@vibe-agent-toolkit/utils 0.2.0-rc.2 → 0.2.0-rc.4

package/dist/link-auth/resolve-token.js

@@ -1,101 +0,0 @@
-/**
- * Token resolution — ordered, first-non-empty-wins.
- *
- * Iterates a provider's `token` source list and returns the first source that
- * yields a non-empty value. Two source shapes:
- *   - `{ env: "NAME" }`                — read from process env (no trimming)
- *   - `{ command: argv }`              — run a command, return trimmed stdout
- *   - `{ command: "gh auth token" }`   — convenience: whitespace-tokenized into
- *     argv. **Not** passed through a shell — operators (`|`, `&&`, `$(...)`)
- *     become literal argv elements, per the design's §6.1 sharp-edge note.
- *
- * Command sources can be disabled at runtime with `VAT_LINKAUTH_ALLOW_COMMAND=0`
- * (or by passing `allowCommand: false` in deps). Useful in security-sensitive
- * environments where arbitrary command execution is undesirable.
- *
- * Returns `undefined` if every source fails or yields an empty/whitespace
- * value — the caller's `resolveAuthenticatedUrl` translates that to the
- * `unverified` outcome (surfaced as `LINK_AUTH_UNVERIFIED` by the validator).
- *
- * Per design issue #113 §4 (token vocabulary) and §6.1 (command execution,
- * `safeExecSync`-backed, `shell: false`).
- */
-import { safeExecResult } from '../safe-exec.js';
-/**
- * Return a copy of the given env with all `GIT_*` keys removed. Case-insensitive
- * on the key so Windows env vars (which are case-insensitive at the OS level,
- * though `process.env` preserves original case) can't sneak through as e.g.
- * `Git_Dir`.
- *
- * Exported for unit testing and for callers assembling their own `runCommand`
- * who want the exact same scrub `defaultRunCommand` applies.
- *
- * Rationale: `vat resources validate` is often invoked from git pre-commit
- * hooks, which pre-set `GIT_DIR` / `GIT_WORK_TREE` / `GIT_INDEX_FILE`. These
- * poison any nested tool that shells out to git, notably `gh auth token`.
- */
-export function scrubGitEnv(source) {
-    return Object.fromEntries(Object.entries(source).filter(([k]) => !k.toUpperCase().startsWith('GIT_')));
-}
-/**
- * Default `runCommand` implementation — exported so callers that want to
- * memoize per-validate-run can wrap it without duplicating the spawn logic.
- * Forwards to `safeExecResult` (no shell, argv-based), with `GIT_*` vars
- * stripped from the child env — see {@link scrubGitEnv}.
- */
-export const defaultRunCommand = (argv) => {
-    if (argv.length === 0)
-        return { success: false, stdout: '' };
-    const [bin, ...args] = argv;
-    if (bin === undefined)
-        return { success: false, stdout: '' };
-    const result = safeExecResult(bin, [...args], { encoding: 'utf8', env: scrubGitEnv(process.env) });
-    const stdout = typeof result.stdout === 'string' ? result.stdout : result.stdout.toString('utf8');
-    return { success: result.success, stdout };
-};
-/**
- * Resolve a token from an ordered list of sources.
- *
- * @returns the first non-empty value, or `undefined` if every source failed.
- * @throws whatever the injected `runCommand` throws (operator-level bug; not
- *   swallowed). Standard `safeExecResult` does not throw under normal use.
- */
-export function resolveToken(sources, deps) {
-    const env = deps?.env ?? process.env;
-    const runCommand = deps?.runCommand ?? defaultRunCommand;
-    const allowCommand = deps?.allowCommand ?? (env['VAT_LINKAUTH_ALLOW_COMMAND'] !== '0');
-    for (const source of sources) {
-        if (!allowCommand && 'command' in source)
-            continue;
-        const value = tryResolveSource(source, env, runCommand);
-        if (value !== undefined && value.length > 0)
-            return value;
-    }
-    return undefined;
-}
-function tryResolveSource(source, env, runCommand) {
-    if ('env' in source) {
-        // Object.hasOwn defends against env names like "__proto__" returning
-        // Object.prototype via the prototype chain.
-        if (!Object.hasOwn(env, source.env))
-            return undefined;
-        return env[source.env];
-    }
-    const argv = toArgv(source.command);
-    if (argv.length === 0)
-        return undefined;
-    const result = runCommand(argv);
-    if (!result.success)
-        return undefined;
-    const trimmed = result.stdout.trim();
-    return trimmed.length === 0 ? undefined : trimmed;
-}
-function toArgv(command) {
-    if (Array.isArray(command))
-        return command;
-    // Whitespace-tokenize the string form. Empty segments (from multiple spaces)
-    // are filtered. Shell operators ('|', '&&', etc.) become literal argv, NOT
-    // pipes — see design §6.1.
-    return command.split(/\s+/).filter((s) => s.length > 0);
-}
-//# sourceMappingURL=resolve-token.js.map

package/dist/link-auth/resolve-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-token.js","sourceRoot":"","sources":["../../src/link-auth/resolve-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA8BjD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,MAAyB;IACnD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACvD,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsC,CAAC,IAAI,EAAE,EAAE;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA+B,EAC/B,IAAmC;IAEnC,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,iBAAiB,CAAC;IACzD,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,KAAK,GAAG,CAAC,CAAC;IAEvF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,IAAI,SAAS,IAAI,MAAM;YAAE,SAAS;QACnD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAmB,EACnB,GAAuC,EACvC,UAA6C;IAE7C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;QACpB,qEAAqE;QACrE,4CAA4C;QAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,SAAS,MAAM,CAAC,OAAmC;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,6EAA6E;IAC7E,2EAA2E;IAC3E,2BAA2B;IAC3B,OAAQ,OAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/link-auth/resolve.d.ts

@@ -1,102 +0,0 @@
-/**
- * Public API for the linkAuth pure engine.
- *
- * `resolveAuthenticatedUrl(url, config)` is the single entry point per design
- * §6: select the first provider whose `match.host` claims the URL, run its
- * rewrite pipeline, resolve a token, build the auth headers, and return
- * everything the caller needs to issue an authenticated fetch.
- *
- * Three outcomes:
- *   - `{ fetchUrl, headers }`              — ready to fetch (provider claimed,
- *                                            rewrite matched, token resolved)
- *   - `{ outcome: 'unsupported' }`         — no provider claims the host, OR
- *                                            host matched but no rewrite did
- *                                            (per §4: "the provider does not
- *                                            claim the URL for rewriting")
- *   - `{ outcome: 'unverified', reason }`  — claimed and rewrote, but no token
- *                                            source resolved a non-empty value
- *
- * Per design issue #113 §6.
- */
-import { type TokenResolutionDeps, type TokenSource } from './resolve-token.js';
-import { type RewriteRule } from './rewrite.js';
-import { type ProviderMatch } from './select-provider.js';
-export interface ProviderAuth {
-    readonly headers: Record<string, string>;
-}
-/**
- * Optional content-fetch header overrides (design issue #113 §6.2).
- *
- * Health-check and content retrieval often need different `Accept` (or other)
- * headers. The canonical example: GitHub's `application/vnd.github+json`
- * returns 200 for any size but omits bytes >1 MiB, while
- * `application/vnd.github.raw` streams the bytes inline. The provider declares
- * `auth.headers` for health-check and an optional `fetch.headers` for content
- * retrieval. Both are templated against the same context (URL captures + token).
- */
-export interface ProviderFetch {
-    readonly headers: Record<string, string>;
-}
-export interface ProviderCheck {
-    readonly method: 'GET' | 'HEAD';
-    readonly aliveStatus: readonly number[];
-    readonly notFoundMeaning: 'ambiguous' | 'dead';
-}
-export interface Provider {
-    readonly match: ProviderMatch;
-    readonly rewrite: readonly RewriteRule[];
-    readonly auth: ProviderAuth;
-    /**
-     * Optional — present when a provider needs different headers for content
-     * retrieval than for health-check. Absent for hosts where one header set
-     * does both jobs.
-     */
-    readonly fetch?: ProviderFetch;
-    readonly token: readonly TokenSource[];
-    readonly check: ProviderCheck;
-}
-export interface LinkAuthConfig {
-    readonly providers: readonly Provider[];
-    /**
-     * Optional content-cache config (consumed by the slice-3 content-fetch
-     * primitive, not by the engine itself). The engine stays stateless; this
-     * field rides along on the config object so the primitive doesn't need a
-     * second source of truth.
-     */
-    readonly cache?: {
-        readonly ttlMinutes?: number;
-    };
-}
-export type ResolveOutcome = {
-    readonly fetchUrl: string;
-    readonly headers: Record<string, string>;
-    /**
-     * Expanded fetch-mode headers, only present when the provider declared
-     * a `fetch` block. Templated against the same context as `headers`
-     * (URL captures + resolved token), so callers do not need to re-resolve
-     * the token to send these. Per §6.2 — content-fetch consumers send
-     * these instead of (or merged over) `headers` for the request body.
-     */
-    readonly fetchHeaders?: Record<string, string>;
-    /**
-     * The matched provider's `check` block, passed through so the post-fetch
-     * classifier (in `packages/resources`) can route status codes to outcomes
-     * without re-running `selectProvider`. Reading this from the engine —
-     * rather than asking the validator to re-derive it — keeps the
-     * provider-match decision in exactly one place.
-     */
-    readonly check: ProviderCheck;
-} | {
-    readonly outcome: 'unsupported';
-} | {
-    readonly outcome: 'unverified';
-    readonly reason: string;
-};
-/**
- * Resolve an authenticated fetch plan for `url` against the configured providers.
- *
- * @param deps - Optional dependency injection for token resolution (`env` map
- *   + `runCommand`). Production callers omit this; tests supply mocks.
- */
-export declare function resolveAuthenticatedUrl(url: string, config: LinkAuthConfig, deps?: Partial<TokenResolutionDeps>): ResolveOutcome;
-//# sourceMappingURL=resolve.d.ts.map

package/dist/link-auth/resolve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/link-auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,WAAW,EAAc,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,sBAAsB,CAAC;AAE1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,WAAW,GAAG,MAAM,CAAC;CAChD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;CAC/B,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,EACtB,IAAI,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAClC,cAAc,CAqChB"}

package/dist/link-auth/resolve.js

@@ -1,66 +0,0 @@
-/**
- * Public API for the linkAuth pure engine.
- *
- * `resolveAuthenticatedUrl(url, config)` is the single entry point per design
- * §6: select the first provider whose `match.host` claims the URL, run its
- * rewrite pipeline, resolve a token, build the auth headers, and return
- * everything the caller needs to issue an authenticated fetch.
- *
- * Three outcomes:
- *   - `{ fetchUrl, headers }`              — ready to fetch (provider claimed,
- *                                            rewrite matched, token resolved)
- *   - `{ outcome: 'unsupported' }`         — no provider claims the host, OR
- *                                            host matched but no rewrite did
- *                                            (per §4: "the provider does not
- *                                            claim the URL for rewriting")
- *   - `{ outcome: 'unverified', reason }`  — claimed and rewrote, but no token
- *                                            source resolved a non-empty value
- *
- * Per design issue #113 §6.
- */
-import { buildHeaders } from './build-headers.js';
-import { resolveToken, } from './resolve-token.js';
-import { rewriteUrl } from './rewrite.js';
-import { selectProvider } from './select-provider.js';
-/**
- * Resolve an authenticated fetch plan for `url` against the configured providers.
- *
- * @param deps - Optional dependency injection for token resolution (`env` map
- *   + `runCommand`). Production callers omit this; tests supply mocks.
- */
-export function resolveAuthenticatedUrl(url, config, deps) {
-    const provider = selectProvider(url, config.providers);
-    if (provider === undefined)
-        return { outcome: 'unsupported' };
-    const rewrite = rewriteUrl(url, provider.rewrite);
-    if (!rewrite.matched)
-        return { outcome: 'unsupported' };
-    const token = resolveToken(provider.token, deps);
-    // eslint-disable-next-line security/detect-possible-timing-attacks -- compare to undefined sentinel, not secret content
-    if (token === undefined) {
-        return {
-            outcome: 'unverified',
-            reason: 'No token source resolved a non-empty value — configure `token` or log in.',
-        };
-    }
-    // Headers see captures + vars + the resolved token. The resolved token wins
-    // over any regex capture named "token" (later in Object.assign wins), so
-    // URL-derived data never leaks into Authorization values.
-    const headerContext = Object.create(null);
-    Object.assign(headerContext, rewrite.context);
-    headerContext['token'] = token;
-    const headers = buildHeaders(provider.auth.headers, headerContext);
-    // Expand fetch.headers against the same context so the resolved token wins
-    // over any URL-captured "token" group here too — the precedence discipline
-    // applies to both header sets, not just auth.headers.
-    const fetchHeaders = provider.fetch === undefined
-        ? undefined
-        : buildHeaders(provider.fetch.headers, headerContext);
-    return {
-        fetchUrl: rewrite.rewrittenUrl,
-        headers,
-        ...(fetchHeaders === undefined ? {} : { fetchHeaders }),
-        check: provider.check,
-    };
-}
-//# sourceMappingURL=resolve.js.map

package/dist/link-auth/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/link-auth/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAoB,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAsB,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA6E1E;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAW,EACX,MAAsB,EACtB,IAAmC;IAEnC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAE9D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAExD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,wHAAwH;IACxH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IACpE,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,aAAa,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAE/B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnE,2EAA2E;IAC3E,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,YAAY,GAChB,QAAQ,CAAC,KAAK,KAAK,SAAS;QAC1B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC1D,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,OAAO;QACP,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;QACvD,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;AACJ,CAAC"}

package/dist/link-auth/rewrite.d.ts

@@ -1,52 +0,0 @@
-/**
- * Rewrite pipeline: ordered when → vars → to.
- *
- * Each provider declares one or more rewrite rules. For an input URL the
- * pipeline strips `?query` and `#fragment`, finds the first rule whose
- * `when` regex matches, computes `vars` (templates over captures), and
- * renders the `to` template against captures + vars merged. The merged
- * context flows out so downstream header templates can interpolate the
- * same variables.
- *
- * Per design issue #113 §4 (vocabulary) and §5.2 (fragment/query
- * stripping must precede a greedy `(?<path>.+)` capture).
- */
-export interface RewriteRule {
-    readonly when: string;
-    readonly vars?: Record<string, string>;
-    readonly to: string;
-}
-export type RewriteOutcome = {
-    readonly matched: true;
-    readonly rewrittenUrl: string;
-    readonly context: Record<string, string>;
-} | {
-    readonly matched: false;
-};
-/**
- * Thrown when a rule's `when` field is not a compilable regex.
- */
-export declare class InvalidRewriteRuleError extends Error {
-    constructor(pattern: string, cause: unknown);
-}
-/**
- * Thrown when a `vars` key collides with a named capture in `when`.
- * Adopter must rename one — vars cannot shadow captures (the design's
- * intent is captures + vars in a single namespace).
- */
-export declare class VarCaptureCollisionError extends Error {
-    constructor(name: string);
-}
-/**
- * Apply an ordered list of rewrite rules to a URL.
- *
- * @returns `{ matched: true, rewrittenUrl, context }` for the first matching
- *   rule, or `{ matched: false }` if no rule claims the URL.
- * @throws {InvalidRewriteRuleError} if a `when` field does not compile
- * @throws {VarCaptureCollisionError} if a vars name shadows a capture name
- * @throws {TemplateMissingVarError} from a template referencing an unknown name
- * @throws {TemplateSyntaxError} from a malformed template expression
- * @throws {UnknownTransformError} from a template calling an unknown transform
- */
-export declare function rewriteUrl(url: string, rules: readonly RewriteRule[]): RewriteOutcome;
-//# sourceMappingURL=rewrite.d.ts.map

package/dist/link-auth/rewrite.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../src/link-auth/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC;AAEhC;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK5C;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,IAAI,EAAE,MAAM;CAMzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,cAAc,CAerF"}

package/dist/link-auth/rewrite.js

@@ -1,102 +0,0 @@
-/**
- * Rewrite pipeline: ordered when → vars → to.
- *
- * Each provider declares one or more rewrite rules. For an input URL the
- * pipeline strips `?query` and `#fragment`, finds the first rule whose
- * `when` regex matches, computes `vars` (templates over captures), and
- * renders the `to` template against captures + vars merged. The merged
- * context flows out so downstream header templates can interpolate the
- * same variables.
- *
- * Per design issue #113 §4 (vocabulary) and §5.2 (fragment/query
- * stripping must precede a greedy `(?<path>.+)` capture).
- */
-import { renderTemplate } from './template.js';
-/**
- * Thrown when a rule's `when` field is not a compilable regex.
- */
-export class InvalidRewriteRuleError extends Error {
-    constructor(pattern, cause) {
-        const reason = cause instanceof Error ? cause.message : String(cause);
-        super(`Invalid rewrite rule "when" regex: ${pattern}. ${reason}`);
-        this.name = 'InvalidRewriteRuleError';
-    }
-}
-/**
- * Thrown when a `vars` key collides with a named capture in `when`.
- * Adopter must rename one — vars cannot shadow captures (the design's
- * intent is captures + vars in a single namespace).
- */
-export class VarCaptureCollisionError extends Error {
-    constructor(name) {
-        super(`Rewrite var "${name}" collides with a regex capture of the same name. Rename one.`);
-        this.name = 'VarCaptureCollisionError';
-    }
-}
-/**
- * Apply an ordered list of rewrite rules to a URL.
- *
- * @returns `{ matched: true, rewrittenUrl, context }` for the first matching
- *   rule, or `{ matched: false }` if no rule claims the URL.
- * @throws {InvalidRewriteRuleError} if a `when` field does not compile
- * @throws {VarCaptureCollisionError} if a vars name shadows a capture name
- * @throws {TemplateMissingVarError} from a template referencing an unknown name
- * @throws {TemplateSyntaxError} from a malformed template expression
- * @throws {UnknownTransformError} from a template calling an unknown transform
- */
-export function rewriteUrl(url, rules) {
-    const stripped = stripFragmentAndQuery(url);
-    for (const rule of rules) {
-        const regex = compileWhen(rule.when);
-        const match = regex.exec(stripped);
-        if (match === null)
-            continue;
-        const captures = collectCaptures(match);
-        const context = computeContext(captures, rule.vars);
-        const rewrittenUrl = renderTemplate(rule.to, context);
-        return { matched: true, rewrittenUrl, context };
-    }
-    return { matched: false };
-}
-function stripFragmentAndQuery(url) {
-    const idx = url.search(/[?#]/);
-    return idx === -1 ? url : url.slice(0, idx);
-}
-function compileWhen(pattern) {
-    try {
-        // Rule patterns originate in trusted config (see design §8); runtime
-        // compilation is intentional, not user-input regex injection.
-        // eslint-disable-next-line security/detect-non-literal-regexp
-        return new RegExp(pattern);
-    }
-    catch (e) {
-        throw new InvalidRewriteRuleError(pattern, e);
-    }
-}
-function collectCaptures(match) {
-    const captures = Object.create(null);
-    // The lib typedef for RegExpMatchArray.groups says values are `string`, but
-    // optional named groups that did not match show up at runtime as `undefined`.
-    // Cast to reflect runtime reality so the filter below is type-meaningful.
-    const groups = (match.groups ?? {});
-    for (const [key, value] of Object.entries(groups)) {
-        if (value !== undefined) {
-            captures[key] = value;
-        }
-    }
-    return captures;
-}
-function computeContext(captures, vars) {
-    const context = Object.create(null);
-    Object.assign(context, captures);
-    if (vars === undefined)
-        return context;
-    for (const [name, template] of Object.entries(vars)) {
-        if (Object.hasOwn(captures, name)) {
-            throw new VarCaptureCollisionError(name);
-        }
-        context[name] = renderTemplate(template, captures);
-    }
-    return context;
-}
-//# sourceMappingURL=rewrite.js.map

package/dist/link-auth/rewrite.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../src/link-auth/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgB/C;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,KAAc;QACzC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,KAAK,CAAC,sCAAsC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,IAAY;QACtB,KAAK,CACH,gBAAgB,IAAI,+DAA+D,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAA6B;IACnE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAE7B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,qEAAqE;QACrE,8DAA8D;QAC9D,8DAA8D;QAC9D,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC/D,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAuC,CAAC;IAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,QAAgC,EAChC,IAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/link-auth/select-provider.d.ts

@@ -1,30 +0,0 @@
-/**
- * Provider selection by URL host.
- *
- * Iterates the configured providers in order; the first one whose `match.host`
- * glob matches the URL hostname (and no `match.excludeHost` glob excludes it)
- * claims the URL. Returns `undefined` if no provider claims it — the caller
- * then falls back to anonymous link-checking.
- *
- * Hostname matching is case-insensitive per RFC 3986. Pattern syntax follows
- * `picomatch` (already a utils dep): `*` matches any character, `**` matches
- * across `/`. For hostnames (no slashes) the practical effect is that `*`
- * happily matches dots — e.g. `*.sharepoint.com` claims both
- * `contoso.sharepoint.com` and `foo.bar.sharepoint.com`.
- *
- * Per design issue #113 §4 (vocabulary item 1: match.host + excludeHost).
- */
-export interface ProviderMatch {
-    readonly host: string;
-    readonly excludeHost?: readonly string[];
-}
-/**
- * Find the first provider whose `match` claims the given URL.
- *
- * @returns the matching provider, or `undefined` if none claim the URL (no
- *   pattern matched, all candidates were excluded, or the URL is malformed).
- */
-export declare function selectProvider<P extends {
-    readonly match: ProviderMatch;
-}>(url: string, providers: readonly P[]): P | undefined;
-//# sourceMappingURL=select-provider.d.ts.map

package/dist/link-auth/select-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"select-provider.d.ts","sourceRoot":"","sources":["../../src/link-auth/select-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,EACxE,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,CAAC,EAAE,GACtB,CAAC,GAAG,SAAS,CAUf"}

package/dist/link-auth/select-provider.js

@@ -1,55 +0,0 @@
-/**
- * Provider selection by URL host.
- *
- * Iterates the configured providers in order; the first one whose `match.host`
- * glob matches the URL hostname (and no `match.excludeHost` glob excludes it)
- * claims the URL. Returns `undefined` if no provider claims it — the caller
- * then falls back to anonymous link-checking.
- *
- * Hostname matching is case-insensitive per RFC 3986. Pattern syntax follows
- * `picomatch` (already a utils dep): `*` matches any character, `**` matches
- * across `/`. For hostnames (no slashes) the practical effect is that `*`
- * happily matches dots — e.g. `*.sharepoint.com` claims both
- * `contoso.sharepoint.com` and `foo.bar.sharepoint.com`.
- *
- * Per design issue #113 §4 (vocabulary item 1: match.host + excludeHost).
- */
-import picomatch from 'picomatch';
-/**
- * Find the first provider whose `match` claims the given URL.
- *
- * @returns the matching provider, or `undefined` if none claim the URL (no
- *   pattern matched, all candidates were excluded, or the URL is malformed).
- */
-export function selectProvider(url, providers) {
-    const host = extractHostname(url);
-    if (host === undefined)
-        return undefined;
-    for (const provider of providers) {
-        if (matches(host, provider.match)) {
-            return provider;
-        }
-    }
-    return undefined;
-}
-function extractHostname(url) {
-    try {
-        return new URL(url).hostname;
-    }
-    catch {
-        return undefined;
-    }
-}
-function matches(host, match) {
-    const lowerHost = host.toLowerCase();
-    if (!picomatch.isMatch(lowerHost, match.host.toLowerCase()))
-        return false;
-    if (match.excludeHost !== undefined) {
-        for (const pattern of match.excludeHost) {
-            if (picomatch.isMatch(lowerHost, pattern.toLowerCase()))
-                return false;
-        }
-    }
-    return true;
-}
-//# sourceMappingURL=select-provider.js.map

package/dist/link-auth/select-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"select-provider.js","sourceRoot":"","sources":["../../src/link-auth/select-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,SAAS,MAAM,WAAW,CAAC;AAOlC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,SAAuB;IAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAoB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/link-auth/template.d.ts

@@ -1,40 +0,0 @@
-/**
- * Tiny template renderer for linkAuth rewrite + header templates.
- *
- * Syntax (strict, no escapes, no nesting):
- *   - `${name}`              → context[name]
- *   - `${transform(name)}`   → applyTransform(transform, context[name])
- *
- * Anything else inside `${...}` throws `TemplateSyntaxError`. Missing context
- * keys throw `TemplateMissingVarError`. Unknown transform names propagate
- * `UnknownTransformError` from the transforms allowlist.
- *
- * This is NOT the project's general-purpose Handlebars renderer
- * (`utils/template.ts`) — that one is `{{...}}` and consumed widely. linkAuth
- * needs different syntax and a closed transform set; the two coexist by
- * namespace (`link-auth/template.ts`).
- */
-/**
- * Thrown when a template references a variable not present in the context.
- * Message names the missing variable and includes the full template for
- * caller-side debugging.
- */
-export declare class TemplateMissingVarError extends Error {
-    constructor(varName: string, template: string);
-}
-/**
- * Thrown when a template contains syntactically invalid content inside `${...}`
- * (empty expression, whitespace, unrecognized form) or an unterminated `${`.
- */
-export declare class TemplateSyntaxError extends Error {
-    constructor(detail: string, template: string);
-}
-/**
- * Render a template by substituting `${...}` expressions from a context map.
- *
- * @throws {TemplateMissingVarError} if a referenced variable is absent
- * @throws {TemplateSyntaxError} for invalid expressions or unterminated `${`
- * @throws {UnknownTransformError} from a `${transform(name)}` call
- */
-export declare function renderTemplate(template: string, context: Record<string, string>): string;
-//# sourceMappingURL=template.d.ts.map

package/dist/link-auth/template.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/link-auth/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAI9C;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAI7C;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAUxF"}