@vibe-agent-toolkit/utils 0.2.0-rc.2 → 0.2.0-rc.4

package/eslint/rules/no-self-package-import.cjs

@@ -0,0 +1,157 @@
+/**
+ * ESLint rule: no-self-package-import
+ *
+ * Disallow a file importing the package it already lives in **by that package's
+ * own name**. Inside `packages/foo/src`, write `./types.js`, never
+ * `@scope/foo`.
+ *
+ * @example
+ * // ❌ BAD — packages/agent-runtime/src/session/file-session-store.ts
+ * import type { SessionStore } from '@vibe-agent-toolkit/agent-runtime';
+ *
+ * // ✅ GOOD
+ * import type { SessionStore } from './types.js';
+ *
+ * ## Why this is a build-breaker and not a style preference
+ *
+ * A self-import resolves out through `node_modules` to the package's OWN
+ * `package.json`, whose `types`/`exports` point at `./dist/index.d.ts` — a file
+ * the compiler is in the middle of producing. It appears to work only because of
+ * a TypeScript courtesy: while `dist` IS the running project's output path,
+ * `dist/index.d.ts` is recognised as this project's own declaration output and
+ * the import is redirected back to `src`, so it resolves with no `dist/` on disk
+ * at all.
+ *
+ * That courtesy is conditional, and every condition is one a build script may
+ * legitimately change. Compile the package with `--outDir` pointed anywhere else
+ * — a staging directory used to make emit atomic, for instance — and `dist` is
+ * no longer this program's output, the redirect is gone, tsc looks for a literal
+ * `dist/index.d.ts`, and a tree that has never been built has none:
+ *
+ *   error TS2307: Cannot find module '@scope/foo' or its corresponding type
+ *                 declarations.
+ *
+ * Knock-on `TS2339`s follow wherever a local type extended one of the now
+ * unresolved imports, which is what makes the failure read as a type bug in
+ * code nobody touched.
+ *
+ * ## Why the compiler cannot be trusted to find these
+ *
+ * The failure is invisible on any machine that has built the package before:
+ * a stale `dist/` satisfies the literal lookup, so the build passes — by
+ * typechecking the package against its PREVIOUS build's declarations. Worse, in
+ * a monorepo whose worktrees live inside the main checkout, module resolution
+ * walks up past the worktree into the parent checkout's `node_modules` and
+ * resolves against a DIFFERENT checkout's `dist/`. Both are green locally and
+ * red in CI, which is the only place the tree is genuinely pristine.
+ *
+ * So a self-import is latent by construction: it costs nothing until the day a
+ * build script changes `outDir`, and then it fails somewhere nobody can
+ * reproduce. Lint is the only stage that sees it on the author's machine.
+ *
+ * ## `packageName` is required, and the rule reads no files to get it
+ *
+ * The obvious implementation walks up from the linted file to the nearest
+ * `package.json` and reads its `name`. This rule deliberately does NOT: every
+ * module on the `./eslint` subpath is plain data that requires nothing — not
+ * `eslint`, not a third-party package, not even a Node builtin — which is what
+ * lets the pack ship as a subpath of a runtime package, keeps `eslint` an
+ * OPTIONAL peer dependency, and keeps the other subpaths resolving in a tree with
+ * no ESLint installed. `test/eslint/subpath-purity.test.ts` enforces that as an
+ * empty-set assertion. One `require('node:fs')` here would be the first crack in
+ * it, for a convenience the config layer can supply for free.
+ *
+ * So the caller names the package, and the caller is a config file that already
+ * runs in full Node and can read every manifest it likes. See the generated
+ * per-package blocks in this repo's `eslint.config.js`.
+ *
+ * Scoping is the caller's job for the same reason: only files a package actually
+ * COMPILES can break the build, and test and example trees commonly import their
+ * own package by name ON PURPOSE, to exercise the public entry point exactly as a
+ * consumer would.
+ */
+
+'use strict';
+
+/**
+ * Whether `specifier` names `packageName` itself or one of its subpaths.
+ *
+ * The subpath check is anchored on `/` so `@scope/foo-bar` is not read as a
+ * subpath of `@scope/foo`.
+ *
+ * @param {string} specifier - The import specifier as written.
+ * @param {string} packageName - The enclosing package's name.
+ * @returns {boolean}
+ */
+function isSelfReference(specifier, packageName) {
+  return specifier === packageName || specifier.startsWith(`${packageName}/`);
+}
+
+module.exports = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        "Disallow importing the enclosing package by its own name; use a relative path so the import does not depend on the package's built `dist/`.",
+      category: 'Build correctness',
+      recommended: true,
+    },
+    messages: {
+      useRelativeImport:
+        "Do not import '{{specifier}}' — this file is already inside '{{packageName}}'. That resolves through the package's own `dist/`, which only works while `dist` is the running compiler's output path; change `outDir` (or build a tree that has never been built) and it fails with TS2307. Import the defining module by relative path instead.",
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          packageName: { type: 'string', minLength: 1 },
+        },
+        required: ['packageName'],
+        additionalProperties: false,
+      },
+    ],
+  },
+
+  create(context) {
+    const { packageName } = context.options[0];
+
+    /**
+     * @param {{ type: string, value?: unknown } | null | undefined} source - A node in source position.
+     */
+    const check = (source) => {
+      if (!source || source.type !== 'Literal') return;
+      const specifier = source.value;
+      if (typeof specifier !== 'string') return;
+      if (!isSelfReference(specifier, packageName)) return;
+      context.report({
+        node: source,
+        messageId: 'useRelativeImport',
+        data: { specifier, packageName },
+      });
+    };
+
+    return {
+      // `import … from 'x'` and `import type … from 'x'`
+      ImportDeclaration: (node) => check(node.source),
+      // `export … from 'x'` and `export * from 'x'` — a barrel re-exporting
+      // through its own package name is the same resolution, one step removed.
+      ExportNamedDeclaration: (node) => check(node.source),
+      ExportAllDeclaration: (node) => check(node.source),
+      // `await import('x')`
+      ImportExpression: (node) => check(node.source),
+      // `import('x')` in TYPE position, which no other visitor above reaches.
+      // The specifier hangs off `source`; typescript-eslint has called this
+      // property `parameter` and `argument` in earlier majors, and reading the
+      // wrong one costs nothing at lint time — the visitor simply never fires.
+      // The `import() in TYPE position` case in `rules.test.ts` is what turns
+      // that silence into a red test if a future parser renames it again.
+      TSImportType: (node) => check(node.source),
+      // `require('x')` in the `.cts`/`.cjs` files this pack also lints.
+      CallExpression: (node) => {
+        if (node.callee.type !== 'Identifier' || node.callee.name !== 'require') return;
+        if (node.arguments.length !== 1) return;
+        check(node.arguments[0]);
+      },
+    };
+  },
+};

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "@vibe-agent-toolkit/utils",
-  "version": "0.2.0-rc.2",
+  "version": "0.2.0-rc.4",
   "type": "module",
   "description": "Core utility functions shared across the vibe-agent-toolkit packages",
-  "sideEffects": false,
+  "sideEffects": [
+    "./dist/crawl-timing.js"
+  ],
   "keywords": [
     "typescript",
     "utilities",
@@ -32,6 +34,10 @@
       "types": "./dist/fs.d.ts",
       "import": "./dist/fs.js"
     },
+    "./text": {
+      "types": "./dist/text.d.ts",
+      "import": "./dist/text.js"
+    },
     "./process": {
       "types": "./dist/process.d.ts",
       "import": "./dist/process.js"
@@ -48,9 +54,9 @@
       "types": "./dist/zod.d.ts",
       "import": "./dist/zod.js"
     },
-    "./template": {
-      "types": "./dist/template-entry.d.ts",
-      "import": "./dist/template-entry.js"
+    "./skill-test": {
+      "types": "./dist/skill-test/index.d.ts",
+      "import": "./dist/skill-test/index.js"
     },
     "./yaml": {
       "types": "./dist/yaml.d.ts",
@@ -84,16 +90,15 @@
     "README.md"
   ],
   "scripts": {
-    "build": "rimraf --glob dist \"*.tsbuildinfo\" && tsc && tsx ../dev-tools/src/copy-yaml-assets.ts",
+    "build": "rimraf --glob dist \"*.tsbuildinfo\" && tsc",
     "test:unit": "vitest run",
     "test:integration": "vitest run --config vitest.integration.config.ts",
-    "test:system": "vitest run --config vitest.system.config.ts",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
     "clean": "rimraf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "handlebars": "^4.7.8",
+    "@vibe-validate/git": "0.20.1",
     "ignore": "^7.0.5",
     "picomatch": "^4.0.3",
     "which": "^5.0.0",

package/dist/link-auth/build-headers.d.ts

@@ -1,34 +0,0 @@
-/**
- * Render auth-header templates with rendered values, and a structural
- * redaction helper for serialization.
- *
- * `buildHeaders` renders each header value template against a context that
- * carries `${token}` plus any named captures / vars from the rewrite step.
- * `redactHeaders` masks `Authorization` values for any caller that needs to
- * serialize headers into logs, errors, or cache entries — the design's §8
- * "tokens never leak" claim depends on every such site routing through this.
- *
- * Per design issue #113 §4 (auth.headers vocabulary) and §8 (redaction is
- * structural; Authorization values never appear in serialized output).
- */
-export declare const REDACTED_VALUE = "<redacted>";
-/**
- * Render a map of header templates into a map of concrete header values.
- *
- * @throws {TemplateMissingVarError} if a header template references an
- *   unknown context key
- * @throws {TemplateSyntaxError} from a malformed template expression
- * @throws {UnknownTransformError} from a template calling an unknown transform
- */
-export declare function buildHeaders(templates: Record<string, string>, context: Record<string, string>): Record<string, string>;
-/**
- * Return a copy of `headers` with sensitive values replaced by `REDACTED_VALUE`.
- * Header-name matching is case-insensitive but exact (no prefix matching) — a
- * header like `X-Authorization-Foo` is NOT considered sensitive.
- *
- * **Input must be a plain key-value object.** A `Headers` instance (Web Fetch
- * API) or a `Map` yields `[]` from `Object.entries` and would silently no-op
- * redaction — converting to a plain object is the caller's responsibility.
- */
-export declare function redactHeaders(headers: Record<string, string>): Record<string, string>;
-//# sourceMappingURL=build-headers.d.ts.map

package/dist/link-auth/build-headers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-headers.d.ts","sourceRoot":"","sources":["../../src/link-auth/build-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,eAAO,MAAM,cAAc,eAAe,CAAC;AAc3C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMrF"}

package/dist/link-auth/build-headers.js

@@ -1,58 +0,0 @@
-/**
- * Render auth-header templates with rendered values, and a structural
- * redaction helper for serialization.
- *
- * `buildHeaders` renders each header value template against a context that
- * carries `${token}` plus any named captures / vars from the rewrite step.
- * `redactHeaders` masks `Authorization` values for any caller that needs to
- * serialize headers into logs, errors, or cache entries — the design's §8
- * "tokens never leak" claim depends on every such site routing through this.
- *
- * Per design issue #113 §4 (auth.headers vocabulary) and §8 (redaction is
- * structural; Authorization values never appear in serialized output).
- */
-import { renderTemplate } from './template.js';
-export const REDACTED_VALUE = '<redacted>';
-/**
- * Header names whose values must be masked when serialized.
- *
- * v1 ships only `authorization` because that is the only secret-bearing
- * header the current macros emit. **Omission is the security risk** — any
- * future macro that emits a header carrying a secret (`Cookie`,
- * `Proxy-Authorization`, `X-API-Key`, custom bearer-style headers) must add
- * that name here, or the token will silently leak through serialization.
- * Extending the set is not the dangerous edit; forgetting to extend it is.
- */
-const SENSITIVE_HEADER_NAMES = new Set(['authorization']);
-/**
- * Render a map of header templates into a map of concrete header values.
- *
- * @throws {TemplateMissingVarError} if a header template references an
- *   unknown context key
- * @throws {TemplateSyntaxError} from a malformed template expression
- * @throws {UnknownTransformError} from a template calling an unknown transform
- */
-export function buildHeaders(templates, context) {
-    const headers = Object.create(null);
-    for (const [name, template] of Object.entries(templates)) {
-        headers[name] = renderTemplate(template, context);
-    }
-    return headers;
-}
-/**
- * Return a copy of `headers` with sensitive values replaced by `REDACTED_VALUE`.
- * Header-name matching is case-insensitive but exact (no prefix matching) — a
- * header like `X-Authorization-Foo` is NOT considered sensitive.
- *
- * **Input must be a plain key-value object.** A `Headers` instance (Web Fetch
- * API) or a `Map` yields `[]` from `Object.entries` and would silently no-op
- * redaction — converting to a plain object is the caller's responsibility.
- */
-export function redactHeaders(headers) {
-    const redacted = Object.create(null);
-    for (const [name, value] of Object.entries(headers)) {
-        redacted[name] = SENSITIVE_HEADER_NAMES.has(name.toLowerCase()) ? REDACTED_VALUE : value;
-    }
-    return redacted;
-}
-//# sourceMappingURL=build-headers.js.map

package/dist/link-auth/build-headers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build-headers.js","sourceRoot":"","sources":["../../src/link-auth/build-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiC,EACjC,OAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA+B;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3F,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/link-auth/expand-macro.d.ts

@@ -1,38 +0,0 @@
-/**
- * Macro loader + expander.
- *
- * Loads the bundled `macros.yaml` once at module init and exposes
- * `expandMacro(name, overrides?)` which deep-merges the named macro with any
- * adopter overrides. The merge is "adopter wins": objects merge recursively,
- * arrays and primitives are replaced wholesale (no element-wise array merge).
- *
- * The shipped macro file is at `link-auth/macros.yaml`, copied into the dist
- * tree by `packages/dev-tools/src/copy-yaml-assets.ts` during build so the
- * runtime `fs.readFileSync(new URL('./macros.yaml', import.meta.url))`
- * resolves in both source-mode (vitest) and built-mode (dist).
- *
- * Per design issue #113 §5 (macros are config, not a privileged code path).
- */
-/**
- * Thrown when a `use: <name>` references a macro not in the shipped set.
- * Message lists the available macros so a typo surfaces clearly.
- */
-export declare class UnknownMacroError extends Error {
-    constructor(name: string, available: readonly string[]);
-}
-/**
- * Look up a macro by name and deep-merge optional adopter overrides on top.
- *
- * Merge semantics:
- *   - Plain objects merge recursively (sibling keys preserved).
- *   - Arrays are replaced wholesale (override's array wins; no concat).
- *   - Primitives are replaced.
- *   - `undefined` in an override is treated as "not provided" (base wins).
- *
- * The returned object and all nested plain objects use null prototypes so
- * `__proto__` / `constructor` keys can never poison consumers.
- *
- * @throws {UnknownMacroError} if `name` is not in the shipped macro set
- */
-export declare function expandMacro(name: string, overrides?: Record<string, unknown>): Record<string, unknown>;
-//# sourceMappingURL=expand-macro.d.ts.map

package/dist/link-auth/expand-macro.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"expand-macro.d.ts","sourceRoot":"","sources":["../../src/link-auth/expand-macro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyCH;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE;CAIvD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/link-auth/expand-macro.js

@@ -1,133 +0,0 @@
-/**
- * Macro loader + expander.
- *
- * Loads the bundled `macros.yaml` once at module init and exposes
- * `expandMacro(name, overrides?)` which deep-merges the named macro with any
- * adopter overrides. The merge is "adopter wins": objects merge recursively,
- * arrays and primitives are replaced wholesale (no element-wise array merge).
- *
- * The shipped macro file is at `link-auth/macros.yaml`, copied into the dist
- * tree by `packages/dev-tools/src/copy-yaml-assets.ts` during build so the
- * runtime `fs.readFileSync(new URL('./macros.yaml', import.meta.url))`
- * resolves in both source-mode (vitest) and built-mode (dist).
- *
- * Per design issue #113 §5 (macros are config, not a privileged code path).
- */
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import { parse as parseYaml } from 'yaml';
-let macrosCache;
-/**
- * Load macros lazily on first use rather than at module init.
- *
- * Why lazy: vitest tests elsewhere in the repo mock `node:fs` (replacing
- * `readFileSync` with `vi.fn()` that returns `undefined`). If we eagerly read
- * at module load, any unrelated test that imports `@vibe-agent-toolkit/utils`
- * and mocks fs crashes inside `parseYaml(undefined)` — module-init code runs
- * unconditionally, before the mock-setup intent reaches our file.
- *
- * Lazy load makes module import side-effect-free; only callers of
- * `expandMacro` pay the fs cost. `macrosPath` is also computed here (not at
- * module top level) so that merely importing this module leaves no `new URL()`
- * reference for bundler static analysis to trip over.
- */
-function getMacros() {
-    if (macrosCache !== undefined)
-        return macrosCache;
-    // Path is derived from `import.meta.url`, not user input — points at the
-    // shipped macros.yaml asset next to this module in both src and dist trees.
-    const macrosPath = fileURLToPath(new URL('./macros.yaml', import.meta.url));
-    // eslint-disable-next-line security/detect-non-literal-fs-filename
-    const macrosFileContent = readFileSync(macrosPath, 'utf8');
-    const parsed = parseYaml(macrosFileContent);
-    if (!isPlainObject(parsed)) {
-        throw new Error('macros.yaml: expected top-level object mapping macro name → provider config.');
-    }
-    macrosCache = freezeMacros(parsed);
-    return macrosCache;
-}
-/**
- * Thrown when a `use: <name>` references a macro not in the shipped set.
- * Message lists the available macros so a typo surfaces clearly.
- */
-export class UnknownMacroError extends Error {
-    constructor(name, available) {
-        super(`Unknown macro "${name}". Available: ${available.join(', ')}.`);
-        this.name = 'UnknownMacroError';
-    }
-}
-/**
- * Look up a macro by name and deep-merge optional adopter overrides on top.
- *
- * Merge semantics:
- *   - Plain objects merge recursively (sibling keys preserved).
- *   - Arrays are replaced wholesale (override's array wins; no concat).
- *   - Primitives are replaced.
- *   - `undefined` in an override is treated as "not provided" (base wins).
- *
- * The returned object and all nested plain objects use null prototypes so
- * `__proto__` / `constructor` keys can never poison consumers.
- *
- * @throws {UnknownMacroError} if `name` is not in the shipped macro set
- */
-export function expandMacro(name, overrides) {
-    const macros = getMacros();
-    const base = macros[name];
-    if (base === undefined) {
-        throw new UnknownMacroError(name, Object.keys(macros));
-    }
-    if (overrides === undefined) {
-        return cloneWithNullProto(base);
-    }
-    const merged = deepMerge(base, overrides);
-    // Top-level result is guaranteed object here because base is.
-    return merged;
-}
-function deepMerge(base, override) {
-    if (override === undefined)
-        return base;
-    if (!isPlainObject(base) || !isPlainObject(override))
-        return cloneValue(override);
-    const result = Object.create(null);
-    for (const [key, value] of Object.entries(base)) {
-        result[key] = cloneValue(value);
-    }
-    for (const [key, value] of Object.entries(override)) {
-        const existing = Object.hasOwn(result, key) ? result[key] : undefined;
-        if (isPlainObject(existing) && isPlainObject(value)) {
-            result[key] = deepMerge(existing, value);
-        }
-        else {
-            result[key] = cloneValue(value);
-        }
-    }
-    return result;
-}
-function cloneValue(value) {
-    if (Array.isArray(value))
-        return value.map(cloneValue);
-    if (isPlainObject(value))
-        return cloneWithNullProto(value);
-    return value;
-}
-function cloneWithNullProto(obj) {
-    const cloned = Object.create(null);
-    for (const [key, value] of Object.entries(obj)) {
-        cloned[key] = cloneValue(value);
-    }
-    return cloned;
-}
-function freezeMacros(parsed) {
-    const frozen = Object.create(null);
-    for (const [name, value] of Object.entries(parsed)) {
-        if (!isPlainObject(value)) {
-            throw new Error(`macros.yaml: macro "${name}" is not an object.`);
-        }
-        frozen[name] = cloneWithNullProto(value);
-    }
-    return frozen;
-}
-function isPlainObject(v) {
-    return typeof v === 'object' && v !== null && !Array.isArray(v);
-}
-//# sourceMappingURL=expand-macro.js.map

package/dist/link-auth/expand-macro.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"expand-macro.js","sourceRoot":"","sources":["../../src/link-auth/expand-macro.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,IAAI,WAAgE,CAAC;AAErE;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS;IAChB,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAElD,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAY,CAAC;IAEvD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,IAAY,EAAE,SAA4B;QACpD,KAAK,CAAC,kBAAkB,IAAI,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,SAAmC;IAEnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,8DAA8D;IAC9D,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,QAAiB;IACjD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA4B;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B;IACnD,MAAM,MAAM,GAA4C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,qBAAqB,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/link-auth/macros.yaml

@@ -1,50 +0,0 @@
-# linkAuth provider macros — shipped defaults referenced by `use: <name>` in
-# adopter `vibe-agent-toolkit.config.yaml` files.
-#
-# Each entry is a full provider config in the §4 vocabulary (match, rewrite,
-# auth, token, check). Adopters reference a macro by name and may deep-merge
-# overrides on top — see design issue #113 §5.
-#
-# Adding a new host is intended to be a config-only PR: append an entry here
-# and add unit tests. Only `vocabulary` changes (e.g. a new transform) require
-# engine code.
-
-github:
-  match:
-    host: github.com
-  rewrite:
-    - when: '^https://github\.com/(?<owner>[^/]+)/(?<repo>[^/]+)/(?:blob|tree)/(?<ref>[^/]+)/(?<path>.+)$'
-      to: 'https://api.github.com/repos/${owner}/${repo}/contents/${path}?ref=${ref}'
-  auth:
-    headers:
-      Authorization: 'Bearer ${token}'
-      Accept: application/vnd.github+json
-  token:
-    - command: gh auth token
-    - env: GITHUB_TOKEN
-  check:
-    method: GET
-    aliveStatus: [200]
-    notFoundMeaning: ambiguous
-
-sharepoint:
-  match:
-    host: '*.sharepoint.com'
-    excludeHost:
-      - '*-my.sharepoint.com'
-  rewrite:
-    - when: '^(?<u>https://.+)$'
-      vars:
-        shareId: 'u!${base64url(u)}'
-      to: 'https://graph.microsoft.com/v1.0/shares/${shareId}/driveItem'
-  auth:
-    headers:
-      Authorization: 'Bearer ${token}'
-  # SharePoint has no zero-config token source (design §5.1 note): a SharePoint-
-  # scoped token requires an Entra app registration; the stock `az` token does
-  # not work. Adopter must supply their own token command.
-  token: []
-  check:
-    method: GET
-    aliveStatus: [200]
-    notFoundMeaning: dead

package/dist/link-auth/resolve-token.d.ts

@@ -1,83 +0,0 @@
-/**
- * Token resolution — ordered, first-non-empty-wins.
- *
- * Iterates a provider's `token` source list and returns the first source that
- * yields a non-empty value. Two source shapes:
- *   - `{ env: "NAME" }`                — read from process env (no trimming)
- *   - `{ command: argv }`              — run a command, return trimmed stdout
- *   - `{ command: "gh auth token" }`   — convenience: whitespace-tokenized into
- *     argv. **Not** passed through a shell — operators (`|`, `&&`, `$(...)`)
- *     become literal argv elements, per the design's §6.1 sharp-edge note.
- *
- * Command sources can be disabled at runtime with `VAT_LINKAUTH_ALLOW_COMMAND=0`
- * (or by passing `allowCommand: false` in deps). Useful in security-sensitive
- * environments where arbitrary command execution is undesirable.
- *
- * Returns `undefined` if every source fails or yields an empty/whitespace
- * value — the caller's `resolveAuthenticatedUrl` translates that to the
- * `unverified` outcome (surfaced as `LINK_AUTH_UNVERIFIED` by the validator).
- *
- * Per design issue #113 §4 (token vocabulary) and §6.1 (command execution,
- * `safeExecSync`-backed, `shell: false`).
- */
-export type TokenSource = {
-    readonly env: string;
-} | {
-    readonly command: string | readonly string[];
-};
-export interface TokenResolutionDeps {
-    /**
-     * Environment lookup map. Defaults to `process.env`. Injectable for tests so
-     * unit tests don't depend on ambient environment state.
-     */
-    readonly env: Record<string, string | undefined>;
-    /**
-     * Command runner. Defaults to `safeExecResult`-wrapped invocation. Injectable
-     * for tests. Receives argv; returns `success` + `stdout`. Should NOT throw
-     * for normal exec failures (return `success: false` instead). Throws are
-     * propagated by `resolveToken` — they indicate operator-level bugs.
-     */
-    readonly runCommand: (argv: readonly string[]) => {
-        success: boolean;
-        stdout: string;
-    };
-    /**
-     * Whether `{ command: ... }` sources are allowed. Defaults to reading
-     * `VAT_LINKAUTH_ALLOW_COMMAND` from the resolved `env` map (not ambient
-     * `process.env`), so a caller supplying a curated `deps.env` can control the
-     * flag without touching real process state. Set to `false` (or set
-     * `VAT_LINKAUTH_ALLOW_COMMAND=0` in the env) to skip all command sources and
-     * rely solely on env-var sources — useful in locked-down CI or security reviews.
-     */
-    readonly allowCommand: boolean;
-}
-/**
- * Return a copy of the given env with all `GIT_*` keys removed. Case-insensitive
- * on the key so Windows env vars (which are case-insensitive at the OS level,
- * though `process.env` preserves original case) can't sneak through as e.g.
- * `Git_Dir`.
- *
- * Exported for unit testing and for callers assembling their own `runCommand`
- * who want the exact same scrub `defaultRunCommand` applies.
- *
- * Rationale: `vat resources validate` is often invoked from git pre-commit
- * hooks, which pre-set `GIT_DIR` / `GIT_WORK_TREE` / `GIT_INDEX_FILE`. These
- * poison any nested tool that shells out to git, notably `gh auth token`.
- */
-export declare function scrubGitEnv(source: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
-/**
- * Default `runCommand` implementation — exported so callers that want to
- * memoize per-validate-run can wrap it without duplicating the spawn logic.
- * Forwards to `safeExecResult` (no shell, argv-based), with `GIT_*` vars
- * stripped from the child env — see {@link scrubGitEnv}.
- */
-export declare const defaultRunCommand: TokenResolutionDeps['runCommand'];
-/**
- * Resolve a token from an ordered list of sources.
- *
- * @returns the first non-empty value, or `undefined` if every source failed.
- * @throws whatever the injected `runCommand` throws (operator-level bug; not
- *   swallowed). Standard `safeExecResult` does not throw under normal use.
- */
-export declare function resolveToken(sources: readonly TokenSource[], deps?: Partial<TokenResolutionDeps>): string | undefined;
-//# sourceMappingURL=resolve-token.d.ts.map

package/dist/link-auth/resolve-token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-token.d.ts","sourceRoot":"","sources":["../../src/link-auth/resolve-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEtG,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvF;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAIxE;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,mBAAmB,CAAC,YAAY,CAO/D,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,IAAI,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAClC,MAAM,GAAG,SAAS,CAWpB"}