@vibe-agent-toolkit/utils 0.2.0-rc.1 → 0.2.0-rc.10

package/eslint/rules/no-self-package-import.cjs

@@ -0,0 +1,168 @@
+/**
+ * ESLint rule: no-self-package-import
+ *
+ * Disallow a file importing the package it already lives in **by that package's
+ * own name**. Inside `packages/foo/src`, write `./types.js`, never
+ * `@scope/foo`.
+ *
+ * @example
+ * // ❌ BAD — packages/agent-runtime/src/session/file-session-store.ts
+ * import type { SessionStore } from '@vibe-agent-toolkit/agent-runtime';
+ *
+ * // ✅ GOOD
+ * import type { SessionStore } from './types.js';
+ *
+ * ## Why this is a build-breaker and not a style preference
+ *
+ * A self-import resolves out through `node_modules` to the package's OWN
+ * `package.json`, whose `types`/`exports` point at `./dist/index.d.ts` — a file
+ * the compiler is in the middle of producing. It appears to work only because of
+ * a TypeScript courtesy: while `dist` IS the running project's output path,
+ * `dist/index.d.ts` is recognised as this project's own declaration output and
+ * the import is redirected back to `src`, so it resolves with no `dist/` on disk
+ * at all.
+ *
+ * That courtesy is conditional, and every condition is one a build script may
+ * legitimately change. Compile the package with `--outDir` pointed anywhere else
+ * — a staging directory used to make emit atomic, for instance — and `dist` is
+ * no longer this program's output, the redirect is gone, tsc looks for a literal
+ * `dist/index.d.ts`, and a tree that has never been built has none:
+ *
+ *   error TS2307: Cannot find module '@scope/foo' or its corresponding type
+ *                 declarations.
+ *
+ * Knock-on `TS2339`s follow wherever a local type extended one of the now
+ * unresolved imports, which is what makes the failure read as a type bug in
+ * code nobody touched.
+ *
+ * ## Why the compiler cannot be trusted to find these
+ *
+ * The failure is invisible on any machine that has built the package before:
+ * a stale `dist/` satisfies the literal lookup, so the build passes — by
+ * typechecking the package against its PREVIOUS build's declarations. Worse, in
+ * a monorepo whose worktrees live inside the main checkout, module resolution
+ * walks up past the worktree into the parent checkout's `node_modules` and
+ * resolves against a DIFFERENT checkout's `dist/`. Both are green locally and
+ * red in CI, which is the only place the tree is genuinely pristine.
+ *
+ * So a self-import is latent by construction: it costs nothing until the day a
+ * build script changes `outDir`, and then it fails somewhere nobody can
+ * reproduce. Lint is the only stage that sees it on the author's machine.
+ *
+ * ## `packageName` is required, and the rule reads no files to get it
+ *
+ * The obvious implementation walks up from the linted file to the nearest
+ * `package.json` and reads its `name`. This rule deliberately does NOT: every
+ * module on the `./eslint` subpath is plain data that requires nothing — not
+ * `eslint`, not a third-party package, not even a Node builtin — which is what
+ * lets the pack ship as a subpath of a runtime package, keeps `eslint` an
+ * OPTIONAL peer dependency, and keeps the other subpaths resolving in a tree with
+ * no ESLint installed. `test/eslint/subpath-purity.test.ts` enforces that as an
+ * empty-set assertion. One `require('node:fs')` here would be the first crack in
+ * it, for a convenience the config layer can supply for free.
+ *
+ * So the caller names the package, and the caller is a config file that already
+ * runs in full Node and can read every manifest it likes. See the generated
+ * per-package blocks in this repo's `eslint.config.js`.
+ *
+ * Scoping is the caller's job for the same reason: only files a package actually
+ * COMPILES can break the build, and test and example trees commonly import their
+ * own package by name ON PURPOSE, to exercise the public entry point exactly as a
+ * consumer would.
+ */
+
+'use strict';
+
+/**
+ * Whether `specifier` names `packageName` itself or one of its subpaths.
+ *
+ * The subpath check is anchored on `/` so `@scope/foo-bar` is not read as a
+ * subpath of `@scope/foo`.
+ *
+ * @param {string} specifier - The import specifier as written.
+ * @param {string} packageName - The enclosing package's name.
+ * @returns {boolean}
+ */
+function isSelfReference(specifier, packageName) {
+  return specifier === packageName || specifier.startsWith(`${packageName}/`);
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        "Disallow importing the enclosing package by its own name; use a relative path so the import does not depend on the package's built `dist/`.",
+      category: 'Build correctness',
+      bans: 'importing the enclosing package by its own name',
+      useInstead: 'a relative path to the defining module',
+      // Not in `recommended`, for two reasons either of which would be enough. It
+      // REQUIRES a `packageName` option — it will not read a `package.json` to find
+      // out, because a rule module must require nothing (see `index.cjs`) — and a
+      // rule with a required option cannot ride in a config that supplies none.
+      // And the directories it must not fire in are a property of the adopter's
+      // `tsconfig`: a self-import only breaks the build in files the package
+      // COMPILES, while test and example trees import their own package by name on
+      // purpose. The consuming config knows both; see the README.
+      recommended: false,
+      recommendedSeverity: 'error',
+    },
+    messages: {
+      useRelativeImport:
+        "Do not import '{{specifier}}' — this file is already inside '{{packageName}}'. That resolves through the package's own `dist/`, which only works while `dist` is the running compiler's output path; change `outDir` (or build a tree that has never been built) and it fails with TS2307. Import the defining module by relative path instead.",
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          packageName: { type: 'string', minLength: 1 },
+        },
+        required: ['packageName'],
+        additionalProperties: false,
+      },
+    ],
+  },
+
+  create(context) {
+    const { packageName } = context.options[0];
+
+    /**
+     * @param {{ type: string, value?: unknown } | null | undefined} source - A node in source position.
+     */
+    const check = (source) => {
+      if (!source || source.type !== 'Literal') return;
+      const specifier = source.value;
+      if (typeof specifier !== 'string') return;
+      if (!isSelfReference(specifier, packageName)) return;
+      context.report({
+        node: source,
+        messageId: 'useRelativeImport',
+        data: { specifier, packageName },
+      });
+    };
+
+    return {
+      // `import … from 'x'` and `import type … from 'x'`
+      ImportDeclaration: (node) => check(node.source),
+      // `export … from 'x'` and `export * from 'x'` — a barrel re-exporting
+      // through its own package name is the same resolution, one step removed.
+      ExportNamedDeclaration: (node) => check(node.source),
+      ExportAllDeclaration: (node) => check(node.source),
+      // `await import('x')`
+      ImportExpression: (node) => check(node.source),
+      // `import('x')` in TYPE position, which no other visitor above reaches.
+      // The specifier hangs off `source`; typescript-eslint has called this
+      // property `parameter` and `argument` in earlier majors, and reading the
+      // wrong one costs nothing at lint time — the visitor simply never fires.
+      // The `import() in TYPE position` case in `test/eslint/rules/no-self-package-import.test.ts` is what turns
+      // that silence into a red test if a future parser renames it again.
+      TSImportType: (node) => check(node.source),
+      // `require('x')` in the `.cts`/`.cjs` files this pack also lints.
+      CallExpression: (node) => {
+        if (node.callee.type !== 'Identifier' || node.callee.name !== 'require') return;
+        if (node.arguments.length !== 1) return;
+        check(node.arguments[0]);
+      },
+    };
+  },
+};

package/eslint/rules/no-test-scoped-functions.cjs

@@ -68,9 +68,16 @@ module.exports = {
   meta: {
     type: 'suggestion',
     docs: {
-      description: 'Disallow function declarations inside test blocks (SonarQube S1515)',
-      category: 'Best Practices',
-      recommended: true,
+      description:
+        'Disallow function declarations inside test blocks (SonarQube S1515)',
+      category: 'Code and test hygiene',
+      bans: 'helper functions declared inside `describe`/`it`',
+      useInstead: 'module scope',
+      // Not in `recommended`: a position on TEST STYLE, not a portability or
+      // correctness fact. Someone installing this package for `safePath.join()`
+      // should not silently inherit a test convention. Enable it by name.
+      recommended: false,
+      recommendedSeverity: 'error',
     },
     messages: {
       moveToModuleScope:

package/eslint/rules/no-unix-shell-commands.cjs

@@ -85,9 +85,13 @@ module.exports = {
   meta: {
     type: 'problem',
     docs: {
-      description: 'Prevent Unix-specific commands that break Windows compatibility',
-      category: 'Cross-Platform',
+      description:
+        'Prevent Unix-specific commands that break Windows compatibility',
+      category: 'Filesystem and process',
+      bans: '`tar`, `grep`, `rm`, `echo`, … spawned directly',
+      useInstead: 'Node APIs, or a portable script fixture',
       recommended: true,
+      recommendedSeverity: 'error',
     },
     fixable: null, // No auto-fix - requires manual refactoring
     schema: [],

package/eslint/rules/no-unsafe-root-join.cjs

@@ -41,8 +41,29 @@ module.exports = {
     docs: {
       description:
         'Enforce safePath.joinUnderRoot() for joins whose first arg is a security root variable (name ends in "Root").',
-      category: 'Security',
-      recommended: true,
+      category: 'Path handling',
+      bans: '`safePath.join(someRoot, x)` where `x` can escape',
+      useInstead: '`safePath.joinUnderRoot()`',
+      subpath: '/path',
+      // Not in `recommended`: an unsound heuristic, pending a rewrite. It keys on
+      // whether an identifier's NAME ends in `root` rather than on whether any
+      // segment is caller-controlled, so it is noisy and blind at once — measured
+      // on a 4,670-file adopter tree: 108 findings, 0 autofixable, and every one
+      // of these verified by execution:
+      //
+      //   FIRES   safePath.join(repoRoot, 'docs', 'product')  <- all literals, cannot escape
+      //   FIRES   safePath.resolve(packageRoot, '..', '..')   <- escaping IS the intent
+      //   FIRES   safePath.join(repoRoot)                     <- one argument, no segment
+      //   silent  safePath.join(base, userInput)              <- THE dangerous shape, missed
+      //
+      // A rule that misses the case it exists to catch must not ride in a config
+      // named `recommended` at any severity — a safety core that cries wolf
+      // teaches people to ignore it, which costs the true positives too. It still
+      // earns `error` where scoped to directories in which a path escape is a
+      // security boundary (VAT scopes it to the skill-test staging code).
+      // Re-include it when it keys on taint rather than on naming.
+      recommended: false,
+      recommendedSeverity: 'error',
     },
     messages: {
       useJoinUnderRoot:

package/eslint/rules/no-url-pathname-for-fs.cjs

@@ -77,8 +77,12 @@ module.exports = {
     docs: {
       description:
         'Disallow `.pathname` on a URL built from `import.meta.url`; use `fileURLToPath()` instead.',
-      category: 'Cross-platform compatibility',
+      category: 'URLs and dynamic imports',
+      bans: '`new URL(x, import.meta.url).pathname` as a filesystem path',
+      useInstead: '`resolveFromImportMeta()` / `fileURLToPath()`',
+      subpath: '/fs',
       recommended: true,
+      recommendedSeverity: 'error',
     },
     messages: {
       useFileURLToPath:

package/eslint/rules/no-version-literal.cjs

@@ -0,0 +1,151 @@
+/**
+ * ESLint rule: no-version-literal
+ *
+ * The mechanical half of CLAUDE.md's "NO VERSIONS" rule. Flags the two shapes
+ * a hand-maintained version integer takes:
+ *
+ * 1. `z.literal(<number>)` on a schema field named like a version
+ *    (`version`, `schemaVersion`, `formatVersion`, `*_VERSION`, …), with or
+ *    without a trailing `.optional()` / `.describe()`;
+ * 2. a variable, `let`, or class field named `<X>_VERSION`, `<X>_REVISION`,
+ *    `VERSION`, `fooVersion`, … initialised to a numeric literal.
+ *
+ * Both are a number a human must remember to bump for stored data to be
+ * judged valid, and nothing fails when they forget: the number and the shape
+ * it claims to describe drift apart silently, and the failure surfaces later
+ * as a reader confidently mis-parsing data it should have refused. A strict
+ * schema already answers "can I read this?" and moves when the shape moves,
+ * for whoever made the edit; a derived digest answers "did these come from
+ * the same shape?". The integer answers neither and costs a permanent human
+ * obligation.
+ *
+ * ## Not offenders, and why the rule already leaves them alone
+ *
+ * - `ANTHROPIC_VERSION = '2023-06-01'` — a STRING header value, an external
+ *   fact; the rule only fires on a NUMERIC initialiser.
+ * - `SUPPORTED_PYTHON_VERSIONS = [...]` — a real list; the name ends in
+ *   `VERSIONS`, not `VERSION`, and the value is an array.
+ * - a regex that PARSES versions; a `const VERSION = '…'` in a test fixture.
+ * - `version: z.string()` / `z.number()` — a field that CARRIES a version is
+ *   fine; a field pinned to one integer is the offender.
+ *
+ * Option `allowNames: string[]` — identifier / property names exempt from the
+ * rule. Ship it empty: the documented non-offenders need no entry, so any
+ * entry here is a version constant somebody decided to keep, and CLAUDE.md
+ * says there is no such case.
+ *
+ * @example
+ * // BAD — bumped from memory, or not
+ * const CACHE_VERSION = 3;
+ * const Cached = z.object({ version: z.literal(3), … });
+ *
+ * // GOOD — the strict schema IS the validity check
+ * const Cached = z.object({ … }).strict();
+ */
+
+'use strict';
+
+/** A name that reads as a version or revision: `X_VERSION`, `VERSION`, `fooVersion`, `version`. */
+const VERSION_NAME = /(?:^|_)(?:VERSION|REVISION)$|(?:^|[a-z])(?:Version|Revision)$|^(?:version|revision)$/u;
+
+/** The numeric literal an initialiser reduces to, seeing through `as const`, or null. */
+function numericInitialiser(init) {
+  if (!init) {
+    return null;
+  }
+  if (init.type === 'TSAsExpression' || init.type === 'TSSatisfiesExpression') {
+    return numericInitialiser(init.expression);
+  }
+  return init.type === 'Literal' && typeof init.value === 'number' ? init : null;
+}
+
+/** The plain name of a declarator id, property key, or class field key, or null. */
+function keyName(key) {
+  if (key.type === 'Identifier') {
+    return key.name;
+  }
+  return key.type === 'Literal' && typeof key.value === 'string' ? key.value : null;
+}
+
+/** Whether a property value's chain roots at `z.literal(<number>)`. */
+function rootsAtNumericZodLiteral(value) {
+  let current = value;
+  while (current.type === 'CallExpression' && current.callee.type === 'MemberExpression') {
+    const { callee } = current;
+    const isZodLiteral =
+      callee.object.type === 'Identifier' &&
+      callee.object.name === 'z' &&
+      callee.property.type === 'Identifier' &&
+      callee.property.name === 'literal';
+    if (isZodLiteral) {
+      return numericInitialiser(current.arguments[0]) !== null;
+    }
+    current = callee.object;
+  }
+  return false;
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Disallow z.literal(<number>) on a version-named field and <X>_VERSION = <number> ' +
+        'constants — a hand-bumped integer deciding data validity is the shape CLAUDE.md bans',
+      recommended: false,
+      recommendedSeverity: 'warn',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          allowNames: { type: 'array', items: { type: 'string' }, uniqueItems: true },
+        },
+        additionalProperties: false,
+      },
+    ],
+    messages: {
+      versionConstant:
+        '{{name}} is a hand-maintained version integer: nothing fails when it is not bumped, so ' +
+        'the number and the shape drift apart silently. Delete it — a .strict() schema already ' +
+        'refuses data it cannot read, and a digest of the shape answers "same shape?" without ' +
+        'anyone remembering a number.',
+      versionLiteralField:
+        '{{name}}: z.literal(<number>) pins stored data to an integer a human must remember to ' +
+        'bump. Delete the field and let the .strict() schema decide validity, or derive a digest ' +
+        'of the shape instead.',
+    },
+  },
+
+  create(context) {
+    const allow = new Set(context.options?.[0]?.allowNames ?? []);
+
+    function checkNamedInitialiser(node, key, init) {
+      const name = keyName(key);
+      if (name === null || allow.has(name) || !VERSION_NAME.test(name)) {
+        return;
+      }
+      if (numericInitialiser(init) !== null) {
+        context.report({ node, messageId: 'versionConstant', data: { name } });
+      }
+    }
+
+    return {
+      VariableDeclarator(node) {
+        checkNamedInitialiser(node, node.id, node.init);
+      },
+      PropertyDefinition(node) {
+        checkNamedInitialiser(node, node.key, node.value);
+      },
+      Property(node) {
+        const name = keyName(node.key);
+        if (name === null || allow.has(name) || !VERSION_NAME.test(name)) {
+          return;
+        }
+        if (rootsAtNumericZodLiteral(node.value)) {
+          context.report({ node, messageId: 'versionLiteralField', data: { name } });
+        }
+      },
+    };
+  },
+};

package/eslint/rules/prefer-startswith-over-regex.cjs

@@ -195,7 +195,16 @@ module.exports = {
     docs: {
       description:
         String.raw`Prefer String#startsWith / String#endsWith over /^literal/.test() — including escaped literals such as \/ and \*, and regexes held in a const`,
+      category: 'Code and test hygiene',
+      bans: '`/^foo/.test(s)`, `` /^\\*glob/.test(s) ``, `const RE = /^foo/; RE.test(s)`',
+      useInstead: "`s.startsWith('foo')`",
+      // `error`, deliberately. This rule was briefly graded on a different axis
+      // ("style, not a defect") and demoted to `warn` — wrong twice over: avoiding
+      // a SonarQube S6557 at lint time instead of at merge time is a real saving,
+      // and the matcher rejects any regex containing a metacharacter, so it only
+      // fires on true literal prefixes and has near-zero churn.
       recommended: true,
+      recommendedSeverity: 'error',
     },
     messages: {
       // `{{pattern}}` carries its FLAGS. Rendering `/^abc/` for a source

package/eslint/rules/require-justified-skip.cjs

@@ -253,8 +253,14 @@ module.exports = {
     docs: {
       description:
         'Require a tracking-issue justification for skipped tests, and ban tautological assertions',
-      category: 'Best Practices',
-      recommended: true,
+      category: 'Code and test hygiene',
+      bans: 'unannotated `it.skip`/`it.todo`, tautological assertions, empty test bodies',
+      useInstead: 'a `SKIP(#123): reason` annotation, or a real assertion',
+      // Not in `recommended`: a position on TEST STYLE, not a portability or
+      // correctness fact. Someone installing this package for `safePath.join()`
+      // should not silently inherit a test convention. Enable it by name.
+      recommended: false,
+      recommendedSeverity: 'error',
     },
     schema: [],
     messages: {

package/eslint/rules/safe-import.cjs

@@ -106,7 +106,7 @@ function insertAboveWithComments(fixer, sourceCode, node, text) {
  * PER-RULE rather than one shared `settings` key, because a seam does not have
  * to split its symbols the way this package does. The same adopter's narrow
  * entry carries `normalizedTmpdir`/`mkdirSyncReal` but NOT `safePath`, so their
- * `no-os-tmpdir` and `no-path-join` need different targets — the exact "path
+ * `no-os-tmpdir` and `no-raw-node-path` need different targets — the exact "path
  * rules here, fs rules there" case a single key cannot express.
  */
 const SAFE_MODULE_PROPERTY = Object.freeze({

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "@vibe-agent-toolkit/utils",
-  "version": "0.2.0-rc.1",
+  "version": "0.2.0-rc.10",
   "type": "module",
   "description": "Core utility functions shared across the vibe-agent-toolkit packages",
-  "sideEffects": false,
+  "sideEffects": [
+    "./dist/crawl-timing.js"
+  ],
   "keywords": [
     "typescript",
     "utilities",
@@ -15,7 +17,7 @@
   "author": "Jeff Dutton",
   "license": "MIT",
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.13.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -32,6 +34,10 @@
       "types": "./dist/fs.d.ts",
       "import": "./dist/fs.js"
     },
+    "./text": {
+      "types": "./dist/text.d.ts",
+      "import": "./dist/text.js"
+    },
     "./process": {
       "types": "./dist/process.d.ts",
       "import": "./dist/process.js"
@@ -48,9 +54,9 @@
       "types": "./dist/zod.d.ts",
       "import": "./dist/zod.js"
     },
-    "./template": {
-      "types": "./dist/template-entry.d.ts",
-      "import": "./dist/template-entry.js"
+    "./skill-test": {
+      "types": "./dist/skill-test/index.d.ts",
+      "import": "./dist/skill-test/index.js"
     },
     "./yaml": {
       "types": "./dist/yaml.d.ts",
@@ -84,20 +90,19 @@
     "README.md"
   ],
   "scripts": {
-    "build": "rimraf --glob dist \"*.tsbuildinfo\" && tsc && tsx ../dev-tools/src/copy-yaml-assets.ts",
+    "build": "tsx ../dev-tools/src/tsc-clean-build.ts",
     "test:unit": "vitest run",
     "test:integration": "vitest run --config vitest.integration.config.ts",
-    "test:system": "vitest run --config vitest.system.config.ts",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
-    "clean": "rimraf dist *.tsbuildinfo"
+    "clean": "rimraf --glob dist \"*.tsbuildinfo\" .tsc-staging"
   },
   "dependencies": {
-    "handlebars": "^4.7.8",
+    "@vibe-validate/git": "0.20.1",
     "ignore": "^7.0.5",
     "picomatch": "^4.0.3",
     "which": "^5.0.0",
-    "yaml": "^2.6.1"
+    "yaml": "^2.9.0"
   },
   "peerDependencies": {
     "eslint": ">=9.0.0"
@@ -108,12 +113,7 @@
     }
   },
   "devDependencies": {
-    "@types/picomatch": "^4.0.2",
     "@types/which": "^3.0.4",
-    "eslint": "^9.39.5",
-    "rimraf": "^6.0.1",
-    "typescript": "^5.9.3",
-    "vitest": "^3.2.4",
     "zod": "^3.25.0"
   },
   "publishConfig": {

package/dist/link-auth/build-headers.d.ts

@@ -1,34 +0,0 @@
-/**
- * Render auth-header templates with rendered values, and a structural
- * redaction helper for serialization.
- *
- * `buildHeaders` renders each header value template against a context that
- * carries `${token}` plus any named captures / vars from the rewrite step.
- * `redactHeaders` masks `Authorization` values for any caller that needs to
- * serialize headers into logs, errors, or cache entries — the design's §8
- * "tokens never leak" claim depends on every such site routing through this.
- *
- * Per design issue #113 §4 (auth.headers vocabulary) and §8 (redaction is
- * structural; Authorization values never appear in serialized output).
- */
-export declare const REDACTED_VALUE = "<redacted>";
-/**
- * Render a map of header templates into a map of concrete header values.
- *
- * @throws {TemplateMissingVarError} if a header template references an
- *   unknown context key
- * @throws {TemplateSyntaxError} from a malformed template expression
- * @throws {UnknownTransformError} from a template calling an unknown transform
- */
-export declare function buildHeaders(templates: Record<string, string>, context: Record<string, string>): Record<string, string>;
-/**
- * Return a copy of `headers` with sensitive values replaced by `REDACTED_VALUE`.
- * Header-name matching is case-insensitive but exact (no prefix matching) — a
- * header like `X-Authorization-Foo` is NOT considered sensitive.
- *
- * **Input must be a plain key-value object.** A `Headers` instance (Web Fetch
- * API) or a `Map` yields `[]` from `Object.entries` and would silently no-op
- * redaction — converting to a plain object is the caller's responsibility.
- */
-export declare function redactHeaders(headers: Record<string, string>): Record<string, string>;
-//# sourceMappingURL=build-headers.d.ts.map

package/dist/link-auth/build-headers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-headers.d.ts","sourceRoot":"","sources":["../../src/link-auth/build-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,cAAc,eAAe,CAAC;AAc3C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMrF"}

package/dist/link-auth/build-headers.js

@@ -1,58 +0,0 @@
-/**
- * Render auth-header templates with rendered values, and a structural
- * redaction helper for serialization.
- *
- * `buildHeaders` renders each header value template against a context that
- * carries `${token}` plus any named captures / vars from the rewrite step.
- * `redactHeaders` masks `Authorization` values for any caller that needs to
- * serialize headers into logs, errors, or cache entries — the design's §8
- * "tokens never leak" claim depends on every such site routing through this.
- *
- * Per design issue #113 §4 (auth.headers vocabulary) and §8 (redaction is
- * structural; Authorization values never appear in serialized output).
- */
-import { renderTemplate } from './template.js';
-export const REDACTED_VALUE = '<redacted>';
-/**
- * Header names whose values must be masked when serialized.
- *
- * v1 ships only `authorization` because that is the only secret-bearing
- * header the current macros emit. **Omission is the security risk** — any
- * future macro that emits a header carrying a secret (`Cookie`,
- * `Proxy-Authorization`, `X-API-Key`, custom bearer-style headers) must add
- * that name here, or the token will silently leak through serialization.
- * Extending the set is not the dangerous edit; forgetting to extend it is.
- */
-const SENSITIVE_HEADER_NAMES = new Set(['authorization']);
-/**
- * Render a map of header templates into a map of concrete header values.
- *
- * @throws {TemplateMissingVarError} if a header template references an
- *   unknown context key
- * @throws {TemplateSyntaxError} from a malformed template expression
- * @throws {UnknownTransformError} from a template calling an unknown transform
- */
-export function buildHeaders(templates, context) {
-    const headers = Object.create(null);
-    for (const [name, template] of Object.entries(templates)) {
-        headers[name] = renderTemplate(template, context);
-    }
-    return headers;
-}
-/**
- * Return a copy of `headers` with sensitive values replaced by `REDACTED_VALUE`.
- * Header-name matching is case-insensitive but exact (no prefix matching) — a
- * header like `X-Authorization-Foo` is NOT considered sensitive.
- *
- * **Input must be a plain key-value object.** A `Headers` instance (Web Fetch
- * API) or a `Map` yields `[]` from `Object.entries` and would silently no-op
- * redaction — converting to a plain object is the caller's responsibility.
- */
-export function redactHeaders(headers) {
-    const redacted = Object.create(null);
-    for (const [name, value] of Object.entries(headers)) {
-        redacted[name] = SENSITIVE_HEADER_NAMES.has(name.toLowerCase()) ? REDACTED_VALUE : value;
-    }
-    return redacted;
-}
-//# sourceMappingURL=build-headers.js.map

package/dist/link-auth/build-headers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-headers.js","sourceRoot":"","sources":["../../src/link-auth/build-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiC,EACjC,OAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA+B;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}