * Look up a macro by name and deep-merge optional adopter overrides on top.
+ *
+ * Merge semantics:
+ *   - Plain objects merge recursively (sibling keys preserved).
+ *   - Arrays are replaced wholesale (override's array wins; no concat).
+ *   - Primitives are replaced.
+ *   - `undefined` in an override is treated as "not provided" (base wins).
+ *
+ * The returned object and all nested plain objects use null prototypes so
+ * `__proto__` / `constructor` keys can never poison consumers.
+ *
+ * @throws {UnknownMacroError} if `name` is not in the shipped macro set
+ */
+export declare function expandMacro(name: string, overrides?: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=expand-macro.d.ts.map

package/dist/link-auth/expand-macro.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expand-macro.d.ts","sourceRoot":"","sources":["../../src/link-auth/expand-macro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwCH;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE;CAIvD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/link-auth/expand-macro.js

@@ -0,0 +1,131 @@
+/**
+ * Macro loader + expander.
+ *
+ * Loads the bundled `macros.yaml` once at module init and exposes
+ * `expandMacro(name, overrides?)` which deep-merges the named macro with any
+ * adopter overrides. The merge is "adopter wins": objects merge recursively,
+ * arrays and primitives are replaced wholesale (no element-wise array merge).
+ *
+ * The shipped macro file is at `link-auth/macros.yaml`, copied into the dist
+ * tree by `packages/dev-tools/src/copy-yaml-assets.ts` during build so the
+ * runtime `fs.readFileSync(new URL('./macros.yaml', import.meta.url))`
+ * resolves in both source-mode (vitest) and built-mode (dist).
+ *
+ * Per design issue #113 §5 (macros are config, not a privileged code path).
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { parse as parseYaml } from 'yaml';
+const macrosPath = fileURLToPath(new URL('./macros.yaml', import.meta.url));
+let macrosCache;
+/**
+ * Load macros lazily on first use rather than at module init.
+ *
+ * Why lazy: vitest tests elsewhere in the repo mock `node:fs` (replacing
+ * `readFileSync` with `vi.fn()` that returns `undefined`). If we eagerly read
+ * at module load, any unrelated test that imports `@vibe-agent-toolkit/utils`
+ * and mocks fs crashes inside `parseYaml(undefined)` — module-init code runs
+ * unconditionally, before the mock-setup intent reaches our file.
+ *
+ * Lazy load makes module import side-effect-free; only callers of
+ * `expandMacro` pay the fs cost.
+ */
+function getMacros() {
+    if (macrosCache !== undefined)
+        return macrosCache;
+    // Path is derived from `import.meta.url`, not user input — points at the
+    // shipped macros.yaml asset next to this module in both src and dist trees.
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    const macrosFileContent = readFileSync(macrosPath, 'utf8');
+    const parsed = parseYaml(macrosFileContent);
+    if (!isPlainObject(parsed)) {
+        throw new Error('macros.yaml: expected top-level object mapping macro name → provider config.');
+    }
+    macrosCache = freezeMacros(parsed);
+    return macrosCache;
+}
+/**
+ * Thrown when a `use: <name>` references a macro not in the shipped set.
+ * Message lists the available macros so a typo surfaces clearly.
+ */
+export class UnknownMacroError extends Error {
+    constructor(name, available) {
+        super(`Unknown macro "${name}". Available: ${available.join(', ')}.`);
+        this.name = 'UnknownMacroError';
+    }
+}
+/**
+ * Look up a macro by name and deep-merge optional adopter overrides on top.
+ *
+ * Merge semantics:
+ *   - Plain objects merge recursively (sibling keys preserved).
+ *   - Arrays are replaced wholesale (override's array wins; no concat).
+ *   - Primitives are replaced.
+ *   - `undefined` in an override is treated as "not provided" (base wins).
+ *
+ * The returned object and all nested plain objects use null prototypes so
+ * `__proto__` / `constructor` keys can never poison consumers.
+ *
+ * @throws {UnknownMacroError} if `name` is not in the shipped macro set
+ */
+export function expandMacro(name, overrides) {
+    const macros = getMacros();
+    const base = macros[name];
+    if (base === undefined) {
+        throw new UnknownMacroError(name, Object.keys(macros));
+    }
+    if (overrides === undefined) {
+        return cloneWithNullProto(base);
+    }
+    const merged = deepMerge(base, overrides);
+    // Top-level result is guaranteed object here because base is.
+    return merged;
+}
+function deepMerge(base, override) {
+    if (override === undefined)
+        return base;
+    if (!isPlainObject(base) || !isPlainObject(override))
+        return cloneValue(override);
+    const result = Object.create(null);
+    for (const [key, value] of Object.entries(base)) {
+        result[key] = cloneValue(value);
+    }
+    for (const [key, value] of Object.entries(override)) {
+        const existing = Object.hasOwn(result, key) ? result[key] : undefined;
+        if (isPlainObject(existing) && isPlainObject(value)) {
+            result[key] = deepMerge(existing, value);
+        }
+        else {
+            result[key] = cloneValue(value);
+        }
+    }
+    return result;
+}
+function cloneValue(value) {
+    if (Array.isArray(value))
+        return value.map(cloneValue);
+    if (isPlainObject(value))
+        return cloneWithNullProto(value);
+    return value;
+}
+function cloneWithNullProto(obj) {
+    const cloned = Object.create(null);
+    for (const [key, value] of Object.entries(obj)) {
+        cloned[key] = cloneValue(value);
+    }
+    return cloned;
+}
+function freezeMacros(parsed) {
+    const frozen = Object.create(null);
+    for (const [name, value] of Object.entries(parsed)) {
+        if (!isPlainObject(value)) {
+            throw new Error(`macros.yaml: macro "${name}" is not an object.`);
+        }
+        frozen[name] = cloneWithNullProto(value);
+    }
+    return frozen;
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+//# sourceMappingURL=expand-macro.js.map

package/dist/link-auth/expand-macro.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expand-macro.js","sourceRoot":"","sources":["../../src/link-auth/expand-macro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE5E,IAAI,WAAgE,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,SAAS,SAAS;IAChB,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAElD,yEAAyE;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAY,CAAC;IAEvD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,IAAY,EAAE,SAA4B;QACpD,KAAK,CAAC,kBAAkB,IAAI,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,SAAmC;IAEnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,8DAA8D;IAC9D,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,QAAiB;IACjD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA4B;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,MAAM,GAA4C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,qBAAqB,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/link-auth/macros.yaml

@@ -0,0 +1,50 @@
+# linkAuth provider macros — shipped defaults referenced by `use: <name>` in
+# adopter `vibe-agent-toolkit.config.yaml` files.
+#
+# Each entry is a full provider config in the §4 vocabulary (match, rewrite,
+# auth, token, check). Adopters reference a macro by name and may deep-merge
+# overrides on top — see design issue #113 §5.
+#
+# Adding a new host is intended to be a config-only PR: append an entry here
+# and add unit tests. Only `vocabulary` changes (e.g. a new transform) require
+# engine code.
+
+github:
+  match:
+    host: github.com
+  rewrite:
+    - when: '^https://github\.com/(?<owner>[^/]+)/(?<repo>[^/]+)/(?:blob|tree)/(?<ref>[^/]+)/(?<path>.+)$'
+      to: 'https://api.github.com/repos/${owner}/${repo}/contents/${path}?ref=${ref}'
+  auth:
+    headers:
+      Authorization: 'Bearer ${token}'
+      Accept: application/vnd.github+json
+  token:
+    - command: gh auth token
+    - env: GITHUB_TOKEN
+  check:
+    method: GET
+    aliveStatus: [200]
+    notFoundMeaning: ambiguous
+
+sharepoint:
+  match:
+    host: '*.sharepoint.com'
+    excludeHost:
+      - '*-my.sharepoint.com'
+  rewrite:
+    - when: '^(?<u>https://.+)$'
+      vars:
+        shareId: 'u!${base64url(u)}'
+      to: 'https://graph.microsoft.com/v1.0/shares/${shareId}/driveItem'
+  auth:
+    headers:
+      Authorization: 'Bearer ${token}'
+  # SharePoint has no zero-config token source (design §5.1 note): a SharePoint-
+  # scoped token requires an Entra app registration; the stock `az` token does
+  # not work. Adopter must supply their own token command.
+  token: []
+  check:
+    method: GET
+    aliveStatus: [200]
+    notFoundMeaning: dead

package/dist/link-auth/resolve-token.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Token resolution — ordered, first-non-empty-wins.
+ *
+ * Iterates a provider's `token` source list and returns the first source that
+ * yields a non-empty value. Two source shapes:
+ *   - `{ env: "NAME" }`                — read from process env (no trimming)
+ *   - `{ command: argv }`              — run a command, return trimmed stdout
+ *   - `{ command: "gh auth token" }`   — convenience: whitespace-tokenized into
+ *     argv. **Not** passed through a shell — operators (`|`, `&&`, `$(...)`)
+ *     become literal argv elements, per the design's §6.1 sharp-edge note.
+ *
+ * Returns `undefined` if every source fails or yields an empty/whitespace
+ * value — the caller's `resolveAuthenticatedUrl` translates that to the
+ * `unverified` outcome (LINK_AUTH_UNVERIFIED in slice 2).
+ *
+ * Per design issue #113 §4 (token vocabulary) and §6.1 (command execution,
+ * `safeExecSync`-backed, `shell: false`).
+ */
+export type TokenSource = {
+    readonly env: string;
+} | {
+    readonly command: string | readonly string[];
+};
+export interface TokenResolutionDeps {
+    /**
+     * Environment lookup map. Defaults to `process.env`. Injectable for tests so
+     * unit tests don't depend on ambient environment state.
+     */
+    readonly env: Record<string, string | undefined>;
+    /**
+     * Command runner. Defaults to `safeExecResult`-wrapped invocation. Injectable
+     * for tests. Receives argv; returns `success` + `stdout`. Should NOT throw
+     * for normal exec failures (return `success: false` instead). Throws are
+     * propagated by `resolveToken` — they indicate operator-level bugs.
+     */
+    readonly runCommand: (argv: readonly string[]) => {
+        success: boolean;
+        stdout: string;
+    };
+}
+/**
+ * Resolve a token from an ordered list of sources.
+ *
+ * @returns the first non-empty value, or `undefined` if every source failed.
+ * @throws whatever the injected `runCommand` throws (operator-level bug; not
+ *   swallowed). Standard `safeExecResult` does not throw under normal use.
+ */
+export declare function resolveToken(sources: readonly TokenSource[], deps?: Partial<TokenResolutionDeps>): string | undefined;
+//# sourceMappingURL=resolve-token.d.ts.map

package/dist/link-auth/resolve-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-token.d.ts","sourceRoot":"","sources":["../../src/link-auth/resolve-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtG,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACxF;AAWD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,IAAI,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAClC,MAAM,GAAG,SAAS,CASpB"}