@vibe-agent-toolkit/utils 0.2.0-rc.3 → 0.2.0-rc.4

package/dist/link-auth/rewrite.js

@@ -1,102 +0,0 @@
-/**
- * Rewrite pipeline: ordered when → vars → to.
- *
- * Each provider declares one or more rewrite rules. For an input URL the
- * pipeline strips `?query` and `#fragment`, finds the first rule whose
- * `when` regex matches, computes `vars` (templates over captures), and
- * renders the `to` template against captures + vars merged. The merged
- * context flows out so downstream header templates can interpolate the
- * same variables.
- *
- * Per design issue #113 §4 (vocabulary) and §5.2 (fragment/query
- * stripping must precede a greedy `(?<path>.+)` capture).
- */
-import { renderTemplate } from './template.js';
-/**
- * Thrown when a rule's `when` field is not a compilable regex.
- */
-export class InvalidRewriteRuleError extends Error {
-    constructor(pattern, cause) {
-        const reason = cause instanceof Error ? cause.message : String(cause);
-        super(`Invalid rewrite rule "when" regex: ${pattern}. ${reason}`);
-        this.name = 'InvalidRewriteRuleError';
-    }
-}
-/**
- * Thrown when a `vars` key collides with a named capture in `when`.
- * Adopter must rename one — vars cannot shadow captures (the design's
- * intent is captures + vars in a single namespace).
- */
-export class VarCaptureCollisionError extends Error {
-    constructor(name) {
-        super(`Rewrite var "${name}" collides with a regex capture of the same name. Rename one.`);
-        this.name = 'VarCaptureCollisionError';
-    }
-}
-/**
- * Apply an ordered list of rewrite rules to a URL.
- *
- * @returns `{ matched: true, rewrittenUrl, context }` for the first matching
- *   rule, or `{ matched: false }` if no rule claims the URL.
- * @throws {InvalidRewriteRuleError} if a `when` field does not compile
- * @throws {VarCaptureCollisionError} if a vars name shadows a capture name
- * @throws {TemplateMissingVarError} from a template referencing an unknown name
- * @throws {TemplateSyntaxError} from a malformed template expression
- * @throws {UnknownTransformError} from a template calling an unknown transform
- */
-export function rewriteUrl(url, rules) {
-    const stripped = stripFragmentAndQuery(url);
-    for (const rule of rules) {
-        const regex = compileWhen(rule.when);
-        const match = regex.exec(stripped);
-        if (match === null)
-            continue;
-        const captures = collectCaptures(match);
-        const context = computeContext(captures, rule.vars);
-        const rewrittenUrl = renderTemplate(rule.to, context);
-        return { matched: true, rewrittenUrl, context };
-    }
-    return { matched: false };
-}
-function stripFragmentAndQuery(url) {
-    const idx = url.search(/[?#]/);
-    return idx === -1 ? url : url.slice(0, idx);
-}
-function compileWhen(pattern) {
-    try {
-        // Rule patterns originate in trusted config (see design §8); runtime
-        // compilation is intentional, not user-input regex injection.
-        // eslint-disable-next-line security/detect-non-literal-regexp
-        return new RegExp(pattern);
-    }
-    catch (e) {
-        throw new InvalidRewriteRuleError(pattern, e);
-    }
-}
-function collectCaptures(match) {
-    const captures = Object.create(null);
-    // The lib typedef for RegExpMatchArray.groups says values are `string`, but
-    // optional named groups that did not match show up at runtime as `undefined`.
-    // Cast to reflect runtime reality so the filter below is type-meaningful.
-    const groups = (match.groups ?? {});
-    for (const [key, value] of Object.entries(groups)) {
-        if (value !== undefined) {
-            captures[key] = value;
-        }
-    }
-    return captures;
-}
-function computeContext(captures, vars) {
-    const context = Object.create(null);
-    Object.assign(context, captures);
-    if (vars === undefined)
-        return context;
-    for (const [name, template] of Object.entries(vars)) {
-        if (Object.hasOwn(captures, name)) {
-            throw new VarCaptureCollisionError(name);
-        }
-        context[name] = renderTemplate(template, captures);
-    }
-    return context;
-}
-//# sourceMappingURL=rewrite.js.map

package/dist/link-auth/rewrite.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../src/link-auth/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAgB/C;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,KAAc;QACzC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,KAAK,CAAC,sCAAsC,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,IAAY;QACtB,KAAK,CACH,gBAAgB,IAAI,+DAA+D,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,KAA6B;IACnE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAE7B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,qEAAqE;QACrE,8DAA8D;QAC9D,8DAA8D;QAC9D,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,uBAAuB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC/D,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAuC,CAAC;IAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CACrB,QAAgC,EAChC,IAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAEvC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/link-auth/select-provider.d.ts

@@ -1,30 +0,0 @@
-/**
- * Provider selection by URL host.
- *
- * Iterates the configured providers in order; the first one whose `match.host`
- * glob matches the URL hostname (and no `match.excludeHost` glob excludes it)
- * claims the URL. Returns `undefined` if no provider claims it — the caller
- * then falls back to anonymous link-checking.
- *
- * Hostname matching is case-insensitive per RFC 3986. Pattern syntax follows
- * `picomatch` (already a utils dep): `*` matches any character, `**` matches
- * across `/`. For hostnames (no slashes) the practical effect is that `*`
- * happily matches dots — e.g. `*.sharepoint.com` claims both
- * `contoso.sharepoint.com` and `foo.bar.sharepoint.com`.
- *
- * Per design issue #113 §4 (vocabulary item 1: match.host + excludeHost).
- */
-export interface ProviderMatch {
-    readonly host: string;
-    readonly excludeHost?: readonly string[];
-}
-/**
- * Find the first provider whose `match` claims the given URL.
- *
- * @returns the matching provider, or `undefined` if none claim the URL (no
- *   pattern matched, all candidates were excluded, or the URL is malformed).
- */
-export declare function selectProvider<P extends {
-    readonly match: ProviderMatch;
-}>(url: string, providers: readonly P[]): P | undefined;
-//# sourceMappingURL=select-provider.d.ts.map

package/dist/link-auth/select-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"select-provider.d.ts","sourceRoot":"","sources":["../../src/link-auth/select-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,EACxE,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,CAAC,EAAE,GACtB,CAAC,GAAG,SAAS,CAUf"}

package/dist/link-auth/select-provider.js

@@ -1,55 +0,0 @@
-/**
- * Provider selection by URL host.
- *
- * Iterates the configured providers in order; the first one whose `match.host`
- * glob matches the URL hostname (and no `match.excludeHost` glob excludes it)
- * claims the URL. Returns `undefined` if no provider claims it — the caller
- * then falls back to anonymous link-checking.
- *
- * Hostname matching is case-insensitive per RFC 3986. Pattern syntax follows
- * `picomatch` (already a utils dep): `*` matches any character, `**` matches
- * across `/`. For hostnames (no slashes) the practical effect is that `*`
- * happily matches dots — e.g. `*.sharepoint.com` claims both
- * `contoso.sharepoint.com` and `foo.bar.sharepoint.com`.
- *
- * Per design issue #113 §4 (vocabulary item 1: match.host + excludeHost).
- */
-import picomatch from 'picomatch';
-/**
- * Find the first provider whose `match` claims the given URL.
- *
- * @returns the matching provider, or `undefined` if none claim the URL (no
- *   pattern matched, all candidates were excluded, or the URL is malformed).
- */
-export function selectProvider(url, providers) {
-    const host = extractHostname(url);
-    if (host === undefined)
-        return undefined;
-    for (const provider of providers) {
-        if (matches(host, provider.match)) {
-            return provider;
-        }
-    }
-    return undefined;
-}
-function extractHostname(url) {
-    try {
-        return new URL(url).hostname;
-    }
-    catch {
-        return undefined;
-    }
-}
-function matches(host, match) {
-    const lowerHost = host.toLowerCase();
-    if (!picomatch.isMatch(lowerHost, match.host.toLowerCase()))
-        return false;
-    if (match.excludeHost !== undefined) {
-        for (const pattern of match.excludeHost) {
-            if (picomatch.isMatch(lowerHost, pattern.toLowerCase()))
-                return false;
-        }
-    }
-    return true;
-}
-//# sourceMappingURL=select-provider.js.map

package/dist/link-auth/select-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"select-provider.js","sourceRoot":"","sources":["../../src/link-auth/select-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,SAAS,MAAM,WAAW,CAAC;AAOlC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,SAAuB;IAEvB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAEzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAoB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1E,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/link-auth/template.d.ts

@@ -1,40 +0,0 @@
-/**
- * Tiny template renderer for linkAuth rewrite + header templates.
- *
- * Syntax (strict, no escapes, no nesting):
- *   - `${name}`              → context[name]
- *   - `${transform(name)}`   → applyTransform(transform, context[name])
- *
- * Anything else inside `${...}` throws `TemplateSyntaxError`. Missing context
- * keys throw `TemplateMissingVarError`. Unknown transform names propagate
- * `UnknownTransformError` from the transforms allowlist.
- *
- * This is NOT the project's general-purpose Handlebars renderer
- * (`utils/template.ts`) — that one is `{{...}}` and consumed widely. linkAuth
- * needs different syntax and a closed transform set; the two coexist by
- * namespace (`link-auth/template.ts`).
- */
-/**
- * Thrown when a template references a variable not present in the context.
- * Message names the missing variable and includes the full template for
- * caller-side debugging.
- */
-export declare class TemplateMissingVarError extends Error {
-    constructor(varName: string, template: string);
-}
-/**
- * Thrown when a template contains syntactically invalid content inside `${...}`
- * (empty expression, whitespace, unrecognized form) or an unterminated `${`.
- */
-export declare class TemplateSyntaxError extends Error {
-    constructor(detail: string, template: string);
-}
-/**
- * Render a template by substituting `${...}` expressions from a context map.
- *
- * @throws {TemplateMissingVarError} if a referenced variable is absent
- * @throws {TemplateSyntaxError} for invalid expressions or unterminated `${`
- * @throws {UnknownTransformError} from a `${transform(name)}` call
- */
-export declare function renderTemplate(template: string, context: Record<string, string>): string;
-//# sourceMappingURL=template.d.ts.map

package/dist/link-auth/template.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/link-auth/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAI9C;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAI7C;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAUxF"}

package/dist/link-auth/template.js

@@ -1,89 +0,0 @@
-/**
- * Tiny template renderer for linkAuth rewrite + header templates.
- *
- * Syntax (strict, no escapes, no nesting):
- *   - `${name}`              → context[name]
- *   - `${transform(name)}`   → applyTransform(transform, context[name])
- *
- * Anything else inside `${...}` throws `TemplateSyntaxError`. Missing context
- * keys throw `TemplateMissingVarError`. Unknown transform names propagate
- * `UnknownTransformError` from the transforms allowlist.
- *
- * This is NOT the project's general-purpose Handlebars renderer
- * (`utils/template.ts`) — that one is `{{...}}` and consumed widely. linkAuth
- * needs different syntax and a closed transform set; the two coexist by
- * namespace (`link-auth/template.ts`).
- */
-import { applyTransform } from './transforms.js';
-const IDENTIFIER = /^[a-zA-Z_]\w*$/;
-const TRANSFORM_CALL = /^(?<fn>[a-zA-Z_]\w*)\((?<arg>[a-zA-Z_]\w*)\)$/;
-/**
- * Thrown when a template references a variable not present in the context.
- * Message names the missing variable and includes the full template for
- * caller-side debugging.
- */
-export class TemplateMissingVarError extends Error {
-    constructor(varName, template) {
-        super(`Template variable "${varName}" not in context. Template: ${template}`);
-        this.name = 'TemplateMissingVarError';
-    }
-}
-/**
- * Thrown when a template contains syntactically invalid content inside `${...}`
- * (empty expression, whitespace, unrecognized form) or an unterminated `${`.
- */
-export class TemplateSyntaxError extends Error {
-    constructor(detail, template) {
-        super(`Invalid template syntax — ${detail}. Template: ${template}`);
-        this.name = 'TemplateSyntaxError';
-    }
-}
-/**
- * Render a template by substituting `${...}` expressions from a context map.
- *
- * @throws {TemplateMissingVarError} if a referenced variable is absent
- * @throws {TemplateSyntaxError} for invalid expressions or unterminated `${`
- * @throws {UnknownTransformError} from a `${transform(name)}` call
- */
-export function renderTemplate(template, context) {
-    const rendered = template.replaceAll(/\$\{([^}]*)\}/g, (_match, body) => resolveExpression(body, template, context));
-    if (rendered.includes('${')) {
-        throw new TemplateSyntaxError('unterminated "${" with no matching "}"', template);
-    }
-    return rendered;
-}
-function resolveExpression(body, template, context) {
-    if (body !== body.trim()) {
-        throw new TemplateSyntaxError(`whitespace in "${body}"`, template);
-    }
-    if (IDENTIFIER.test(body)) {
-        return lookupContextVar(context, body, template);
-    }
-    const callMatch = TRANSFORM_CALL.exec(body);
-    if (callMatch?.groups !== undefined) {
-        const { fn, arg } = callMatch.groups;
-        if (fn === undefined || arg === undefined) {
-            throw new TemplateSyntaxError(`unexpected regex result for "${body}"`, template);
-        }
-        return applyTransform(fn, lookupContextVar(context, arg, template));
-    }
-    throw new TemplateSyntaxError(`unrecognized expression "${body}"`, template);
-}
-/**
- * Fetch a variable from the context map, blocking prototype-chain bypass.
- *
- * Without `Object.hasOwn`, `context["__proto__"]` would return `Object.prototype`
- * (a non-undefined object) and the renderer would substitute `[object Object]`
- * into the output. Mirrors the closed-allowlist discipline in `transforms.ts`.
- */
-function lookupContextVar(context, key, template) {
-    if (!Object.hasOwn(context, key)) {
-        throw new TemplateMissingVarError(key, template);
-    }
-    const value = context[key];
-    if (value === undefined) {
-        throw new TemplateMissingVarError(key, template);
-    }
-    return value;
-}
-//# sourceMappingURL=template.js.map

package/dist/link-auth/template.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.js","sourceRoot":"","sources":["../../src/link-auth/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,cAAc,GAAG,+CAA+C,CAAC;AAEvE;;;;GAIG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe,EAAE,QAAgB;QAC3C,KAAK,CAAC,sBAAsB,OAAO,+BAA+B,QAAQ,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CAAC,6BAA6B,MAAM,eAAe,QAAQ,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAA+B;IAC9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAC9E,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAC3C,CAAC;IAEF,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,QAAgB,EAChB,OAA+B;IAE/B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC;QACrC,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,IAAI,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CACvB,OAA+B,EAC/B,GAAW,EACX,QAAgB;IAEhB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/link-auth/transforms.d.ts

@@ -1,46 +0,0 @@
-/**
- * Transform allowlist for linkAuth rewrite templates.
- *
- * Rewrite `to:` templates may call transforms over named regex captures —
- * e.g. `${base64url(u)}` for Microsoft Graph share-ids. The allowed set is
- * frozen in this file: adding a transform requires a VAT PR (see issue #113
- * design §4.1). There is no arbitrary-evaluation path.
- *
- * v1 inputs are assumed to be ASCII URL host/path captures. Non-ASCII edge
- * cases (lone surrogates) are pinned by tests so future regressions surface.
- */
-declare const TRANSFORMS: {
-    readonly base64url: (s: string) => string;
-    readonly urlencode: (s: string) => string;
-    readonly lower: (s: string) => string;
-};
-export type TransformName = keyof typeof TRANSFORMS;
-/**
- * The closed allowlist of transform names. Callers parsing rewrite templates
- * can validate transform calls (e.g. `${base64url(u)}`) against this list at
- * config-load time, surfacing typos before any URL is rewritten.
- */
-export declare const ALLOWED_TRANSFORMS: readonly TransformName[];
-/**
- * Thrown by `applyTransform` when called with a name not in the closed
- * allowlist. The message names the bad transform and the full allowlist so
- * a misconfigured macro surfaces a clear error at load time.
- */
-export declare class UnknownTransformError extends Error {
-    constructor(name: string);
-}
-/**
- * Dispatch a transform by name on a string input.
- *
- * Security claim: only the names in `ALLOWED_TRANSFORMS` resolve; any other
- * input throws `UnknownTransformError`. Lookup uses `Object.hasOwn` to block
- * prototype-chain keys (`toString`, `__proto__`, `constructor`, …) that a
- * `name in TRANSFORMS` check would let through.
- *
- * @throws {UnknownTransformError} if `name` is not in the allowlist
- * @throws {URIError} from `urlencode` on lone-surrogate inputs — deliberate;
- *   v1 callers pass URL-derived captures that cannot legally contain these
- */
-export declare function applyTransform(name: string, input: string): string;
-export {};
-//# sourceMappingURL=transforms.d.ts.map

package/dist/link-auth/transforms.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transforms.d.ts","sourceRoot":"","sources":["../../src/link-auth/transforms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,QAAA,MAAM,UAAU;4BACC,MAAM;4BACN,MAAM;wBACV,MAAM;CAC6B,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,UAAU,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,aAAa,EAEtD,CAAC;AAEF;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlE"}

package/dist/link-auth/transforms.js

@@ -1,52 +0,0 @@
-/**
- * Transform allowlist for linkAuth rewrite templates.
- *
- * Rewrite `to:` templates may call transforms over named regex captures —
- * e.g. `${base64url(u)}` for Microsoft Graph share-ids. The allowed set is
- * frozen in this file: adding a transform requires a VAT PR (see issue #113
- * design §4.1). There is no arbitrary-evaluation path.
- *
- * v1 inputs are assumed to be ASCII URL host/path captures. Non-ASCII edge
- * cases (lone surrogates) are pinned by tests so future regressions surface.
- */
-const TRANSFORMS = {
-    base64url: (s) => Buffer.from(s, 'utf8').toString('base64url'),
-    urlencode: (s) => encodeURIComponent(s),
-    lower: (s) => s.toLowerCase(),
-};
-/**
- * The closed allowlist of transform names. Callers parsing rewrite templates
- * can validate transform calls (e.g. `${base64url(u)}`) against this list at
- * config-load time, surfacing typos before any URL is rewritten.
- */
-export const ALLOWED_TRANSFORMS = Object.freeze(Object.keys(TRANSFORMS));
-/**
- * Thrown by `applyTransform` when called with a name not in the closed
- * allowlist. The message names the bad transform and the full allowlist so
- * a misconfigured macro surfaces a clear error at load time.
- */
-export class UnknownTransformError extends Error {
-    constructor(name) {
-        super(`Unknown transform "${name}". Allowed: ${ALLOWED_TRANSFORMS.join(', ')}.`);
-        this.name = 'UnknownTransformError';
-    }
-}
-/**
- * Dispatch a transform by name on a string input.
- *
- * Security claim: only the names in `ALLOWED_TRANSFORMS` resolve; any other
- * input throws `UnknownTransformError`. Lookup uses `Object.hasOwn` to block
- * prototype-chain keys (`toString`, `__proto__`, `constructor`, …) that a
- * `name in TRANSFORMS` check would let through.
- *
- * @throws {UnknownTransformError} if `name` is not in the allowlist
- * @throws {URIError} from `urlencode` on lone-surrogate inputs — deliberate;
- *   v1 callers pass URL-derived captures that cannot legally contain these
- */
-export function applyTransform(name, input) {
-    if (!Object.hasOwn(TRANSFORMS, name)) {
-        throw new UnknownTransformError(name);
-    }
-    return TRANSFORMS[name](input);
-}
-//# sourceMappingURL=transforms.js.map

package/dist/link-auth/transforms.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"transforms.js","sourceRoot":"","sources":["../../src/link-auth/transforms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,UAAU,GAAG;IACjB,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IACtE,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;CACS,CAAC;AAIjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA6B,MAAM,CAAC,MAAM,CACvE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAoB,CAC3C,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,IAAY;QACtB,KAAK,CAAC,sBAAsB,IAAI,eAAe,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,UAAU,CAAC,IAAqB,CAAC,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC"}

package/dist/template-entry.d.ts

@@ -1,10 +0,0 @@
-/**
- * @vibe-agent-toolkit/utils/template
- *
- * Cached Handlebars rendering with HTML escaping disabled. Pure with respect
- * to Node builtins, but it pulls in `handlebars` (and transitively
- * `source-map`) — roughly 239KB bundled. Quarantined behind its own subpath
- * so importing a path helper never pays for it.
- */
-export * from './template.js';
-//# sourceMappingURL=template-entry.d.ts.map

package/dist/template-entry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template-entry.d.ts","sourceRoot":"","sources":["../src/template-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,eAAe,CAAC"}

package/dist/template-entry.js

@@ -1,10 +0,0 @@
-/**
- * @vibe-agent-toolkit/utils/template
- *
- * Cached Handlebars rendering with HTML escaping disabled. Pure with respect
- * to Node builtins, but it pulls in `handlebars` (and transitively
- * `source-map`) — roughly 239KB bundled. Quarantined behind its own subpath
- * so importing a path helper never pays for it.
- */
-export * from './template.js';
-//# sourceMappingURL=template-entry.js.map

package/dist/template-entry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"template-entry.js","sourceRoot":"","sources":["../src/template-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,cAAc,eAAe,CAAC"}

package/dist/template.d.ts

@@ -1,7 +0,0 @@
-/**
- * Render a Handlebars template with the given context.
- * Uses noEscape since this is for markdown content, not HTML.
- * Compiled templates are cached by template string.
- */
-export declare function renderTemplate(template: string, context: Record<string, unknown>): string;
-//# sourceMappingURL=template.d.ts.map

package/dist/template.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../src/template.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CASzF"}

package/dist/template.js

@@ -1,18 +0,0 @@
-import Handlebars from 'handlebars';
-const templateCache = new Map();
-/**
- * Render a Handlebars template with the given context.
- * Uses noEscape since this is for markdown content, not HTML.
- * Compiled templates are cached by template string.
- */
-export function renderTemplate(template, context) {
-    let compiled = templateCache.get(template);
-    if (!compiled) {
-        // Safe: templates render markdown/plaintext, not HTML. No XSS risk.
-        // eslint-disable-next-line sonarjs/disabled-auto-escaping
-        compiled = Handlebars.compile(template, { noEscape: true });
-        templateCache.set(template, compiled);
-    }
-    return compiled(context);
-}
-//# sourceMappingURL=template.js.map

package/dist/template.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.js","sourceRoot":"","sources":["../src/template.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAgC;IAC/E,IAAI,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,oEAAoE;QACpE,0DAA0D;QAC1D,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}